crash in mozilla::dom::CanvasRenderingContext2D::EnsureWritablePath()

VERIFIED FIXED in mozilla28

Status

()

--
critical
VERIFIED FIXED
6 years ago
4 years ago

People

(Reporter: yury, Assigned: yury)

Tracking

({crash, testcase})

Trunk
mozilla28
x86
Windows 7
crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(firefox23-, firefox24-, firefox25-, firefox28-)

Details

(Whiteboard: [shumway], crash signature, URL)

Attachments

(2 attachments)

(Assignee)

Description

6 years ago
Created attachment 778653 [details]
test_case.html

This bug was filed from the Socorro interface and is 
report bp-f6096047-d846-4127-8b22-f98542130719 .
 ============================================================= 

Appears on DirectX due to fail at [1] and connected with EnsureUserSpacePath logic [2].


  [1] http://mxr.mozilla.org/mozilla-central/source/gfx/2d/PathD2D.cpp#237
  [2] http://hg.mozilla.org/releases/mozilla-release/annotate/e55e45536133/content/canvas/src/CanvasRenderingContext2D.cpp#l1875
(Assignee)

Updated

6 years ago
OS: Windows NT → Windows 7

Updated

6 years ago
Keywords: testcase
(Assignee)

Updated

6 years ago
tracking-firefox23: --- → ?
tracking-firefox24: --- → ?
tracking-firefox25: --- → ?
Please renominate with a justification of why this should track, since this isn't marked as a topcrash or recent regression.
tracking-firefox23: ? → -
tracking-firefox24: ? → -
tracking-firefox25: ? → -
+cc: bas

Can you take a quick look and advise?
Flags: needinfo?(bas)
(Assignee)

Comment 3

5 years ago
(In reply to Alex Keybl [:akeybl] from comment #1)
> Please renominate with a justification of why this should track, since this
> isn't marked as a topcrash or recent regression.

After landing Shumway it's number 45 in topcrashes for Firefox 27.
tracking-firefox27: --- → ?
(In reply to Yury Delendik (:yury) from comment #3)
> (In reply to Alex Keybl [:akeybl] from comment #1)
> > Please renominate with a justification of why this should track, since this
> > isn't marked as a topcrash or recent regression.
> 
> After landing Shumway it's number 45 in topcrashes for Firefox 27.

Up from what topcrash rank?

Let's wait to see where this lands on Aurora before tracking.
tracking-firefox27: ? → ---
tracking-firefox28: --- → ?
Removing tracking flags - shumway won't move on from m-c for at least another couple of releases.
tracking-firefox28: ? → -
(Assignee)

Comment 6

5 years ago
Created attachment 829683 [details] [diff] [review]
Clear builder when fill rule for path changes.

The fix is based on the "There is also never a path and a path builder present at the same time." constraint.
Attachment #829683 - Flags: review?(bas)
Comment on attachment 829683 [details] [diff] [review]
Clear builder when fill rule for path changes.

Review of attachment 829683 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch :).
Attachment #829683 - Flags: review?(bas) → review+
(Assignee)

Updated

5 years ago
Keywords: checkin-needed
https://hg.mozilla.org/integration/mozilla-inbound/rev/52e4b1e785fd
Assignee: nobody → ydelendik
Flags: in-testsuite+
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/52e4b1e785fd
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Reproduced the crash on Nightly 2013-07-26.
Verified fixed in 28.0a1 (2013-12-04), win 7 x64
Status: RESOLVED → VERIFIED
Flags: needinfo?(bas)
You need to log in before you can comment on or make changes to this bug.