699563 - "ABORT: Failed to create pixman images?"

Status: RESOLVED WORKSFORME

(Core :: Graphics, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ABORT: Failed to create pixman images?: 'src && dest', file gfx/layers/basic/BasicLayers.cpp, line 1701

Comment 1

[Jesse Ruderman]

Attachment: stack trace

Comment 2

[Matt Woodrow (:mattwoodrow)]

This is caused by a crazy transform giving us an infinite sized transformed rect.

Our call to surfaceRect.Intersect(transformedRect) isn't handling the infinite values correctly, so instead of being clamped to the surface rect we end up attempting to allocate an infinite sized destination surface.

roc: Do you have any suggestions on how you'd prefer to handle this?

My two ideas so far were to make BaseRect::Intersect correctly handle infinite float/double values or add a BaseRect::IsValid method which looks for inf/nan and we can skip the intersection.

Comment 3

[Robert O'Callahan (:roc) (email my personal email if necessary)]

That latter sounds better. The former is unnecessary overhead in most cases.

Comment 4

[Jesse Ruderman]

Attachment: testcase 2 (requires fuzzing extension or blank profile)

This one crashes during a drawWindow call.  If you use a blank profile, Firefox's thumbnail service is likely to call drawWindow.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

No longer asserts on trunk. The second testcase will require some help to land (to remove the fuzzer dependency), however.

Comment 6

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c29bb1dc4d4b

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/c29bb1dc4d4b

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-b2g44_v2_5/rev/c29bb1dc4d4b

Comment 9

[Carsten Book [:Tomcat]]

removing the b2g 2.5 flag since this commit has been reverted due to an incorrect merge, sorry for the confusion