1714669 - Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at /builds/worker/checkouts/gecko/third_party/rust/euclid/src/point.rs:418

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Found while fuzzing m-c 20210604-f3aa64653924 (--enable-debug --enable-fuzzing)

Hit MOZ_CRASH(called Option::unwrap() on a None value) at /builds/worker/checkouts/gecko/third_party/rust/euclid/src/point.rs:418

#0 0x7f33ec6cc0e5 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:256:3
#1 0x7f33ec6cc0e5 in RustMozCrash src/mozglue/static/rust/wrappers.cpp:17:3
#2 0x7f33ec6cc094 in mozglue_static::panic_hook::h6daf39e33fe989f9 src/mozglue/static/rust/lib.rs:89:9
#3 0x7f33ec6cbabb in core::ops::function::Fn::call::haebf2b5154c60ea4 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:70:5
#4 0x7f33ed62b3ef in std::panicking::rust_panic_with_hook::h01f9d4e9485ccb8b /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/std/src/panicking.rs:595:17
#5 0x7f33ed62af26 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h25bff4eb752cc444 /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/std/src/panicking.rs:495:13
#6 0x7f33ed6272db in std::sys_common::backtrace::__rust_end_short_backtrace::h5dfd3f7920e58cc5 /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/std/src/sys_common/backtrace.rs:141:18
#7 0x7f33ed62aeb8 in rust_begin_unwind /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/std/src/panicking.rs:493:5
#8 0x7f33e3e38260 in core::panicking::panic_fmt::h5673e42e796a7b06 /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/core/src/panicking.rs:92:14
#9 0x7f33e3e381ac in core::panicking::panic::h20773dbe024b562f /rustc/88f19c6dab716c6281af7602e30f413e809c5974/library/core/src/panicking.rs:50:5
#10 0x7f33ebf9b45e in euclid::box2d::Box2D$LT$T$C$U$GT$::cast::h0ed39ee7fecaf09a src/third_party/rust/euclid/src/box2d.rs
#11 0x7f33ebf9b45e in euclid::box2d::Box2D$LT$T$C$U$GT$::to_i32::h85c85eb5029485cb src/third_party/rust/euclid/src/box2d.rs:581:9
#12 0x7f33ebf9b45e in webrender::compositor::sw_compositor::SwSurface::device_bounds::hbcc02e1338cfaf9f src/gfx/wr/webrender/src/compositor/sw_compositor.rs:160:27
#13 0x7f33ebf9b45e in webrender::compositor::sw_compositor::SwCompositor::occlude_surfaces::h97ae850418fc0d07 src/gfx/wr/webrender/src/compositor/sw_compositor.rs:813:30
#14 0x7f33ebf9b45e in _$LT$webrender..compositor..sw_compositor..SwCompositor$u20$as$u20$webrender..composite..Compositor$GT$::start_compositing::h4f7972b0bb36e493 src/gfx/wr/webrender/src/compositor/sw_compositor.rs:1400:9
#15 0x7f33ec0b9ac8 in webrender::renderer::_$LT$impl$u20$webrender..composite..CompositeState$GT$::composite_native::hfa7712c200dc9599 src/gfx/wr/webrender/src/renderer/mod.rs:5965:9
#16 0x7f33ec0b9ac8 in webrender::renderer::Renderer::draw_frame::h599129bae309729d src/gfx/wr/webrender/src/renderer/mod.rs:4407:17
#17 0x7f33ec0a2739 in webrender::renderer::Renderer::render_impl::h385b29511948fa02 src/gfx/wr/webrender/src/renderer/mod.rs:1914:17
#18 0x7f33ec0a08d7 in webrender::renderer::Renderer::render::h5f82311d47fe2151 src/gfx/wr/webrender/src/renderer/mod.rs:1660:30
#19 0x7f33ebe1da77 in wr_renderer_render src/gfx/webrender_bindings/src/bindings.rs:639:11
#20 0x7f33e594a874 in mozilla::wr::RendererOGL::UpdateAndRender(mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, bool*, mozilla::wr::RendererStats*) src/gfx/webrender_bindings/RendererOGL.cpp:186:8
#21 0x7f33e59497d3 in mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> const&, mozilla::TimeStamp const&, bool, mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, bool*) src/gfx/webrender_bindings/RenderThread.cpp:485:31
#22 0x7f33e594911c in mozilla::wr::RenderThread::HandleFrameOneDoc(mozilla::wr::WrWindowId, bool) src/gfx/webrender_bindings/RenderThread.cpp:340:3
#23 0x7f33e5952c5e in applyImpl<mozilla::wr::RenderThread, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, bool), StoreCopyPassByConstLRef<mozilla::wr::WrWindowId>, StoreCopyPassByConstLRef<bool> , 0, 1> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1150:12
#24 0x7f33e5952c5e in apply<mozilla::wr::RenderThread, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, bool)> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1156:12
#25 0x7f33e5952c5e in mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, bool), true, (mozilla::RunnableKind)0, mozilla::wr::WrWindowId, bool>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1203:13
#26 0x7f33e486825c in MessageLoop::RunTask(already_AddRefed<nsIRunnable>) src/ipc/chromium/src/base/message_loop.cc:468:11
#27 0x7f33e4868dd5 in MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&) src/ipc/chromium/src/base/message_loop.cc:477:5
#28 0x7f33e486907a in MessageLoop::DoWork() src/ipc/chromium/src/base/message_loop.cc:552:13
#29 0x7f33e4869a80 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) src/ipc/chromium/src/base/message_pump_default.cc:35:31
#30 0x7f33e4867eb7 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:335:10
#31 0x7f33e4867dd2 in RunHandler src/ipc/chromium/src/base/message_loop.cc:328:3
#32 0x7f33e4867dd2 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:310:3
#33 0x7f33e4875c5f in base::Thread::ThreadMain() src/ipc/chromium/src/base/thread.cc:191:16
#34 0x7f33e48711d9 in ThreadFunc(void*) src/ipc/chromium/src/base/platform_thread_posix.cc:40:13
#35 0x7f33f9471608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
#36 0x7f33f903a292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/zlEd5HAO-ydgi6L-S9GlAg/index.html

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Unable to reproduce bug using build None. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[Jeff Muizelaar [:jrmuizel]]

Tyson, does this still reproduce and is there a test available for this?

Comment 4

[Tyson Smith [:tsmith]]

We don't have a working test case and this was last reported while fuzzing m-c 20211027-b5086513fe50.