Bug 1649668 Comment 0 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by

Tyson Smith [:tsmith]

on 2020-06-30 20:22:05 PDT

==48375==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f20bfe6c28b bp 0x7f2099493900 sp 0x7f20994934b0 T27)
==48375==The signal is caused by a WRITE memory access.
==48375==Hint: address points to the zero page.
    #0 0x7f20bfe6c28a in RustMozCrash (/home/user/workspace/browsers/m-c-20200629154604-fuzzing-asan-opt/libxul.so+0x1445728a)
    #1 0x7f20bea159dc in mozglue_static::panic_hook::h49c6b7e77d9abe99 src/mozglue/static/rust/lib.rs:89:8
    #2 0x7f20bea158ab in core::ops::function::Fn::call::h486500c193845745 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/ops/function.rs:72:4
    #3 0x7f20befb3df3 in std::panicking::rust_panic_with_hook::hb976084785e50594 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/panicking.rs:474:16
    #4 0x7f20befb3bd9 in rust_begin_unwind /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/panicking.rs:378:4
    #5 0x7f20be0de3af in core::panicking::panic_fmt::h45f7d6868edb5678 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/panicking.rs:85:13
    #6 0x7f20be0e4901 in core::option::expect_failed::h9a8bff6ff005b30d /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/option.rs:1203:4
    #7 0x7f20bf88e1d9 in core::option::Option$LT$T$GT$::expect::h522d31ffa1f42323 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/option.rs:347:20
    #8 0x7f20bf88e1d9 in webrender::spatial_tree::SpatialTree::get_relative_transform::h61ef8427f95075e0 src/gfx/wr/webrender/src/spatial_tree.rs:321:35
    #9 0x7f20bf8755b1 in webrender::prim_store::SpaceMapper$LT$F$C$T$GT$::set_target_spatial_node::h1cdd2a59ce0223eb src/gfx/wr/webrender/src/prim_store/mod.rs:256:28
    #10 0x7f20bfaf0a5f in webrender::picture::PicturePrimitive::post_update::hd2b524f5f78af2a6 src/gfx/wr/webrender/src/picture.rs:6157:12
    #11 0x7f20bfa83e29 in webrender::picture::PictureUpdateState::update::h3e49dd3f4d89b782 src/gfx/wr/webrender/src/picture.rs:4000:12
    #12 0x7f20bfa83d69 in webrender::picture::PictureUpdateState::update::h3e49dd3f4d89b782 src/gfx/wr/webrender/src/picture.rs:3989:20
    #13 0x7f20bfa83d69 in webrender::picture::PictureUpdateState::update::h3e49dd3f4d89b782 src/gfx/wr/webrender/src/picture.rs:3989:20
    #14 0x7f20bfa83d69 in webrender::picture::PictureUpdateState::update::h3e49dd3f4d89b782 src/gfx/wr/webrender/src/picture.rs:3989:20
    #15 0x7f20bfa7aa7f in webrender::picture::PictureUpdateState::update_all::had848fb1c75c812b src/gfx/wr/webrender/src/picture.rs:3901:8
    #16 0x7f20bfa7aa7f in webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::h5188ce4868864adf src/gfx/wr/webrender/src/frame_builder.rs:347:8
    #17 0x7f20bfa7aa7f in webrender::frame_builder::FrameBuilder::build::h978bbcf1d90801a1 src/gfx/wr/webrender/src/frame_builder.rs:593:34
    #18 0x7f20bfa66a54 in webrender::render_backend::Document::build_frame::h68f085ca7fba3b8b src/gfx/wr/webrender/src/render_backend.rs:643:24
    #19 0x7f20bfa581a3 in webrender::render_backend::RenderBackend::update_document::h266dc88e36fc7934 src/gfx/wr/webrender/src/render_backend.rs:1555:40
    #20 0x7f20bfa5421b in webrender::render_backend::RenderBackend::prepare_transactions::h502987b6e761b4fa src/gfx/wr/webrender/src/render_backend.rs:1392:31
    #21 0x7f20bfa5421b in webrender::render_backend::RenderBackend::process_api_msg::hb21a1245248c5af7 src/gfx/wr/webrender/src/render_backend.rs:1335:16
    #22 0x7f20bfa3f145 in webrender::render_backend::RenderBackend::run::hf179e180e0bd7e37 src/gfx/wr/webrender/src/render_backend.rs:961:20
    #23 0x7f20bfa39747 in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::ha83aabab8cff91ca src/gfx/wr/webrender/src/renderer.rs:2629:12
    #24 0x7f20bfa39747 in std::sys_common::backtrace::__rust_begin_short_backtrace::h338c3b6f227cbc73 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/sys_common/backtrace.rs:130:4
    #25 0x7f20bfa38ded in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h24989f571fd7dc4d /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/thread/mod.rs:475:16
    #26 0x7f20bfa38ded in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::ha28cee2f14347c46 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/panic.rs:318:8
    #27 0x7f20bfa38ded in std::panicking::try::do_call::h5a67ad17d9149a22 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/panicking.rs:303:39
    #28 0x7f20bfa38ded in __rust_maybe_catch_panic /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libpanic_abort/lib.rs:30:4
    #29 0x7f20bfa38ded in std::panicking::try::h5de4d66cd712ff59 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/panicking.rs:281:12
    #30 0x7f20bfa38ded in std::panic::catch_unwind::h70fe94df26504fbf /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/panic.rs:394:13
    #31 0x7f20bfa38ded in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h7f6186accc6d77b1 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/thread/mod.rs:474:29
    #32 0x7f20bfa38ded in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::hcff5e3ea22d786c6 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/ops/function.rs:232:4
    #33 0x7f20befc547d in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h553ef812d1929d1b /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/liballoc/boxed.rs:1017:8
    #34 0x7f20befc90cf in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h51b51bce029ae491 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/liballoc/boxed.rs:1017:8
    #35 0x7f20befc90cf in std::sys_common::thread::start_thread::hca943f45f04c8e46 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/sys_common/thread.rs:13:4
    #36 0x7f20befc90cf in std::sys::unix::thread::Thread::new::thread_start::h352e8a5875b189ee /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/sys/unix/thread.rs:80:16
    #37 0x7f20d58066b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #38 0x7f20d482c41c in clone /build/glibc-LK5gWL/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Revision 1 by

