1872776 - firefox: src/rasterize.h:1157: void draw_perspective_spans(int, Point3D *, Interpolants *, Texture &, Texture &, const ClipRect &) [P = unsigned int]: Assertion `l0.y == r0.y' failed.

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20231125-a137631f73ce (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid> --xvfb

firefox: src/rasterize.h:1157: void draw_perspective_spans(int, Point3D *, Interpolants *, Texture &, Texture &, const ClipRect &) [P = unsigned int]: Assertion `l0.y == r0.y' failed.

#0 0x7f625b6969fc in __pthread_kill_implementation nptl/pthread_kill.c:44:76
#1 0x7f625b6969fc in __pthread_kill_internal nptl/pthread_kill.c:78:10
#2 0x7f625b6969fc in pthread_kill nptl/pthread_kill.c:89:10
#3 0x7f625b642475 in gsignal signal/../sysdeps/posix/raise.c:26:13
#4 0x7f625b6287f2 in abort stdlib/abort.c:79:7
#5 0x7f625b62871a in __assert_fail_base assert/assert.c:92:3
#6 0x7f625b639e95 in __assert_fail assert/assert.c:101:3
#7 0x7f62507fdc7d in draw_perspective_spans<unsigned int> /builds/worker/checkouts/gecko/gfx/wr/swgl/src/rasterize.h:1157:3
#8 0x7f62507fdc7d in draw_perspective_clipped(int, glsl::vec4_scalar*, glsl::vec3*, Texture&, Texture&) /builds/worker/checkouts/gecko/gfx/wr/swgl/src/rasterize.h:1442:5
#9 0x7f62506e9b1e in draw_perspective /builds/worker/checkouts/gecko/gfx/wr/swgl/src/rasterize.h
#10 0x7f62506e9b1e in draw_quad(int, Texture&, Texture&) /builds/worker/checkouts/gecko/gfx/wr/swgl/src/rasterize.h:1559:5
#11 0x7f62506e7757 in draw_elements<unsigned short> /builds/worker/checkouts/gecko/gfx/wr/swgl/src/rasterize.h:1655:5
#12 0x7f62506e7757 in DrawElementsInstanced /builds/worker/checkouts/gecko/gfx/wr/swgl/src/gl.cc:2748:7
#13 0x7f62502c388b in _$LT$gleam..gl..ErrorReactingGl$LT$F$GT$$u20$as$u20$gleam..gl..Gl$GT$::draw_elements_instanced::hdb26ac9c50bfa966 /builds/worker/checkouts/gecko/third_party/rust/gleam/src/gl.rs:98:26
#14 0x7f625044f96b in webrender::device::gl::Device::draw_indexed_triangles_instanced_u16::hcbcaa6a007181441 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/device/gl.rs:3739:9
#15 0x7f6250524dfd in webrender::renderer::Renderer::draw_instanced_batch::h42ecf4aadd612f1c /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:2022:17
#16 0x7f6250529eae in webrender::renderer::Renderer::draw_alpha_batch_container::h577f78d3624776a3 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:2879:17
#17 0x7f6250538651 in webrender::renderer::Renderer::draw_picture_cache_target::he4b3293f336ed580 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:2683:17
#18 0x7f6250538651 in webrender::renderer::Renderer::draw_frame::h624bb9acaf7b8145 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:4645:21
#19 0x7f625051a531 in webrender::renderer::Renderer::render_impl::h37d9ab347444972a /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:1518:17
#20 0x7f625051849b in webrender::renderer::Renderer::render::h535f8fdb2e57c34f /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:1235:30
#21 0x7f62501cdcc7 in wr_renderer_render /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/bindings.rs:619:11
#22 0x7f62482798e2 in mozilla::wr::RendererOGL::UpdateAndRender(mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>> const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char>> const&, bool*, mozilla::wr::RendererStats*) /builds/worker/checkouts/gecko/gfx/webrender_bindings/RendererOGL.cpp:190:19
#23 0x7f62482783a3 in mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> const&, mozilla::TimeStamp const&, bool, mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>> const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char>> const&, bool*) /builds/worker/checkouts/gecko/gfx/webrender_bindings/RenderThread.cpp:781:31
#24 0x7f624827789c in mozilla::wr::RenderThread::HandleFrameOneDocInner(mozilla::wr::WrWindowId, bool, bool, mozilla::Maybe<mozilla::wr::FramePublishId>) /builds/worker/checkouts/gecko/gfx/webrender_bindings/RenderThread.cpp:624:3
#25 0x7f6248276ec3 in HandleFrameOneDoc /builds/worker/checkouts/gecko/gfx/webrender_bindings/RenderThread.cpp:573:3
#26 0x7f6248276ec3 in mozilla::wr::RenderThread::WrNotifierEvent_HandleNewFrameReady(mozilla::wr::WrWindowId, bool, mozilla::wr::FramePublishId) /builds/worker/checkouts/gecko/gfx/webrender_bindings/RenderThread.cpp:534:3
#27 0x7f6248276a52 in mozilla::wr::RenderThread::HandleWrNotifierEvents(mozilla::wr::WrWindowId) /builds/worker/checkouts/gecko/gfx/webrender_bindings/RenderThread.cpp:496:9
#28 0x7f62482841da in operator()<StoreCopyPassByConstLRef<mozilla::wr::WrWindowId> &> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1164:18
#29 0x7f62482841da in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), StoreCopyPassByConstLRef<mozilla::wr::WrWindowId> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
#30 0x7f62482841da in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), StoreCopyPassByConstLRef<mozilla::wr::WrWindowId> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
#31 0x7f62482841da in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<StoreCopyPassByConstLRef<mozilla::wr::WrWindowId> > &, 0UL> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
#32 0x7f62482841da in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1163:9), std::tuple<StoreCopyPassByConstLRef<mozilla::wr::WrWindowId> > &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
#33 0x7f62482841da in apply<mozilla::wr::RenderThread, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId)> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
#34 0x7f62482841da in mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId), true, (mozilla::RunnableKind)0, mozilla::wr::WrWindowId>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1213:13
#35 0x7f6246a637b1 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1193:16
#36 0x7f6246a6a78d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#37 0x7f624773ed8e in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
#38 0x7f6247657591 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#39 0x7f6247657591 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#40 0x7f6246a5ea83 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:370:10
#41 0x7f625b9f6d0f in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#42 0x7f625b694ac2 in start_thread nptl/pthread_create.c:442:8
#43 0x7f625b72665f  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1872776 using build mozilla-central 20231125091605-a137631f73ce. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 2

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/PaSbwfzq0xz5GF5W86VsyQ/index.html

(Collected manually since bugmon was having trouble with it)

Comment 3

[Lee Salzman [:lsalzman]]

Attachment: Bug 1872776 - Avoid multiplying by NaN in draw_perspective. r?aosmond

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5608664350d8
Avoid multiplying by NaN in draw_perspective. r=gfx-reviewers,ahale

Comment 5

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/5608664350d8