1498385 - Crash Report [@ webrender::image::compute_tile_range ]

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect, P2)

Description

[Jeff Muizelaar [:jrmuizel]]

https://crash-stats.mozilla.com/report/index/38f760f1-c203-471e-96ff-5f4000181011

Comment 1

[Jeff Muizelaar [:jrmuizel]]

https://github.com/servo/webrender/pull/3192 will help with diagnosing this.

Comment 2

[Matt Woodrow (:mattwoodrow)]

I can reproduce this with tiled blob images: https://treeherder.mozilla.org/#/jobs?repo=try&revision=9e2e5b4d7eb112055060a6d606fc0e01487f4bdf&selectedJob=204993161

(lldb) p *visible_area
(euclid::rect::TypedRect<u32, webrender_api::units::DevicePixel>) $10 = {
  origin = {
    x = 113250
    y = 26843548
  }
  size = {
    width = 1601
    height = 2001
  }
}

Dividing y by the tile_size (256) gives us a number that's still too big for a u16 (104857), and then we panic.

Comment 3

[Tyson Smith [:tsmith]]

This issue has also been found by a fuzzer. Would a testcase be useful at this point? I ask because I'll need to do it locally.

Comment 4

[Maire Reavy [:mreavy]]

(In reply to Tyson Smith [:tsmith] from comment #3)
> This issue has also been found by a fuzzer. Would a testcase be useful at
> this point? I ask because I'll need to do it locally.

Yes, a test case would be useful.  Thanks.

Comment 5

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Here is a reduced test case. It only reproduces on older builds. FWIW our fuzzers have not hit this issues since Oct 29.

Comment 6

[Matt Woodrow (:mattwoodrow)]

With blob tiling enabled, this is covered by the existing crashtest xpcom/string/crashtests/1113005.html, and is now fixed.