search

keeleysam / tenfourfox

Automatically exported from code.google.com/p/tenfourfox
0 stars 0 forks source link

Crash on changing composite modes #217

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
Affects 17-20 (probably has existed since we implemented DrawTargetCG). On 
http://tutorials.jenkov.com/html5-canvas/composition.html, click on any of the 
operators (say, "destination-atop").

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x7c3e8e3d
0x903cd618 in CGGStackRestore ()

Need to rebuild unstripped to get a useful backtrace.

Original issue reported on code.google.com by classi...@floodgap.com on 6 Apr 2013 at 11:48

GoogleCodeExporter commented 9 years ago 
#0  0x903cd618 in CGGStackRestore ()
#1  0x06ee6d48 in mozilla::gfx::DrawTargetCG::FillGlyphs (this=0x30169c40, 
aFont=<value temporarily unavailable, due to optimizations>, aBuffer=<value 
temporarily unavailable, due to optimizations>, aPattern=<value temporarily 
unavailable, due to optimizations>, aDrawOptions=<value temporarily 
unavailable, due to optimizations>) at 
/Volumes/BruceDeuce/src/mozilla-20.0/gfx/2d/DrawTargetCG.cpp:1063
#2  0x05955cdc in mozilla::dom::CanvasBidiProcessor::DrawText (this=0xefffa590, 
xOffset=<value temporarily unavailable, due to optimizations>, width=<value 
temporarily unavailable, due to optimizations>) at 
/Volumes/BruceDeuce/src/mozilla-20.0/content/canvas/src/CanvasRenderingContext2D
.cpp:2392
#3  0x055785f0 in nsBidiPresUtils::ProcessText (aText=0x1, aLength=11, 
aBaseDirection=NSBIDI_LTR, aPresContext=0x1a7f800, aprocessor=@0x30179fb4, 
aMode=MODE_DRAW, aPosResolve=0x0, aPosResolveCount=0, aWidth=0x0, 
aBidiEngine=0xefffa538) at 
/Volumes/BruceDeuce/src/mozilla-20.0/layout/base/nsBidiPresUtils.cpp:1863

There's an odd glitch here in FillGlyphs. At the end,

  fixer.Fix(mCg);
  CGContextRestoreGState(cg);

Changing this to mCg works. However, the code does not crash on real Firefox, 
so maybe this is a 10.4-ism. None of the other blocks have cg, though; they, 
too, use mCg.

Anyway, this is a trivial fix we can ship in 17.0.6 and 21.

Original comment by classi...@floodgap.com on 7 Apr 2013 at 4:03

GoogleCodeExporter commented 9 years ago 
Shipped

Original comment by classi...@floodgap.com on 10 May 2013 at 9:52