896047 - crash in mozilla::dom::CanvasRenderingContext2D::EnsureWritablePath()

Status: VERIFIED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Yury Delendik (:yury)]

Attachment: test_case.html

This bug was filed from the Socorro interface and is 
report bp-f6096047-d846-4127-8b22-f98542130719 .
 ============================================================= 

Appears on DirectX due to fail at [1] and connected with EnsureUserSpacePath logic [2].


  [1] http://mxr.mozilla.org/mozilla-central/source/gfx/2d/PathD2D.cpp#237
  [2] http://hg.mozilla.org/releases/mozilla-release/annotate/e55e45536133/content/canvas/src/CanvasRenderingContext2D.cpp#l1875

Comment 1

[Alex Keybl [:akeybl]]

Please renominate with a justification of why this should track, since this isn't marked as a topcrash or recent regression.

Comment 2

[Jet Villegas (inactive)]

+cc: bas

Can you take a quick look and advise?

Comment 3

[Yury Delendik (:yury)]

(In reply to Alex Keybl [:akeybl] from comment #1)
> Please renominate with a justification of why this should track, since this
> isn't marked as a topcrash or recent regression.

After landing Shumway it's number 45 in topcrashes for Firefox 27.

Comment 4

[Alex Keybl [:akeybl]]

(In reply to Yury Delendik (:yury) from comment #3)
> (In reply to Alex Keybl [:akeybl] from comment #1)
> > Please renominate with a justification of why this should track, since this
> > isn't marked as a topcrash or recent regression.
> 
> After landing Shumway it's number 45 in topcrashes for Firefox 27.

Up from what topcrash rank?

Let's wait to see where this lands on Aurora before tracking.

Comment 5

[Alex Keybl [:akeybl]]

Removing tracking flags - shumway won't move on from m-c for at least another couple of releases.

Comment 6

[Yury Delendik (:yury)]

Attachment: Clear builder when fill rule for path changes.

The fix is based on the "There is also never a path and a path builder present at the same time." constraint.

Comment 7

[Yury Delendik (:yury)]

https://tbpl.mozilla.org/?tree=Try&rev=df04a50914a6

Comment 8

[Bas Schouten (:bas.schouten)]

Comment on attachment 829683 [details] [diff] [review]
Clear builder when fill rule for path changes.

Review of attachment 829683 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch :).

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/52e4b1e785fd

Comment 10

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/52e4b1e785fd

Comment 11

[Paul Silaghi, QA [:pauly]]

Reproduced the crash on Nightly 2013-07-26.
Verified fixed in 28.0a1 (2013-12-04), win 7 x64