Closed Bug 1695814 Opened 3 years ago Closed 2 years ago

Hit MOZ_CRASH(bug: get_target_rect called before allocating) at gfx/wr/webrender/src/render_task.rs:1425

Categories

(Core :: Graphics: WebRender, defect, P3)

defect

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox88 --- affected

People

(Reporter: tsmith, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, crash)

The fuzzers started hitting this with m-c 20210226-cb97abb15942. The test cases are not reducing very well and are reporting multiple assertions.

Hit MOZ_CRASH(bug: get_target_rect called before allocating) at gfx/wr/webrender/src/render_task.rs:1425

#0 0x7f8b645b8be5 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:254:3
#1 0x7f8b645b8be5 in RustMozCrash src/mozglue/static/rust/wrappers.cpp:17:3
#2 0x7f8b645b8b94 in mozglue_static::panic_hook::hbbc7bc8518f2f09c src/mozglue/static/rust/lib.rs:89:9
#3 0x7f8b645b856b in core::ops::function::Fn::call::h74ce577ceebae4e6 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:70:5
#4 0x7f8b655c5085 in std::panicking::rust_panic_with_hook::hb27ea14285131c61 /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/std/src/panicking.rs:595:17
#5 0x7f8b63b8fd05 in std::panicking::begin_panic::_$u7b$$u7b$closure$u7d$$u7d$::hbdf69100a8f1407e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:520:9
#6 0x7f8b63b806ef in std::sys_common::backtrace::__rust_end_short_backtrace::hd1a3fee6e894b0e9 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:141:18
#7 0x7f8b63b8fcce in std::panicking::begin_panic::hb947d4f7f515ce0c /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:519:12
#8 0x7f8b63dbb5ba in webrender::render_task::RenderTask::get_target_rect::h59c942dddb5a2d20 src/gfx/wr/webrender/src/render_task.rs:1425:17
#9 0x7f8b63dbb5ba in webrender::render_task_graph::RenderTaskGraphBuilder::end_frame::hc196024e24d6e1cc src/gfx/wr/webrender/src/render_task_graph.rs:626:31
#10 0x7f8b63d11b5b in webrender::frame_builder::FrameBuilder::build::h0bdbf9dfa48a90e6 src/gfx/wr/webrender/src/frame_builder.rs:593:28
#11 0x7f8b63d957ae in webrender::render_backend::Document::build_frame::he2343d93fff0c4ed src/gfx/wr/webrender/src/render_backend.rs:622:25
#12 0x7f8b63da66cb in webrender::render_backend::RenderBackend::update_document::he42f3d86d2ddc615 src/gfx/wr/webrender/src/render_backend.rs:1508:41
#13 0x7f8b63d9cab6 in webrender::render_backend::RenderBackend::prepare_transactions::hc85c91340bbe6ac7 src/gfx/wr/webrender/src/render_backend.rs:1362:28
#14 0x7f8b63d9cab6 in webrender::render_backend::RenderBackend::process_api_msg::h68b0322d0239fcbc src/gfx/wr/webrender/src/render_backend.rs:1218:17
#15 0x7f8b63b826ad in webrender::render_backend::RenderBackend::run::h031c3d81b51f8ddd src/gfx/wr/webrender/src/render_backend.rs:894:21
#16 0x7f8b63b826ad in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h78785921f24c3e5b src/gfx/wr/webrender/src/renderer/mod.rs:1278:13
#17 0x7f8b63b826ad in std::sys_common::backtrace::__rust_begin_short_backtrace::ha1c6115d5f09754b /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:125:18
#18 0x7f8b63ba34f9 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h8a21d5b4f8815dfa /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:474:17
#19 0x7f8b63ba34f9 in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::haf44b2a8608c2080 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:322:9
#20 0x7f8b63ba34f9 in std::panicking::try::do_call::hb87d5846e8b53b30 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:379:40
#21 0x7f8b63ba34f9 in std::panicking::try::h0338be5c16956d70 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:343:19
#22 0x7f8b63ba34f9 in std::panic::catch_unwind::h35071a840a72e312 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:396:14
#23 0x7f8b63ba34f9 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h8d028a379752c475 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:473:30
#24 0x7f8b63ba34f9 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h7654f74ec7a6776e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5
#25 0x7f8b655d5499 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h9ed215ba67984d70 /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/alloc/src/boxed.rs:1328:9
#26 0x7f8b655d5499 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::hcece06e1fe04906f /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/alloc/src/boxed.rs:1328:9
#27 0x7f8b655d5499 in std::sys::unix::thread::Thread::new::thread_start::h6e82a4b7be15319a /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b/library/std/src/sys/unix/thread.rs:71:17
#28 0x7f8b791216da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
#29 0x7f8b780ffa3e in clone /build/glibc-2ORdQG/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

A Pernosco session is available here: https://pernos.co/debug/VWP7zbNaqalo1CMWgARSOw/index.html

Other assertion we are seeing which seem to be related is:

Hit MOZ_CRASH(assertion failed: task.children.is_empty()) at gfx/wr/webrender/src/render_task_graph.rs:746

Blocks: domino
Blocks: gfx-triage
Severity: -- → S4
Priority: -- → P3
See Also: → 1695016
No longer blocks: gfx-triage

This was last reported by fuzzers a year ago targeting m-c 20210530-007ed77b9cf0.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.