1975837 - (CVE-2025-9182) UndefinedBehaviorSanitizer: SEGV in glsl::fetchOffsetsFloat after realloc failure on Texture::allocate new_buf

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Irvan Kurniawan [:sourc7]]

Attachment: testcase1.html

After visited the testcase using ffpuppet with --headless flags, I discovered it crashed with SIGSEGV / SI_KERNEL, the testcase is very reliable to hit at SIGSEGV / SI_KERNEL on my Intel i9-13900k, even when repeatedly run the testcase using ffpuppet e.g. 30x, it able to crash at same crash signature.

After some investigation, I found the crash is occur after realloc failure in gfx/wr/swgl/src/gl.cc Texture::allocate on new_buf.

I able to reproduce on UBSAN after compiling with --enable-undefined-sanitizer=bounds (bounds only) for faster execution. To see the full crash stack it still require to apply gl.cc.patch to directly replicate the realloc allocation failure.

Tested on:

• Firefox Nightly 142.0a1 (2025-07-05) (32-bit) on Arch Linux
• Firefox 140.0.2 (32-bit) on Arch Linux
• Firefox ESR 140.0esr (32-bit) on Arch Linux
• Firefox ESR 128.12.0esr (32-bit) on Arch Linux

Steps to reproduce:

1. Download the testcase1.html
2. Run python -m ffpuppet /path/to/firefox --url /path/to/testcase1.html --headless
3. Firefox crashed with Crash|SIGSEGV / SI_KERNEL

Comment 1

[Irvan Kurniawan [:sourc7]]

Attachment: log_minidump_00.txt

Comment 2

[Irvan Kurniawan [:sourc7]]

Attachment: log_brush_linear_gradient_frag.patched.txt

Comment 3

[Irvan Kurniawan [:sourc7]]

Attachment: log_ubsan_cs_linear_gradient_frag.patched.txt

Comment 4

[Irvan Kurniawan [:sourc7]]

Attachment: glcc_new_buf_realloc.patch

Comment 5

[Irvan Kurniawan [:sourc7]]

Attachment: gdb_glsl::fetchOffsetsFloat_symbolized_crash.withoutpatch.txt

Comment 6

[Irvan Kurniawan [:sourc7]]

Attachment: gdb_brush_linear_gradient_crash.officialbuild.txt

Comment 7

[Lee Salzman [:lsalzman]]

I can't reproduce this based on the testcase. I need more reliable steps to reproduce here. There is already actually code in place that bounds checks these accesses, so that theoretically if its hitting something, this is some sort of access off of a null pointer. But I can't reproduce it to see if that's going on at all.

Comment 8

[Irvan Kurniawan [:sourc7]]

Hi :lsalzman, thanks for the feedback,

I recently tested the testcase1.html, I also able to reproduce this reliably on my AMD Ryzen 7 5700G on Arch Linux, when testing this 10x on ffpuppet --display headless, I can reliably reproduce the SIGSEGV / SI_KERNEL in all 10 test runs.

I can also reproduce this reliably on Ubuntu22.04 on QEMU/KVM.

As it have to trigger realloc failure, for now I can only reproduce this on Firefox (32-bit) with Linux OS, here the updated testcase:

Steps to reproduce:

1. Download attached testcase1.html
2. On Linux OS run python -m ffpuppet /path/to/firefox-i686/firefox --url /path/to/testcase1.html --display headless
3. Firefox 32-bit crashed with Crash|SIGSEGV / SI_KERNEL

Comment 9

[Irvan Kurniawan [:sourc7]]

Attachment: log_minidump_00_ryzen_7_5700g.txt

Comment 10

[Lee Salzman [:lsalzman]]

As far as I can tell, looking at the crash in GDB, the crash doesn't actually happen in that thread, because the bounds checking prevents it from actually crashing there by redirecting to zeroFetchBuf and modifying any offsets within it to be zero. The realloc failure is a red herring, in that it is only symptomatic of us running out of memory in the parent process as a whole, but which has consequences elsewhere, not here.

What happens is that we simply run out of memory, and WebRender itself OOMs in the memory allocator in a different thread. The testcase just spends so much time in the shader that we are coincidentally almost always in the same place inside SWGL when this happens, but the crash isn't happening there. The ffpuppet harness just obscures which thread is actually signaling the assert, but this becomes more apparent when you look at the gdb thread listing instead, which actually shows the WebRender thread generating the assert:

...
53 Thread 0xd06feb40 (LWP 557511) "Renderer" glsl::texelFetchUnchecked (ptr=..., x=0, y=0, sampler=<optimized out>) at src/texture.h:415
...
85 Thread 0xc6ffdb40 (LWP 557556) "WRRende~ckend#1" 0x565930a7 in MOZ_CrashSequence (aAddress=0x0, aLine=35)
at /home/lee/mc/obj-nightly32/dist/include/mozilla/Assertions.h:248
...

So, otherwise stated, this isn't really a crash, but an intentional OOM assert happening inside WebRender. I wouldn't classify this as a sec issue.

Comment 11

[Lee Salzman [:lsalzman]]

Dveditz, can we downgrade this bug? I think is just a mimic of a sec issue due to the aforementioned thread shenanigans above, but is not actually a sec issue. We just OOM in another thread when WebRender/Rust tries to alloc, and the thread that was imputed to have caused a crash doesn't actually crash at all, it is merely very busy doing work there due to the dynamics of the testcase.

Comment 12

[Irvan Kurniawan [:sourc7]]

I have some info to share, please wait.

Comment 13

[Irvan Kurniawan [:sourc7]]

I can also reproduce this on standalone Firefox using config gfx.webrender.software to true or firefox --headless

When launched on gdb with args gdb --batch --ex "run" --ex "bt" --args ./firefox --headless /tmp/testcase1.html after a seconds Firefox will crash, and GDB output (on official 32-bit build):

[ Legend: Modified register | Code | Heap | Stack | String ]
──────────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────
$eax   : 0xe883bb2c  →  0x00000000
$ebx   : 0x0       
$ecx   : 0xd00fb350  →  0x00000000
$edx   : 0x0       
$esp   : 0xd00fb30c  →  0xd00fb350  →  0x00000000
$ebp   : 0xd00fb318  →  0xd00fb3e8  →  0xd00fc3b8  →  0xd00fd408  →  0xd00fd438  →  0xd00fd478  →  0xd00fd6b8  →  0xd00fdd28
$esi   : 0x0       
$edi   : 0x0       
$eip   : 0xeff8c6f6  →  0x900c280f  →  0xffffffff
$eflags: [zero carry PARITY adjust sign trap INTERRUPT direction overflow RESUME virtualx86 IDENTIFICATION]
$cs: 0x23 $ss: 0x2b $ds: 0x2b $es: 0x2b $fs: 0x00 $gs: 0x63 
──────────────────────────────────────────────────────────────────────────────────────────────────────────────── stack ────
0xd00fb30c│+0x0000: 0xd00fb350  →  0x00000000    ← $esp
0xd00fb310│+0x0004: 0xc13cb010  →  0xf0038080  →  0x56e58955  →  0xffffffff
0xd00fb314│+0x0008: 0xf0ce42c8  →  0x0a079660  →  0x00000000
0xd00fb318│+0x000c: 0xd00fb3e8  →  0xd00fc3b8  →  0xd00fd408  →  0xd00fd438  →  0xd00fd478  →  0xd00fd6b8  →  0xd00fdd28   ← $ebp
0xd00fb31c│+0x0010: 0xf0038220  →  0x4046280f  →  0xffffffff
0xd00fb320│+0x0014: 0x3f000000  →  0xffffffff
0xd00fb324│+0x0018: 0x3f000000  →  0xffffffff
0xd00fb328│+0x001c: 0x3f000000  →  0xffffffff
────────────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:32 ────
   0xeff8c6ea <brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4))+007a> movd   ebx, xmm3
   0xeff8c6ee <brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4))+007e> movd   esi, xmm0
   0xeff8c6f2 <brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4))+0082> movd   edi, xmm2
 → 0xeff8c6f6 <brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4))+0086> movaps xmm1, XMMWORD PTR [eax+edx*4]
   0xeff8c6fa <brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4))+008a> movaps xmm4, XMMWORD PTR [eax+ebx*4]
   0xeff8c6fe <brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4))+008e> movaps xmm0, XMMWORD PTR [eax+esi*4]
   0xeff8c702 <brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4))+0092> movaps xmm2, XMMWORD PTR [eax+edi*4]
   0xeff8c706 <brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4))+0096> movaps xmm3, xmm1
   0xeff8c709 <brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4))+0099> movaps xmm5, xmm4
────────────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 61, Name: "TaskCon~ller #6", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#1] Id 8, Name: "glean.dispatche", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#2] Id 60, Name: "TaskCon~ller #5", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#3] Id 18, Name: "StyleThread#3", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#4] Id 55, Name: "TaskCon~ller #0", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#5] Id 54, Name: "Cookie", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#6] Id 126, Name: "FSBroker1825963", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#7] Id 53, Name: "Cache2 I/O", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#8] Id 96, Name: "sqldb:c~lite #4", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#9] Id 51, Name: "TRR Background", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#10] Id 57, Name: "TaskCon~ller #2", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#11] Id 47, Name: "ImageIO", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#12] Id 43, Name: "WRWorkerLP#7", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#13] Id 42, Name: "WRWorkerLP#6", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#14] Id 89, Name: "AudioIP~allback", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#15] Id 40, Name: "WRWorkerLP#4", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#16] Id 111, Name: "MemoryPoller", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#17] Id 39, Name: "WRWorkerLP#3", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#18] Id 36, Name: "WRWorkerLP#0", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#19] Id 35, Name: "WRWorker#3", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#20] Id 93, Name: "sqldb:b~lite #2", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#21] Id 37, Name: "WRWorkerLP#1", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#22] Id 33, Name: "WRWorker#1", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#23] Id 101, Name: "SSL Cert #1", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#24] Id 58, Name: "TaskCon~ller #3", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#25] Id 32, Name: "WRWorker#0", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#26] Id 29, Name: "firefox:sh0", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#27] Id 10, Name: "Timer", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#28] Id 11, Name: "Netlink Monitor", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#29] Id 15, Name: "HTML5 Parser", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#30] Id 106, Name: "WRRende~ckend#2", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#31] Id 12, Name: "Socket Thread", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#32] Id 56, Name: "TaskCon~ller #1", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#33] Id 4, Name: "pool-spawner", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#34] Id 83, Name: "SwComposite", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#35] Id 44, Name: "WrGlyph~terizer", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#36] Id 9, Name: "IPC I/O Parent", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#37] Id 7, Name: "gdbus", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#38] Id 20, Name: "StyleThread#5", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#39] Id 16, Name: "StyleThread#1", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#40] Id 6, Name: "pool-0", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#41] Id 14, Name: "Backgro~Pool #1", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#42] Id 5, Name: "gmain", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#43] Id 50, Name: "BgIOThr~Pool #1", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#44] Id 31, Name: "Renderer", stopped 0xeff8c6f6 in brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4)) (), reason: SIGSEGV
[#45] Id 28, Name: "firefox:disk$0", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#46] Id 23, Name: "pool-1", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#47] Id 107, Name: "DOM Worker", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#48] Id 13, Name: "IPDL Background", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#49] Id 41, Name: "WRWorkerLP#5", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#50] Id 27, Name: "Permission", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#51] Id 38, Name: "WRWorkerLP#2", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#52] Id 3, Name: "AsyncSi~lThread", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#53] Id 1, Name: "firefox-bin", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#54] Id 34, Name: "WRWorker#2", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#55] Id 128, Name: "DNS Resolver #9", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#56] Id 46, Name: "CanvasRenderer", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#57] Id 86, Name: "WRRende~ckend#1", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#58] Id 17, Name: "StyleThread#2", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#59] Id 48, Name: "SandboxReporter", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#60] Id 22, Name: "BHMgr Processor", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#61] Id 124, Name: "DNS Resolver #8", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#62] Id 19, Name: "StyleThread#4", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#63] Id 75, Name: "DNS Resolver #1", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#64] Id 85, Name: "WRScene~derLP#1", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#65] Id 59, Name: "TaskCon~ller #4", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#66] Id 127, Name: "FSBroker1825969", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#67] Id 49, Name: "IPC Launch", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#68] Id 76, Name: "StreamTrans #9", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#69] Id 91, Name: "sqldb:p~lite #1", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#70] Id 103, Name: "WRScene~ilder#2", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#71] Id 45, Name: "Compositor", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#72] Id 21, Name: "BHMgr Monitor", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#73] Id 25, Name: "JS Watchdog", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#74] Id 62, Name: "TaskCon~ller #7", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#75] Id 69, Name: "IndexedDB IO #1", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#76] Id 30, Name: "Softwar~cThread", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#77] Id 64, Name: "Worker Launcher", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#78] Id 65, Name: "QuotaManager IO", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#79] Id 66, Name: "FSBroker1825706", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#80] Id 68, Name: "StreamTrans #4", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#81] Id 70, Name: "StreamTrans #5", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#82] Id 72, Name: "StreamTrans #7", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#83] Id 73, Name: "StreamTrans #8", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#84] Id 84, Name: "WRScene~ilder#1", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#85] Id 92, Name: "DNS Resolver #2", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#86] Id 118, Name: "FSBroker1825869", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#87] Id 79, Name: "GMPThread", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#88] Id 94, Name: "sqldb:p~lite #3", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#89] Id 80, Name: "ImageBridgeChld", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#90] Id 