1683946 - Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at /builds/worker/checkouts/gecko/third_party/rust/euclid/src/size.rs:285

Status: RESOLVED DUPLICATE of bug 1822677

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing (--enable-debug --enable-fuzzing)

Hit MOZ_CRASH(called Option::unwrap() on a None value) at src/third_party/rust/euclid/src/size.rs:285

#0 0x7faba2ba1325 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:254:3
#1 0x7faba2ba1325 in RustMozCrash src/mozglue/static/rust/wrappers.cpp:17:3
#2 0x7faba2ba12d4 in mozglue_static::panic_hook::ha757622518ce090b src/mozglue/static/rust/lib.rs:89:9
#3 0x7faba2ba0bfb in core::ops::function::Fn::call::h2f0433a5b64f4daf /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:70:5
#4 0x7faba3b78465 in std::panicking::rust_panic_with_hook::h2bdec87b60580584 /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/std/src/panicking.rs:581:17
#5 0x7faba3b77fe8 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h101ca09d9df5db47 /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/std/src/panicking.rs:484:9
#6 0x7faba3b732db in std::sys_common::backtrace::__rust_end_short_backtrace::h3bb85654c20113ca /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/std/src/sys_common/backtrace.rs:153:18
#7 0x7faba3b77fa8 in rust_begin_unwind /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/std/src/panicking.rs:483:5
#8 0x7faba3bddcb0 in core::panicking::panic_fmt::h48c31e1e3d550146 /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/core/src/panicking.rs:85:14
#9 0x7faba3bddbfc in core::panicking::panic::h184ede6dd822ffb4 /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/core/src/panicking.rs:50:5
#10 0x7faba23f13f4 in webrender::clip::ClipNode::update::h4a75dbac60f14a04 src/gfx/wr/webrender/src/clip.rs
#11 0x7faba23f5b3c in webrender::clip::ClipStore::build_clip_chain_instance::h11166ac09e885e8b src/gfx/wr/webrender/src/clip.rs:1236:21
#12 0x7faba25bfa86 in webrender::visibility::update_primitive_visibility::hfcd34cd47223268a src/gfx/wr/webrender/src/visibility.rs:434:34
#13 0x7faba25bf3b2 in webrender::visibility::update_primitive_visibility::hfcd34cd47223268a src/gfx/wr/webrender/src/visibility.rs:337:44
#14 0x7faba25bf309 in webrender::visibility::update_primitive_visibility::hfcd34cd47223268a src/gfx/wr/webrender/src/visibility.rs:337:44
#15 0x7faba25bf3b2 in webrender::visibility::update_primitive_visibility::hfcd34cd47223268a src/gfx/wr/webrender/src/visibility.rs:337:44
#16 0x7faba242ee7d in webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::h7abbde2f8f8d0a4e src/gfx/wr/webrender/src/frame_builder.rs:347:13
#17 0x7faba242ee7d in webrender::frame_builder::FrameBuilder::build::h6ec0e1ff8d576e93 src/gfx/wr/webrender/src/frame_builder.rs:502:9
#18 0x7faba24b679e in webrender::render_backend::Document::build_frame::hf749c0b504b95746 src/gfx/wr/webrender/src/render_backend.rs:622:25
#19 0x7faba24c73cd in webrender::render_backend::RenderBackend::update_document::h8c51c808d439f7cf src/gfx/wr/webrender/src/render_backend.rs:1507:41
#20 0x7faba24bde21 in webrender::render_backend::RenderBackend::prepare_transactions::h3c8024283bfb4c7b src/gfx/wr/webrender/src/render_backend.rs:1357:28
#21 0x7faba24bde21 in webrender::render_backend::RenderBackend::process_api_msg::h3c9d3b4f0a1dfc6b src/gfx/wr/webrender/src/render_backend.rs:1217:17
#22 0x7faba22b17ed in webrender::render_backend::RenderBackend::run::h8506c0ad20f763a5 src/gfx/wr/webrender/src/render_backend.rs:892:21
#23 0x7faba22b17ed in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h14fd868c2decd410 src/gfx/wr/webrender/src/renderer.rs:2564:13
#24 0x7faba22b17ed in std::sys_common::backtrace::__rust_begin_short_backtrace::hb923b58588469b20 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:137:18
#25 0x7faba22d023f in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h25acfb4e93949b50 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:464:17
#26 0x7faba22d023f in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h423d6549a48bcb44 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:308:9
#27 0x7faba22d023f in std::panicking::try::do_call::hdd29b4f4c23911e6 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:381:40
#28 0x7faba22d023f in std::panicking::try::h59406bcb282efed2 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:345:19
#29 0x7faba22d023f in std::panic::catch_unwind::h85822dd2828a4422 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:382:14
#30 0x7faba22d023f in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h4f8874e6220b3410 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:463:30
#31 0x7faba22d023f in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h9b31292093927ac9 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5
#32 0x7faba3b86f09 in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::hbb39a3e615f69ef9 /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/alloc/src/boxed.rs:1042:9
#33 0x7faba3b86f09 in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h79630a683aed732c /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/alloc/src/boxed.rs:1042:9
#34 0x7faba3b86f09 in std::sys::unix::thread::Thread::new::thread_start::h4afaeade0da13617 /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/std/src/sys/unix/thread.rs:87:17
#35 0x7fabb759b6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
#36 0x7fabb6579a3e in clone /build/glibc-2ORdQG/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Tyson Smith [:tsmith]]

