Closed Bug 1772555 Opened 2 years ago Closed 2 years ago

Hit MOZ_CRASH(-inf should be between 0 and 1) at gfx/wr/webrender_api/src/color.rs:130

Categories

(Core :: Graphics: WebRender, defect, P3)

x86_64
Linux
defect

Tracking

()

VERIFIED FIXED
103 Branch
Tracking Status
firefox103 --- verified

People

(Reporter: jkratzer, Assigned: emilio)

References

(Blocks 1 open bug)

Details

(Keywords: testcase, Whiteboard: [bugmon:bisected,confirmed], [wptsync upstream])

Attachments

(2 files)

Testcase found while fuzzing mozilla-central rev 2f53c261903e (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 2f53c261903e --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html
Hit MOZ_CRASH(-inf should be between 0 and 1) at gfx/wr/webrender_api/src/color.rs:130

    ==641226==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fe3d5947795 bp 0x7fe3334109e0 sp 0x7fe3334109d0 T641552)
    ==641226==The signal is caused by a WRITE memory access.
    ==641226==Hint: address points to the zero page.
        #0 0x7fe3d5947795 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
        #1 0x7fe3d5947795 in RustMozCrash /mozglue/static/rust/wrappers.cpp:18:3
        #2 0x7fe3d5947714 in mozglue_static::panic_hook::h48e37746cd0167e5 /mozglue/static/rust/lib.rs:91:9
        #3 0x7fe3d594717b in core::ops::function::Fn::call::h97f65c94ad4cad45 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:70:5
        #4 0x7fe3d672e71f in std::panicking::rust_panic_with_hook::habfdcc2e90f9fd4c /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:702:17
        #5 0x7fe3d672e556 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::he054b2a83a51d2cd /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:588:13
        #6 0x7fe3d672b393 in std::sys_common::backtrace::__rust_end_short_backtrace::ha48b94ab49b30915 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:138:18
        #7 0x7fe3d672e288 in rust_begin_unwind /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:584:5
        #8 0x7fe3cc051502 in core::panicking::panic_fmt::h366d3a309ae17c94 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:143:14
        #9 0x7fe3d556f3a9 in _$LT$webrender_api..color..ColorU$u20$as$u20$core..convert..From$LT$webrender_api..color..ColorF$GT$$GT$::from::hae6d048e3435a9a4 /gfx/wr/webrender_api/src/color.rs
        #10 0x7fe3d5490404 in _$LT$T$u20$as$u20$core..convert..Into$LT$U$GT$$GT$::into::h4cc27f9319c5395b /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/convert/mod.rs:550:9
        #11 0x7fe3d5490404 in webrender::scene_building::read_gradient_stops::_$u7b$$u7b$closure$u7d$$u7d$::h595040223285094a /gfx/wr/webrender/src/scene_building.rs:4219:20
        #12 0x7fe3d5490404 in core::ops::function::impls::_$LT$impl$u20$core..ops..function..FnOnce$LT$A$GT$$u20$for$u20$$RF$mut$u20$F$GT$::call_once::h38dcc320fcc1be3c /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:280:13
        #13 0x7fe3d5490404 in core::option::Option$LT$T$GT$::map::h61f82eb5c6db61d1 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/option.rs:912:29
        #14 0x7fe3d5490404 in _$LT$core..iter..adapters..map..Map$LT$I$C$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::next::h0ee20bb2065cc43a /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/iter/adapters/map.rs:103:9
        #15 0x7fe3d5490404 in alloc::vec::Vec$LT$T$C$A$GT$::extend_desugared::hd97ba67d3a2abde7 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/mod.rs:2651:35
        #16 0x7fe3d5490404 in _$LT$alloc..vec..Vec$LT$T$C$A$GT$$u20$as$u20$alloc..vec..spec_extend..SpecExtend$LT$T$C$I$GT$$GT$::spec_extend::h127484b43ed3fe41 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/spec_extend.rs:18:9
        #17 0x7fe3d5490404 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..spec_from_iter_nested..SpecFromIterNested$LT$T$C$I$GT$$GT$::from_iter::h80c168c8648551c3 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/spec_from_iter_nested.rs:43:9
        #18 0x7fe3d5490404 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..spec_from_iter..SpecFromIter$LT$T$C$I$GT$$GT$::from_iter::ha55a3adeece9e429 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/spec_from_iter.rs:33:9
        #19 0x7fe3d5490404 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$core..iter..traits..collect..FromIterator$LT$T$GT$$GT$::from_iter::h0de275b920d294ce /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/mod.rs:2554:9
        #20 0x7fe3d5490404 in core::iter::traits::iterator::Iterator::collect::h1d1f667127319c29 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/iter/traits/iterator.rs:1784:9
        #21 0x7fe3d5490404 in webrender::scene_building::read_gradient_stops::h8d3603446d79f084 /gfx/wr/webrender/src/scene_building.rs:4216:5
        #22 0x7fe3d5478aa6 in webrender::scene_building::SceneBuilder::build_item::h7693e30adc65cc2d /gfx/wr/webrender/src/scene_building.rs:1500:29
        #23 0x7fe3d5470469 in webrender::scene_building::SceneBuilder::build_all::h9bb43e54c2dbcf24 /gfx/wr/webrender/src/scene_building.rs:878:25
        #24 0x7fe3d5469101 in webrender::scene_building::SceneBuilder::build::h8d6643d654f147e4 /gfx/wr/webrender/src/scene_building.rs:583:9
        #25 0x7fe3d5469101 in webrender::scene_builder_thread::SceneBuilderThread::process_transaction::hb2a5cc1ce227c8e1 /gfx/wr/webrender/src/scene_builder_thread.rs:596:25
        #26 0x7fe3d545a0a9 in webrender::scene_builder_thread::SceneBuilderThread::run::_$u7b$$u7b$closure$u7d$$u7d$::h5975bac8fc0fd553 /gfx/wr/webrender/src/scene_builder_thread.rs:313:36
        #27 0x7fe3d545a0a9 in core::iter::adapters::map::map_try_fold::_$u7b$$u7b$closure$u7d$$u7d$::hbc4562643b5e1aab /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/iter/adapters/map.rs:91:28
        #28 0x7fe3d545a0a9 in core::iter::traits::iterator::Iterator::try_fold::h2baa6aeafb3dec67 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/iter/traits/iterator.rs:2186:21
        #29 0x7fe3d545a0a9 in _$LT$core..iter..adapters..map..Map$LT$I$C$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::try_fold::hbd060316b95f5445 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/iter/adapters/map.rs:117:9
        #30 0x7fe3d545a0a9 in _$LT$I$u20$as$u20$alloc..vec..in_place_collect..SpecInPlaceCollect$LT$T$C$I$GT$$GT$::collect_in_place::h8e7554f60d56f6e4 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/in_place_collect.rs:251:13
        #31 0x7fe3d545a0a9 in alloc::vec::in_place_collect::_$LT$impl$u20$alloc..vec..spec_from_iter..SpecFromIter$LT$T$C$I$GT$$u20$for$u20$alloc..vec..Vec$LT$T$GT$$GT$::from_iter::h11f63afba0b3b491 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/in_place_collect.rs:178:19
        #32 0x7fe3d545a0a9 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$core..iter..traits..collect..FromIterator$LT$T$GT$$GT$::from_iter::h533470dbf6736fb0 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/vec/mod.rs:2554:9
        #33 0x7fe3d545a0a9 in core::iter::traits::iterator::Iterator::collect::h49c9ef9d21173782 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/iter/traits/iterator.rs:1784:9
        #34 0x7fe3d545a0a9 in webrender::scene_builder_thread::SceneBuilderThread::run::h2b43e6d7ad7d3af1 /gfx/wr/webrender/src/scene_builder_thread.rs:312:67
        #35 0x7fe3d51aa6e4 in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h2d1260fd2c0ff5f0 /gfx/wr/webrender/src/renderer/mod.rs:1249:13
        #36 0x7fe3d51aa6e4 in std::sys_common::backtrace::__rust_begin_short_backtrace::hbb4bc0105b22947f /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:122:18
        #37 0x7fe3d51c6f2e in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h4f976fea4ce8063f /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/thread/mod.rs:498:17
        #38 0x7fe3d51c6f2e in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hd80c2ff1eb823c0e /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panic/unwind_safe.rs:271:9
        #39 0x7fe3d51c6f2e in std::panicking::try::do_call::h2c47723eb942ab77 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:492:40
        #40 0x7fe3d51c6f2e in std::panicking::try::hfbc5f779a35fbf3e /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:456:19
        #41 0x7fe3d51c6f2e in std::panic::catch_unwind::hbbe28fcec1fdef83 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panic.rs:137:14
        #42 0x7fe3d51c6f2e in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::h9cfff8055ac18565 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/thread/mod.rs:497:30
        #43 0x7fe3d51c6f2e in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h2c86b0061975ddb2 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:227:5
        #44 0x7fe3d6738922 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::ha99802c2c52ada61 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/boxed.rs:1861:9
        #45 0x7fe3d6738922 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::ha39aea1c57e28a15 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/alloc/src/boxed.rs:1861:9
        #46 0x7fe3d6738922 in std::sys::unix::thread::Thread::new::thread_start::h9f8e3d72b1f7662f /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys/unix/thread.rs:108:17
        #47 0x7fe3e2e9a608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
        #48 0x7fe3e2a61132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3 in MOZ_Crash
    ==641226==ABORTING
Attached file Testcase