81, Name: "FSBroker1825748", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#91] Id 99, Name: "DNS Resolver #4", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#92] Id 82, Name: "ProcessHangMon", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#93] Id 87, Name: "FSBroker1825757", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#94] Id 88, Name: "AudioIP~ver RPC", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#95] Id 122, Name: "DNS Resolver #7", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#96] Id 90, Name: "AudioIP~ion RPC", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#97] Id 95, Name: "DNS Resolver #3", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#98] Id 97, Name: "sqldb:p~lite #5", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#99] Id 100, Name: "FSBroker1825804", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#100] Id 102, Name: "SwComposite", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#101] Id 105, Name: "WRScene~derLP#2", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#102] Id 108, Name: "RemoteLzyStream", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#103] Id 109, Name: "URL Classifier", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#104] Id 110, Name: "sqldb:d~lite #6", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#105] Id 113, Name: "FSBroker1825856", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#106] Id 117, Name: "glean.mps", stopped 0xf7fc5579 in ?? (), reason: SIGSEGV
[#107] Id 119, Name: "SaveScripts", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#108] Id 120, Name: "DNS Resolver #5", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#109] Id 121, Name: "DNS Resolver #6", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#110] Id 125, Name: "FSBroker1825957", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#111] Id 129, Name: "DNS Res~ver #10", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
[#112] Id 130, Name: "DNS Res~ver #11", stopped 0xf7a3a67b in ?? (), reason: SIGSEGV
──────────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0xeff8c6f6 → brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4))()
[#1] 0xf0038220 → cs_linear_gradient_frag::run(glsl::FragmentShaderImpl*)()
[#2] 0xebade415 → draw_quad(int, Texture&, Texture&)()
[#3] 0xeaecc133 → DrawElementsInstanced()
[#4] 0xeaecbb18 → <swgl::swgl_fns::Context as gleam::gl::Gl>::draw_elements_instanced()
[#5] 0xefdc896d → webrender::device::gl::Device::draw_indexed_triangles_instanced_u16()
[#6] 0xeaeb6206 → webrender::renderer::Renderer::draw_render_target()
[#7] 0xeaec26db → webrender::renderer::Renderer::draw_frame()
[#8] 0xeaea966d → webrender::renderer::Renderer::render_impl()
[#9] 0xeae99d9f → webrender::renderer::Renderer::render()
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
#0  0xeff8c6f6 in brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4)) () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#1  0xf0038220 in cs_linear_gradient_frag::run(glsl::FragmentShaderImpl*) () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#2  0xebade415 in draw_quad(int, Texture&, Texture&) () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#3  0xeaecc133 in DrawElementsInstanced () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#4  0xeaecbb18 in <swgl::swgl_fns::Context as gleam::gl::Gl>::draw_elements_instanced () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#5  0xefdc896d in webrender::device::gl::Device::draw_indexed_triangles_instanced_u16 () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#6  0xeaeb6206 in webrender::renderer::Renderer::draw_render_target () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#7  0xeaec26db in webrender::renderer::Renderer::draw_frame () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#8  0xeaea966d in webrender::renderer::Renderer::render_impl () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#9  0xeae99d9f in webrender::renderer::Renderer::render () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#10 0xeae99606 in wr_renderer_render () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#11 0xea3828d8 in mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> const&, mozilla::TimeStamp const&, mozilla::wr::FrameReadyParams const&, mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, mozilla::wr::RendererStats*, bool*) () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#12 0xea2f8d30 in mozilla::wr::RenderThread::HandleFrameOneDoc(mozilla::wr::WrWindowId, mozilla::wr::FrameReadyParams const&, mozilla::Maybe<mozilla::wr::FramePublishId>) () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#13 0xea2f872b in mozilla::wr::RenderThread::HandleWrNotifierEvents(mozilla::wr::WrWindowId) () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#14 0xea2f8567 in mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId), true, (mozilla::RunnableKind)0, mozilla::wr::WrWindowId>::Run() () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#15 0xea173985 in NS_ProcessNextEvent(nsIThread*, bool) () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#16 0xea171deb in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#17 0xea99d00f in MessageLoop::Run() () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#18 0xea99c9ef in nsThread::ThreadFunc(void*) () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
#19 0xf7fa2395 in _pt_root () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libnspr4.so
#20 0x5659ab7e in set_alt_signal_stack_and_start(PthreadCreateParams*) ()
#21 0xf7a317ab in ?? () from /usr/lib32/libc.so.6
#22 0xf7acc5f8 in ?? () from /usr/lib32/libc.so.6

