1725575 - Crash in [@ std::collections::hash::map::HashMap<T>::entry | webrender::prim_store::gradient::linear::LinearGradientTemplate::update]

Status: NEW

(Core :: Graphics: WebRender, defect)

Description

[Julien Cristau [:jcristau]]

Crash report: https://crash-stats.mozilla.org/report/index/21587801-fddf-448c-b110-dcad10210813

Reason: SIGSEGV /SEGV_ACCERR

Top 10 frames of crashing thread:

0 libxul.so std::collections::hash::map::HashMap<K, V, S>::entry /build/rustc-bpWQIb/rustc-1.47.0+dfsg1+llvm/library/std/src/collections/hash/map.rs:659
1 libxul.so webrender::prim_store::gradient::linear::LinearGradientTemplate::update /build/firefox-O8T03n/firefox-90.0.2+build1/gfx/wr/webrender/src/prim_store/gradient/linear.rs:530
2 libxul.so webrender::prepare::prepare_interned_prim_for_render /build/firefox-O8T03n/firefox-90.0.2+build1/gfx/wr/webrender/src/prepare.rs:684
3 libxul.so webrender::prepare::prepare_primitives /build/firefox-O8T03n/firefox-90.0.2+build1/gfx/wr/webrender/src/prepare.rs:112
4 libxul.so webrender::frame_builder::FrameBuilder::build /build/firefox-O8T03n/firefox-90.0.2+build1/gfx/wr/webrender/src/frame_builder.rs:571
5 libxul.so webrender::render_backend::Document::build_frame /build/firefox-O8T03n/firefox-90.0.2+build1/gfx/wr/webrender/src/render_backend.rs:573
6 libxul.so webrender::render_backend::RenderBackend::update_document /build/firefox-O8T03n/firefox-90.0.2+build1/gfx/wr/webrender/src/render_backend.rs:1473
7 libxul.so webrender::render_backend::RenderBackend::process_api_msg /build/firefox-O8T03n/firefox-90.0.2+build1/gfx/wr/webrender/src/render_backend.rs:1183
8 libxul.so std::sys_common::backtrace::__rust_begin_short_backtrace /build/rustc-bpWQIb/rustc-1.47.0+dfsg1+llvm/library/std/src/sys_common/backtrace.rs:137
9 libxul.so core::ops::function::FnOnce::call_once{{vtable.shim}} /build/rustc-bpWQIb/rustc-1.47.0+dfsg1+llvm/library/core/src/ops/function.rs:227

This signature seems to have appeared in 90, on linux32.

Comment 1

[raycy.jp]

Similar?
bp-fc5018df-4e65-4744-8ef0-3a9120210919

Comment 2

[raycy.jp]

how about bp-fc5ef9f6-d1dc-4792-a9b8-cfc7a0210918

Comment 3

[raycy.jp]

bp-aa01d811-38ae-4730-8fe5-dcd900210917

Comment 4

[Jim Mathies [:jimm]]

Linux only crash, happens in the parent so it brings down the browser. Not high volume, and hasn't shown up since 92 release.

https://crash-stats.mozilla.org/signature/?product=Firefox&signature=std%3A%3Acollections%3A%3Ahash%3A%3Amap%3A%3AHashMap%3CT%3E%3A%3Aentry%20%7C%20webrender%3A%3Aprim_store%3A%3Agradient%3A%3Alinear%3A%3ALinearGradientTemplate%3A%3Aupdate&date=%3E%3D2021-09-09T19%3A50%3A00.000Z&date=%3C2021-09-23T19%3A50%3A00.000Z

Comment 5

[Darkspirit]

(In reply to raycy.jp from comment #3)
On which websites do you encounter this crash?

Comment 6

[Jeff Muizelaar [:jrmuizel]]

The next step here is probably to take a close look at the crashing address to figure out what's going on.

Comment 7

[Andrew Osmond [:aosmond] (he/him)]

This only seems to happen on builds produced by Ubuntu/Ubuntu derivatives. I don't see a single crash for our own builds. I suspect there is a build environment issue here.

Comment 8

[Andrew Osmond [:aosmond] (he/him)]

jrmuizel reminded me that they likely build without SSE2 and we get x87 floating point.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 5 desktop browser crashes on Linux on beta

For more information, please visit auto_nag documentation.

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit auto_nag documentation.

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 5 desktop browser crashes on Linux on beta

For more information, please visit auto_nag documentation.

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit auto_nag documentation.

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 5 desktop browser crashes on Linux on beta

For more information, please visit auto_nag documentation.

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

Based on the topcrash criteria, the crash signature linked to this bug is not a topcrash signature anymore.

For more information, please visit auto_nag documentation.

Comment 15

[Gabriele Svelto [:gsvelto]]

Adjusting signature in preparation for bug 1795651.