1891322 - Hit MOZ_CRASH(assertion failed: !(first.offset > last.offset)) at gfx/wr/webrender_api/src/gradient_builder.rs:137

Status: VERIFIED FIXED

(Core :: Graphics: WebRender, defect, P1)

Description

[Tyson Smith [:tsmith] (PTO)]

Attachment: testcase.html

Found while fuzzing m-c 20240412-be4463b26a49 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(assertion failed: !(first.offset > last.offset)) at gfx/wr/webrender_api/src/gradient_builder.rs:137

#0 0x719780833d85 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:317:3
#1 0x719780833d85 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x71978083323d in mozglue_static::panic_hook::h43eaefe9eb9c21c7 /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:98:9
#3 0x71978083323d in core::ops::function::Fn::call::h428b5e23b1db83db /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/core/src/ops/function.rs:79:5
#4 0x7197819211a5 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::h4dd5cc3b5605ae1a /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/alloc/src/boxed.rs:2029:9
#5 0x7197819211a5 in std::panicking::rust_panic_with_hook::hb164d19c0c1e71d4 /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panicking.rs:785:13
#6 0x719781920eb8 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h0369088c533c20e9 /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panicking.rs:651:13
#7 0x71978191e3e5 in std::sys_common::backtrace::__rust_end_short_backtrace::hc11d910daf35ac2e /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/sys_common/backtrace.rs:171:18
#8 0x719781920c43 in rust_begin_unwind /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panicking.rs:647:5
#9 0x71978196ce54 in core::panicking::panic_fmt::ha6effc2775a0749c /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/core/src/panicking.rs:72:14
#10 0x71978196cf12 in core::panicking::panic::h44790a89027c670f /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/core/src/panicking.rs:144:5
#11 0x719780558fe3 in webrender_api::gradient_builder::GradientBuilder::normalize::he7c6ad6d8268af6f /builds/worker/checkouts/gecko/gfx/wr/webrender_api/src/gradient_builder.rs:137:9
#12 0x719780558962 in webrender_api::gradient_builder::GradientBuilder::radial_gradient::h574f1573485c8162 /builds/worker/checkouts/gecko/gfx/wr/webrender_api/src/gradient_builder.rs:91:13
#13 0x719780552cc3 in webrender_api::display_list::DisplayListBuilder::create_radial_gradient::h117d937a913e316d /builds/worker/checkouts/gecko/gfx/wr/webrender_api/src/display_list.rs:1524:24
#14 0x71978007b056 in wr_dp_push_radial_gradient /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/bindings.rs:3702:20
#15 0x71977c45ad52 in mozilla::nsCSSGradientRenderer::BuildWebRenderDisplayItems(mozilla::wr::DisplayListBuilder&, mozilla::layers::StackingContextHelper const&, nsRect const&, nsRect const&, nsSize const&, mozilla::gfx::IntRectTyped<mozilla::CSSPixel> const&, bool, float) /builds/worker/checkouts/gecko/layout/painting/nsCSSRenderingGradients.cpp:1360:14
#16 0x71977c48936a in mozilla::nsImageRenderer::BuildWebRenderDisplayItems(nsPresContext*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayItem*, nsRect const&, nsRect const&, nsRect const&, nsPoint const&, nsSize const&, mozilla::gfx::IntRectTyped<mozilla::CSSPixel> const&, float) /builds/worker/checkouts/gecko/layout/painting/nsImageRenderer.cpp:584:16
#17 0x71977c4460c3 in mozilla::nsImageRenderer::BuildWebRenderDisplayItemsForLayer(nsPresContext*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayItem*, nsRect const&, nsRect const&, nsPoint const&, nsRect const&, nsSize const&, float) /builds/worker/checkouts/gecko/layout/painting/nsImageRenderer.cpp:775:10
#18 0x71977c443677 in nsCSSRendering::BuildWebRenderDisplayItemsForStyleImageLayerWithSC(nsCSSRendering::PaintBGParams const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayItem*, mozilla::ComputedStyle*, nsStyleBorder const&) /builds/worker/checkouts/gecko/layout/painting/nsCSSRendering.cpp:2729:36
#19 0x71977c4431ef in nsCSSRendering::BuildWebRenderDisplayItemsForStyleImageLayer(nsCSSRendering::PaintBGParams const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayItem*) /builds/worker/checkouts/gecko/layout/painting/nsCSSRendering.cpp:1958:10
#20 0x71977c469c55 in mozilla::nsDisplayBackgroundImage::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:3413:7
#21 0x719777b34ac6 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1864:41
#22 0x719777b33282 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:2130:7
#23 0x71977c4744b2 in CreateWebRenderCommandsNewClipListOption /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:4620:30
#24 0x71977c4744b2 in CreateWebRenderCommands /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.h:4959:12
#25 0x71977c4744b2 in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:5246:22
#26 0x719777b34ac6 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1864:41
#27 0x719777b33282 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:2130:7
#28 0x719777b3180a in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1785:5
#29 0x719777b474b8 in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderLayerManager.cpp:365:30
#30 0x71977c462f87 in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /builds/worker/checkouts/gecko/layout/painting/nsDisplayList.cpp:2305:18
#31 0x71977c0d3761 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /builds/worker/checkouts/gecko/layout/base/nsLayoutUtils.cpp:3312:9
#32 0x71977c03ce9f in mozilla::PresShell::PaintInternal(nsView*, mozilla::PaintInternalFlags) /builds/worker/checkouts/gecko/layout/base/PresShell.cpp:6578:5
#33 0x71977bbb6d62 in nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:408:18
#34 0x71977bbb67ee in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) /builds/worker/checkouts/gecko/view/nsViewManager.cpp:343:22
#35 0x71977bbb7e4d in nsViewManager::ProcessPendingUpdates() /builds/worker/checkouts/gecko/view/nsViewManager.cpp:916:5
#36 0x71977bff11e5 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2841:11
#37 0x71977bffa621 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:367:13
#38 0x71977bffa621 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:345:7
#39 0x71977bffa520 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:361:5
#40 0x71977bffa3bd in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:951:5
#41 0x71977bff965c in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:861:5
#42 0x71977bff88c9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:592:14
#43 0x71977b3090fb in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncMainChild.cpp:66:15
#44 0x71977b5fb905 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:237:78
#45 0x71977b4e3ae0 in mozilla::dom::PContentChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PContentChild.cpp:8282:32
#46 0x719777250bbf in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1818:25
#47 0x71977724d912 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1737:9
#48 0x71977724e592 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1530:3
#49 0x71977724f6df in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1628:14
#50 0x71977652e097 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:578:16
#51 0x719776523706 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:905:26
#52 0x719776521ee7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:728:15
#53 0x719776522365 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:514:36
#54 0x719776532036 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:232:37
#55 0x719776532036 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.h:548:5
#56 0x719776547362 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
#57 0x71977654e4ad in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#58 0x719777256b05 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#59 0x71977716ca61 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#60 0x71977716ca61 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#61 0x71977bc22168 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:148:27
#62 0x71977bce5e18 in nsAppShell::Run() /builds/worker/checkouts/gecko/widget/gtk/nsAppShell.cpp:470:33
#63 0x71977db31c8b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:712:20
#64 0x7197772579e6 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#65 0x71977716ca61 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#66 0x71977716ca61 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#67 0x71977db314b2 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:647:34
#68 0x58b3882ba5c6 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#69 0x58b3882ba5c6 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:375:18
#70 0x71978c429d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#71 0x71978c429e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#72 0x58b3882902f8 in _start (/home/user/workspace/browsers/m-c-20240413085157-fuzzing-debug/firefox-bin+0x592f8) (BuildId: 8553aaf648eb5b578f899bbf9a05117a2b83de03)

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240414212202-25a22c2f9391.
The bug appears to have been introduced in the following build range:

