1423311 - blob-images: thread 'WRRenderBackend#1' panicked at 'called `Option::unwrap()` on a `None` value' in [@ webrender::resource_cache::ResourceCache::request_image]

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebRender, defect, P3)

Description

[Jesse Schwartzentruber (:truber)]

Attachment: testcase.html

The attached testcase caused a panic while fuzzing m-c rev 20171205-b4cef8d1dff0 with these prefs:

    user_pref("layers.acceleration.force-enabled", true);
    user_pref("gfx.webrender.enabled", true);
    user_pref("gfx.webrender.blob-images", true);


thread 'WRRenderBackend#1' panicked at 'called `Option::unwrap()` on a `None` value', /checkout/src/libcore/option.rs:335:20
stack backtrace:
   0:     0x7f45b10abda3 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::h8ed7485deb8ab958
                               at /checkout/src/libstd/sys/unix/backtrace/tracing/gcc_s.rs:49
   1:     0x7f45b10aa43c - std::panicking::default_hook::{{closure}}::h0088fe51b67c687c
                               at /checkout/src/libstd/sys_common/backtrace.rs:69
                               at /checkout/src/libstd/sys_common/backtrace.rs:58
                               at /checkout/src/libstd/panicking.rs:381
   2:     0x7f45b10a9e6d - std::panicking::default_hook::hf425c768c5ffbbad
                               at /checkout/src/libstd/panicking.rs:397
   3:     0x7f45b10a9941 - std::panicking::rust_panic_with_hook::h25b934bb4484e9e0
                               at /checkout/src/libstd/panicking.rs:577
   4:     0x7f45b10a982b - std::panicking::begin_panic::h59483e27e93d7bc6
                               at /checkout/src/libstd/panicking.rs:538
   5:     0x7f45b10a97b9 - std::panicking::begin_panic_fmt::h5f221297e8a3dbdb
                               at /checkout/src/libstd/panicking.rs:522
   6:     0x7f45b10b9662 - core::panicking::panic_fmt::h4d1ab9bae1f32475
                               at /checkout/src/libstd/panicking.rs:498
   7:     0x7f45b10bb226 - core::panicking::panic::h8ce57b1f932a0889
                               at /checkout/src/libcore/panicking.rs:51
   8:     0x7f45b0d477ad - webrender::resource_cache::ResourceCache::request_image::h5a2149daef161431
                               at /checkout/src/libcore/macros.rs:20
                               at /builds/worker/workspace/build/src/gfx/webrender/src/resource_cache.rs:561
   9:     0x7f45b0d45d3d - webrender::clip::ClipSources::update::h2232fd80dfbbd1d4
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip.rs:240
  10:     0x7f45b0d4ef63 - webrender::clip_scroll_node::ClipScrollNode::update::h18c220158e01d49d
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_node.rs:349
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_node.rs:286
  11:     0x7f45b0d28a46 - webrender::clip_scroll_tree::ClipScrollTree::update_node::hbfe493ec5fe33ba0
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_tree.rs:400
  12:     0x7f45b0d28b40 - webrender::clip_scroll_tree::ClipScrollTree::update_node::hbfe493ec5fe33ba0
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_tree.rs:414
  13:     0x7f45b0d28b40 - webrender::clip_scroll_tree::ClipScrollTree::update_node::hbfe493ec5fe33ba0
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_tree.rs:414
  14:     0x7f45b0d28b40 - webrender::clip_scroll_tree::ClipScrollTree::update_node::hbfe493ec5fe33ba0
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_tree.rs:414
