1805557 - Hit MOZ_CRASH(assertion failed: !(vecTangent * vecTangent < rLastTangentFuzz)) at /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/bezierflattener.rs:824

Status: NEW

(Core :: Graphics: Canvas2D, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20221213-300b0ac8eb7b (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Hit MOZ_CRASH(assertion failed: !(vecTangent * vecTangent < rLastTangentFuzz)) at /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/bezierflattener.rs:824

#0 0x7f181cb339e5 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7f181cb339e5 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7f181cb33962 in mozglue_static::panic_hook::hd18ed6809dbf28d1 /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:91:9
#3 0x7f181cb3342b in core::ops::function::Fn::call::h07766207557d1e22 /rustc/897e37553bba8b42751c67658967889d11ecd120/library/core/src/ops/function.rs:77:5
#4 0x7f181dbccffc in std::panicking::rust_panic_with_hook::h7b190ce1a948faac /rustc/897e37553bba8b42751c67658967889d11ecd120/library/std/src/panicking.rs:702:17
#5 0x7f181dbcce10 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::hbafbfdc3e1b97f68 /rustc/897e37553bba8b42751c67658967889d11ecd120/library/std/src/panicking.rs:586:13
#6 0x7f181dbc9fbb in std::sys_common::backtrace::__rust_end_short_backtrace::hda93e5fef243b4c0 /rustc/897e37553bba8b42751c67658967889d11ecd120/library/std/src/sys_common/backtrace.rs:138:18
#7 0x7f181dbccb71 in rust_begin_unwind /rustc/897e37553bba8b42751c67658967889d11ecd120/library/std/src/panicking.rs:584:5
#8 0x7f181dc22732 in core::panicking::panic_fmt::h8d17ca1073d9a733 /rustc/897e37553bba8b42751c67658967889d11ecd120/library/core/src/panicking.rs:142:14
#9 0x7f181dc2257c in core::panicking::panic::hf0565452d0d0936c /rustc/897e37553bba8b42751c67658967889d11ecd120/library/core/src/panicking.rs:48:5
#10 0x7f181bc95a0d in aa_stroke::bezierflattener::CBezierFlattener::GetLastTangent::h5e4db97174555b36 /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/bezierflattener.rs:824:5
#11 0x7f181bc95a0d in aa_stroke::bezierflattener::CBezierFlattener::Flatten::ha9a5bd0b24348498 /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/bezierflattener.rs:595:73
#12 0x7f181bc97b08 in aa_stroke::arc_segment_tri::ha9d318ce8ebd7a85 /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/lib.rs:300:5
#13 0x7f181bc994cc in aa_stroke::Stroker::line_to::h82ac83dda19b6fe6 /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/lib.rs:685:21
#14 0x7f181bc99da3 in _$LT$aa_stroke..Stroker..curve_to_internal..Target$u20$as$u20$aa_stroke..bezierflattener..CFlatteningSink$GT$::AcceptPoint::h7b53143fe47151da /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/lib.rs:759:21
#15 0x7f181bc95427 in aa_stroke::bezierflattener::CBezierFlattener::Step::h7bb61c6a3996e529 /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/bezierflattener.rs:654:14
#16 0x7f181bc95427 in aa_stroke::bezierflattener::CBezierFlattener::Flatten::ha9a5bd0b24348498 /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/bezierflattener.rs:571:14
#17 0x7f181bc96f44 in aa_stroke_curve_to /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/c_bindings.rs
#18 0x7f181643ef79 in mozilla::gfx::GenerateStrokeVertexBuffer(mozilla::gfx::QuantizedPath const&, mozilla::gfx::StrokeOptions const*, float, WGR::OutputVertex*, unsigned long) /builds/worker/checkouts/gecko/dom/canvas/DrawTargetWebgl.cpp:2656:11
#19 0x7f181643d28f in mozilla::gfx::DrawTargetWebgl::SharedContext::DrawPathAccel(mozilla::gfx::Path const*, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&, mozilla::gfx::StrokeOptions const*, mozilla::gfx::ShadowOptions const*, bool) /builds/worker/checkouts/gecko/dom/canvas/DrawTargetWebgl.cpp:2863:22
#20 0x7f181643ad6d in mozilla::gfx::DrawTargetWebgl::DrawPath(mozilla::gfx::Path const*, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&, mozilla::gfx::StrokeOptions const*) /builds/worker/checkouts/gecko/dom/canvas/DrawTargetWebgl.cpp:3033:23
#21 0x7f18164415bd in mozilla::gfx::DrawTargetWebgl::Stroke(mozilla::gfx::Path const*, mozilla::gfx::Pattern const&, mozilla::gfx::StrokeOptions const&, mozilla::gfx::DrawOptions const&) /builds/worker/checkouts/gecko/dom/canvas/DrawTargetWebgl.cpp:3287:3
#22 0x7f181646a61e in mozilla::dom::AdjustedTarget::Stroke(mozilla::gfx::Path const*, mozilla::gfx::Pattern const&, mozilla::gfx::StrokeOptions const&, mozilla::gfx::DrawOptions const&) /builds/worker/checkouts/gecko/dom/canvas/CanvasRenderingContext2D.cpp:703:14
