1536085 - Hit MOZ_CRASH(assertion failed: t >= -T::epsilon() * T::from(10.0).unwrap() && t <= T::one() + T::epsilon() * T::from(10.0).unwrap()) at /builds/worker/workspace/build/src/third_party/rust/plane-split/src/polygon.rs:535

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect, P2)

Description

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 9421b477d67c.

Hit MOZ_CRASH(assertion failed: t >= -T::epsilon() * T::from(10.0).unwrap() && t <= T::one() + T::epsilon() * T::from(10.0).unwrap()) at /builds/worker/workspace/build/src/third_party/rust/plane-split/src/polygon.rs:535

rax = 0x00005637fa890e40   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007fcf5d4f1b4a
rsi = 0x00007fcf8aaa18b0   rdi = 0x00007fcf8aaa0680
rbp = 0x00007fcf5d4f1b30   rsp = 0x00007fcf5d4f1b20
r8 = 0x00007fcf8aaa18b0    r9 = 0x00007fcf5d4fd700
r10 = 0x0000000000000000   r11 = 0x0000000000000000
r12 = 0x0000000000000217   r13 = 0x000000000000004e
r14 = 0x00007fcf80118ff8   r15 = 0x000000000000007a
rip = 0x00007fcf7d13ec39
OS|Linux|0.0.0 Linux 4.18.0-16-generic #17~18.04.1-Ubuntu SMP Tue Feb 12 13:35:51 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|50
50|0|libxul.so|GeckoCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:9421b477d67cfc4c9e03350cd554a9e6acc7f435|314|0x0
50|1|libxul.so|gkrust_shared::panic_hook|hg:hg.mozilla.org/mozilla-central:toolkit/library/rust/shared/lib.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|234|0x9
50|2|libxul.so|core::ops::function::Fn::call|git:github.com/rust-lang/rust:src/libcore/ops/function.rs:9fda7c2237db910e41d6a712e9a2139b352e558b|78|0x5
50|3|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:9fda7c2237db910e41d6a712e9a2139b352e558b|495|0x6
50|4|libxul.so|std::panicking::begin_panic|git:github.com/rust-lang/rust:src/libstd/panicking.rs:9fda7c2237db910e41d6a712e9a2139b352e558b|425|0x14
50|5|libxul.so|<plane_split::polygon::Polygon<T, U>>::split_with_normal|hg:hg.mozilla.org/mozilla-central:<::std::macros::panic macros>:9421b477d67cfc4c9e03350cd554a9e6acc7f435|3|0x18
50|6|libxul.so|<plane_split::clip::Clipper<T, U>>::clip|hg:hg.mozilla.org/mozilla-central:third_party/rust/plane-split/src/clip.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|108|0x15
50|7|libxul.so|<webrender::prim_store::SpaceMapper<F, T>>::map|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/util.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|845|0x5
50|8|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|2836|0x8
50|9|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1722|0x1f
50|10|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1722|0x1f
50|11|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1722|0x1f
50|12|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1722|0x1f
50|13|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1722|0x1f
50|14|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1722|0x1f
50|15|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1722|0x1f
50|16|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1722|0x1f
50|17|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1722|0x1f
50|18|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1722|0x1f
50|19|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1722|0x1f
50|20|libxul.so|webrender::picture::PictureUpdateState::update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1722|0x1f
50|21|libxul.so|webrender::picture::PictureUpdateState::update_all|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1636|0x20
50|22|libxul.so|webrender::frame_builder::FrameBuilder::build|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/frame_builder.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|378|0x10
50|23|libxul.so|webrender::render_backend::Document::build_frame|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|509|0x3f
50|24|libxul.so|webrender::render_backend::RenderBackend::update_document|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1372|0xe
50|25|libxul.so|webrender::render_backend::RenderBackend::process_api_msg|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1248|0x36
50|26|libxul.so|webrender::render_backend::RenderBackend::process_api_msg|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1212|0x5
50|27|libxul.so|_fini|||0x172f4d4
50|28|libc-2.27.so||||0x88910
50|29|libxul.so|<euclid::transform3d::TypedTransform3D<T, Src, Dst>>::inverse|hg:hg.mozilla.org/mozilla-central:third_party/rust/euclid/src/transform3d.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|288|0x8
50|30|||||0x7fcf8a500000
50|31|firefox-bin|arena_t::RallocSmallOrLarge(void*, unsigned long, unsigned long)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:9421b477d67cfc4c9e03350cd554a9e6acc7f435|3427|0x5
50|32|firefox-bin|RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::RotateLeft(RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::TreeNode)|hg:hg.mozilla.org/mozilla-central:memory/build/rb.h:9421b477d67cfc4c9e03350cd554a9e6acc7f435|554|0xc
50|33|firefox-bin|RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::RotateLeft(RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::TreeNode)|hg:hg.mozilla.org/mozilla-central:memory/build/rb.h:9421b477d67cfc4c9e03350cd554a9e6acc7f435|554|0xc
50|34|firefox-bin|RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::MoveRedLeft(RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::TreeNode)|hg:hg.mozilla.org/mozilla-central:memory/build/rb.h:9421b477d67cfc4c9e03350cd554a9e6acc7f435|603|0x9
50|35|firefox-bin|RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::Remove(RedBlackTree<arena_chunk_map_t, ArenaAvailTreeTrait>::TreeNode)|hg:hg.mozilla.org/mozilla-central:memory/build/rb.h:9421b477d67cfc4c9e03350cd554a9e6acc7f435|548|0x5
50|36|firefox-bin|arena_t::SplitRun(arena_run_t*, unsigned long, bool, bool)|hg:hg.mozilla.org/mozilla-central:memory/build/rb.h:9421b477d67cfc4c9e03350cd554a9e6acc7f435|137|0x9
50|37|firefox-bin|arena_t::AllocRun(unsigned long, bool, bool)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:9421b477d67cfc4c9e03350cd554a9e6acc7f435|2410|0x17
50|38|firefox-bin|AutoLock<Mutex>::~AutoLock()|hg:hg.mozilla.org/mozilla-central:memory/build/Mutex.h:9421b477d67cfc4c9e03350cd554a9e6acc7f435|75|0x9
50|39|firefox-bin|arena_t::MallocLarge(unsigned long, bool)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:9421b477d67cfc4c9e03350cd554a9e6acc7f435|2831|0xb
50|40|firefox-bin|BaseAllocator::malloc(unsigned long)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:9421b477d67cfc4c9e03350cd554a9e6acc7f435|3935|0xd
50|41|firefox-bin|Allocator<MozJemallocBase>::malloc(unsigned long)|hg:hg.mozilla.org/mozilla-central:memory/build/malloc_decls.h:9421b477d67cfc4c9e03350cd554a9e6acc7f435|38|0x14
50|42|libxul.so|webrender::hit_test::HitTester::new|git:github.com/rust-lang/rust:src/liballoc/alloc.rs:9fda7c2237db910e41d6a712e9a2139b352e558b|82|0xe
50|43|libxul.so|webrender::render_backend::Document::rebuild_hit_tester|git:github.com/rust-lang/rust:src/liballoc/alloc.rs:9fda7c2237db910e41d6a712e9a2139b352e558b|100|0x6
50|44|libxul.so|webrender::render_backend::RenderBackend::update_document|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:9421b477d67cfc4c9e03350cd554a9e6acc7f435|1436|0x8

Comment 1

[Dzmitry Malyshau [:kvark]]

This is a fragile assert, but it's also harmless.

Comment 2

[Dzmitry Malyshau [:kvark]]

Attachment: Update plane-split to 0.13.8

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/16570d684879
Update plane-split to 0.13.8 r=jrmuizel

Comment 4

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/16570d684879

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Can we land this testcase as a crashtest?

Comment 6

[Dzmitry Malyshau [:kvark]]

It was a debug assert, and failing it marginally wasn't meant to cause any trouble. And now we don't have the assert, so I don't think a crash test would be very useful at this point. However, what we can (and should) do is have a unit test in plane-split library itself that ensures that this case isn't causing any issues.