Closed Bug 1694780 Opened 3 years ago Closed 3 years ago

Hit MOZ_CRASH(explicit panic) at gfx/wr/webrender/src/render_task.rs:40 (e739b957:51173c95)

Categories

(Core :: Graphics: WebRender, defect)

defect

Tracking

()

RESOLVED FIXED
88 Branch
Tracking Status
firefox88 --- fixed

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase, Whiteboard: [bugmon:confirmed])

Attachments

(2 files)

Attached file testcase.zip

Testcase found while fuzzing mozilla-central rev b3eb91f0b5a7 (built with --enable-debug).

Hit MOZ_CRASH(explicit panic) at gfx/wr/webrender/src/render_task.rs:40 (e739b957:51173c95)

    #0 0x7fd57cee2415 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:254:3
    #1 0x7fd57cee2415 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:17:3
    #2 0x7fd57cee23c4 in mozglue_static::panic_hook::hbbc7bc8518f2f09c /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:89:9
    #3 0x7fd57cee1d9b in core::ops::function::Fn::call::h74ce577ceebae4e6 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:70:5
    #4 0x7fd57deee995 in std::panicking::rust_panic_with_hook::hb27ea14285131c61 /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/std/src/panicking.rs:595:17
    #5 0x7fd57c44e7d5 in std::panicking::begin_panic::_$u7b$$u7b$closure$u7d$$u7d$::hbdf69100a8f1407e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:520:9
    #6 0x7fd57c43ebaf in std::sys_common::backtrace::__rust_end_short_backtrace::hd1a3fee6e894b0e9 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:141:18
    #7 0x7fd57c44e79e in std::panicking::begin_panic::hb947d4f7f515ce0c /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:519:12
    #8 0x7fd57c6252ed in webrender::picture::PicturePrimitive::take_context::h6d166e384094b1c4 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_task.rs
    #9 0x7fd57c632d1e in webrender::prepare::prepare_prim_for_render::h362c35786dfa6192 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:174:23
    #10 0x7fd57c632d1e in webrender::prepare::prepare_primitives::h0f0e776ba10f0f7d /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:118:16
    #11 0x7fd57c5cfcb8 in webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::h266c4397a6e0dd7f /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:479:17
    #12 0x7fd57c5cfcb8 in webrender::frame_builder::FrameBuilder::build::he97e9057bbbcfd2f /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:571:9
    #13 0x7fd57c6592ce in webrender::render_backend::Document::build_frame::he2343d93fff0c4ed /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:622:25
    #14 0x7fd57c669ea7 in webrender::render_backend::RenderBackend::update_document::he42f3d86d2ddc615 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1503:41
    #15 0x7fd57c660606 in webrender::render_backend::RenderBackend::prepare_transactions::hc85c91340bbe6ac7 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1353:28
    #16 0x7fd57c660606 in webrender::render_backend::RenderBackend::process_api_msg::h68b0322d0239fcbc /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1213:17
    #17 0x7fd57c440b4d in webrender::render_backend::RenderBackend::run::h031c3d81b51f8ddd /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:889:21
    #18 0x7fd57c440b4d in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h78785921f24c3e5b /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:1278:13
    #19 0x7fd57c440b4d in std::sys_common::backtrace::__rust_begin_short_backtrace::ha1c6115d5f09754b /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:125:18
    #20 0x7fd57c462159 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h8a21d5b4f8815dfa /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:474:17
    #21 0x7fd57c462159 in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::haf44b2a8608c2080 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:322:9
    #22 0x7fd57c462159 in std::panicking::try::do_call::hb87d5846e8b53b30 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:379:40
    #23 0x7fd57c462159 in std::panicking::try::h0338be5c16956d70 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:343:19
    #24 0x7fd57c462159 in std::panic::catch_unwind::h35071a840a72e312 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:396:14
    #25 0x7fd57c462159 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h8d028a379752c475 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:473:30
    #26 0x7fd57c462159 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h7654f74ec7a6776e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5
    #27 0x7fd57defeda9 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h9ed215ba67984d70 /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/alloc/src/boxed.rs:1328:9
    #28 0x7fd57defeda9 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::hcece06e1fe04906f /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/alloc/src/boxed.rs:1328:9
    #29 0x7fd57defeda9 in std::sys::unix::thread::Thread::new::thread_start::h6e82a4b7be15319a /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/std/src/sys/unix/thread.rs:71:17
    #30 0x7fd589e13608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
    #31 0x7fd5899dc292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Flags: in-testsuite?

Bugmon Analysis:
Unable to reproduce bug using the following builds:

mozilla-central 20210224215151-69be3221f49a
mozilla-central 20210224100119-b3eb91f0b5a7
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon
Whiteboard: [bugmon:confirm] → [bugmon:confirmed]

I can reproduce this in a debug build of changeset b3eb91f0b5a7 on Fedora 33 x86_64.

Before the panic, it says:

[2021-03-02T19:08:54Z ERROR webrender::render_task] Attempting to create a render task of size 35777056x1013118

I needed to change the test case to wait two seconds before calling mozRequestFullScreen, since Firefox was rejecting the full-screen request because the tab was not focused.

Severity: -- → S3
Attached file Revised test case
Flags: needinfo?(gwatson)

I'm unable to reproduce this locally - tried a number of different resolutions / DPI ratios. I end up with what seems to be a huge page (both H and V scrollbars). Jim, since you're able to repro locally, could you perhaps get some more information from take_context in the stack trace? (specifically, it would be interesting to know what the picture composite mode is, and what the inputs are that end up resulting in a rect of that size).

Flags: needinfo?(gwatson)

This is no longer reproducible on m-c, as a result of the recent mix-blend patches that have landed.

Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → 88 Branch
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: