1946178 - firefox: src/composite.h:690: static YUVMatrix YUVMatrix::From(const vec3_scalar &, const mat3_scalar &, int): Assertion `rgb_from_debiased_ycbcr[1].x == 0.0' failed.

Status: NEW

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Found with m-c 20250204-1a07567906ae (--enable-debug --enable-fuzzing)

This was found by visiting a live website with a 32-bit debug build. I was able to reproduce the issue but it did take multiple attempts. I was running a 32-bit build on Ubuntu (x86_64).

STR:

• Launch browser and visit: http://elegantthemes.com/

Or via site-scout:

$ pip install fuzzfetch site-scout --upgrade
$ fuzzfetch -d --fuzzing --cpu x86 -n firefox
$ site-scout ./firefox/firefox --visits 20 --display xvfb --explore -u <url>

firefox: src/composite.h:690: static YUVMatrix YUVMatrix::From(const vec3_scalar &, const mat3_scalar &, int): Assertion `rgb_from_debiased_ycbcr[1].x == 0.0' failed.

#0 0xf7fc4579  (linux-gate.so.1+0x579) (BuildId: ebb8da22affe313e02b849d6991f97d0d1770903)
#1 0xf7a7aaa6  (/lib/i386-linux-gnu/libc.so.6+0x88aa6) (BuildId: 559bcd138c06a98975421c680491f5666816aef2)
#2 0xf7a29684 in raise (/lib/i386-linux-gnu/libc.so.6+0x37684) (BuildId: 559bcd138c06a98975421c680491f5666816aef2)
#3 0xf7a123ab in abort (/lib/i386-linux-gnu/libc.so.6+0x203ab) (BuildId: 559bcd138c06a98975421c680491f5666816aef2)
#4 0xf7a122b1  (/lib/i386-linux-gnu/libc.so.6+0x202b1) (BuildId: 559bcd138c06a98975421c680491f5666816aef2)
#5 0xf7a219fe in __assert_fail (/lib/i386-linux-gnu/libc.so.6+0x2f9fe) (BuildId: 559bcd138c06a98975421c680491f5666816aef2)
#6 0xedfeb4d0 in YUVMatrix::From(glsl::vec3_scalar const&, glsl::mat3_scalar const&, int) /builds/worker/checkouts/gecko/gfx/wr/swgl/src/composite.h
#7 0xee070af3 in int blendYUV<true, glsl::sampler2DRect_impl*, glsl::sampler2DRect_impl*, unsigned int, NoColor>(unsigned int*, int, glsl::sampler2DRect_impl*, glsl::vec2, glsl::vec4_scalar const&, glsl::sampler2DRect_impl*, glsl::vec2, glsl::vec4_scalar const&, glsl::vec3_scalar const&, glsl::mat3_scalar const&, int, NoColor) /builds/worker/checkouts/gecko/gfx/wr/swgl/src/swgl_ext.h:1103:7
#8 0xee06f368 in brush_yuv_image_TEXTURE_RECT_YUV_frag::swgl_drawSpanRGBA8() /builds/worker/workspace/obj-build/i686-unknown-linux-gnu/debug/build/swgl-03660b3a2ca872a4/out/brush_yuv_image_ALPHA_PASS_TEXTURE_RECT_YUV.h:961:4
#9 0xee06cbc5 in brush_yuv_image_ALPHA_PASS_TEXTURE_RECT_YUV_frag::draw_span_RGBA8(glsl::FragmentShaderImpl*) /builds/worker/workspace/obj-build/i686-unknown-linux-gnu/debug/build/swgl-03660b3a2ca872a4/out/brush_yuv_image_ALPHA_PASS_TEXTURE_RECT_YUV.h:1033:28
#10 0xee0011db in draw_span /builds/worker/checkouts/gecko/gfx/wr/swgl/src/program.h:168:12
#11 0xee0011db in draw_depth_span<unsigned int> /builds/worker/checkouts/gecko/gfx/wr/swgl/src/rasterize.h:628:38
#12 0xee0011db in draw_quad_spans<unsigned int> /builds/worker/checkouts/gecko/gfx/wr/swgl/src/rasterize.h:1025:13
#13 0xee0011db in draw_quad(int, Texture&, Texture&) /builds/worker/checkouts/gecko/gfx/wr/swgl/src/rasterize.h:1625:5
#14 0xedffa9a8 in draw_elements<unsigned short> /builds/worker/checkouts/gecko/gfx/wr/swgl/src/rasterize.h:1655:5
#15 0xedffa9a8 in DrawElementsInstanced /builds/worker/checkouts/gecko/gfx/wr/swgl/src/gl.cc:2748:7
#16 0xedfdcd96 in _$LT$swgl..swgl_fns..Context$u20$as$u20$gleam..gl..Gl$GT$::draw_elements_instanced::h60745b65ccffe9a9 /builds/worker/checkouts/gecko/gfx/wr/swgl/src/swgl_fns.rs:1590:13
#17 0xedb0be16 in _$LT$gleam..gl..ErrorReactingGl$LT$F$GT$$u20$as$u20$gleam..gl..Gl$GT$::draw_elements_instanced::h4934f391e8d8c190 /builds/worker/checkouts/gecko/third_party/rust/gleam/src/gl.rs:98:26
#18 0xedce5d6f in webrender::device::gl::Device::draw_indexed_triangles_instanced_u16::h2b5220a981e58b2e /builds/worker/checkouts/gecko/gfx/wr/webrender/src/device/gl.rs:3749:9
#19 0xeddf1e9f in webrender::renderer::Renderer::draw_instanced_batch::h7a9a27b9f9d10e1b /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:2060:17
#20 0xeddf3fcf in webrender::renderer::Renderer::draw_alpha_batch_container::h51291aa0e3ab6606 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:2961:17
#21 0xeddfd1c5 in webrender::renderer::Renderer::draw_render_target::h44f18d3120221e80 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:4198:13
#22 0xede04f8d in webrender::renderer::Renderer::draw_frame::h3c18f5c791327279 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:4895:17
#23 0xedde1df4 in webrender::renderer::Renderer::render_impl::ha2fc126eebaa1288 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:1555:17
#24 0xedddf645 in webrender::renderer::Renderer::render::hbcadb266fa4e86ca /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:1265:30
#25 0xed9fb51c in wr_renderer_render /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/bindings.rs:649:11
#26 0xe611302a in mozilla::wr::RendererOGL::UpdateAndRender(mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>> const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char>> const&, bool*, mozilla::wr::RendererStats*) /builds/worker/checkouts/gecko/gfx/webrender_bindings/RendererOGL.cpp:191:19
#27 0xe6111aa3 in mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> const&, mozilla::TimeStamp const&, bool, mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>> const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char>> const&, mozilla::wr::RendererStats*, bool*) /builds/worker/checkouts/gecko/gfx/webrender_bindings/RenderThread.cpp:851:31
#28 0xe6110dda in mozilla::wr::RenderThread::HandleFrameOneDocInner(mozilla::wr::WrWindowId, bool, bool, mozilla::Maybe<mozilla::wr::FramePublishId>) /builds/worker/checkouts/gecko/gfx/webrender_bindings/RenderThread.cpp:666:3
#29 0xe6110435 in mozilla::wr::RenderThread::HandleFrameOneDoc(mozilla::wr::WrWindowId, bool, bool, mozilla::Maybe<mozilla::wr::FramePublishId>) /builds/worker/checkouts/gecko/gfx/webrender_bindings/RenderThread.cpp:613:3
#30 0xe610ff91 in WrNotifierEvent_HandleNewFrameReady /builds/worker/checkouts/gecko/gfx/webrender_bindings/RenderThread.cpp:574:3
#31 0xe610ff91 in mozilla::wr::RenderThread::HandleWrNotifierEvents(mozilla::wr::WrWindowId) /builds/worker/checkouts/gecko/gfx/webrender_bindings/RenderThread.cpp:536:9
#32 0xe60c892c in operator()<StoreCopyPassByConstLRef<mozilla::TimeStamp> &> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
#33 0xe60c892c in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), StoreCopyPassByConstLRef<mozilla::TimeStamp> &> /builds/worker/fetches/sysroot-i686-linux-gnu/usr/lib/gcc/i586-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
#34 0xe60c892c in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), StoreCopyPassByConstLRef<mozilla::TimeStamp> &> /builds/worker/fetches/sysroot-i686-linux-gnu/usr/lib/gcc/i586-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
#35 0xe60c892c in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<StoreCopyPassByConstLRef<mozilla::TimeStamp> > &, 0U> /builds/worker/fetches/sysroot-i686-linux-gnu/usr/lib/gcc/i586-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
#36 0xe60c892c in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<StoreCopyPassByConstLRef<mozilla::TimeStamp> > &> /builds/worker/fetches/sysroot-i686-linux-gnu/usr/lib/gcc/i586-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
#37 0xe60c892c in apply<mozilla::gfx::VRThread, void (mozilla::gfx::VRThread::*)(mozilla::TimeStamp)> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
#38 0xe60c892c in mozilla::detail::RunnableMethodImpl<mozilla::gmp::ChromiumCDMChild*, void (mozilla::gmp::ChromiumCDMChild::*)(bool (mozilla::gmp::PChromiumCDMChild::*)()), true, (mozilla::RunnableKind)0, bool (mozilla::gmp::PChromiumCDMChild::*)()>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
#39 0xe48e96d7 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1153:16
#40 0xe48f010a in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#41 0xe5484d36 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:299:20
#42 0xe53d9aae in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:369:10
#43 0xe53d99ba in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:362:3
#44 0xe53d99ba in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:344:3
#45 0xe48e4ffa in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:366:10
#46 0xf71ce4be in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:191:3

Comment 1

[Tyson Smith [:tsmith]]

This has been reported by live site testing running 64-bit builds on multiple sites (http://www.apple.com/ipad-pro/ for example) but I have not been able to reproduce the issue on a 64-bit build.

Comment 2

[Jamie Nicol [:jnicol]]

Kelsey, Lee, you seem to have touched this code. Any ideas?

Comment 3

[Jamie Nicol [:jnicol]]

Tyson, is this deliberately being run with software webrender enabled? Or have we encountered an error causing us to fallback. Is it possible to see the about:support from the machine?

Comment 4

[Tyson Smith [:tsmith]]

Attachment: about-support.txt

Comment 5

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/YYfkesJ25Ft92FIMuFXNoA/index.html

Comment 6

[Tyson Smith [:tsmith]]

I am also seeing firefox: src/composite.h:670: static YUVMatrix YUVMatrix::From(const vec3_scalar &, const mat3_scalar &, int): Assertion 'rgb_from_debiased_ycbcr[0].y >= 1' failed is that a new issues or the same?