Bug 286338 – [Win] Offset out of range in span::subspan(offset, count) under WebCore::convertImagePixelsUnaccelerated

• Component: New Bugs
• Status: RESOLVED FIXED

[Fujii Hironori]

With Debug CRT, Windows port is crashing for some canvas tests.
For example fast/canvas/canvas-clip-path.html

> Debug Assertion Failed!
> 
> Program: C:\webkit\wb\webkitbuild\debug\bin\WebCore.dll
> File: C:\Program Files\Microsoft Visual Studio\2022\Professional\VC\Tools\MSVC\14.42.34433\include\span
> Line: 423
> 
> Expression: Offset out of range in span::subspan(offset, count)w

> WebCore.dll!std::span<const unsigned char,18446744073709551615>::subspan(const unsigned __int64 _Offset, const unsigned __int64 _Count) Line 423	C++
> WebCore.dll!WTF::skip<const unsigned char>(std::span<const unsigned char,18446744073709551615> & data, unsigned __int64 amountToSkip) Line 47	C++
> WebCore.dll!WebCore::convertImagePixelsUnaccelerated<&WebCore::convertSinglePixelPremultipliedToUnpremultiplied>(const WebCore::ConstPixelBufferConversionView & source, const WebCore::PixelBufferConversionView & destination, const WebCore::IntSize & destinationSize) Line 288	C++
> WebCore.dll!WebCore::convertImagePixels(const WebCore::ConstPixelBufferConversionView & source, const WebCore::PixelBufferConversionView & destination, const WebCore::IntSize & destinationSize) Line 349	C++
> WebCore.dll!WebCore::ImageBufferBackend::getPixelBuffer(const WebCore::IntRect & sourceRect, std::span<const unsigned char,18446744073709551615> sourceData, WebCore::PixelBuffer & destinationPixelBuffer) Line 132	C++
> WebKit2.dll!WebKit::ImageBufferShareableBitmapBackend::getPixelBuffer(const WebCore::IntRect & srcRect, WebCore::PixelBuffer & destination) Line 157	C++
> WebCore.dll!WebCore::ImageBuffer::getPixelBuffer(const WebCore::PixelBufferFormat & destinationFormat, const WebCore::IntRect & sourceRect, const WebCore::ImageBufferAllocator & allocator) Line 541	C++
> WebKit2.dll!WebKit::RemoteImageBufferProxy::getPixelBuffer(const WebCore::PixelBufferFormat & destinationFormat, const WebCore::IntRect & sourceRect, const WebCore::ImageBufferAllocator & allocator) Line 282	C++
> WebCore.dll!WebCore::CanvasRenderingContext2DBase::getImageData(int sx, int sy, int sw, int sh, std::optional<WebCore::ImageDataSettings> settings) Line 2598	C++
> WebCore.dll!WebCore::jsCanvasRenderingContext2DPrototypeFunction_getImageDataBody(JSC::JSGlobalObject * lexicalGlobalObject, JSC::CallFrame * callFrame, WebCore::JSCanvasRenderingContext2D * castedThis) Line 2601	C++
> WebCore.dll!WebCore::IDLOperation<WebCore::JSCanvasRenderingContext2D>::call<&WebCore::jsCanvasRenderingContext2DPrototypeFunction_getImageDataBody,0>(JSC::JSGlobalObject & lexicalGlobalObject, JSC::CallFrame & callFrame, const char * operationName) Line 63	C++
> WebCore.dll!WebCore::jsCanvasRenderingContext2DPrototypeFunction_getImageData(JSC::JSGlobalObject * lexicalGlobalObject, JSC::CallFrame * callFrame) Line 2606	C++
> 000001b6000011b8()	Unknown
> 00000038cdbfcac0()	Unknown
> JavaScriptCore.dll!llint_entry()	C++

[Fujii Hironori]

Pull request: https://github.com/WebKit/WebKit/pull/39365

[EWS]

Committed 289484@main (53ee544dee9b): <https://commits.webkit.org/289484@main>

Reviewed commits have been landed. Closing PR #39365 and removing active labels.

[Radar WebKit Bug Importer]

<rdar://problem/143801677>