From the GDB output, it stopped at [#44] Id 31, Name: "Renderer", stopped 0xeff8c6f6 in brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4)) (), reason: SIGSEGV.

From the code it crashes at:

    178  SI vec4 fetchOffsetsFloat(const uint32_t* buf, I32 offset) {
 →  179    return pixel_float_to_vec4(*(Float*)&buf[offset.x], *(Float*)&buf[offset.y],
    180                               *(Float*)&buf[offset.z], *(Float*)&buf[offset.w]);
    181  }

From the GDB CPU registers instructions, from LLM analysis, here the summary:

You're hitting a SIGSEGV (segmentation fault) at this instruction:

0xeff8c6f6 → movaps xmm1, XMMWORD PTR [eax+edx*4]

This is attempting to:

1. Load a 16-byte aligned block of memory into xmm1
2. From the address calculated as: eax + edx * 4

So the effective address is:

[eax + edx * 4] = [0xe883bb2c + 0x0] = 0xe883bb2c

The calculated memory address, 0xe883bb2c, does not end in 0. This means it is not 16-byte aligned. When the movaps instruction attempted to read from this unaligned address, it violated the CPU's rules for that instruction, which triggered a general protection fault and caused the program to crash..

Thats reason on log_minidump_00.txt it crashes at SIGSEGV / SI_KERNEL (general protection fault) because it hit address 0xe883bb2c (which not 16-byte aligned)

Comment 14

[Irvan Kurniawan [:sourc7]]

Attachment: gdb_brush_linear_gradient.officialbuild.txt

Comment 15

[Irvan Kurniawan [:sourc7]]

Attachment: gdb_cs_linear_gradient_frag.disable-optimize.txt

Comment 16

[Irvan Kurniawan [:sourc7]]

Attachment: gdb_glsl_fetchoffsetsfloat.o2.txt

Comment 17

[Irvan Kurniawan [:sourc7]]

What happens is that we simply run out of memory, and WebRender itself OOMs in the memory allocator in a different thread

When on normal OOM scenarios or assertion failures, I usually receive minidumps mozalloc_abort, RustMozCrash, or RustHandleOOM.

However, in this case, the crash is SIGSEGV / SI_KERNEL, which is quite rare findings. From GDB instructions, analyzed it hit at address 0xe883bb2c (which not 16-byte aligned), so it shows SIGSEGV / SI_KERNEL and also reliable to hit the same.

Comment 18

[Irvan Kurniawan [:sourc7]]

When trying to find a regression using Mozregression and own Firefox build, I was able to reproduce the issue from 2023 build.

I haven’t investigated earlier builds from 2022 or 2021, as I have to adjust build system dependency breakages which would take more time.

Comment 19

[Lee Salzman [:lsalzman]]

(In reply to Irvan Kurniawan [:sourc7] from comment #18)

When trying to find a regression using Mozregression and own Firefox build, I was able to reproduce the issue from 2023 build.

I haven’t investigated earlier builds from 2022 or 2021, as I have to adjust build system dependency breakages which would take more time.

Most evidence points to this being an assertion from another thread, with the testcase merely just forcing one thread to run a statement repeatedly while the assertion is happening in another thread. Assertions can and will throw those signals to cause the abort, so this is not an abnormal result.

If it is merely a case of movaps signaling on an alignment issue, instead (which I still haven't managed to reproduce at all), then this just means that it is signaling when trying to do an unaligned access on zeroFetchBuf, but which is bounded and doesn't really represent a security issue by itself.

Either way, this would be a sec-low, I believe, since this is either just the OOM itself from the test page causing Rust to assert, or the OOM causes us to use bounds checking code in SWGL that could cause an unaligned access if the compiler allocated zeroFetchBuf to an unaligned address, but still just an intermittent crash subsequent to an OOM.

I could write up a patch to align the memory for zeroFetchBuf.

Comment 20

[Irvan Kurniawan [:sourc7]]

Attachment: gdb_firefox_nightly_32bit+info_threads.txt

(In reply to Lee Salzman [:lsalzman] from comment #19)

In GDB, run "info threads", and it will show that the crash is happening elsewhere via the MOZ_CrashSequence signature.