Tyson Smith [:tsmith]

on 2020-06-30 21:00:56 PDT

```c
==48375==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f20bfe6c28b bp 0x7f2099493900 sp 0x7f20994934b0 T27)
==48375==The signal is caused by a WRITE memory access.
==48375==Hint: address points to the zero page.
    #0 0x7f20bfe6c28a in RustMozCrash (/home/user/workspace/browsers/m-c-20200629154604-fuzzing-asan-opt/libxul.so+0x1445728a)
    #1 0x7f20bea159dc in mozglue_static::panic_hook::h49c6b7e77d9abe99 src/mozglue/static/rust/lib.rs:89:8
    #2 0x7f20bea158ab in core::ops::function::Fn::call::h486500c193845745 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/ops/function.rs:72:4
    #3 0x7f20befb3df3 in std::panicking::rust_panic_with_hook::hb976084785e50594 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/panicking.rs:474:16
    #4 0x7f20befb3bd9 in rust_begin_unwind /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/panicking.rs:378:4
    #5 0x7f20be0de3af in core::panicking::panic_fmt::h45f7d6868edb5678 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/panicking.rs:85:13
    #6 0x7f20be0e4901 in core::option::expect_failed::h9a8bff6ff005b30d /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/option.rs:1203:4
    #7 0x7f20bf88e1d9 in core::option::Option$LT$T$GT$::expect::h522d31ffa1f42323 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/option.rs:347:20
    #8 0x7f20bf88e1d9 in webrender::spatial_tree::SpatialTree::get_relative_transform::h61ef8427f95075e0 src/gfx/wr/webrender/src/spatial_tree.rs:321:35
    #9 0x7f20bf8755b1 in webrender::prim_store::SpaceMapper$LT$F$C$T$GT$::set_target_spatial_node::h1cdd2a59ce0223eb src/gfx/wr/webrender/src/prim_store/mod.rs:256:28
    #10 0x7f20bfaf0a5f in webrender::picture::PicturePrimitive::post_update::hd2b524f5f78af2a6 src/gfx/wr/webrender/src/picture.rs:6157:12
    #11 0x7f20bfa83e29 in webrender::picture::PictureUpdateState::update::h3e49dd3f4d89b782 src/gfx/wr/webrender/src/picture.rs:4000:12
    #12 0x7f20bfa83d69 in webrender::picture::PictureUpdateState::update::h3e49dd3f4d89b782 src/gfx/wr/webrender/src/picture.rs:3989:20
    #13 0x7f20bfa83d69 in webrender::picture::PictureUpdateState::update::h3e49dd3f4d89b782 src/gfx/wr/webrender/src/picture.rs:3989:20
    #14 0x7f20bfa83d69 in webrender::picture::PictureUpdateState::update::h3e49dd3f4d89b782 src/gfx/wr/webrender/src/picture.rs:3989:20
    #15 0x7f20bfa7aa7f in webrender::picture::PictureUpdateState::update_all::had848fb1c75c812b src/gfx/wr/webrender/src/picture.rs:3901:8
    #16 0x7f20bfa7aa7f in webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::h5188ce4868864adf src/gfx/wr/webrender/src/frame_builder.rs:347:8
    #17 0x7f20bfa7aa7f in webrender::frame_builder::FrameBuilder::build::h978bbcf1d90801a1 src/gfx/wr/webrender/src/frame_builder.rs:593:34
    #18 0x7f20bfa66a54 in webrender::render_backend::Document::build_frame::h68f085ca7fba3b8b src/gfx/wr/webrender/src/render_backend.rs:643:24
