1922160 - Hit MOZ_CRASH(Bad Prim render task size: 1918x0) at gfx/wr/webrender/src/render_task.rs:1072

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20240809-7f7cc1db0cad (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(Bad Prim render task size: 1918x0) at gfx/wr/webrender/src/render_task.rs:1072

#0 0x7faac415e1d5 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:317:3
#1 0x7faac415e1d5 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7faac415dec9 in mozglue_static::panic_hook::h4c5eb0863d05a1de /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:102:9
#3 0x7faac415d97b in core::ops::function::Fn::call::h90eb7b2caeac90e7 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/core/src/ops/function.rs:79:5
#4 0x7faac538007e in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::hce7569f4ca5d1b64 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/alloc/src/boxed.rs:2084:9
#5 0x7faac538007e in std::panicking::rust_panic_with_hook::hfe205f6954b2c97b /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/panicking.rs:808:13
#6 0x7faac537fca6 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h6cb44b3a50f28c44 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/panicking.rs:674:13
#7 0x7faac537eac8 in std::sys::backtrace::__rust_end_short_backtrace::hf1c1f2a92799bb0e /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/sys/backtrace.rs:168:18
#8 0x7faac537f933 in rust_begin_unwind /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/panicking.rs:665:5
#9 0x7faac53a7072 in core::panicking::panic_fmt::h3d8fc78294164da7 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/core/src/panicking.rs:74:14
#10 0x7faac3b4381c in webrender::render_task::RenderTask::new_dynamic::hc13d535d11452c8d /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_task.rs:1072:9
#11 0x7faac3b4381c in webrender::box_shadow::_$LT$impl$u20$webrender..pattern..PatternBuilder$u20$for$u20$webrender..prim_store..PrimTemplate$LT$webrender..box_shadow..BoxShadowData$GT$$GT$::build::h03892cf4b517ad63 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/box_shadow.rs:112:59
#12 0x7faac3c09081 in webrender::quad::prepare_quad::_$u7b$$u7b$closure$u7d$$u7d$::h2162e1192d646026 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/quad.rs:153:13
#13 0x7faac3c09081 in core::option::Option$LT$T$GT$::unwrap_or_else::hd34d52c83086b21d /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/core/src/option.rs:1015:21
#14 0x7faac3c09081 in webrender::quad::prepare_quad::h2525af5122c1a491 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/quad.rs:152:38
#15 0x7faac3be381f in webrender::prepare::prepare_interned_prim_for_render::h4d2addccad3019eb /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs
#16 0x7faac3be1f0d in webrender::prepare::prepare_prim_for_render::h8535d96fd5d1c1cf /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:288:5
#17 0x7faac3be1f0d in webrender::prepare::prepare_primitives::hcfb3b543e6d86aa0 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:82:17
#18 0x7faac3b9c1b9 in webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::haca753b309d1e383 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:465:17
#19 0x7faac3b9c1b9 in webrender::frame_builder::FrameBuilder::build::h228fd860152e6432 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:573:9
#20 0x7faac3c10119 in webrender::render_backend::Document::build_frame::hb541b38e2c91e498 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:530:25
#21 0x7faac3c2164f in webrender::render_backend::RenderBackend::update_document::ha26572fb44753d08 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1466:41
#22 0x7faac3c18a33 in webrender::render_backend::RenderBackend::prepare_transactions::hfbbbde7d087ac163 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1306:28
#23 0x7faac3c18a33 in webrender::render_backend::RenderBackend::process_api_msg::h783e3b12d6d6c759 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1153:17
#24 0x7faac3913b39 in webrender::render_backend::RenderBackend::run::ha31ec1166773f8ef /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:802:21
#25 0x7faac3913b39 in webrender::renderer::init::create_webrender_instance::_$u7b$$u7b$closure$u7d$$u7d$::hf8f7665b59b75222 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/init.rs:715:9
#26 0x7faac3913b39 in std::sys::backtrace::__rust_begin_short_backtrace::h969e9b800031296a /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/sys/backtrace.rs:152:18
#27 0x7faac391fabc in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h787a7e2e5cfd81a6 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/thread/mod.rs:538:17
#28 0x7faac391fabc in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h8879be7aaf0ec954 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/core/src/panic/unwind_safe.rs:272:9
#29 0x7faac391fabc in std::panicking::try::do_call::hfd3754f067b2356b /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/panicking.rs:557:40
#30 0x7faac391fabc in std::panicking::try::hd15d39153288603a /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/panicking.rs:521:19
#31 0x7faac391fabc in std::panic::catch_unwind::hcf83f7dfee188f72 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/panic.rs:350:14
#32 0x7faac391fabc in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::h0a11c1b239345cfa /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/thread/mod.rs:537:30
#33 0x7faac391fabc in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::habc605b078fce9a9 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/core/src/ops/function.rs:250:5
#34 0x7faac5383b2a in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::ha1963004222e7822 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/alloc/src/boxed.rs:2070:9
#35 0x7faac5383b2a in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h1086ced1f7c494c2 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/alloc/src/boxed.rs:2070:9
#36 0x7faac5383b2a in std::sys::pal::unix::thread::Thread::new::thread_start::ha8af9c992ef0b208 /rustc/eeb90cda1969383f56a2637cbd3037bdf598841c/library/std/src/sys/pal/unix/thread.rs:108:17
#37 0x7faacec94ac2 in start_thread nptl/pthread_create.c:442:8
#38 0x7faaced2684f  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Tyson Smith [:tsmith]]

This has been detected by live site testing.

Comment 2

[Mayank Bansal]

This is the crash i get from the testcase: https://crash-stats.mozilla.org/report/index/f85d9539-3632-4e92-8eb1-4be480241002

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1917493

:gw, since you are the author of the regressor, bug 1917493, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Iulian Moraru]

This should now be fixed since Bug 1917493 was backed out.
Backout link: https://hg.mozilla.org/integration/autoland/rev/a54af0b7d23a1e96466f4f5a45fa7229b4f88e07

Comment 5

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1922160 using build mozilla-central 20240809212700-7f7cc1db0cad. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.