1877585 - Hit MOZ_CRASH(Unable to find a bin for 2816x0!) at gfx/wr/webrender/src/texture_pack/guillotine.rs:29

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20240124-150dd33322ea (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(Unable to find a bin for 2816x0!) at gfx/wr/webrender/src/texture_pack/guillotine.rs:29

#0 0x7fa100a1a695 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:301:3
#1 0x7fa100a1a695 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7fa100a19f81 in mozglue_static::panic_hook::hcde8c41b666cd4bd /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:96:9
#3 0x7fa100a19f81 in core::ops::function::Fn::call::hbc1a9607fd1e5256 /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/core/src/ops/function.rs:79:5
#4 0x7fa101a40557 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::h1f8f335eaa9cfaee /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/alloc/src/boxed.rs:2021:9
#5 0x7fa101a40557 in std::panicking::rust_panic_with_hook::h2b5517d590cab22e /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/std/src/panicking.rs:783:13
#6 0x7fa101a402ad in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h233112c06e0ef43e /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/std/src/panicking.rs:657:13
#7 0x7fa101a3d865 in std::sys_common::backtrace::__rust_end_short_backtrace::h6e893f24d7ebbff8 /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/std/src/sys_common/backtrace.rs:170:18
#8 0x7fa101a40011 in rust_begin_unwind /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/std/src/panicking.rs:645:5
#9 0x7fa101a8c894 in core::panicking::panic_fmt::hbf0e066aabfa482c /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/core/src/panicking.rs:72:14
#10 0x7fa100666b86 in webrender::texture_pack::guillotine::FreeListBin::for_size::_$u7b$$u7b$closure$u7d$$u7d$::h8cb9a95b88e3558c /builds/worker/checkouts/gecko/gfx/wr/webrender/src/texture_pack/guillotine.rs:29:32
#11 0x7fa100666b86 in core::option::Option$LT$T$GT$::unwrap_or_else::h982f0d4c2af7507b /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/core/src/option.rs:976:21
#12 0x7fa100666b86 in webrender::texture_pack::guillotine::FreeListBin::for_size::h3a6cf8bfb8baefe4 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/texture_pack/guillotine.rs:29:14
#13 0x7fa100666b86 in webrender::texture_pack::guillotine::GuillotineAllocator::push::hfdced32b08486e5a /builds/worker/checkouts/gecko/gfx/wr/webrender/src/texture_pack/guillotine.rs:99:18
#14 0x7fa1005a96e0 in webrender::texture_pack::guillotine::GuillotineAllocator::new::h692e6d4e42acf891 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/texture_pack/guillotine.rs:89:13
#15 0x7fa1005a96e0 in webrender::render_task_graph::RenderTaskGraphBuilder::end_frame::h8dadc904d44e9aa4 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_task_graph.rs:462:44
#16 0x7fa100521acd in webrender::frame_builder::FrameBuilder::build::h0070923234045056 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:590:28
#17 0x7fa10057fda2 in webrender::render_backend::Document::build_frame::h06bc2ea654b278b3 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:521:25
#18 0x7fa100596597 in webrender::render_backend::RenderBackend::update_document::h3756da9da33c2d81 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1439:41
#19 0x7fa10058d31e in webrender::render_backend::RenderBackend::prepare_transactions::h58040ae4c9113c67 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1283:28
#20 0x7fa10058d31e in webrender::render_backend::RenderBackend::process_api_msg::h52e256be124236d5 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1136:17
#21 0x7fa100312e8a in webrender::render_backend::RenderBackend::run::he500ca6559be8e69 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:787:21
#22 0x7fa100312e8a in webrender::renderer::init::create_webrender_instance::_$u7b$$u7b$closure$u7d$$u7d$::hbefe2c360b737467 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/init.rs:685:9
#23 0x7fa100312e8a in std::sys_common::backtrace::__rust_begin_short_backtrace::h81918dc3e47daafe /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/std/src/sys_common/backtrace.rs:154:18
#24 0x7fa10031bcb2 in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::hfda76aeaf66066f0 /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/std/src/thread/mod.rs:529:17
#25 0x7fa10031bcb2 in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h58393165759d7909 /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/core/src/panic/unwind_safe.rs:272:9
#26 0x7fa10031bcb2 in std::panicking::try::do_call::hec0f8bb04ef08574 /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/std/src/panicking.rs:552:40
#27 0x7fa10031bcb2 in std::panicking::try::h4b2d6e40280c5d7e /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/std/src/panicking.rs:516:19
#28 0x7fa10031bcb2 in std::panic::catch_unwind::h1444bccf73a77b07 /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/std/src/panic.rs:142:14
#29 0x7fa10031bcb2 in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::h0a3b5538724e34d2 /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/std/src/thread/mod.rs:528:30
#30 0x7fa10031bcb2 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::hd231658e22c7114b /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/core/src/ops/function.rs:250:5
#31 0x7fa101a4a414 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::hc7eafaff61e32df9 /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/alloc/src/boxed.rs:2007:9
#32 0x7fa101a4a414 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h6ba4a5de48dd2304 /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/alloc/src/boxed.rs:2007:9
#33 0x7fa101a4a414 in std::sys::unix::thread::Thread::new::thread_start::he469335aef763e45 /rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/std/src/sys/unix/thread.rs:108:17
#34 0x7fa10c494ac2 in start_thread nptl/pthread_create.c:442:8
#35 0x7fa10c52684f  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240131050955-2cac2f68bfdc.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 6ae9a5505bee30ab3db67a99155a2a3447ad73e6 (20230201034720)
End: 150dd33322ea6d34c4829f8e67efe7e37be8c48e (20240124211633)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Comment 2

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20240124211633-150dd33322ea) but not with tip (mozilla-central 20240329205904-33becba24b3c.)

The bug appears to have been fixed in the following build range:

Start: 54c13c0498731427f23aff4c7e87900a715761b0 (20240304084822)
End: 8a586af3529ef8d1a3c9cc2238ff643c5169122d (20240304104949)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=54c13c0498731427f23aff4c7e87900a715761b0&tochange=8a586af3529ef8d1a3c9cc2238ff643c5169122d

nical, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 3

[Nicolas Silva [:nical]]

nical, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Confirmed.