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220603155506-68727ef04ccf.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: f3aa64653924b1be713882b95438b29a4724ce39 (20210604102111)
End: 2f53c261903ebb5437dcc75c0a2b0b3572f60658 (20220603093350)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

Assigning to you Emilio since per our discussion on the elements you were preparing a patch, If I misunderstood don't hesitate to reassign to me.

Assignee: nobody → emilio
Severity: -- → S3
Priority: -- → P3

:emilio, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Flags: needinfo?(emilio)

Sorry, wrong needinfo because of a bug in the bot.

Flags: needinfo?(emilio)
Flags: needinfo?(emilio)
Flags: needinfo?(emilio)

This ensures they're clamped on Animated -> sRGB conversion, and in the
future we'll have to implement different color spaces so we'll need to
use it anyways.

Pushed by ealvarez@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/003cad9bbcc6
Use style interpolation code for gradients. r=nical
Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/34533 for changes under testing/web-platform/tests
Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed], [wptsync upstream]

Backed out for causing reftest failures on bugs/1315113-1.html.

Push with failures

Failure log

Backout link

Flags: needinfo?(emilio)
Upstream PR was closed without merging
Pushed by ealvarez@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/4ac58cd0b80b
Use style interpolation code for gradients. r=nical
Flags: needinfo?(emilio)
Pushed by emilio@crisal.io:
https://hg.mozilla.org/integration/autoland/rev/89876ebb02dc
Annotate a test as fuzzy as some other neighboring tests.
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 103 Branch
Upstream PR merged by moz-wptsync-bot

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220623035450-d26536dbf462.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: