Hit MOZ_CRASH(-inf should be between 0 and 1) at gfx/wr/webrender_api/src/color.rs:130
Categories
(Core :: Graphics: WebRender, defect, P3)
Tracking
()
Tracking | Status | |
---|---|---|
firefox103 | --- | verified |
People
(Reporter: jkratzer, Assigned: emilio)
References
(Blocks 1 open bug)
Details
(Keywords: testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])
Attachments
(2 files)
Testcase found while fuzzing mozilla-central rev 2f53c261903e (built with: --enable-debug --enable-fuzzing).
Testcase can be reproduced using the following commands:
$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 2f53c261903e --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html
Hit MOZ_CRASH(-inf should be between 0 and 1) at gfx/wr/webrender_api/src/color.rs:130
==641226==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fe3d5947795 bp 0x7fe3334109e0 sp 0x7fe3334109d0 T641552)
==641226==The signal is caused by a WRITE memory access.
==641226==Hint: address points to the zero page.
#0 0x7fe3d5947795 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7fe3d5947795 in RustMozCrash /mozglue/static/rust/wrappers.cpp:18:3
#2 0x7fe3d5947714 in mozglue_static::panic_hook::h48e37746cd0167e5 /mozglue/static/rust/lib.rs:91:9
#3 0x7fe3d594717b in core::ops::function::Fn::call::h97f65c94ad4cad45 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:70:5
#4 0x7fe3d672e71f in std::panicking::rust_panic_with_hook::habfdcc2e90f9fd4c /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:702:17
#5 0x7fe3d672e556 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::he054b2a83a51d2cd /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:588:13
#6 0x7fe3d672b393 in std::sys_common::backtrace::__rust_end_short_backtrace::ha48b94ab49b30915 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:138:18
#7 0x7fe3d672e288 in rust_begin_unwind /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:584:5
#8 0x7fe3cc051502 in core::panicking::panic_fmt::h366d3a309ae17c94 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:143:14
#9 0x7fe3d556f3a9 in _$LT$webrender_api..color..ColorU$u20$as$u20$core..convert..From$LT$webrender_api..color..ColorF$GT$$GT$::from::hae6d048e3435a9a4 /gfx/wr/webrender_api/src/color.rs
#10 0x7fe3d5490404 in _$LT$T$u20$as$u20$core..convert..Into$LT$U$GT$$GT$::into::h4cc27f9319c5395b /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/convert/mod.rs:550:9
#11 0x7fe3d5490404 in webrender::scene_building::read_gradient_stops::_$u7b$$u7b$closure$u7d$$u7d$::h595040223285094a /gfx/wr/webrender/src/scene_building.rs:4219:20
#12 0x7fe3d5490404 in core::ops::function::impls::_$LT$impl$u20$core..ops..function..FnOnce$LT$A$GT$$u20$for$u20$$RF$mut$u20$F$GT$::call_once::h38dcc320fcc1be3c /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:280:13
#13 0x7fe3d5490404 in core::option::Option$LT$T$GT$::map::h61f82eb5c6db61d1 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/option.rs:912:29
#14 0x7fe3d5490404 in _$LT$core..iter..adapters..map..Map$LT$I$C$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::next::h0ee20bb2065cc43a /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/iter/adapters/map.rs:103:9
#15 0x7fe3d5490404 in alloc::vec::Vec$LT$T$C$A$GT$::extend_desugared::hd97ba67d3a2abde7 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/mod.rs:2651:35
#16 0x7fe3d5490404 in _$LT$alloc..vec..Vec$LT$T$C$A$GT$$u20$as$u20$alloc..vec..spec_extend..SpecExtend$LT$T$C$I$GT$$GT$::spec_extend::h127484b43ed3fe41 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/spec_extend.rs:18:9
#17 0x7fe3d5490404 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..spec_from_iter_nested..SpecFromIterNested$LT$T$C$I$GT$$GT$::from_iter::h80c168c8648551c3 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/spec_from_iter_nested.rs:43:9
#18 0x7fe3d5490404 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..spec_from_iter..SpecFromIter$LT$T$C$I$GT$$GT$::from_iter::ha55a3adeece9e429 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/spec_from_iter.rs:33:9
#19 0x7fe3d5490404 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$core..iter..traits..collect..FromIterator$LT$T$GT$$GT$::from_iter::h0de275b920d294ce /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/mod.rs:2554:9
#20 0x7fe3d5490404 in core::iter::traits::iterator::Iterator::collect::h1d1f667127319c29 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/iter/traits/iterator.rs:1784:9
#21 0x7fe3d5490404 in webrender::scene_building::read_gradient_stops::h8d3603446d79f084 /gfx/wr/webrender/src/scene_building.rs:4216:5
#22 0x7fe3d5478aa6 in webrender::scene_building::SceneBuilder::build_item::h7693e30adc65cc2d /gfx/wr/webrender/src/scene_building.rs:1500:29
#23 0x7fe3d5470469 in webrender::scene_building::SceneBuilder::build_all::h9bb43e54c2dbcf24 /gfx/wr/webrender/src/scene_building.rs:878:25
#24 0x7fe3d5469101 in webrender::scene_building::SceneBuilder::build::h8d6643d654f147e4 /gfx/wr/webrender/src/scene_building.rs:583:9
#25 0x7fe3d5469101 in webrender::scene_builder_thread::SceneBuilderThread::process_transaction::hb2a5cc1ce227c8e1 /gfx/wr/webrender/src/scene_builder_thread.rs:596:25
#26 0x7fe3d545a0a9 in webrender::scene_builder_thread::SceneBuilderThread::run::_$u7b$$u7b$closure$u7d$$u7d$::h5975bac8fc0fd553 /gfx/wr/webrender/src/scene_builder_thread.rs:313:36
#27 0x7fe3d545a0a9 in core::iter::adapters::map::map_try_fold::_$u7b$$u7b$closure$u7d$$u7d$::hbc4562643b5e1aab /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/iter/adapters/map.rs:91:28
#28 0x7fe3d545a0a9 in core::iter::traits::iterator::Iterator::try_fold::h2baa6aeafb3dec67 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/iter/traits/iterator.rs:2186:21
#29 0x7fe3d545a0a9 in _$LT$core..iter..adapters..map..Map$LT$I$C$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::try_fold::hbd060316b95f5445 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/iter/adapters/map.rs:117:9
#30 0x7fe3d545a0a9 in _$LT$I$u20$as$u20$alloc..vec..in_place_collect..SpecInPlaceCollect$LT$T$C$I$GT$$GT$::collect_in_place::h8e7554f60d56f6e4 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/in_place_collect.rs:251:13
#31 0x7fe3d545a0a9 in alloc::vec::in_place_collect::_$LT$impl$u20$alloc..vec..spec_from_iter..SpecFromIter$LT$T$C$I$GT$$u20$for$u20$alloc..vec..Vec$LT$T$GT$$GT$::from_iter::h11f63afba0b3b491 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/in_place_collect.rs:178:19
#32 0x7fe3d545a0a9 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$core..iter..traits..collect..FromIterator$LT$T$GT$$GT$::from_iter::h533470dbf6736fb0 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/mod.rs:2554:9
#33 0x7fe3d545a0a9 in core::iter::traits::iterator::Iterator::collect::h49c9ef9d21173782 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/iter/traits/iterator.rs:1784:9
#34 0x7fe3d545a0a9 in webrender::scene_builder_thread::SceneBuilderThread::run::h2b43e6d7ad7d3af1 /gfx/wr/webrender/src/scene_builder_thread.rs:312:67
#35 0x7fe3d51aa6e4 in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h2d1260fd2c0ff5f0 /gfx/wr/webrender/src/renderer/mod.rs:1249:13
#36 0x7fe3d51aa6e4 in std::sys_common::backtrace::__rust_begin_short_backtrace::hbb4bc0105b22947f /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:122:18
#37 0x7fe3d51c6f2e in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h4f976fea4ce8063f /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/thread/mod.rs:498:17
#38 0x7fe3d51c6f2e in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hd80c2ff1eb823c0e /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panic/unwind_safe.rs:271:9
#39 0x7fe3d51c6f2e in std::panicking::try::do_call::h2c47723eb942ab77 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:492:40
#40 0x7fe3d51c6f2e in std::panicking::try::hfbc5f779a35fbf3e /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:456:19
#41 0x7fe3d51c6f2e in std::panic::catch_unwind::hbbe28fcec1fdef83 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panic.rs:137:14
#42 0x7fe3d51c6f2e in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::h9cfff8055ac18565 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/thread/mod.rs:497:30
#43 0x7fe3d51c6f2e in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h2c86b0061975ddb2 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:227:5
#44 0x7fe3d6738922 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::ha99802c2c52ada61 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/boxed.rs:1861:9
#45 0x7fe3d6738922 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::ha39aea1c57e28a15 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/boxed.rs:1861:9
#46 0x7fe3d6738922 in std::sys::unix::thread::Thread::new::thread_start::h9f8e3d72b1f7662f /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys/unix/thread.rs:108:17
#47 0x7fe3e2e9a608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#48 0x7fe3e2a61132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3 in MOZ_Crash
==641226==ABORTING
Reporter | ||
Comment 1•2 years ago
|
||
Comment 2•2 years ago
|
||
Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220603155506-68727ef04ccf.
Unable to bisect testcase (Testcase reproduces on start build!):
Start: f3aa64653924b1be713882b95438b29a4724ce39 (20210604102111)
End: 2f53c261903ebb5437dcc75c0a2b0b3572f60658 (20220603093350)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)
Comment 3•2 years ago
|
||
Assigning to you Emilio since per our discussion on the elements you were preparing a patch, If I misunderstood don't hesitate to reassign to me.
Comment 4•2 years ago
|
||
:emilio, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.
Assignee | ||
Updated•2 years ago
|
Assignee | ||
Updated•2 years ago
|
Assignee | ||
Comment 6•2 years ago
|
||
This ensures they're clamped on Animated -> sRGB conversion, and in the
future we'll have to implement different color spaces so we'll need to
use it anyways.
Pushed by ealvarez@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/003cad9bbcc6 Use style interpolation code for gradients. r=nical
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/34533 for changes under testing/web-platform/tests
Comment 9•2 years ago
|
||
Backed out for causing reftest failures on bugs/1315113-1.html.
Upstream PR was closed without merging
Comment 11•2 years ago
|
||
Pushed by ealvarez@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/4ac58cd0b80b Use style interpolation code for gradients. r=nical
Assignee | ||
Updated•2 years ago
|
Comment 12•2 years ago
|
||
Pushed by emilio@crisal.io: https://hg.mozilla.org/integration/autoland/rev/89876ebb02dc Annotate a test as fuzzy as some other neighboring tests.
Comment 13•2 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/4ac58cd0b80b
https://hg.mozilla.org/mozilla-central/rev/89876ebb02dc
Upstream PR merged by moz-wptsync-bot
Comment 15•2 years ago
|
||
Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220623035450-d26536dbf462.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Description
•