525990 - Null deref crash in [@ _moz_cairo_surface_flush - gfxASurface::Flush - nsGLPbufferCGL::ThebesSurface]

Status: RESOLVED INVALID

(Core :: Graphics: CanvasWebGL, defect)

Description

[Drew Yao]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-us) AppleWebKit/531.9 (KHTML, like Gecko) Version/4.0.3 Safari/531.9
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a1pre) Gecko/20091101 Minefield/3.7a1pre

Null dereference crash in WebGL stuff, affects 3.7 and not 3.5.  
Related to canvas with large width.

Reproducible: Always

Steps to Reproduce:
Use recent Firefox 3.7 (this doesn't affect 3.5).

Set webgl.enabled_for_all_sites = true in about:config

Open attached html file
Actual Results:  
Crash.

Process:         firefox-bin [47053]
Path:            /Volumes/data_apps/obj-x86_64-apple-darwin10.0.0/dist/MinefieldDebug.app/Contents/MacOS/firefox-bin
Identifier:      org.mozilla.firefox
Version:         3.7a1pre (3.7a1pre)
Code Type:       X86-64 (Native)
Parent Process:  launchd [200]

Date/Time:       2009-11-02 13:06:50.235 -0800
OS Version:      Mac OS X 10.6.1 (10B504)
Report Version:  6

Interval Since Last Report:          1886 sec
Crashes Since Last Report:           2
Per-App Interval Since Last Report:  610 sec
Per-App Crashes Since Last Report:   2
Anonymous UUID:                      3D956540-F69B-4457-B4A4-761A72189954

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000014
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   libthebes.dylib               	0x000000011506b328 _moz_cairo_surface_flush + 16
1   libthebes.dylib               	0x00000001150029b1 gfxASurface::Flush() + 25 (gfxASurface.cpp:262)
2   libgklayout.dylib             	0x0000000115630c8e nsGLPbufferCGL::ThebesSurface() + 418 (nsGLPbufferCGL.cpp:246)
3   libgklayout.dylib             	0x000000011561da20 mozilla::WebGLContext::Render(gfxContext*, gfxPattern::GraphicsFilter) + 168 (WebGLContext.cpp:253)
4   libgklayout.dylib             	0x0000000115690b00 nsHTMLCanvasElement::RenderContexts(gfxContext*, gfxPattern::GraphicsFilter) + 86 (nsHTMLCanvasElement.cpp:488)
5   libgklayout.dylib             	0x0000000115326e52 nsHTMLCanvasFrame::PaintCanvas(nsIRenderingContext&, nsRect const&, nsPoint) + 432 (nsHTMLCanvasFrame.cpp:257)
6   libgklayout.dylib             	0x00000001153276c9 nsDisplayItemCanvas::Paint(nsDisplayListBuilder*, nsIRenderingContext*) + 75 (nsHTMLCanvasFrame.cpp:74)
7   libgklayout.dylib             	0x0000000115265596 nsDisplayList::Paint(nsDisplayListBuilder*, nsIRenderingContext*) const + 112 (nsDisplayList.cpp:407)
8   libgklayout.dylib             	0x00000001152655db nsDisplayWrapList::Paint(nsDisplayListBuilder*, nsIRenderingContext*) + 41 (nsDisplayList.cpp:925)
9   libgklayout.dylib             	0x000000011526574c nsDisplayClip::Paint(nsDisplayListBuilder*, nsIRenderingContext*) + 90 (nsDisplayList.cpp:1121)
10  libgklayout.dylib             	0x0000000115265596 nsDisplayList::Paint(nsDisplayListBuilder*, nsIRenderingContext*) const + 112 (nsDisplayList.cpp:407)
...

Comment 1

[Drew Yao]

Attachment: test case which causes crash

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Looks like the same bug/cause as bug 525984.

Comment 3

[Drew Yao]

I don't think this is a duplicate.  It still crashes with a patch in place for 525984.

Comment 4

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Ah.  mQuartzSurface needs nsnull treatment, and needs error checking to make sure it's valid when ThebesSurface() is called.

Comment 5

[Daniel Veditz [:dveditz]]

nsGLPbufferCGL::ThebesSurface() exists on the 1.9.2 branch but not WebGLContext. Is there some way other than WebGL to get to the buggy code, or was that NPOTB on 1.9.2?

Definitely not in FF 3.5 (1.9.1-branch).

Comment 6

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

NPOTB in 1.9.2.

Comment 7

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

nsGLPbufferCGL is gone