Hit MOZ_CRASH(explicit panic) at gfx/wr/webrender/src/render_task.rs:40 (e739b957:51173c95)
Categories
(Core :: Graphics: WebRender, defect)
Tracking
()
Tracking | Status | |
---|---|---|
firefox88 | --- | fixed |
People
(Reporter: jkratzer, Unassigned)
References
(Blocks 2 open bugs)
Details
(Keywords: assertion, testcase, Whiteboard: [bugmon:confirmed])
Attachments
(2 files)
Testcase found while fuzzing mozilla-central rev b3eb91f0b5a7 (built with --enable-debug).
Hit MOZ_CRASH(explicit panic) at gfx/wr/webrender/src/render_task.rs:40 (e739b957:51173c95)
#0 0x7fd57cee2415 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:254:3
#1 0x7fd57cee2415 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:17:3
#2 0x7fd57cee23c4 in mozglue_static::panic_hook::hbbc7bc8518f2f09c /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:89:9
#3 0x7fd57cee1d9b in core::ops::function::Fn::call::h74ce577ceebae4e6 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:70:5
#4 0x7fd57deee995 in std::panicking::rust_panic_with_hook::hb27ea14285131c61 /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/std/src/panicking.rs:595:17
#5 0x7fd57c44e7d5 in std::panicking::begin_panic::_$u7b$$u7b$closure$u7d$$u7d$::hbdf69100a8f1407e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:520:9
#6 0x7fd57c43ebaf in std::sys_common::backtrace::__rust_end_short_backtrace::hd1a3fee6e894b0e9 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:141:18
#7 0x7fd57c44e79e in std::panicking::begin_panic::hb947d4f7f515ce0c /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:519:12
#8 0x7fd57c6252ed in webrender::picture::PicturePrimitive::take_context::h6d166e384094b1c4 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_task.rs
#9 0x7fd57c632d1e in webrender::prepare::prepare_prim_for_render::h362c35786dfa6192 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:174:23
#10 0x7fd57c632d1e in webrender::prepare::prepare_primitives::h0f0e776ba10f0f7d /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:118:16
#11 0x7fd57c5cfcb8 in webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::h266c4397a6e0dd7f /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:479:17
#12 0x7fd57c5cfcb8 in webrender::frame_builder::FrameBuilder::build::he97e9057bbbcfd2f /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:571:9
#13 0x7fd57c6592ce in webrender::render_backend::Document::build_frame::he2343d93fff0c4ed /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:622:25
#14 0x7fd57c669ea7 in webrender::render_backend::RenderBackend::update_document::he42f3d86d2ddc615 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1503:41
#15 0x7fd57c660606 in webrender::render_backend::RenderBackend::prepare_transactions::hc85c91340bbe6ac7 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1353:28
#16 0x7fd57c660606 in webrender::render_backend::RenderBackend::process_api_msg::h68b0322d0239fcbc /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1213:17
#17 0x7fd57c440b4d in webrender::render_backend::RenderBackend::run::h031c3d81b51f8ddd /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:889:21
#18 0x7fd57c440b4d in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h78785921f24c3e5b /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:1278:13
#19 0x7fd57c440b4d in std::sys_common::backtrace::__rust_begin_short_backtrace::ha1c6115d5f09754b /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:125:18
#20 0x7fd57c462159 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h8a21d5b4f8815dfa /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:474:17
#21 0x7fd57c462159 in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::haf44b2a8608c2080 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:322:9
#22 0x7fd57c462159 in std::panicking::try::do_call::hb87d5846e8b53b30 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:379:40
#23 0x7fd57c462159 in std::panicking::try::h0338be5c16956d70 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:343:19
#24 0x7fd57c462159 in std::panic::catch_unwind::h35071a840a72e312 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:396:14
#25 0x7fd57c462159 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h8d028a379752c475 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:473:30
#26 0x7fd57c462159 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h7654f74ec7a6776e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5
#27 0x7fd57defeda9 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h9ed215ba67984d70 /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/alloc/src/boxed.rs:1328:9
#28 0x7fd57defeda9 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::hcece06e1fe04906f /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/alloc/src/boxed.rs:1328:9
#29 0x7fd57defeda9 in std::sys::unix::thread::Thread::new::thread_start::h6e82a4b7be15319a /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/std/src/sys/unix/thread.rs:71:17
#30 0x7fd589e13608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
#31 0x7fd5899dc292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Comment 1•3 years ago
|
||
Bugmon Analysis:
Unable to reproduce bug using the following builds:
mozilla-central 20210224215151-69be3221f49a
mozilla-central 20210224100119-b3eb91f0b5a7
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.
Updated•3 years ago
|
Comment 2•3 years ago
|
||
I can reproduce this in a debug build of changeset b3eb91f0b5a7 on Fedora 33 x86_64.
Before the panic, it says:
[2021-03-02T19:08:54Z ERROR webrender::render_task] Attempting to create a render task of size 35777056x1013118
I needed to change the test case to wait two seconds before calling mozRequestFullScreen
, since Firefox was rejecting the full-screen request because the tab was not focused.
Updated•3 years ago
|
Comment 3•3 years ago
|
||
Updated•3 years ago
|
Comment 4•3 years ago
|
||
I'm unable to reproduce this locally - tried a number of different resolutions / DPI ratios. I end up with what seems to be a huge page (both H and V scrollbars). Jim, since you're able to repro locally, could you perhaps get some more information from take_context
in the stack trace? (specifically, it would be interesting to know what the picture composite mode is, and what the inputs are that end up resulting in a rect of that size).
Comment 5•3 years ago
|
||
This is no longer reproducible on m-c, as a result of the recent mix-blend patches that have landed.
Updated•3 years ago
|
Description
•