1713362 - Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at gfx/wr/webrender/src/batch.rs:3236

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Found while fuzzing m-c 20210527-b1d195d012a4 (--enable-debug --enable-fuzzing)

A reduced test case will be attached if one becomes available.

Hit MOZ_CRASH(called Option::unwrap() on a None value) at gfx/wr/webrender/src/batch.rs:3236

#0 0x7f25e8751ae5 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:256:3
#1 0x7f25e8751ae5 in RustMozCrash src/mozglue/static/rust/wrappers.cpp:17:3
#2 0x7f25e8751a94 in mozglue_static::panic_hook::h6daf39e33fe989f9 src/mozglue/static/rust/lib.rs:89:9
#3 0x7f25e87514bb in core::ops::function::Fn::call::haebf2b5154c60ea4 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:70:5
#4 0x7f25e96b143f in std::panicking::rust_panic_with_hook::h01f9d4e9485ccb8b /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/std/src/panicking.rs:595:17
#5 0x7f25e96b0f76 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h25bff4eb752cc444 /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/std/src/panicking.rs:495:13
#6 0x7f25e96ad32b in std::sys_common::backtrace::__rust_end_short_backtrace::h5dfd3f7920e58cc5 /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/std/src/sys_common/backtrace.rs:141:18
#7 0x7f25e96b0f08 in rust_begin_unwind /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/std/src/panicking.rs:493:5
#8 0x7f25dff15e20 in core::panicking::panic_fmt::h5673e42e796a7b06 /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/core/src/panicking.rs:92:14
#9 0x7f25dff15d6c in core::panicking::panic::h20773dbe024b562f /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/core/src/panicking.rs:50:5
#10 0x7f25e7fea1ee in core::option::Option$LT$T$GT$::unwrap::h70dd44cd3aa21a6f /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/option.rs:386:21
#11 0x7f25e7fea1ee in webrender::batch::BatchBuilder::add_segmented_prim_to_batch::he61b58b1056a9695 src/gfx/wr/webrender/src/batch.rs:3233:54
#12 0x7f25e7fdfdd3 in webrender::batch::BatchBuilder::add_prim_to_batch::h6182628adea21ab4 src/gfx/wr/webrender/src/batch.rs:2307:17
#13 0x7f25e7fdc93e in webrender::batch::BatchBuilder::add_pic_to_batch::hdb9a55b810077741 src/gfx/wr/webrender/src/batch.rs:874:17
#14 0x7f25e804d7f7 in webrender::frame_builder::build_render_pass::he2ca4b18ea0daa2e src/gfx/wr/webrender/src/frame_builder.rs:919:9
#15 0x7f25e804d7f7 in webrender::frame_builder::FrameBuilder::build::h5e404cd2eb7b9abe src/gfx/wr/webrender/src/frame_builder.rs:634:28
#16 0x7f25e80c7256 in webrender::render_backend::Document::build_frame::h1dd1a15c4a0d0b3c src/gfx/wr/webrender/src/render_backend.rs:587:25
#17 0x7f25e80db2ad in webrender::render_backend::RenderBackend::update_document::h9cece3c9b55f1c9c src/gfx/wr/webrender/src/render_backend.rs:1493:41
#18 0x7f25e80cc85a in webrender::render_backend::RenderBackend::prepare_transactions::hb0fd06cb4db7d1a3 src/gfx/wr/webrender/src/render_backend.rs:1345:28
#19 0x7f25e80cc85a in webrender::render_backend::RenderBackend::process_api_msg::h6be38f52c2037a62 src/gfx/wr/webrender/src/render_backend.rs:1203:17
#20 0x7f25e7f0e6d9 in webrender::render_backend::RenderBackend::run::h6ac587c177d5b124 src/gfx/wr/webrender/src/render_backend.rs:862:21
#21 0x7f25e7f0e6d9 in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h49431507e1a38a9d src/gfx/wr/webrender/src/renderer/mod.rs:1265:13
#22 0x7f25e7f0e6d9 in std::sys_common::backtrace::__rust_begin_short_backtrace::h17b6c572dd2fab5a /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:125:18
#23 0x7f25e7f2e5ae in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h9de91db91085370e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:474:17
#24 0x7f25e7f2e5ae in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h370812b859f5639a /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:344:9
#25 0x7f25e7f2e5ae in std::panicking::try::do_call::he0556871ba1e61e7 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:379:40
#26 0x7f25e7f2e5ae in std::panicking::try::h7f23e48e5e93cca9 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:343:19
#27 0x7f25e7f2e5ae in std::panic::catch_unwind::ha50a99713e8f36f5 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:431:14
#28 0x7f25e7f2e5ae in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::hfd2d03555e67b4e3 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:473:30
#29 0x7f25e7f2e5ae in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h5f2c848cd165cae7 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5
#30 0x7f25e96c0c79 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h72cc29c4d47b6ef1 /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/alloc/src/boxed.rs:1546:9
#31 0x7f25e96c0c79 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::hb6246b2a6989332b /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/alloc/src/boxed.rs:1546:9
#32 0x7f25e96c0c79 in std::sys::unix::thread::Thread::new::thread_start::h09db1c25841995a6 /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/std/src/sys/unix/thread.rs:71:17
#33 0x7f25f56c7608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
#34 0x7f25f5290292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/in9sZt2MxcEcm4ShXQ28rQ/index.html

Comment 2

[Tyson Smith [:tsmith]]

This was last seen by fuzzers targeting m-c 20211216-646bd6a3104d.