1615141 - Hit MOZ_CRASH(bug: unable to map) at src/libcore/option.rs:1188

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Hit MOZ_CRASH(bug: unable to map) at src/libcore/option.rs:1188

56|0|libxul.so|RustMozCrash|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/wrappers.cpp:f314754b7e11062f78e3f55e80e061ff9db7a326|17|0x15
56|1|libxul.so|mozglue_static::panic_hook|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/lib.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|89|0x9
56|2|libxul.so|core::ops::function::Fn::call|git:github.com/rust-lang/rust:src/libcore/ops/function.rs:5e1a799842ba6ed4a57e91f7ab9435947482f7d8|72|0xc
56|3|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:5e1a799842ba6ed4a57e91f7ab9435947482f7d8|475|0x6
56|4|libxul.so|rust_begin_unwind|git:github.com/rust-lang/rust:src/libstd/panicking.rs:5e1a799842ba6ed4a57e91f7ab9435947482f7d8|375|0x18
56|5|libxul.so|core::panicking::panic_fmt|git:github.com/rust-lang/rust:src/libcore/panicking.rs:5e1a799842ba6ed4a57e91f7ab9435947482f7d8|84|0x6
56|6|libxul.so|core::option::expect_failed|git:github.com/rust-lang/rust:src/libcore/option.rs:5e1a799842ba6ed4a57e91f7ab9435947482f7d8|1188|0x54
56|7|libxul.so|webrender::picture::TileCacheInstance::update_prim_dependencies|git:github.com/rust-lang/rust:src/libcore/option.rs:5e1a799842ba6ed4a57e91f7ab9435947482f7d8|348|0x12
56|8|libxul.so|webrender::prim_store::PrimitiveStore::update_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|2131|0x4c
56|9|libxul.so|webrender::prim_store::PrimitiveStore::update_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|1997|0x2e
56|10|libxul.so|webrender::prim_store::PrimitiveStore::update_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|1997|0x2e
56|11|libxul.so|webrender::prim_store::PrimitiveStore::update_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|1997|0x2e
56|12|libxul.so|webrender::prim_store::PrimitiveStore::update_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|1997|0x2e
56|13|libxul.so|webrender::prim_store::PrimitiveStore::update_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|1997|0x2e
56|14|libxul.so|webrender::frame_builder::FrameBuilder::build|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/frame_builder.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|370|0x2a
56|15|libxul.so|webrender::render_backend::Document::build_frame|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|556|0x28
56|16|libxul.so|webrender::render_backend::RenderBackend::update_document|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|1577|0x1c
56|17|libxul.so|webrender::render_backend::RenderBackend::process_api_msg|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|1302|0x339
56|18|libxul.so|webrender::render_backend::RenderBackend::process_api_msg|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|1302|0x2a
56|19|libxul.so|webrender::hit_test::HitTester::new|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/hit_test.rs:f314754b7e11062f78e3f55e80e061ff9db7a326|231|0xe
56|20|firefox-bin|arena_t::DallocSmall(arena_chunk_t*, void*, arena_chunk_map_t*)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:f314754b7e11062f78e3f55e80e061ff9db7a326|3299|0x10
56|21|firefox-bin|arena_t::DallocSmall(arena_chunk_t*, void*, arena_chunk_map_t*)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:f314754b7e11062f78e3f55e80e061ff9db7a326|3299|0x10
56|22|firefox-bin|arena_dalloc(void*, unsigned long, arena_t*)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:f314754b7e11062f78e3f55e80e061ff9db7a326|3390|0x11
56|23|firefox-bin|arena_t::DallocSmall(arena_chunk_t*, void*, arena_chunk_map_t*)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:f314754b7e11062f78e3f55e80e061ff9db7a326|3299|0x10
56|24|firefox-bin|arena_dalloc(void*, unsigned long, arena_t*)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:f314754b7e11062f78e3f55e80e061ff9db7a326|3390|0x11
56|25|firefox-bin|PageFree(mozilla::Maybe<unsigned long> const&, void*)|hg:hg.mozilla.org/mozilla-central:memory/replace/phc/PHC.cpp:f314754b7e11062f78e3f55e80e061ff9db7a326|1073|0x9

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/nZ-03yHFHjdtyonBVh5PEA/index.html

Comment 2

[Andrew Osmond [:aosmond] (he/him)]

https://searchfox.org/mozilla-central/rev/a4be2fbe9bd4f405c91cc16e4e3a80400f5a9301/gfx/wr/webrender/src/picture.rs#2551

Comment 3

[Glenn Watson [:gw]]

Attachment: Bug 1615141 - Fix panic in picture cache dependency building.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fc74126fedeb
Fix panic in picture cache dependency building. r=Bert

Comment 5

[Glenn Watson [:gw]]

Patch attached to fix this panic.

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/fc74126fedeb

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Is this something we should consider uplifting to Beta for Fx74 also or can this ride 75 to release?

Comment 8

[Glenn Watson [:gw]]

It's probably not something that is likely to be hit often on real content (was found by a fuzz test, I believe) and I don't think we've seen any real world crash reports for it.

On the other hand, it's a small, simple and low-risk patch - so if it applies cleanly, it might be worth uplifting it despite the above?

Comment 9

[Ryan VanderMeulen [:RyanVM]]

It grafts cleanly to Beta, but it doesn't sound like it's worth it based on what we know. Feel free to nominate if you think it's better safe than sorry, though.