Hi :lsalzman, I've re-run gdb --args ./firefox --headless /tmp/testcase1.html on Firefox Nightly 32-bit, then after the crash, run "info threads" in GDB, here the logs:

gef➤  info threads
  Id   Target Id                                        Frame 
  1    Thread 0xf799e0c0 (LWP 261461) "firefox-bin"     0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  3    Thread 0xf76ffb40 (LWP 261467) "AsyncSi~lThread" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  4    Thread 0xf4660b40 (LWP 261470) "pool-spawner"    0xf7fc5579 in ?? ()
  5    Thread 0xf3e5fb40 (LWP 261471) "gmain"           0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  6    Thread 0xf365eb40 (LWP 261473) "pool-0"          0xf7fc5579 in ?? ()
  7    Thread 0xf2da9b40 (LWP 261474) "gdbus"           0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  8    Thread 0xf2530b40 (LWP 261475) "glean.dispatche" 0xf7fc5579 in ?? ()
  9    Thread 0xf478bb40 (LWP 261477) "IPC I/O Parent"  0xf7fc5579 in ?? ()
  10   Thread 0xf20ffb40 (LWP 261478) "Timer"           0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  11   Thread 0xf20beb40 (LWP 261479) "Netlink Monitor" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  12   Thread 0xf207db40 (LWP 261480) "Socket Thread"   0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  13   Thread 0xf203cb40 (LWP 261481) "IPDL Background" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  14   Thread 0xf1ffbb40 (LWP 261482) "Backgro~Pool #1" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  15   Thread 0xf1fbab40 (LWP 261483) "HTML5 Parser"    0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  16   Thread 0xf1f79b40 (LWP 261484) "StyleThread#1"   0xf7fc5579 in ?? ()
  17   Thread 0xf1f38b40 (LWP 261485) "StyleThread#2"   0xf7fc5579 in ?? ()
  18   Thread 0xf1ef7b40 (LWP 261486) "StyleThread#3"   0xf7fc5579 in ?? ()
  19   Thread 0xf1eb6b40 (LWP 261487) "StyleThread#4"   0xf7fc5579 in ?? ()
  20   Thread 0xf1e75b40 (LWP 261488) "StyleThread#5"   0xf7fc5579 in ?? ()
  21   Thread 0xf17ffb40 (LWP 261489) "BHMgr Monitor"   0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  22   Thread 0xf17beb40 (LWP 261490) "BHMgr Processor" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  23   Thread 0xf177db40 (LWP 261491) "pool-1"          0xf7fc5579 in ?? ()
  25   Thread 0xf1e28b40 (LWP 261493) "JS Watchdog"     0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  27   Thread 0xe1251b40 (LWP 261497) "Permission"      0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  28   Thread 0xe1a93b40 (LWP 261500) "firefox:disk$0"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  29   Thread 0xd0a5fb40 (LWP 261501) "firefox:sh0"     0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  30   Thread 0xd025eb40 (LWP 261503) "Softwar~cThread" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
* 31   Thread 0xd00ffb40 (LWP 261504) "Renderer"        0xeff8c6f6 in brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4)) () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so
  32   Thread 0xd00beb40 (LWP 261505) "WRWorker#0"      0xf7fc5579 in ?? ()
  33   Thread 0xcfebdb40 (LWP 261506) "WRWorker#1"      0xf7fc5579 in ?? ()
  34   Thread 0xcfaffb40 (LWP 261507) "WRWorker#2"      0xf7fc5579 in ?? ()
  35   Thread 0xcf6ffb40 (LWP 261508) "WRWorker#3"      0xf7fc5579 in ?? ()
  36   Thread 0xcf2ffb40 (LWP 261509) "WRWorkerLP#0"    0xf7fc5579 in ?? ()
  37   Thread 0xceeffb40 (LWP 261510) "WRWorkerLP#1"    0xf7fc5579 in ?? ()
  38   Thread 0xceaffb40 (LWP 261511) "WRWorkerLP#2"    0xf7fc5579 in ?? ()
  39   Thread 0xce6ffb40 (LWP 261512) "WRWorkerLP#3"    0xf7fc5579 in ?? ()
  40   Thread 0xce2ffb40 (LWP 261513) "WRWorkerLP#4"    0xf7fc5579 in ?? ()
  41   Thread 0xcdeffb40 (LWP 261514) "WRWorkerLP#5"    0xf7fc5579 in ?? ()
  42   Thread 0xcdaffb40 (LWP 261515) "WRWorkerLP#6"    0xf7fc5579 in ?? ()
  43   Thread 0xcd6ffb40 (LWP 261516) "WRWorkerLP#7"    0xf7fc5579 in ?? ()
  44   Thread 0xcd2ffb40 (LWP 261517) "WrGlyph~terizer" 0xf7fc5579 in ?? ()
  45   Thread 0xcfca0b40 (LWP 261518) "Compositor"      0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  46   Thread 0xcceffb40 (LWP 261519) "CanvasRenderer"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  47   Thread 0xcf87eb40 (LWP 261520) "ImageIO"         0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  48   Thread 0xcf0bbb40 (LWP 261521) "SandboxReporter" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  49   Thread 0xcf07ab40 (LWP 261522) "IPC Launch"      0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  50   Thread 0xcecfeb40 (LWP 261525) "BgIOThr~Pool #1" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  51   Thread 0xcecbdb40 (LWP 261526) "TRR Background"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  52   Thread 0xcec7cb40 (LWP 261528) "StreamTrans #1"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  53   Thread 0xce8feb40 (LWP 261529) "Cache2 I/O"      0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  54   Thread 0xce8bdb40 (LWP 261530) "Cookie"          0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  55   Thread 0xcc3ffb40 (LWP 261539) "TaskCon~ller #0" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  56   Thread 0xcc200b40 (LWP 261540) "TaskCon~ller #1" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  57   Thread 0xcc001b40 (LWP 261541) "TaskCon~ller #2" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  58   Thread 0xcbe02b40 (LWP 261542) "TaskCon~ller #3" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  59   Thread 0xcbc03b40 (LWP 261543) "TaskCon~ller #4" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  60   Thread 0xcba04b40 (LWP 261544) "TaskCon~ller #5" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  61   Thread 0xcb805b40 (LWP 261545) "TaskCon~ller #6" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  62   Thread 0xcb606b40 (LWP 261546) "TaskCon~ller #7" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  63   Thread 0xce87cb40 (LWP 261547) "StreamTrans #2"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  64   Thread 0xce4feb40 (LWP 261548) "Worker Launcher" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  65   Thread 0xce4bdb40 (LWP 261549) "QuotaManager IO" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  66   Thread 0xce47cb40 (LWP 261552) "FSBroker261523"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  67   Thread 0xcd878b40 (LWP 261554) "IndexedDB IO #1" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  69   Thread 0xcd46bb40 (LWP 261556) "DNS Resolver #1" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  71   Thread 0xcc9feb40 (LWP 261558) "StreamTrans #4"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  73   Thread 0xca969b40 (LWP 261560) "StreamTrans #6"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  75   Thread 0xca9dfb40 (LWP 261562) "DNS Resolver #2" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  77   Thread 0xc72ffb40 (LWP 261564) "DOM Worker"      0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  78   Thread 0xc687cb40 (LWP 261566) "GMPThread"       0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  79   Thread 0xc65ffb40 (LWP 261573) "ImageBridgeChld" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  80   Thread 0xc65beb40 (LWP 261574) "FSBroker261565"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  81   Thread 0xc657db40 (LWP 261576) "ProcessHangMon"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  82   Thread 0xcec11b40 (LWP 261582) "SwComposite"     0xf7fc5579 in ?? ()
  83   Thread 0xc653cb40 (LWP 261583) "WRScene~ilder#1" 0xf7fc5579 in ?? ()
  84   Thread 0xc633bb40 (LWP 261585) "WRScene~derLP#1" 0xf7fc5579 in ?? ()
  85   Thread 0xc613ab40 (LWP 261592) "WRRende~ckend#1" 0xf7fc5579 in ?? ()
  86   Thread 0xc54ffb40 (LWP 261606) "FSBroker261575"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  87   Thread 0xc54beb40 (LWP 261607) "AudioIP~ver RPC" 0xf7fc5579 in ?? ()
  88   Thread 0xc547db40 (LWP 261608) "AudioIP~allback" 0xf7fc5579 in ?? ()
  89   Thread 0xc543cb40 (LWP 261610) "AudioIP~ion RPC" 0xf7fc5579 in ?? ()
  90   Thread 0xc5363b40 (LWP 261612) "sqldb:b~lite #1" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  96   Thread 0xbcc7db40 (LWP 261618) "DNS Resolver #3" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  97   Thread 0xbcaffb40 (LWP 261619) "sqldb:p~lite #2" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  98   Thread 0xbcabeb40 (LWP 261622) "sqldb:c~lite #3" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  99   Thread 0xbca7db40 (LWP 261623) "sqldb:p~lite #4" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  100  Thread 0xc68ffb40 (LWP 261624) "DNS Resolver #4" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  101  Thread 0xc68beb40 (LWP 261626) "FSBroker261625"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  102  Thread 0xce035b40 (LWP 261630) "SwComposite"     0xf7fc5579 in ?? ()
  103  Thread 0xbb4ffb40 (LWP 261633) "WRScene~ilder#2" 0xf7fc5579 in ?? ()
  104  Thread 0xbb2feb40 (LWP 261634) "WRScene~derLP#2" 0xf7fc5579 in ?? ()
  105  Thread 0xbb0fdb40 (LWP 261635) "WRRende~ckend#2" 0xf7fc5579 in ?? ()
  106  Thread 0xbbe74b40 (LWP 261655) "RemoteLzyStream" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  107  Thread 0xbbeffb40 (LWP 261685) "URL Classifier"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  108  Thread 0xbbebeb40 (LWP 261690) "sqldb:d~lite #5" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  109  Thread 0xbae6bb40 (LWP 261692) "MemoryPoller"    0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  110  Thread 0xb71ffb40 (LWP 261710) "FSBroker261704"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  111  Thread 0xb71beb40 (LWP 261714) "sqldb:p~lite #6" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  115  Thread 0xb66ffb40 (LWP 261718) "glean.mps"       0xf7fc5579 in ?? ()
  116  Thread 0xbaefcb40 (LWP 261720) "FSBroker261719"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  117  Thread 0xbaebbb40 (LWP 261739) "SaveScripts"     0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  119  Thread 0xb6cffb40 (LWP 261763) "DNS Resolver #5" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  120  Thread 0xb6cbeb40 (LWP 261764) "DNS Resolver #6" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  121  Thread 0xb6869b40 (LWP 261765) "DNS Resolver #7" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  122  Thread 0xb63ccb40 (LWP 261766) "DNS Resolver #8" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  123  Thread 0xb638bb40 (LWP 261767) "DNS Resolver #9" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  124  Thread 0xb634ab40 (LWP 261768) "DNS Res~ver #10" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  125  Thread 0xb50ffb40 (LWP 261769) "DNS Res~ver #11" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  126  Thread 0xb50beb40 (LWP 261770) "DNS Res~ver #12" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  127  Thread 0xb64feb40 (LWP 261771) "DNS Res~ver #13" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  128  Thread 0xb64bdb40 (LWP 261772) "DNS Res~ver #14" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  130  Thread 0xc08beb40 (LWP 261789) "FSBroker261786"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  131  Thread 0xcd4acb40 (LWP 261798) "FSBroker261787"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  132  Thread 0xc79ffb40 (LWP 261801) "FSBroker261800"  0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  133  Thread 0xcc9bdb40 (LWP 261861) "SSL Cert #4"     0xf7a3a67b in ?? () from /usr/lib32/libc.so.6
  139  Thread 0xb717db40 (LWP 261911) "UpdateProcessor" 0xf7a3a67b in ?? () from /usr/lib32/libc.so.6