#23 0x7f181646a3b3 in mozilla::dom::CanvasRenderingContext2D::Stroke() /builds/worker/checkouts/gecko/dom/canvas/CanvasRenderingContext2D.cpp:2932:10
#24 0x7f1815828190 in mozilla::dom::CanvasRenderingContext2D_Binding::stroke(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/CanvasRenderingContext2DBinding.cpp:3226:28
#25 0x7f1816378132 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3287:13
#26 0x7f181a68c3a6 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:459:13
#27 0x7f181a68bccf in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:547:12
#28 0x7f181a67d90f in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:619:10
#29 0x7f181a67d90f in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3379:16
#30 0x7f181a670fce in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:431:13
#31 0x7f181a68bbcb in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:579:13
#32 0x7f181a68d0fc in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:646:8
#33 0x7f181a74796c in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
#34 0x7f18160780e3 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventListenerBinding.cpp:62:8
#35 0x7f181693cdb6 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
#36 0x7f181693cadc in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1311:43
#37 0x7f181693d789 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1507:17
#38 0x7f1816932736 in HandleEvent /builds/worker/checkouts/gecko/dom/events/EventListenerManager.h:395:5
#39 0x7f1816932736 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:347:17
#40 0x7f1816931c6b in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:549:16
#41 0x7f181693442b in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1122:11
#42 0x7f1816936f06 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp
#43 0x7f1814ebf3db in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:1373:17
#44 0x7f1814a0af16 in nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:4547:28
#45 0x7f1814a0ad15 in nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:4517:10
#46 0x7f1814c41a43 in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/checkouts/gecko/dom/base/Document.cpp:7876:3
#47 0x7f1814cf3078 in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
#48 0x7f1814cf3078 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1168:12
#49 0x7f1814cf3078 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1215:13
#50 0x7f18131e2712 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:140:20
#51 0x7f18131ec9a5 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:539:16
#52 0x7f18131e7f7c in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:852:26
#53 0x7f18131e6b4a in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:684:15
#54 0x7f18131e6ea5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:462:36
#55 0x7f18131f02a6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:188:37
#56 0x7f18131f02a6 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
#57 0x7f1813205c58 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1204:16
#58 0x7f181320c49d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:474:10
#59 0x7f1813dfdfa3 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#60 0x7f1813d22f38 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#61 0x7f1813d22e41 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#62 0x7f1813d22e41 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#63 0x7f1818219348 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:150:27
#64 0x7f181a44709b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:884:20
#65 0x7f1813dfee69 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#66 0x7f1813d22f38 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#67 0x7f1813d22e41 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#68 0x7f1813d22e41 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#69 0x7f181a44662c in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:743:34
#70 0x5583c8919ca0 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#71 0x5583c8919ca0 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:359:18
#72 0x7f18285f6d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#73 0x7f18285f6e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#74 0x5583c88f0308 in _start (/home/user/workspace/browsers/m-c-20221213165020-fuzzing-debug/firefox-bin+0x5b308) (BuildId: 632b23276e3228be633d34f1ac3c66957e03ca4b)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20221213165020-300b0ac8eb7b.
The bug appears to have been introduced in the following build range:

