1702661 - Hit MOZ_CRASH(assertion failed: self.font_contexts.lock_shared_context().has_font(&font.font_key)) at gfx/wr/webrender/src/glyph_rasterizer/mod.rs:70

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20210326-cad5e739410b (--enable-debug --enable-fuzzing)

Hit MOZ_CRASH(assertion failed: self.font_contexts.lock_shared_context().has_font(&font.font_key)) at gfx/wr/webrender/src/glyph_rasterizer/mod.rs:70

#0 0x7f06ad14bd15 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:246:3
#1 0x7f06ad14bd15 in RustMozCrash src/mozglue/static/rust/wrappers.cpp:17:3
#2 0x7f06ad14bcc4 in mozglue_static::panic_hook::h3ffea86f75ae0747 src/mozglue/static/rust/lib.rs:89:9
#3 0x7f06ad14b69b in core::ops::function::Fn::call::had4c2414fa4ff0d5 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:70:5
#4 0x7f06ae157af5 in std::panicking::rust_panic_with_hook::h71e6a073d87de1f5 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/std/src/panicking.rs:595:17
#5 0x7f06ae1575e6 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::hd549436f6bb6dbb8 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/std/src/panicking.rs:495:13
#6 0x7f06ae1537db in std::sys_common::backtrace::__rust_end_short_backtrace::h4e5f4b72b04174c3 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/std/src/sys_common/backtrace.rs:141:18
#7 0x7f06ae157578 in rust_begin_unwind /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/std/src/panicking.rs:493:5
#8 0x7f06ae1c06f0 in core::panicking::panic_fmt::hcd56f7f635f62c74 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/core/src/panicking.rs:92:14
#9 0x7f06ae1c063c in core::panicking::panic::h07405d6be4bce887 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/core/src/panicking.rs:50:5
#10 0x7f06aca225b3 in webrender::glyph_rasterizer::GlyphRasterizer::request_glyphs::h4204e123b34a7d17 src/gfx/wr/webrender/src/glyph_rasterizer/mod.rs:70:9
#11 0x7f06acb51821 in webrender::resource_cache::ResourceCache::request_glyphs::hb7ae4cf0188dd260 src/gfx/wr/webrender/src/resource_cache.rs:1075:9
#12 0x7f06aca95e32 in webrender::prim_store::text_run::TextRunPrimitive::request_resources::ha13078dcadc4682e src/gfx/wr/webrender/src/prim_store/text_run.rs:469:9
#13 0x7f06aca80bef in webrender::prepare::prepare_interned_prim_for_render::h9af54c418315e6d1 src/gfx/wr/webrender/src/prepare.rs:370:13
#14 0x7f06aca76e3a in webrender::prepare::prepare_prim_for_render::h209ba48b19e4adf2 src/gfx/wr/webrender/src/prepare.rs:248:5
#15 0x7f06aca76e3a in webrender::prepare::prepare_primitives::hb6f8ec48ee1ce6f4 src/gfx/wr/webrender/src/prepare.rs:116:16
#16 0x7f06aca193e4 in webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::h28e2006fd64b8790 src/gfx/wr/webrender/src/frame_builder.rs:480:17
#17 0x7f06aca193e4 in webrender::frame_builder::FrameBuilder::build::h96abc7b333009a95 src/gfx/wr/webrender/src/frame_builder.rs:572:9
#18 0x7f06acaa02a7 in webrender::render_backend::Document::build_frame::h2c2e068aaa76b2ca src/gfx/wr/webrender/src/render_backend.rs:625:25
#19 0x7f06acab1a83 in webrender::render_backend::RenderBackend::update_document::hf32d91e7e7aa8a54 src/gfx/wr/webrender/src/render_backend.rs:1526:41
#20 0x7f06acaa7ce6 in webrender::render_backend::RenderBackend::prepare_transactions::h51608eba19522f94 src/gfx/wr/webrender/src/render_backend.rs:1378:28
#21 0x7f06acaa7ce6 in webrender::render_backend::RenderBackend::process_api_msg::haf62d3c9d16ae515 src/gfx/wr/webrender/src/render_backend.rs:1234:17
#22 0x7f06ac88b7ad in webrender::render_backend::RenderBackend::run::ha973b52bb21082e2 src/gfx/wr/webrender/src/render_backend.rs:905:21
#23 0x7f06ac88b7ad in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h48c56f8a0fcd0e1a src/gfx/wr/webrender/src/renderer/mod.rs:1281:13
#24 0x7f06ac88b7ad in std::sys_common::backtrace::__rust_begin_short_backtrace::ha15bd84dad9f1dc3 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:125:18
#25 0x7f06ac8ad389 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h6844b16081fab287 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:474:17
#26 0x7f06ac8ad389 in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h3212da61736926a3 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:344:9
#27 0x7f06ac8ad389 in std::panicking::try::do_call::hb5cb857f30c65ed7 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:379:40
#28 0x7f06ac8ad389 in std::panicking::try::h26e0339b2e3e66ac /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:343:19
#29 0x7f06ac8ad389 in std::panic::catch_unwind::h398fd3c1a7a47df6 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:431:14
#30 0x7f06ac8ad389 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h3cdd8789b0e21f98 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:473:30
#31 0x7f06ac8ad389 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::haa0410989cb7b6c8 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5
#32 0x7f06ae1680e9 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h61144a2be4ee36d8 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/alloc/src/boxed.rs:1521:9
#33 0x7f06ae1680e9 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::hcf5d395fdd120c17 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/alloc/src/boxed.rs:1521:9
#34 0x7f06ae1680e9 in std::sys::unix::thread::Thread::new::thread_start::hb5e40d3d934ebb7a /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/std/src/sys/unix/thread.rs:71:17
#35 0x7f06ba0af608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
#36 0x7f06b9c78292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Tyson Smith [:tsmith]]

Attachment: prefs.js

Comment 2

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/v3jRqfe0LEQhjz5hDfAY9A/index.html

Comment 3

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210401155139-75221f284379.
The bug appears to have been introduced in the following build range:

Start: 821bbb36f7d37f1e2dd73d193e728712a55c143d (20200707130545)
End: fb2b08c6bc8c320127586fcedb2626e496bf3dcf (20200707213111)
Pushlog: https://hg.mozilla.org/mozilla-unified/pushloghtml?fromchange=821bbb36f7d37f1e2dd73d193e728712a55c143d&tochange=fb2b08c6bc8c320127586fcedb2626e496bf3dcf

Comment 4

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20210326040809-cad5e739410b) but not with tip (mozilla-central 20220128155052-48e8fb0b62c5.)
The bug appears to have been fixed in the following build range:

Start: 9b23d1bb84b2499b94d91c5f588fc93a54e5bdcc (20220124214229)
End: e960e654cbc9f60ce79eb1535fd6ec4e3acc2029 (20220125100058)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=9b23d1bb84b2499b94d91c5f588fc93a54e5bdcc&tochange=e960e654cbc9f60ce79eb1535fd6ec4e3acc2029
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.