Testcase found while fuzzing mozilla-central rev 643848d855eb (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 643848d855eb --debug --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: !tempTarget.UseOptimizeShadow(), at /dom/canvas/CanvasRenderingContext2D.cpp:5711

    ==70977==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7d6d8421bac3 bp 0x7ffececad350 sp 0x7ffececacea0 T70977)
    ==70977==The signal is caused by a WRITE memory access.
    ==70977==Hint: address points to the zero page.
        #0 0x7d6d8421bac3 in mozilla::dom::CanvasRenderingContext2D::DrawImage(mozilla::dom::HTMLImageElementOrSVGImageElementOrHTMLCanvasElementOrHTMLVideoElementOrOffscreenCanvasOrImageBitmapOrVideoFrame const&, double, double, double, double, double, double, double, double, unsigned char, mozilla::ErrorResult&) /dom/canvas/CanvasRenderingContext2D.cpp:5711:7
        #1 0x7d6d83cb63db in DrawImage /builds/worker/workspace/obj-build/dist/include/mozilla/dom/CanvasRenderingContext2D.h:255:5
        #2 0x7d6d83cb63db in mozilla::dom::CanvasRenderingContext2D_Binding::drawImage(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/./CanvasRenderingContext2DBinding.cpp:3998:28
        #3 0x7d6d840fab37 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3269:13
        #4 0x7d6d886ae4c4 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /js/src/vm/Interpreter.cpp:479:13
        #5 0x7d6d886adddd in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:573:12
        #6 0x7d6d886bda4a in CallFromStack /js/src/vm/Interpreter.cpp:645:10
        #7 0x7d6d886bda4a in js::Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3060:16
        #8 0x7d6d886ad3a2 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:451:13
        #9 0x7d6d886addf9 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:605:13
        #10 0x7d6d886af2b7 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:672:8
        #11 0x7d6d887cead7 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:119:10
        #12 0x7d6d83f54e31 in mozilla::dom::Function::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/./FunctionBinding.cpp:50:8
        #13 0x7d6d82d12143 in void mozilla::dom::Function::Call<nsCOMPtr<nsIGlobalObject>>(nsCOMPtr<nsIGlobalObject> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/FunctionBinding.h:71:12
        #14 0x7d6d82d11ee3 in mozilla::dom::CallbackTimeoutHandler::Call(char const*) /dom/base/TimeoutHandler.cpp:168:29
        #15 0x7d6d8298cc0d in nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*) /dom/base/nsGlobalWindowInner.cpp:6327:38
        #16 0x7d6d82d0e907 in mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool) /dom/base/TimeoutManager.cpp:879:44
        #17 0x7d6d82d0d8fb in mozilla::dom::TimeoutExecutor::MaybeExecute() /dom/base/TimeoutExecutor.cpp:179:11
        #18 0x7d6d82d10099 in Notify /dom/base/TimeoutExecutor.cpp:246:5
        #19 0x7d6d82d10099 in non-virtual thunk to mozilla::dom::TimeoutExecutor::Notify(nsITimer*) /dom/base/TimeoutExecutor.cpp
        #20 0x7d6d80eb0c4e in operator() /xpcom/threads/nsTimerImpl.cpp:677:44
        #21 0x7d6d80eb0c4e in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:677:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:678:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:681:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:682:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:309:16
        #22 0x7d6d80eb0c4e in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:676:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:677:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:678:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:681:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:682:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:318:14
        #23 0x7d6d80eb0c4e in matchN<mozilla::Variant<nsTimerImpl::UnknownCallback, nsCOMPtr<nsITimerCallback>, nsCOMPtr<nsIObserver>, nsTimerImpl::FuncCallback, nsTimerImpl::ClosureCallback> &, (lambda at /xpcom/threads/nsTimerImpl.cpp:676:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:677:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:678:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:681:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:682:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:902:12
        #24 0x7d6d80eb0c4e in match<(lambda at /xpcom/threads/nsTimerImpl.cpp:676:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:677:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:678:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:681:7), (lambda at /xpcom/threads/nsTimerImpl.cpp:682:7)> /builds/worker/workspace/obj-build/dist/include/mozilla/Variant.h:857:12
        #25 0x7d6d80eb0c4e in nsTimerImpl::Fire(int) /xpcom/threads/nsTimerImpl.cpp:675:22
        #26 0x7d6d80eafdeb in nsTimerEvent::Run() /xpcom/threads/TimerThread.cpp:515:11
        #27 0x7d6d80ed5980 in mozilla::ThrottledEventQueue::Inner::ExecuteRunnable() /xpcom/threads/ThrottledEventQueue.cpp:254:22
        #28 0x7d6d80ed2741 in mozilla::ThrottledEventQueue::Inner::Executor::Run() /xpcom/threads/ThrottledEventQueue.cpp:81:15
        #29 0x7d6d80ea4cd7 in mozilla::RunnableTask::Run() /xpcom/threads/TaskController.cpp:578:16
        #30 0x7d6d80e9a346 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:905:26
        #31 0x7d6d80e98b27 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /xpcom/threads/TaskController.cpp:728:15
        #32 0x7d6d80e98fa5 in mozilla::TaskController::ProcessPendingMTTask(bool) /xpcom/threads/TaskController.cpp:514:36
        #33 0x7d6d80ea8ce9 in operator() /xpcom/threads/TaskController.cpp:235:37
        #34 0x7d6d80ea8ce9 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_1>::Run() /xpcom/threads/nsThreadUtils.h:548:5
        #35 0x7d6d80ebdfa2 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1199:16
        #36 0x7d6d80ec50ed in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #37 0x7d6d81bab1f3 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #38 0x7d6d81ac11a1 in RunHandler /ipc/chromium/src/base/message_loop.cc:363:3
        #39 0x7d6d81ac11a1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:345:3
        #40 0x7d6d86570088 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:148:27
        #41 0x7d6d86633ca8 in nsAppShell::Run() /widget/gtk/nsAppShell.cpp:470:33
        #42 0x7d6d8846f78b in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:712:20
        #43 0x7d6d81bac126 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:235:9
        #44 0x7d6d81ac11a1 in RunHandler /ipc/chromium/src/base/message_loop.cc:363:3
        #45 0x7d6d81ac11a1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:345:3
        #46 0x7d6d8846efb2 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:647:34
        #47 0x602e053915c6 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #48 0x602e053915c6 in main /browser/app/nsBrowserApp.cpp:375:18
        #49 0x7d6d95c56d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #50 0x7d6d95c56e3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #51 0x602e053672f8 in _start (/home/jkratzer/builds/m-c-20240409093900-fuzzing-debug/firefox-bin+0x592f8) (BuildId: ee2187d63f331818083659cf4411c425a899e839)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /dom/canvas/CanvasRenderingContext2D.cpp:5711:7 in mozilla::dom::CanvasRenderingContext2D::DrawImage(mozilla::dom::HTMLImageElementOrSVGImageElementOrHTMLCanvasElementOrHTMLVideoElementOrOffscreenCanvasOrImageBitmapOrVideoFrame const&, double, double, double, double, double, double, double, double, unsigned char, mozilla::ErrorResult&)
    ==70977==ABORTING

Verified bug as reproducible on mozilla-central 20240410204322-e2456ba9a2f6.
The bug appears to have been introduced in the following build range:

Start: 6109c9e63027ad132c8448ca4457d263284fc283 (20240328092313)
End: 1e7411c6b6399b5f5595f99e8d08576e473af625 (20240328094739)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6109c9e63027ad132c8448ca4457d263284fc283&tochange=1e7411c6b6399b5f5595f99e8d08576e473af625

UseOptimizeShadow landed in 1887818.

Sotaro, could you take a look?

Set release status flags based on info from the regressing bug 1887818

https://hg.mozilla.org/mozilla-central/rev/3bdbaa3eb9d4

Verified bug as fixed on rev mozilla-central 20240416161813-7e8c4adc46e1.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

The patch landed in nightly and beta is affected.
:sotaro, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox126 to wontfix.

For more information, please visit BugBot documentation.

Comment on attachment 9396572 [details]
Bug 1890852 - Fix UseOptimizeShadow check in CanvasRenderingContext2D::DrawImage()

Beta/Release Uplift Approval Request

• User impact if declined: Shadow color might not be rendered when Canvas2d renders video.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: none
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): With this change, when optimized shadows are used, rendering is done in the existing un-optimized way.
• String changes made/needed:
• Is Android affected?: No

Comment on attachment 9396572 [details]
Bug 1890852 - Fix UseOptimizeShadow check in CanvasRenderingContext2D::DrawImage()

Approved for 126.0b3