The GDB shows the current thread is * 31 Thread 0xd00ffb40 (LWP 261504) "Renderer" 0xeff8c6f6 in brush_linear_gradient_ALPHA_PASS_frag::fetch_from_gpu_buffer_2f(int __vector(4)) () from /home/sourc7/Programs/firefox-i686-nightly-latest2/libxul.so

Comment 21

[Lee Salzman [:lsalzman]]

Attachment: (secure)

Comment 22

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/b7885fbd8611
https://hg.mozilla.org/integration/autoland/rev/6701869e3188
r=aosmond

Comment 23

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/6701869e3188

Comment 24

[Daniel Veditz [:dveditz]]

(In reply to Irvan Kurniawan [:sourc7] from comment #18)

When trying to find a regression using Mozregression and own Firefox build, I was able to reproduce the issue from 2023 build. I haven’t investigated earlier builds from 2022 or 2021 [...]

It's rarely worth the effort to pin down a regression that old. Recent-ish regressions are worth tracking down for several reasons, but for one thing the author of the regressing patch is most likely to still have the code fresh in their mind and is in the best position to fix the regression safely. But beyond that the main question is "Which supported releases are affected and need a patch?" Once we get to "we have to patch everything" we don't need to keep searching for the cause except to satisfy curiosity.

I agree with the sec-low

Comment 25

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR140 approval when you get a chance.

Comment 26

[Lee Salzman [:lsalzman]]

Comment on attachment 9500313 [details]
(secure)

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: OOM crash
• User impact if declined:
• Fix Landed on Version:
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky):

Comment 27

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9500313 [details]
(secure)

Approved for 140.2esr.

Comment 28

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/ff46b5cfd33a

Comment 29

[Catalin Sasca, Desktop Test Engineering [:csasca]]

Tried reproducing this issue on two different machines with Ubuntu 24.04 and 22.04 (one physical and one VM) but had o luck in doing so with 32 bit Firefox. After further talks with Lee, we dropped trying to reproduce/verify this as it is just an OOM issue.