1723228 - Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at gfx/wr/webrender/src/batch.rs:1355

Status: RESOLVED DUPLICATE of bug 1713846

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20210730-1f2953ad605e (--enable-debug --enable-fuzzing). This is only seen by fuzzers on Windows.

Hit MOZ_CRASH(called Option::unwrap() on a None value) at gfx/wr/webrender/src/batch.rs:1355

30|0|xul.dll|RustMozCrash(char const*, int, char const*)|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/wrappers.cpp:1f2953ad605e262ed1cab1851942253bb0e05241|17|0x23
30|1|xul.dll|mozglue_static::panic_hook(core::panic::PanicInfo*)|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/lib.rs:1f2953ad605e262ed1cab1851942253bb0e05241|91|0x7
30|2|xul.dll|core::ops::function::Fn::call<fn(core::panic::PanicInfo*),tuple<core::panic::PanicInfo*>>(void (**)(core::panic::PanicInfo*), core::panic::PanicInfo*)|git:github.com/rust-lang/rust:../53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b/library/core/src/ops/function.rs:53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b|70|0x12
30|3|xul.dll|std::panicking::rust_panic_with_hook()|git:github.com/rust-lang/rust:../53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b//library/std/src/panicking.rs:53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b|595|0x6
30|4|xul.dll|std::panicking::begin_panic_handler::{{closure}}()|git:github.com/rust-lang/rust:../53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b//library/std/src/panicking.rs:53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b|495|0x28
30|5|xul.dll|std::sys_common::backtrace::__rust_end_short_backtrace<closure-0,!>()|git:github.com/rust-lang/rust:../53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b//library/std/src/sys_common/backtrace.rs:53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b|141|0x1b
30|6|xul.dll|std::panicking::begin_panic_handler()|git:github.com/rust-lang/rust:../53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b//library/std/src/panicking.rs:53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b|493|0x19
30|7|xul.dll|core::panicking::panic_fmt()|git:github.com/rust-lang/rust:../53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b//library/core/src/panicking.rs:53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b|92|0x5
30|8|xul.dll|core::panicking::panic()|git:github.com/rust-lang/rust:../53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b//library/core/src/panicking.rs:53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b|50|0x8
30|9|xul.dll|webrender::batch::{{impl}}::add_prim_to_batch::{{closure}}(webrender::batch::{{impl}}::add_prim_to_batch::closure-0*, webrender::internal_types::TextureSource, webrender::glyph_rasterizer::GlyphFormat, slice<webrender::resource_cache::GlyphFetchResult>)|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/batch.rs:1f2953ad605e262ed1cab1851942253bb0e05241|1355|0x18
30|10|xul.dll|webrender::batch::BatchBuilder::add_prim_to_batch(webrender::prim_store::PrimitiveInstance*, webrender::spatial_tree::SpatialNodeIndex, webrender::render_target::RenderTargetContext*, webrender::gpu_cache::GpuCache*, webrender::render_task_graph::RenderTaskGraph*, alloc::vec::Vec<webrender::prim_store::DeferredResolve, alloc::alloc::Global>*, webrender::gpu_types::PrimitiveHeaders*, webrender::gpu_types::TransformPalette*, webrender::spatial_tree::SpatialNodeIndex, webrender::spatial_tree::SpatialNodeIndex, webrender::gpu_types::ZBufferIdGenerator*, webrender::composite::CompositeState*)|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/batch.rs:1f2953ad605e262ed1cab1851942253bb0e05241|1268|0x58