    #19 0x7f20bfa581a3 in webrender::render_backend::RenderBackend::update_document::h266dc88e36fc7934 src/gfx/wr/webrender/src/render_backend.rs:1555:40
    #20 0x7f20bfa5421b in webrender::render_backend::RenderBackend::prepare_transactions::h502987b6e761b4fa src/gfx/wr/webrender/src/render_backend.rs:1392:31
    #21 0x7f20bfa5421b in webrender::render_backend::RenderBackend::process_api_msg::hb21a1245248c5af7 src/gfx/wr/webrender/src/render_backend.rs:1335:16
    #22 0x7f20bfa3f145 in webrender::render_backend::RenderBackend::run::hf179e180e0bd7e37 src/gfx/wr/webrender/src/render_backend.rs:961:20
    #23 0x7f20bfa39747 in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::ha83aabab8cff91ca src/gfx/wr/webrender/src/renderer.rs:2629:12
    #24 0x7f20bfa39747 in std::sys_common::backtrace::__rust_begin_short_backtrace::h338c3b6f227cbc73 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/sys_common/backtrace.rs:130:4
    #25 0x7f20bfa38ded in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h24989f571fd7dc4d /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/thread/mod.rs:475:16
    #26 0x7f20bfa38ded in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::ha28cee2f14347c46 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/panic.rs:318:8
    #27 0x7f20bfa38ded in std::panicking::try::do_call::h5a67ad17d9149a22 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/panicking.rs:303:39
    #28 0x7f20bfa38ded in __rust_maybe_catch_panic /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libpanic_abort/lib.rs:30:4
    #29 0x7f20bfa38ded in std::panicking::try::h5de4d66cd712ff59 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/panicking.rs:281:12
    #30 0x7f20bfa38ded in std::panic::catch_unwind::h70fe94df26504fbf /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/panic.rs:394:13
    #31 0x7f20bfa38ded in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h7f6186accc6d77b1 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/thread/mod.rs:474:29
    #32 0x7f20bfa38ded in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::hcff5e3ea22d786c6 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/ops/function.rs:232:4
    #33 0x7f20befc547d in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h553ef812d1929d1b /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/liballoc/boxed.rs:1017:8
    #34 0x7f20befc90cf in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h51b51bce029ae491 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/liballoc/boxed.rs:1017:8
    #35 0x7f20befc90cf in std::sys_common::thread::start_thread::hca943f45f04c8e46 /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/sys_common/thread.rs:13:4
    #36 0x7f20befc90cf in std::sys::unix::thread::Thread::new::thread_start::h352e8a5875b189ee /rustc/4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/sys/unix/thread.rs:80:16
    #37 0x7f20d58066b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
    #38 0x7f20d482c41c in clone /build/glibc-LK5gWL/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109
```

Back to Bug 1649668 Comment 0