1982738 - Assertion failure: [GFX1 39]: Failed to get ScaledFont entry for FontInstanceKey 13, at /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Logging.h:811

Status: NEW

(Core :: Graphics: Text, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing 20250615-2408bee8bcc4 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: [GFX1 39]: Failed to get ScaledFont entry for FontInstanceKey 13, at /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Logging.h:811

#0 0x7f7c3ebc52a8 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
#1 0x7f7c3ebc52a8 in mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::WriteLog(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Logging.h:812:9
#2 0x7f7c3ebc51c4 in mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::Flush() /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Logging.h:276:7
#3 0x7f7c3f2b3784 in ~Log /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Logging.h:269:12
#4 0x7f7c3f2b3784 in GetScaledFont /builds/worker/checkouts/gecko/gfx/webrender_bindings/Moz2DImageRenderer.cpp:287:5
#5 0x7f7c3f2b3784 in Moz2DRenderCallback /builds/worker/checkouts/gecko/gfx/webrender_bindings/Moz2DImageRenderer.cpp:426:11
#6 0x7f7c3f2b3784 in wr_moz2d_render_cb /builds/worker/checkouts/gecko/gfx/webrender_bindings/Moz2DImageRenderer.cpp:476:10
#7 0x7f7c46f47de3 in webrender_bindings::moz2d_renderer::rasterize_blob::_$u7b$$u7b$closure$u7d$$u7d$::h88a936067325749f /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/moz2d_renderer.rs:598:16
#8 0x7f7c46f47de3 in webrender_bindings::moz2d_renderer::autoreleasepool::hcfa0899c41904804 /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/moz2d_renderer.rs:580:9
#9 0x7f7c46f47de3 in webrender_bindings::moz2d_renderer::rasterize_blob::h3f2ba04149278722 /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/moz2d_renderer.rs:596:18
#10 0x7f7c46f475cf in core::ops::function::FnMut::call_mut::h2f55a3b635773972 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:166:5
#11 0x7f7c46f475cf in core::iter::adapters::map::map_try_fold::_$u7b$$u7b$closure$u7d$$u7d$::h09de93bcd8639c1f /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/adapters/map.rs:95:28
#12 0x7f7c46f475cf in _$LT$alloc..vec..into_iter..IntoIter$LT$T$C$A$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::try_fold::h44bc82a59d8539cc /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/vec/into_iter.rs:346:25
#13 0x7f7c46f475cf in _$LT$core..iter..adapters..map..Map$LT$I$C$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::try_fold::heda10ba9afe6529f /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/adapters/map.rs:121:9
#14 0x7f7c46f475cf in _$LT$I$u20$as$u20$alloc..vec..in_place_collect..SpecInPlaceCollect$LT$T$C$I$GT$$GT$::collect_in_place::h55022e3dedd1587f /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/vec/in_place_collect.rs:380:13
#15 0x7f7c46f475cf in alloc::vec::in_place_collect::from_iter_in_place::h2a92f93753336bb8 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/vec/in_place_collect.rs:271:9
#16 0x7f7c46f475cf in alloc::vec::in_place_collect::from_iter_in_place$u7b$$u7b$reify.shim$u7d$$u7d$::h9a8c4a9f28a4c24e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/vec/in_place_collect.rs:251:1
#17 0x7f7c46f475cf in alloc::vec::in_place_collect::_$LT$impl$u20$alloc..vec..spec_from_iter..SpecFromIter$LT$T$C$I$GT$$u20$for$u20$alloc..vec..Vec$LT$T$GT$$GT$::from_iter::h47fa592fa8e420ae /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/vec/in_place_collect.rs:246:9
#18 0x7f7c46f475cf in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$core..iter..traits..collect..FromIterator$LT$T$GT$$GT$::from_iter::hf5f897ce4cfd34da /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/vec/mod.rs:3424:9
#19 0x7f7c46f475cf in core::iter::traits::iterator::Iterator::collect::h21c59352e76a5e6e /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:1971:9
#20 0x7f7c46f475cf in _$LT$webrender_bindings..moz2d_renderer..Moz2dBlobRasterizer$u20$as$u20$webrender_api..image..AsyncBlobImageRasterizer$GT$::rasterize::h8fe347c1c86b8548 /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/moz2d_renderer.rs:564:54
#21 0x7f7c47443b63 in webrender::scene_builder_thread::rasterize_blobs::hea58589cbeb31ada /builds/worker/checkouts/gecko/gfx/wr/webrender/src/scene_builder_thread.rs:46:36
#22 0x7f7c46fb8ad0 in webrender::scene_builder_thread::LowPrioritySceneBuilderThread::process_transaction::h9fa8c836c4fdffb7 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/scene_builder_thread.rs:857:9