Attachment: prefs.js

Comment 2

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/Ng5_-w0G6M-Pq9-mquuDdQ/index.html

Comment 3

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Unable to reproduce bug using the following builds:

mozilla-central 20201222215026-be30820869d8
mozilla-central 20201222093533-54a95a4088a2
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 4

[Tyson Smith [:tsmith]]

An updated Pernosco session is available here: https://pernos.co/debug/IKWGI46wfp_si3RSRExfNA/index.html

Comment 5

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Unable to reproduce bug using the following builds:

mozilla-central 20210426213158-6f8320a4798f
mozilla-central 20201222093533-54a95a4088a2
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 6

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Unable to reproduce bug 1683946 using build mozilla-central 20210213095234-6c32d769ff9a. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 8

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Hopefully this testcase works with bugmon.

Comment 9

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Unable to reproduce bug 1683946 using build mozilla-central 20210804035633-4fc8a8759035. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 10

[Jason Kratzer [:jkratzer]]

Not sure why bugmon is failing on this. I can reproduce it locally. I'll investigate.

Comment 11

[Jason Kratzer [:jkratzer]]

Ah, it appears that the testcase is not reproducible on the earliest available build (4fc8a8759035) however it does reproduce on tip. I'll re-enable bugmon and set it to verify once this bug has been fixed.

Comment 12

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Unable to reproduce bug 1683946 using build mozilla-central 20210807092614-7338d7d94091. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 13

[Glenn Watson [:gw]]

Should this be closed now, if bugmon is still unable to repro?

Comment 14

[Tyson Smith [:tsmith]]

I am able to reproduce the issue. I guess bugmon is still failing on this test. Tested with m-c 20221017-ac1330b68d3e.

Comment 15

[Jason Kratzer [:jkratzer]]

The problem appears to be that the most recent testcase does not trigger on the build nearest the date this bug was filed (20211019-1e37fc4a7f53).

Comment 16

[Mayank Bansal]

Got a crash on the latest Nightly from the testcase: https://crash-stats.mozilla.org/report/index/bf69bc2c-6ecb-4449-b526-9c7420221019

Comment 17

[Mayank Bansal]

A mozregression on the the latest testcase points to this:

2022-10-19T08:21:17.703000: DEBUG : Found commit message:
Bug 1749380 - Part 2 - Performance and quality fixes for part 1. r=gfx-reviewers,nical
Differential Revision: https://phabricator.services.mozilla.com/D138982
2022-10-19T08:21:17.709000: INFO : Stopped

Comment 18

[Darkspirit]

comment 8 = bp-a61391fc-1735-4783-b3f7-343200230331 [@ webrender::clip::ClipNode::update ]

Comment 19

[Ryan VanderMeulen [:RyanVM]]

Any chance we can get this in Pernosco, Tyson? We continue to see these crashes in the wild.

Comment 20

[Tyson Smith [:tsmith]]

bugmon should be able to do this for us.

Comment 21

[Tyson Smith [:tsmith]]

Looks like bugmon is MIA.

A Pernosco session is available here: https://pernos.co/debug/6gWtXUyTTPlOGI87qxjX3A/index.html

Comment 22

[Ryan VanderMeulen [:RyanVM]]

Hi Glenn, does the Pernosco trace help narrow this down?

Comment 23

[Darkspirit]

With Flatpak (bug 1653852) I got a slighty different crash.
$ flatpak run --allow=devel org.mozilla.firefox https://bug1683946.bmoattachments.org/attachment.cgi?id=9288209
= bp-34a80c97-7329-426a-95ca-258810230406 [@ euclid::size::Size2D<T>::cast ]
vs.
Nightly binary: bp-eb3c42ff-1df5-4c76-8b0c-921d90230406 [@ webrender::clip::ClipNode::update ]

Comment 24

[Jason Kratzer [:jkratzer]]

(In reply to Tyson Smith [:tsmith] from comment #21)

Looks like bugmon is MIA.

A Pernosco session is available here: https://pernos.co/debug/6gWtXUyTTPlOGI87qxjX3A/index.html

Bugmon never picked this up because the bugmon keyword was missing. It likely wouldn't have been able to get a pernosco session anyway because it never reproduced the testcase using the original rev in comment 0.

Comment 25

[Glenn Watson [:gw]]

Tyson, this seems to be a dup of https://bugzilla.mozilla.org/show_bug.cgi?id=1822677, which has a patch attached. I can repro without that patch but not with it. Are you happy to close as dup, or do you want to leave open for now until that patch lands to confirm?

Comment 26

[Tyson Smith [:tsmith]]

Yeah let's mark it as a dup, thanks.