1704321 - Hit MOZ_CRASH(bug: should always map as axis-aligned) at gfx/wr/webrender/src/batch.rs:3659

Status: VERIFIED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

First found while fuzzing m-c 20210410-f84605e6fc8b (--enable-debug --enable-fuzzing)

Hit MOZ_CRASH(bug: should always map as axis-aligned) at gfx/wr/webrender/src/batch.rs:3659

#0 0x7f042a085de5 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:246:3
#1 0x7f042a085de5 in RustMozCrash src/mozglue/static/rust/wrappers.cpp:17:3
#2 0x7f042a085d94 in mozglue_static::panic_hook::h99e59ae8464cffce src/mozglue/static/rust/lib.rs:89:9
#3 0x7f042a08576b in core::ops::function::Fn::call::hb3ebde122b59edf5 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:70:5
#4 0x7f042b0921e5 in std::panicking::rust_panic_with_hook::h71e6a073d87de1f5 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/std/src/panicking.rs:595:17
#5 0x7f042b091d06 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::hd549436f6bb6dbb8 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/std/src/panicking.rs:497:13
#6 0x7f042b08decb in std::sys_common::backtrace::__rust_end_short_backtrace::h4e5f4b72b04174c3 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/std/src/sys_common/backtrace.rs:141:18
#7 0x7f042b091c68 in rust_begin_unwind /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/std/src/panicking.rs:493:5
#8 0x7f042b0fade0 in core::panicking::panic_fmt::hcd56f7f635f62c74 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/core/src/panicking.rs:92:14
#9 0x7f042b0fa9c2 in core::option::expect_failed::h5086d7196b9e2f90 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/core/src/option.rs:1292:5
#10 0x7f04298ee48c in core::option::Option$LT$T$GT$::expect::hbd2d1d4b498576ec /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/option.rs:349:21
#11 0x7f04298ee48c in webrender::batch::ClipBatcher::add::_$u7b$$u7b$closure$u7d$$u7d$::hb26e0c85d04aec23 src/gfx/wr/webrender/src/batch.rs:3657:34
#12 0x7f04299f3e23 in webrender::batch::ClipBatcher::add::hdd10690159abcecd src/gfx/wr/webrender/src/batch.rs:3710:37
#13 0x7f04299f3e23 in _$LT$webrender..render_target..AlphaRenderTarget$u20$as$u20$webrender..render_target..RenderTarget$GT$::add_task::he7d26cdde5f3244b src/gfx/wr/webrender/src/render_target.rs:527:36
#14 0x7f042994f975 in webrender::frame_builder::build_render_pass::h33a1c2dfa2cc36df src/gfx/wr/webrender/src/frame_builder.rs:819:29
#15 0x7f042994f975 in webrender::frame_builder::FrameBuilder::build::h03e96151a871ad8c src/gfx/wr/webrender/src/frame_builder.rs:634:28
#16 0x7f04299d55a7 in webrender::render_backend::Document::build_frame::hedd819f6a2bb42f9 src/gfx/wr/webrender/src/render_backend.rs:626:25
#17 0x7f04299e6d53 in webrender::render_backend::RenderBackend::update_document::h3261e84ba2b4aec0 src/gfx/wr/webrender/src/render_backend.rs:1553:41
#18 0x7f04299dcf86 in webrender::render_backend::RenderBackend::prepare_transactions::hc00182363586dcd4 src/gfx/wr/webrender/src/render_backend.rs:1405:28
#19 0x7f04299dcf86 in webrender::render_backend::RenderBackend::process_api_msg::h5b28bd2de2afdd0a src/gfx/wr/webrender/src/render_backend.rs:1258:17
#20 0x7f04297be549 in webrender::render_backend::RenderBackend::run::h7f4cbbe2ecba02a2 src/gfx/wr/webrender/src/render_backend.rs:906:21
#21 0x7f04297be549 in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h17544c4b55264a8e src/gfx/wr/webrender/src/renderer/mod.rs:1285:13
#22 0x7f04297be549 in std::sys_common::backtrace::__rust_begin_short_backtrace::ha1d3b7e6a58e9161 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:125:18
#23 0x7f04297dfee9 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::hca00fb971ab6655f /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:474:17
#24 0x7f04297dfee9 in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h8bb23e0206900091 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:344:9
#25 0x7f04297dfee9 in std::panicking::try::do_call::hf6798e7b0859edca /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:379:40
#26 0x7f04297dfee9 in std::panicking::try::ha37a570903fe5af9 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:343:19
#27 0x7f04297dfee9 in std::panic::catch_unwind::h4c53a488c053c07d /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:431:14
#28 0x7f04297dfee9 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h2f8650268659bc1e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:473:30
#29 0x7f04297dfee9 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h0d2fc460a30ad122 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5
#30 0x7f042b0a27d9 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h61144a2be4ee36d8 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/alloc/src/boxed.rs:1521:9
#31 0x7f042b0a27d9 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::hcf5d395fdd120c17 /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/alloc/src/boxed.rs:1521:9
#32 0x7f042b0a27d9 in std::sys::unix::thread::Thread::new::thread_start::hb5e40d3d934ebb7a /rustc/2fd73fabe469357a12c2c974c140f67e7cdd76d0/library/std/src/sys/unix/thread.rs:71:17
#33 0x7f0437519608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
#34 0x7f04370e2292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210410214333-0ea49daf534f.
The bug appears to have been introduced in the following build range:

Start: 3a4f4d99eb21080af52e408da7b60885140136d2 (20210409225536)
End: 21c7387d8d86a5277d339632fc31b0a1b410786a (20210409231013)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=3a4f4d99eb21080af52e408da7b60885140136d2&tochange=21c7387d8d86a5277d339632fc31b0a1b410786a

Comment 2

[Mayank Bansal]

got a crash from the testcase :https://crash-stats.mozilla.org/report/index/40e7d8c6-1e1d-47c6-8564-2065f0210411

Comment 3

[Lee Salzman [:lsalzman]]

Attachment: Bug 1704321 - Handle non-invertible clip transforms for image clip masks. r?gw

Not all transforms we encounter for image clip masks are invertible. When the unmap of the
world rect back to the local rect fails, we can safely fall back to using a scissor rect.
Skipping the scissor rect is an optimization and is not needed for correctness.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8f77fe5d56b2
Handle non-invertible clip transforms for image clip masks. r=gfx-reviewers,bradwerth

Comment 6

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/8f77fe5d56b2

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20210413035647-d68cc4d521d9.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1682195