  15:     0x7f45b0d28b40 - webrender::clip_scroll_tree::ClipScrollTree::update_node::hbfe493ec5fe33ba0
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_tree.rs:414
  16:     0x7f45b0d28b40 - webrender::clip_scroll_tree::ClipScrollTree::update_node::hbfe493ec5fe33ba0
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_tree.rs:414
  17:     0x7f45b0d28b40 - webrender::clip_scroll_tree::ClipScrollTree::update_node::hbfe493ec5fe33ba0
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_tree.rs:414
  18:     0x7f45b0d28b40 - webrender::clip_scroll_tree::ClipScrollTree::update_node::hbfe493ec5fe33ba0
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_tree.rs:414
  19:     0x7f45b0d28b40 - webrender::clip_scroll_tree::ClipScrollTree::update_node::hbfe493ec5fe33ba0
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_tree.rs:414
  20:     0x7f45b0d28b40 - webrender::clip_scroll_tree::ClipScrollTree::update_node::hbfe493ec5fe33ba0
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_tree.rs:414
  21:     0x7f45b0d28b40 - webrender::clip_scroll_tree::ClipScrollTree::update_node::hbfe493ec5fe33ba0
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_tree.rs:414
  22:     0x7f45b0d22d5a - webrender::render_backend::Document::render::hbca4070b23c51ce7
                               at /builds/worker/workspace/build/src/gfx/webrender/src/clip_scroll_tree.rs:368
                               at /builds/worker/workspace/build/src/gfx/webrender/src/frame_builder.rs:1702
                               at /builds/worker/workspace/build/src/gfx/webrender/src/frame.rs:1182
                               at /builds/worker/workspace/build/src/gfx/webrender/src/render_backend.rs:117
  23:     0x7f45b0d16340 - webrender::render_backend::RenderBackend::process_document::hcc8ad1271fe1f961
                               at /builds/worker/workspace/build/src/gfx/webrender/src/render_backend.rs:419
  24:     0x7f45b0d07345 - webrender::render_backend::RenderBackend::run::ha1b0869f3e969d22
                               at /builds/worker/workspace/build/src/gfx/webrender/src/render_backend.rs:491
  25:     0x7f45b0d05957 - std::sys_common::backtrace::__rust_begin_short_backtrace::h0aa9d3d182377cab
                               at /builds/worker/workspace/build/src/gfx/webrender/src/renderer.rs:1988
                               at /checkout/src/libstd/sys_common/backtrace.rs:134
  26:     0x7f45b0d04f66 - <F as alloc::boxed::FnBox<A>>::call_box::hab3e6d66a857965e
                               at /checkout/src/libstd/thread/mod.rs:400
                               at /checkout/src/libstd/panic.rs:296
                               at /checkout/src/libstd/panicking.rs:480
                               at /checkout/src/libpanic_abort/lib.rs:38
                               at /checkout/src/libstd/panic.rs:361
                               at /checkout/src/libstd/thread/mod.rs:399
                               at /checkout/src/liballoc/boxed.rs:726
  27:     0x7f45b10b6ab3 - std::sys::imp::thread::Thread::new::thread_start::hbaf1b5aa1ca8e3ea
                               at /checkout/src/liballoc/boxed.rs:736
                               at /checkout/src/libstd/sys_common/thread.rs:24
                               at /checkout/src/libstd/sys/unix/thread.rs:90
  28:     0x7f45c2663089 - start_thread
  29:     0x7f45c16a447e - __clone
  30:                0x0 - <unknown>