#23 0x7f7c46fb8ad0 in webrender::scene_builder_thread::LowPrioritySceneBuilderThread::run::_$u7b$$u7b$closure$u7d$$u7d$::hcc5e954c6cc7759d /builds/worker/checkouts/gecko/gfx/wr/webrender/src/scene_builder_thread.rs:835:36
#24 0x7f7c46fb8ad0 in core::iter::adapters::map::map_fold::_$u7b$$u7b$closure$u7d$$u7d$::h4ed5f20082f0f813 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/adapters/map.rs:88:28
#25 0x7f7c46fb8ad0 in core::iter::traits::iterator::Iterator::fold::h3911e0a32137174c /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:2546:21
#26 0x7f7c46fb8ad0 in _$LT$core..iter..adapters..map..Map$LT$I$C$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::fold::h1ce2a9b47cb1617d /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/adapters/map.rs:128:9
#27 0x7f7c46fb8ad0 in core::iter::traits::iterator::Iterator::for_each::hdcfe65469ab339cf /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:800:9
#28 0x7f7c46fb8ad0 in alloc::vec::Vec$LT$T$C$A$GT$::extend_trusted::hcbb162c4f5c79ec7 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/vec/mod.rs:3565:17
#29 0x7f7c46fb8ad0 in _$LT$alloc..vec..Vec$LT$T$C$A$GT$$u20$as$u20$alloc..vec..spec_extend..SpecExtend$LT$T$C$I$GT$$GT$::spec_extend::hc840f64134b0b1ec /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/vec/spec_extend.rs:29:9
#30 0x7f7c46fb8ad0 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..spec_from_iter_nested..SpecFromIterNested$LT$T$C$I$GT$$GT$::from_iter::hd257e2cfa7e5f5b7 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/vec/spec_from_iter_nested.rs:62:9
#31 0x7f7c46fb8ad0 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..spec_from_iter..SpecFromIter$LT$T$C$I$GT$$GT$::from_iter::h1277e6ba8a9562e5 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/vec/spec_from_iter.rs:34:9
#32 0x7f7c46fb8ad0 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$core..iter..traits..collect..FromIterator$LT$T$GT$$GT$::from_iter::ha6955e9a78c174d3 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/alloc/src/vec/mod.rs:3424:9
#33 0x7f7c46fb8ad0 in core::iter::traits::iterator::Iterator::collect::hf4334571cf798c80 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:1971:9
#34 0x7f7c46fb8ad0 in webrender::scene_builder_thread::LowPrioritySceneBuilderThread::run::hbc06eb6c19b21e0d /builds/worker/checkouts/gecko/gfx/wr/webrender/src/scene_builder_thread.rs:836:26
#35 0x7f7c46fb8ad0 in webrender::renderer::init::create_webrender_instance::_$u7b$$u7b$closure$u7d$$u7d$::hca01ecc1b545cbaf /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/init.rs:655:13
#36 0x7f7c46fb8ad0 in std::sys::backtrace::__rust_begin_short_backtrace::h49ab54bf38cd736b /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys/backtrace.rs:152:18
#37 0x7f7c46fc6c30 in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h5d24e0e5c2882211 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:559:17
#38 0x7f7c46fc6c30 in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hbfd5a487a5a463d3 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/panic/unwind_safe.rs:272:9
#39 0x7f7c46fc6c30 in std::panicking::try::do_call::h1a53fced17857087 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:587:40
#40 0x7f7c46fc6c30 in std::panicking::try::h79712b37262f5dfd /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:550:19
#41 0x7f7c46fc6c30 in std::panic::catch_unwind::haf70bddf192711d3 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:358:14
#42 0x7f7c46fc6c30 in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::hbb1d0dacf5727121 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:557:30
#43 0x7f7c46fc6c30 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h8f99ecd13118fea9 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
#44 0x7f7c490fba8a in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h292d1663b0785fda /rustc/05f9846f893b09a1be1fc8560e33fc3c815cfecb/library/alloc/src/boxed.rs:1976:9
#45 0x7f7c490fba8a in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h9d4af7b531852d72 /rustc/05f9846f893b09a1be1fc8560e33fc3c815cfecb/library/alloc/src/boxed.rs:1976:9
#46 0x7f7c490fba8a in std::sys::pal::unix::thread::Thread::new::thread_start::hcc5ed016d554f327 /rustc/05f9846f893b09a1be1fc8560e33fc3c815cfecb/library/std/src/sys/pal/unix/thread.rs:106:17
#47 0x7f7c52e9caa3 in start_thread ./nptl/pthread_create.c:447:8
#48 0x7f7c52f29c3b in clone3 ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0

Comment 1

[Erich Gubler [:ErichDonGubler] (he/him)]

This doesn't seem too severe, based on the low report count in crash data. Classifying as S3.

Lee, maybe this is an easy fix? 🤔