30|11|xul.dll|webrender::batch::BatchBuilder::add_pic_to_batch(webrender::picture::PicturePrimitive*, webrender::render_target::RenderTargetContext*, webrender::gpu_cache::GpuCache*, webrender::render_task_graph::RenderTaskGraph*, alloc::vec::Vec<webrender::prim_store::DeferredResolve, alloc::alloc::Global>*, webrender::gpu_types::PrimitiveHeaders*, webrender::gpu_types::TransformPalette*, webrender::spatial_tree::SpatialNodeIndex, webrender::spatial_tree::SpatialNodeIndex, webrender::gpu_types::ZBufferIdGenerator*, webrender::composite::CompositeState*)|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/batch.rs:1f2953ad605e262ed1cab1851942253bb0e05241|874|0x36
30|12|xul.dll|webrender::frame_builder::FrameBuilder::build(webrender::scene::BuiltScene*, webrender::resource_cache::ResourceCache*, webrender::gpu_cache::GpuCache*, webrender::render_task_graph::RenderTaskGraphBuilder*, webrender::render_backend::FrameStamp, euclid::point::Point2D<i32, webrender_api::units::DevicePixel>, webrender::scene::SceneProperties*, webrender::render_backend::DataStores*, webrender::render_backend::ScratchBuffer*, webrender_api::DebugFlags, webrender::picture::TileCacheLogger*, std::collections::hash::map::HashMap<webrender::picture::SliceId, alloc::boxed::Box<webrender::picture::TileCacheInstance, alloc::alloc::Global>, core::hash::BuildHasherDefault<fxhash::FxHasher>>*, bool, webrender::profiler::TransactionProfile*)|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/frame_builder.rs:1f2953ad605e262ed1cab1851942253bb0e05241|637|0x1bd1
30|13|xul.dll|webrender::render_backend::Document::build_frame(webrender::resource_cache::ResourceCache*, webrender::gpu_cache::GpuCache*, webrender_api::DebugFlags, webrender::picture::TileCacheLogger*, std::collections::hash::map::HashMap<webrender::picture::SliceId, alloc::boxed::Box<webrender::picture::TileCacheInstance, alloc::alloc::Global>, core::hash::BuildHasherDefault<fxhash::FxHasher>>*, core::option::Option<webrender::renderer::FullFrameStats>)|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:1f2953ad605e262ed1cab1851942253bb0e05241|577|0x6f
30|14|xul.dll|webrender::render_backend::RenderBackend::update_document(webrender_api::DocumentId, alloc::vec::Vec<webrender::render_api::ResourceUpdate, alloc::alloc::Global>, alloc::vec::Vec<webrender::render_api::FrameMsg, alloc::alloc::Global>, alloc::vec::Vec<webrender_api::NotificationRequest, alloc::alloc::Global>, bool, core::option::Option<u64>, bool, unsigned int*, bool)|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:1f2953ad605e262ed1cab1851942253bb0e05241|1477|0x2c
30|15|xul.dll|webrender::render_backend::RenderBackend::process_api_msg(webrender::render_api::ApiMsg, unsigned int*)|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:1f2953ad605e262ed1cab1851942253bb0e05241|1187|0x2a7
30|16|xul.dll|std::sys_common::backtrace::__rust_begin_short_backtrace<closure-5,tuple<>>(webrender::renderer::{{impl}}::new::closure-5)|git:github.com/rust-lang/rust:../53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b/library/std/src/sys_common/backtrace.rs:53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b|125|0x62a
30|17|xul.dll|core::ops::function::FnOnce::call_once<closure-0,tuple<>>(std::thread::{{impl}}::spawn_unchecked::closure-0*)|git:github.com/rust-lang/rust:../53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b/library/core/src/ops/function.rs:53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b|227|0x74
30|18|xul.dll|std::sys::windows::thread::{{impl}}::new::thread_start()|git:github.com/rust-lang/rust:../53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b//library/std/src/sys/windows/thread.rs:53cb7b09b00cbea8754ffb78e7e3cb521cb8af4b|56|0x16
30|19|kernel32.dll|guard_check_icall_nop|||0x16024
30|20|xul.dll||||0x7ed1f80
30|21|mozglue.dll|patched_BaseThreadInitThunk(int, void*, void*)|hg:hg.mozilla.org/mozilla-central:mozglue/dllservices/WindowsDllBlocklist.cpp:1f2953ad605e262ed1cab1851942253bb0e05241|588|0x29
30|22|ntdll.dll|guard_check_icall_nop|||0x51641
30|23|KERNELBASE.dll|guard_check_icall_nop|||0x10b050

Comment 1

[Tyson Smith [:tsmith]]

Looks like this was already logged.