Open Bug 1711595 Opened 4 years ago Updated 2 years ago

Assertion failure: bytes.length() > sizeof(size_t), at /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:706

Categories

(Core :: Graphics: WebRender, defect, P3)

Product:
Core
Component:
Graphics: WebRender
Type:
defect

Tracking

()

Tracking Flags:
Tracking Status
firefox-esr102 --- affected
firefox90 --- wontfix
firefox108 --- wontfix
firefox109 --- wontfix
firefox110 --- affected

People

(Reporter: tsmith, Unassigned, NeedInfo)

References

(Blocks 2 open bugs)

Details

(Keywords: testcase)

Crash Data

Attachments

(2 files)

testcase.html
229 bytes, text/html
Details
testcase-x86
186 bytes, text/html
Details
Attached file testcase.html —

Found while fuzzing m-c 20210513-9a633c33737c (--enable-address-sanitizer --enable-fuzzing)

To help catch this issue ASAN_OPTIONS=max_allocation_size_mb=512 was used.

Assertion failure: bytes.length() > sizeof(size_t), at /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:706

==16716==WARNING: AddressSanitizer failed to allocate 0x218cefe2 bytes
=================================================================
==16716==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f1aa985e89c bp 0x7fff712b12c0 sp 0x7fff712b0b20 T0)
==16716==The signal is caused by a WRITE memory access.
==16716==Hint: address points to the zero page.
    #0 0x7f1aa985e89c in mozilla::layers::DIGroup::EndGroup(mozilla::layers::WebRenderLayerManager*, nsDisplayListBuilder*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::Grouper*, nsDisplayItem*, nsDisplayItem*) /gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:706:7
    #1 0x7f1aa985b073 in mozilla::layers::Grouper::ConstructGroups(nsDisplayListBuilder*, mozilla::layers::WebRenderCommandBuilder*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::DIGroup*, nsDisplayList*, mozilla::layers::StackingContextHelper const&) /gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1260:17
    #2 0x7f1aa98631e9 in mozilla::layers::WebRenderCommandBuilder::DoGroupingForDisplayList(nsDisplayList*, nsDisplayItem*, nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1522:5
    #3 0x7f1aa9865fcd in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(nsDisplayList*, nsDisplayItem*, nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1691:5
    #4 0x7f1aaf694f43 in nsDisplayWrapList::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, nsDisplayListBuilder*) /gecko/layout/painting/nsDisplayList.cpp:5645:30
    #5 0x7f1aaf6bb988 in nsDisplaySVGWrapper::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, nsDisplayListBuilder*) /gecko/layout/painting/nsDisplayList.cpp:10035:29
    #6 0x7f1aa98682fb in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, nsDisplayListBuilder*) /gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1673:41
    #7 0x7f1aa9866761 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(nsDisplayList*, nsDisplayItem*, nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1796:7
    #8 0x7f1aaf6aa5ea in nsDisplayTransform::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, nsDisplayListBuilder*) /gecko/layout/painting/nsDisplayList.cpp:8097:30
    #9 0x7f1aa98682fb in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, nsDisplayListBuilder*) /gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1673:41
    #10 0x7f1aa9866761 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(nsDisplayList*, nsDisplayItem*, nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1796:7
    #11 0x7f1aaf694f43 in nsDisplayWrapList::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, nsDisplayListBuilder*) /gecko/layout/painting/nsDisplayList.cpp:5645:30
    #12 0x7f1aaf69b617 in nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, nsDisplayListBuilder*) /gecko/layout/painting/nsDisplayList.cpp:6399:22
    #13 0x7f1aa98682fb in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, nsDisplayListBuilder*) /gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1673:41
    #14 0x7f1aa9866761 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(nsDisplayList*, nsDisplayItem*, nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) /gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1796:7
    #15 0x7f1aa986502f in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, nsDisplayList*, nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) /gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1593:5
    #16 0x7f1aa98cbe05 in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(nsDisplayList*, nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double) /gecko/gfx/layers/wr/WebRenderLayerManager.cpp:368:30
    #17 0x7f1aaf672888 in nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /gecko/layout/painting/nsDisplayList.cpp:2504:18
    #18 0x7f1aaef7a2ec in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /gecko/layout/base/nsLayoutUtils.cpp:3492:45
    #19 0x7f1aaee8fddf in mozilla::PresShell::Paint(nsView*, nsRegion const&, mozilla::PaintFlags) /gecko/layout/base/PresShell.cpp:6399:5