Start: 90ef908ff18573cca9f4f0e5d676df56875c68b5 (20240412093252)
End: a65ef2dc959b5fe431d3fcaa757b423aeec2677b (20240412141209)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=90ef908ff18573cca9f4f0e5d676df56875c68b5&tochange=a65ef2dc959b5fe431d3fcaa757b423aeec2677b

Comment 2

[Tyson Smith [:tsmith] (PTO)]

This is currently the top fuzzblocker by a fair margin. It is being reported by multiple fuzzers.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

:ahale, since you are the author of the regressor, bug 1885716, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Ashley Hale [:ahale]]

Interesting that we have an assert for this, it shouldn't be difficult to fix. I reversed the gradient interpolation direction for a specific case where both colors are the same, I'll look into how that resulted in this issue.

Comment 6

[Andrew McCreight [:mccr8]]

This is also showing up on Nightly, or at least the same assertion.

Comment 7

[Ashley Hale [:ahale]]

(In reply to Andrew McCreight [:mccr8] from comment #6)

This is also showing up on Nightly, or at least the same assertion.

In fuzzing or in actual usage? If actual usage I would be curious what manages to trigger it.

In any case I don't think this assert is the right solution, it claims to be preventing a panic but asserts are designed to cause panics, so the rationale is unclear to me (even from Bug 1708540 which it was fixing), I'm coding a more robust 'make it still render something' solution but I am not sure what is objectively better here.

Comment 8

[Ashley Hale [:ahale]]

Attachment: Bug 1891322 - more robust solution for NaN offset in gradients r?nical,#gfx-reviewers

Comment 9

[Andrew McCreight [:mccr8]]

(In reply to Ashley Hale [:ahale] from comment #7)

(In reply to Andrew McCreight [:mccr8] from comment #6)

This is also showing up on Nightly, or at least the same assertion.

In fuzzing or in actual usage? If actual usage I would be curious what manages to trigger it.

Fuzzing usually disables the crash reporter, so I think this is actual users. No real comments on the crash reports. There were two crashes with this URL: https://www.404media.co/a-spy-site-is-scraping-discord-and-selling-users-messages/ Also a lot of crashes from this site, though you need a login so that's not useful: https://dsbn.elearningontario.ca Plus a few other random sites.

Comment 10

[Ashley Hale [:ahale]]

Bumping to S2 as this appears to be a very consistent crash on some real sites when using Nightly, not just fuzzers (which are certainly urgent but rarely user impacting).

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/df293fdc441b
more robust solution for NaN offset in gradients r=gfx-reviewers,lsalzman

Comment 12

[Ashley Hale [:ahale]]

Comment on attachment 9397434 [details]
Bug 1891322 - more robust solution for NaN offset in gradients r?nical,#gfx-reviewers

Beta/Release Uplift Approval Request

• User impact if declined: Assert failure in GPU process causes tab crashes on at least two sites (one a paywalled e-learning suite) detailed in Bug 1891322.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce: Visit https://www.404media.co/a-spy-site-is-scraping-discord-and-selling-users-messages/ and scroll down - crash is quite immediate in affected versions.
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The assert is replaced with a fallback that renders a flat color from the gradient stops table, there is no correct way to render a NaN offset so anything we do here is not covered by spec, simply not panicking is an improvement.
• String changes made/needed:
• Is Android affected?: Yes

Comment 13

[Bugmon [:jkratzer for issues]]

Successfully recorded a pernosco session. A link to the pernosco session will be added here shortly.

Comment 14

[Bugmon [:jkratzer for issues]]

A pernosco session for this bug can be found here.

Comment 15

[tszentpeteri]

https://hg.mozilla.org/mozilla-central/rev/df293fdc441b

Comment 16

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20240419094732-99364906cd1d.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 18

[Donal Meehan [:dmeehan]]

Comment on attachment 9397434 [details]
Bug 1891322 - more robust solution for NaN offset in gradients r?nical,#gfx-reviewers

Approved for 126.0b4

Comment 19

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/ee303cd3d937