Comment 1

[Darkspirit]

https://bugzilla.mozilla.org/attachment.cgi?id=8934650

(main profile)
Meldungs-ID 	Sendedatum
bp-59969c38-b8bb-4eb6-8aab-a69170171205	05.12.17 20:45 [@ @0x408388 ]
> called `Option::unwrap()` on a `None` value
bp-b6e23d93-f6ed-4b5d-9a90-5c2ff0171205	05.12.17 20:45 [@ nsObserverService::RemoveObserver ]
> MOZ_CRASH(Using observer service off the main thread!)
bp-9af04407-a0a0-482c-ae1b-ceeec0171205	05.12.17 20:45 [@ mozalloc_abort | abort | webrender::resource_cache::ResourceCache::request_image ]
> called `Option::unwrap()` on a `None` value
bp-41709944-c799-497c-bb08-5fde10171205	05.12.17 20:45 [@ mozalloc_abort | abort | webrender::resource_cache::ResourceCache::request_image ]
> called `Option::unwrap()` on a `None` value

Comment 2

[Kartikaya Gupta (email:[e-mail])]

Does the testcase reliably reproduce the crash for you? What platform did you see this on? Did your build have anything special in the mozconfig (or did you use a stock build from treeherder)?

Comment 3

[Jesse Schwartzentruber (:truber)]

Yes, it is 100% reliable for me. This reproduces on the latest linux x86-64 builds (asan-opt & debug) and macosx64 builds (opt & debug) from taskcluster. It did not reproduce for me on windows 10.

Comment 4

[Sotaro Ikeda [:sotaro]]

I could reproduce the crash.

Comment 5

[Sotaro Ikeda [:sotaro]]

On debug build on linux, I saw the following log. It seems like a similar problem to  Bug 1391255 Comment 13.

> [GFX3-]: Surface size too large (exceeds extent limit)!

Comment 6

[Sotaro Ikeda [:sotaro]]

(In reply to Sotaro Ikeda [:sotaro] from comment #4)
> I could reproduce the crash.

When gfx.webrender.blob-images was not true, I did not saw the crash.

Comment 7

[Intermittent Failures Robot]

1 failures in 747 pushes (0.001 failures/push) were associated with this bug in the last 7 days.    

Repository breakdown:
* autoland: 1

Platform breakdown:
* linux64-qr: 1

For more details, see:
https://brasstacks.mozilla.com/orangefactor/?display=Bug&bugid=1423311&startday=2018-03-05&endday=2018-03-11&tree=all

Comment 8

[Darkspirit]

https://bug1423311.bmoattachments.org/attachment.cgi?id=8934650

bp-6769afc9-a998-4606-9c12-d0c610180425
bp-93392446-67e7-41c4-ac59-307360180425
bp-76972dfe-f63c-4d5a-8d71-1a6a60180425

layers.acceleration.force-enabled;true
gfx.webrender.enabled;true
gfx.webrender.blob-images;TRUE
gfx.webrender.hit-test;true
gfx.webrender.blob.invalidation;false
gfx.webrender.async-scene-build;0 
-> bp-3ee67036-9482-4f26-961a-ed1c50180425

layers.acceleration.force-enabled;true
gfx.webrender.enabled;true
gfx.webrender.blob-images;FALSE
gfx.webrender.hit-test;true
gfx.webrender.blob.invalidation;false
gfx.webrender.async-scene-build;0
-> does not crash without blob-images

bug 1455743 comment 3 has the same crash signature, but is only reproducible if gfx.webrender.async-scene-build is enabled.

Comment 9

[Darkspirit]

(In reply to Jesse Schwartzentruber (:truber) from comment #0)
> Created attachment 8934650 [details]
> testcase.html

Crash reason changed:
bp-7f92be4a-9163-4583-a990-3ab210180706
> Moz2D replay problem

And it looks like rust crash signatures are broken. Now there's one signature for multiple crash reasons:
https://crash-stats.mozilla.com/signature/?product=Firefox&signature=mozalloc_abort%20%7C%20abort%20%7C%20_ZN11panic_abort18__rust_start_panic5abort17hfb98714efe360e0fE%20%7C%20__rust_start_panic%20%7C%20_ZN3std9panicking20rust_panic_with_hook17h608586f043d70222E&date=%3E%3D2018-06-29T15%3A24%3A56.000Z&date=%3C2018-07-06T15%3A24%3A56.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=install_time&_sort=-date&page=1#reports

Comment 10

[Kartikaya Gupta (email:[e-mail])]

Looks like the symbols aren't getting demangled, and so the step that's supposed to filter out the rust panic boilerplate stack frames out of the signature isn't getting triggered.

Comment 11

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 12

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 13

[Darkspirit]

My god.

(In reply to Jesse Schwartzentruber (:truber) from comment #0)
> Created attachment 8934650 [details]
> testcase.html

bp-e153490b-b6bd-4170-bdc0-3824a0181001
> called `Option::unwrap()` on a `None` value

Comment 14

[Tyson Smith [:tsmith]]

The fuzzers last hit this issue in November 2018. Can we close this?

Comment 15

[Jeff Muizelaar [:jrmuizel]]

Not a problem anymore.

Comment 16

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a regression, but please revert this change in case of error.