    #20 0x7f1aae875d65 in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /gecko/view/nsViewManager.cpp:459:18
    #21 0x7f1aae87547f in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /gecko/view/nsViewManager.cpp:394:22
    #22 0x7f1aae87743d in nsViewManager::ProcessPendingUpdates() /gecko/view/nsViewManager.cpp:972:5
    #23 0x7f1aaee0da2c in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /gecko/layout/base/nsRefreshDriver.cpp:2431:11
    #24 0x7f1aaee18837 in TickDriver /gecko/layout/base/nsRefreshDriver.cpp:346:13
    #25 0x7f1aaee18837 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /gecko/layout/base/nsRefreshDriver.cpp:324:7
    #26 0x7f1aaee1859d in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /gecko/layout/base/nsRefreshDriver.cpp:340:5
    #27 0x7f1aaee18325 in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /gecko/layout/base/nsRefreshDriver.cpp:773:5
    #28 0x7f1aaee1792f in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /gecko/layout/base/nsRefreshDriver.cpp:702:16
    #29 0x7f1aaee16ee9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /gecko/layout/base/nsRefreshDriver.cpp:615:7
    #30 0x7f1aaee16661 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /gecko/layout/base/nsRefreshDriver.cpp:536:9
    #31 0x7f1aae070a77 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /gecko/dom/ipc/VsyncChild.cpp:68:15
    #32 0x7f1aa8b6205c in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
    #33 0x7f1aa87fee66 in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6008:32
    #34 0x7f1aa8280caa in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /gecko/ipc/glue/MessageChannel.cpp:2152:25
    #35 0x7f1aa827d3d8 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /gecko/ipc/glue/MessageChannel.cpp:2076:9
    #36 0x7f1aa827ed35 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /gecko/ipc/glue/MessageChannel.cpp:1924:3
    #37 0x7f1aa827f89b in mozilla::ipc::MessageChannel::MessageTask::Run() /gecko/ipc/glue/MessageChannel.cpp:1955:13
    #38 0x7f1aa70e79f2 in mozilla::RunnableTask::Run() /gecko/xpcom/threads/TaskController.cpp:482:16
    #39 0x7f1aa70b4480 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:766:26
    #40 0x7f1aa70b1f87 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /gecko/xpcom/threads/TaskController.cpp:621:15
    #41 0x7f1aa70b23dd in mozilla::TaskController::ProcessPendingMTTask(bool) /gecko/xpcom/threads/TaskController.cpp:405:36
    #42 0x7f1aa70f1a21 in operator() /gecko/xpcom/threads/TaskController.cpp:138:37
    #43 0x7f1aa70f1a21 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() /gecko/xpcom/threads/nsThreadUtils.h:534:5
    #44 0x7f1aa70ced68 in nsThread::ProcessNextEvent(bool, bool*) /gecko/xpcom/threads/nsThread.cpp:1159:16
    #45 0x7f1aa70d9b1c in NS_ProcessNextEvent(nsIThread*, bool) /gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #46 0x7f1aa828842f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /gecko/ipc/glue/MessagePump.cpp:85:21
    #47 0x7f1aa8190661 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #48 0x7f1aa8190661 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #49 0x7f1aa8190661 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #50 0x7f1aae927d97 in nsBaseAppShell::Run() /gecko/widget/nsBaseAppShell.cpp:137:27
    #51 0x7f1ab2b7877f in XRE_RunAppShell() /gecko/toolkit/xre/nsEmbedFunctions.cpp:911:20
    #52 0x7f1aa8190661 in RunInternal /gecko/ipc/chromium/src/base/message_loop.cc:335:10
    #53 0x7f1aa8190661 in RunHandler /gecko/ipc/chromium/src/base/message_loop.cc:328:3
    #54 0x7f1aa8190661 in MessageLoop::Run() /gecko/ipc/chromium/src/base/message_loop.cc:310:3
    #55 0x7f1ab2b78158 in XRE_InitChildProcess(int, char**, XREChildData const*) /gecko/toolkit/xre/nsEmbedFunctions.cpp:743:34
    #56 0x560d27caa61d in content_process_main(mozilla::Bootstrap*, int, char**) /gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #57 0x560d27caaa4d in main /gecko/browser/app/nsBrowserApp.cpp:313:18
    #58 0x7f1ac87290b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #59 0x560d27bfb919 in _start (/home/worker/builds/m-c-20210514033445-fuzzing-asan-opt/firefox+0x5b919)
Flags: in-testsuite?

A Pernosco session is available here: https://pernos.co/debug/8Ya9zPy81PDDPP5DxnV5gA/index.html

It looks like we're ending up with a recording that has an index entry but no Moz2D recording data. Presumably because of a filter that doesn't paint. It shouldn't be too hard to fix.

Flags: needinfo?(jmuizelaar)
Severity: -- → S3
Priority: -- → P3
Attached file testcase-x86 —

This is much easier to trigger with a 32-bit build. This test case is much more reliable but only works on 32-bit builds.

Found on crash-stats: bp-6764ee81-feab-4c94-aa2c-cf7b60221228

Blocks: wr-oom
Crash Signature: [@ OOM | unknown | mozilla::layers::DIGroup::EndGroup ]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: