1885338 - Crash in [@ <core::ops::range::Range<usize> as core::slice::index::SliceIndex<[T]>>::index]

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebRender, defect)

Description

[Sean Feng [:sefeng]]

Crash report: https://crash-stats.mozilla.org/report/index/039b22bf-6bce-423e-8996-a93560240313

MOZ_CRASH Reason: range end index 2 out of range for slice of length 1

Top 10 frames of crashing thread:

0  XUL  MOZ_Crash  mfbt/Assertions.h:301
0  XUL  RustMozCrash  mozglue/static/rust/wrappers.cpp:18
1  XUL  mozglue_static::panic_hook  mozglue/static/rust/lib.rs:96
2  XUL  core::ops::function::Fn::call  library/core/src/ops/function.rs:79
3  XUL  <alloc::boxed::Box<F, A> as core::ops::function::Fn<Args>>::call  library/alloc/src/boxed.rs:2029
3  XUL  std::panicking::rust_panic_with_hook  library/std/src/panicking.rs:783
4  XUL  std::panicking::begin_panic_handler::{{closure}}  library/std/src/panicking.rs:657
5  XUL  std::sys_common::backtrace::__rust_end_short_backtrace  library/std/src/sys_common/backtrace.rs:171
6  XUL  rust_begin_unwind  library/std/src/panicking.rs:645
7  XUL  core::panicking::panic_fmt  library/core/src/panicking.rs:72

I checked a few crashes and there are a few different callers.
midir::backend::coremidi::MidiInput::handle_input
webrender::scene_building::SceneBuilder::finalize_picture
webrender::prim_store::text_run::TextRunPrimitive::request_resources

Comment 1

[Glenn Watson [:gw]]

The referenced crash report looks like it's inside webgpu.

Comment 2

[Erich Gubler [:ErichDonGubler]]

The WebGPU-relevant crash report in the description is bug 1877461 (which already has a resolution), but the current set of reports contains stacks from WebRender also (report a3354fdd-a972-46d5-9407-7c3b30240329's last interesting frame is webrender::scene_building::SceneBuilder::finalize_picture). I think we need to add a few of the slice access frames as known prefixes for Socorro, a la bug 1876623.

Comment 3

[Erich Gubler [:ErichDonGubler]]

Just filed bug 1889120 to track the prefixes we'll need in Socorro to distinguish WebGPU and WebRender cases.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.