Note: There are a few cases of duplicates in user autocompletion which are being worked on.

_cairo_d2d_mask reads uninitialized memory

RESOLVED FIXED

Status

()

Core
Graphics
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: roc, Assigned: roc)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

When 'clip' is NULL, we reach

       box.p1.x = MAX(box.p1.x, boxes->p1.x);
       box.p2.x = MIN(box.p2.x, boxes->p2.x);
       box.p1.y = MAX(box.p1.y, boxes->p1.y);
       box.p2.y = MIN(box.p2.y, boxes->p2.y);

with 'boxes' set to &box_stack, which is uninitialized on the stack. We seem to be getting lucky most of the time and these operations are having no effect, but with some patches in my queue, we stop getting lucky and reftests start failing :-(.
Created attachment 520126 [details] [diff] [review]
fix
Attachment #520126 - Flags: review?(bas.schouten)
correction, test_canvas.html starts failing.
This is certainly an improvement!

We're not getting lucky most of the time however, and I could r+ this, however the code you're fixing is from the unreviewed patch from bug 600760 :). In other words it's not being tested (it's not even present) at the moment and that's probably the only reason the test doesn't fail without your patch queue, since that patch is in your patch queue.
Blocks: 600760
Aha! Well then, feel free to roll this into bug 600760.
(In reply to comment #4)
> Aha! Well then, feel free to roll this into bug 600760.

Will do! Thanks for catching this. I hope it didn't cause too much trouble.
Comment on attachment 520126 [details] [diff] [review]
fix

This was fixed in the original patch this bug was in.
Attachment #520126 - Flags: review?(bas.schouten)
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.