Start: 38ad87bc6f42df650e19616ba8bf27b5d5a68afe (20221203092459)
End: d17c3b5d62f062cb82f540a210afb05ff87f9c70 (20221203213736)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=38ad87bc6f42df650e19616ba8bf27b5d5a68afe&tochange=d17c3b5d62f062cb82f540a210afb05ff87f9c70

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1803604

:lsalzman, since you are the author of the regressor, bug 1803604, could you take a look?

For more information, please visit auto_nag documentation.

Comment 3

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20221213165020-300b0ac8eb7b) but not with tip (mozilla-central 20230317210204-c6b709a45852.)

The bug appears to have been fixed in the following build range:

Start: b8472c1213cb9bf7fd96d1139a9fd15cf10b3bd1 (20230311175853)
End: b8472c1213cb9bf7fd96d1139a9fd15cf10b3bd1 (20230311212417)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b8472c1213cb9bf7fd96d1139a9fd15cf10b3bd1&tochange=b8472c1213cb9bf7fd96d1139a9fd15cf10b3bd1

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 4

[Tyson Smith [:tsmith]]

I am able to reproduce this. Bugmon has been updated since this report so let's retry.

Comment 5

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/CqDI1LJ5JyOuju1p2eVTlQ/index.html

Comment 6

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230519115028-225c5ab0d999.
The bug appears to have been introduced in the following build range:

Start: 38ad87bc6f42df650e19616ba8bf27b5d5a68afe (20221203092459)
End: 63b85eeb214b1166b26019c73d5e1dd67d6a43bf (20221203112756)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=38ad87bc6f42df650e19616ba8bf27b5d5a68afe&tochange=63b85eeb214b1166b26019c73d5e1dd67d6a43bf

Comment 7

[Donal Meehan [:dmeehan]]

:lsalzman looks like there is a missing NI for you. This is still repro based on Comment 6 and regressed by Bug 1803604.
Are the Severity and Priority still accurate? Wondering if this will be looked at during the 115 cycle, or will it be a later release?

Comment 8

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20221213165020-300b0ac8eb7b) but not with tip (mozilla-central 20230527093530-b45b68be3f9b.)

The bug appears to have been fixed in the following build range:

Start: 6aeb0b124f5887237e9c0582197d34d3596842b8 (20230422094547)
End: 59455d15fb58c0e5bcf1a485d11e52904ea3cbff (20230422123310)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6aeb0b124f5887237e9c0582197d34d3596842b8&tochange=59455d15fb58c0e5bcf1a485d11e52904ea3cbff

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 9

[Tyson Smith [:tsmith]]

bugmon is incorrect here, this issue is still reproducible using the attached test case and the fuzzers are still reporting it.

Comment 10

[Donal Meehan [:dmeehan]]

Adding back the needinfo for Comment 7

Comment 11

[Lee Salzman [:lsalzman]]

This is just a debug assert. I don't think it represents anything serious. Jeff?

Comment 12

[Matthew Gaudet (he/him) [:mgaudet]]

Side note, I can also reproduce this on a local build trying to run https://absorb-initial-cost-in-perf-dashboard--speedometer-preview.netlify.app/?developerMode=&tags=webcomponents

Comment 13

[Timothy Nikkel (:tnikkel)]

This is annoying because I hit it running speedometer3 and one has to jump through a few hoops to disable this assert.