1645281 - Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at src/third_party/rust/euclid/src/size.rs:319

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Hit MOZ_CRASH(called Option::unwrap() on a None value) at /builds/worker/checkouts/gecko/third_party/rust/euclid/src/size.rs:319

18|0|libxul.so|RustMozCrash|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/wrappers.cpp:590d76562067863dd840c9ff7cf85d5e8e2d6b4d|17|0x15
18|1|libxul.so|mozglue_static::panic_hook|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/lib.rs:590d76562067863dd840c9ff7cf85d5e8e2d6b4d|89|0x9
18|2|libxul.so|core::ops::function::Fn::call|git:github.com/rust-lang/rust:src/libcore/ops/function.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|72|0xc
18|3|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|474|0x7
18|4|libxul.so|rust_begin_unwind|git:github.com/rust-lang/rust:src/libstd/panicking.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|378|0x2f
18|5|libxul.so|core::panicking::panic_fmt|git:github.com/rust-lang/rust:src/libcore/panicking.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|85|0x6
18|6|libxul.so|core::panicking::panic|git:github.com/rust-lang/rust:src/libcore/panicking.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|52|0x49
18|7|libxul.so|webrender::clip::ClipNode::update|git:github.com/rust-lang/rust:src/libcore/option.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|0|0x44
18|8|libxul.so|webrender::clip::ClipStore::build_clip_chain_instance|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/clip.rs:590d76562067863dd840c9ff7cf85d5e8e2d6b4d|1181|0xd
18|9|libxul.so|webrender::prim_store::PrimitiveStore::update_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:590d76562067863dd840c9ff7cf85d5e8e2d6b4d|2096|0x57
18|10|libxul.so|webrender::prim_store::PrimitiveStore::update_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:590d76562067863dd840c9ff7cf85d5e8e2d6b4d|1993|0x2f
18|11|libxul.so|webrender::prim_store::PrimitiveStore::update_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:590d76562067863dd840c9ff7cf85d5e8e2d6b4d|1993|0x2f
18|12|libxul.so|webrender::prim_store::PrimitiveStore::update_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:590d76562067863dd840c9ff7cf85d5e8e2d6b4d|1993|0x2f
18|13|libxul.so|webrender::prim_store::PrimitiveStore::update_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:590d76562067863dd840c9ff7cf85d5e8e2d6b4d|1993|0x2f
18|14|libxul.so|webrender::frame_builder::FrameBuilder::build|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/frame_builder.rs:590d76562067863dd840c9ff7cf85d5e8e2d6b4d|385|0x30
18|15|libxul.so|webrender::render_backend::Document::build_frame|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:590d76562067863dd840c9ff7cf85d5e8e2d6b4d|615|0x22
18|16|libxul.so|webrender::render_backend::RenderBackend::update_document|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:590d76562067863dd840c9ff7cf85d5e8e2d6b4d|1520|0x1c
18|17|libxul.so|webrender::render_backend::RenderBackend::process_api_msg|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:590d76562067863dd840c9ff7cf85d5e8e2d6b4d|1300|0x199

Comment 1

[Connor Brewster [:cbrewster]]

Looks like we keep hitting cases where we either create surfaces that are too large or hit device rect i32 overflows with the surface scaling I added. I can keep adding more maximum size checks, but I think we should consider how to manage this in a more unified way rather than have a bunch of ad-hoc size checks scattered around.

I wonder if it would make sense to do the max size check when creating render tasks themselves (like what Nical had in this revision https://phabricator.services.mozilla.com/D75789). I think this would work for all tasks except for picture tasks since we need to record the adjusted device pixel scale for text runs and to adjust blur radii.

Comment 2

[Darkspirit]

bp-513e0d6f-fd64-45e0-ba51-e313c0200612

Comment 3

[Darkspirit]

KDE, X11, Debian Testing (0x8086 0x162b Intel Iris Graphics 6100 (BDW GT3))
good: white page
bad: grey page, "CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown" on about:support. If you repeat tab switching, it falls back to Basic.
mozregression --good 2020-05-01 --bad 2020-06-11 --pref gfx.webrender.all:true -a about:support -a https://bugzilla.mozilla.org/attachment.cgi?id=9156149

8:07.17 INFO: Last good revision: dd35edffc6dffb7ae6a4050b955c6e7855cdffcd
8:07.17 INFO: First bad revision: 2383139c85c0a60504a871530d099f96eff9e59d
8:07.17 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=dd35edffc6dffb7ae6a4050b955c6e7855cdffcd&tochange=2383139c85c0a60504a871530d099f96eff9e59d

2383139c85c0a60504a871530d099f96eff9e59d cbrewster — Bug 1639729: Propagate surface device pixel scale to child surfaces r=Bert

Comment 4

[Bert Peers [:bpeers]]

Yeah I don't have any better ideas than stomping these out as they come up :( I've fixed another one of these in Bug 1643620: the safety check comes as late as possible to make sure we work with the final data, but early enough that we still have an alternative to fall back on (rather than just throwing our hands/an exception).
Even if there's a logic error with the Clip code higher up that makes it ask for crazy values, the backend should be robust against such misuse.

Comment 5

[Connor Brewster [:cbrewster]]

Attachment: Bug 1645281: Limit the size of box shadow render tasks r=gw,Bert

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b51500258c3a
Limit the size of box shadow render tasks r=gw,Bert

Comment 7

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/b51500258c3a

Comment 8

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/b51500258c3a