971262 - Faulty: Segfault in SurfaceDescriptor::type() under DeprecatedImageHostSingle::MakeDeprecatedTextureHost

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: Faulty/ASan session

Found by Christoph Diehl's "Faulty" fuzzer, see bug 777067

Comment 1

[Benoit Jacob [:bjacob] (mostly away)]

Interesting bit in the log:

 2:47.23 [Faulty] pickle field {int} of value: 9 changed to: 1
 2:47.24 [Parent 19847] ###!!! ASSERTION: should be implemented or not used: 'Error', file /hack/mozilla-central/gfx/layers/composite/CompositableHost.h, line 138


this is 

  virtual bool UpdateThebes(const ThebesBufferData& aData,
                            const nsIntRegion& aUpdated,
                            const nsIntRegion& aOldValidRegionBack,
                            nsIntRegion* aUpdatedRegionBack)
  {
    NS_ERROR("should be implemented or not used");
    return false;
  }

these 9 and 1 values here are defined in CompositorTypes.h:

enum CompositableType
{
  BUFFER_UNKNOWN,
  // the deprecated compositable types
  BUFFER_IMAGE_SINGLE,    // image/canvas with a single texture, single buffered
  BUFFER_IMAGE_BUFFERED,  // canvas, double buffered
  BUFFER_BRIDGE,          // image bridge protocol
  BUFFER_CONTENT,         // thebes layer interface, single buffering
  BUFFER_CONTENT_DIRECT,  // thebes layer interface, double buffering
  BUFFER_CONTENT_INC,     // thebes layer interface, only sends incremental
                          // updates to a texture on the compositor side.
  BUFFER_TILED,           // tiled thebes layer
  // the new compositable types
  COMPOSITABLE_IMAGE,     // image with single buffering
  COMPOSITABLE_CONTENT_SINGLE,  // thebes layer interface, single buffering
  COMPOSITABLE_CONTENT_DOUBLE,  // thebes layer interface, double buffering
  BUFFER_COUNT
};

So 9 is COMPOSITABLE_CONTENT_SINGLE i.e. a ContentHost and 1 is BUFFER_IMAGE_SINGLE i.e. a ImageHost.

Comment 2

[Benoit Jacob [:bjacob] (mostly away)]

Based on that, I suspect that this is a manifestation of bug 969549.

Comment 3

[Benoit Jacob [:bjacob] (mostly away)]

Fixed by the landing of bug 969549.

Comment 4

[Matt Wobensmith [:mwobensmith][:matt:]]

Marking [qa-] for desktop QA verification. FxOS QA may choose to verify at a later date.