1704844 - Hit MOZ_CRASH(bug: must be allocated) at gfx/wr/webrender/src/render_task_graph.rs:560

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Found while fuzzing m-c 20210408-970ef713fe58 (--enable-debug --enable-fuzzing).

Test cases are unreliable but a Pernosco session will be added shortly.

Hit MOZ_CRASH(bug: must be allocated) at gfx/wr/webrender/src/render_task_graph.rs:560

#0 0x2dcc34332e65 in MOZ_Crash(char const*, int, char const*) src/objdir-ff-debug/dist/include/mozilla/Assertions.h:246:3
#1 0x2dcc34332e65 in RustMozCrash src/mozglue/static/rust/wrappers.cpp:17:3
#2 0x2dcc3433057d in mozglue_static::panic_hook::h8eb0bc61355944f3 src/mozglue/static/rust/lib.rs:89:9
#3 0x2dcc34330e06 in core::ops::function::Fn::call::h42ba0ce96583861e /home/twsmith/.rustup/toolchains/nightly-2020-11-14-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:70:5
#4 0x2dcc3707a205 in std::panicking::rust_panic_with_hook::h55d23fef0ad751bc /rustc/74f7e32f43b5fb0f83896d124566d8242eb786b1/library/std/src/panicking.rs:597:17
#5 0x2dcc33aa19d6 in std::panicking::begin_panic::_$u7b$$u7b$closure$u7d$$u7d$::hfabcb7c21e9eeeaa /home/twsmith/.rustup/toolchains/nightly-2020-11-14-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:522:9
#6 0x2dcc33a9cab6 in std::sys_common::backtrace::__rust_end_short_backtrace::hc3fb93cdb1e4ef32 /home/twsmith/.rustup/toolchains/nightly-2020-11-14-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:141:18
#7 0x2dcc33aa1901 in std::panicking::begin_panic::h4cb3f12b1d91e9bb /home/twsmith/.rustup/toolchains/nightly-2020-11-14-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:521:12
#8 0x2dcc332ce861 in webrender::render_task_graph::RenderTaskGraphBuilder::end_frame::hd5951925381d67e0 src/gfx/wr/webrender/src/render_task_graph.rs:560:67
#9 0x2dcc32d990fd in webrender::frame_builder::FrameBuilder::build::he31caaa576f3b4df src/gfx/wr/webrender/src/frame_builder.rs:596:28
#10 0x2dcc32948178 in webrender::render_backend::Document::build_frame::h20ff04a2fca590fa src/gfx/wr/webrender/src/render_backend.rs:626:25
#11 0x2dcc3294e6d1 in webrender::render_backend::RenderBackend::update_document::h69903460b7cbdd3b src/gfx/wr/webrender/src/render_backend.rs:1553:41
#12 0x2dcc3294dbb3 in webrender::render_backend::RenderBackend::prepare_transactions::ha8924d25383e1bc8 src/gfx/wr/webrender/src/render_backend.rs:1405:28
#13 0x2dcc3294c4fc in webrender::render_backend::RenderBackend::process_api_msg::h53e9e1cf8eab3121 src/gfx/wr/webrender/src/render_backend.rs:1258:17
#14 0x2dcc32949735 in webrender::render_backend::RenderBackend::run::hc7c75aae657c9bd2 src/gfx/wr/webrender/src/render_backend.rs:906:21
#15 0x2dcc33575bdb in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::hd63d99d6a15be748 src/gfx/wr/webrender/src/renderer/mod.rs:1285:13
#16 0x2dcc32cead80 in std::sys_common::backtrace::__rust_begin_short_backtrace::h5ccedc5fd3da42b8 /home/twsmith/.rustup/toolchains/nightly-2020-11-14-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:125:18
#17 0x2dcc32c75181 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h830b7b33c366a85e /home/twsmith/.rustup/toolchains/nightly-2020-11-14-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/mod.rs:474:17
#18 0x2dcc32c71f81 in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hd3516503c67128f5 /home/twsmith/.rustup/toolchains/nightly-2020-11-14-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:322:9
#19 0x2dcc32c770d7 in std::panicking::try::do_call::h8d08b027ceca0620 /home/twsmith/.rustup/toolchains/nightly-2020-11-14-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:381:40
#20 0x2dcc32c75ff1 in std::panicking::try::h79bc1b3ca39ac528 /home/twsmith/.rustup/toolchains/nightly-2020-11-14-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:345:19
#21 0x2dcc32c72711 in std::panic::catch_unwind::hb04e992d939d0545 /home/twsmith/.rustup/toolchains/nightly-2020-11-14-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panic.rs:396:14
#22 0x2dcc32c74f98 in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::hf19ed193228582c1 /home/twsmith/.rustup/toolchains/nightly-2020-11-14-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/thread/mod.rs:473:30
#23 0x2dcc32df849f in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h1c6a975015637c45 /home/twsmith/.rustup/toolchains/nightly-2020-11-14-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5
#24 0x2dcc370892e9 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h9e7afb7a0a438236 /rustc/74f7e32f43b5fb0f83896d124566d8242eb786b1/library/alloc/src/boxed.rs:1307:9
#25 0x2dcc370892e9 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h70c646c4271337a1 /rustc/74f7e32f43b5fb0f83896d124566d8242eb786b1/library/alloc/src/boxed.rs:1307:9
#26 0x2dcc370892e9 in std::sys::unix::thread::Thread::new::thread_start::h35d2b8d36f210d02 /rustc/74f7e32f43b5fb0f83896d124566d8242eb786b1/library/std/src/sys/unix/thread.rs:71:17
#27 0x689a2f6e96da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
#28 0x2dcc16d5b71e in clone /build/glibc-S9d2JN/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/gijZG7NFEO67aRcKT8jZdw/index.html

Comment 2

[Tyson Smith [:tsmith]]

This was last reported by fuzzers a year ago targeting m-c 20210530-1514fcbf80a0.