2052341 - Hit MOZ_CRASH(attempt to subtract with overflow) at /builds/worker/checkouts/gecko/third_party/rust/euclid/src/point.rs:611

Status: VERIFIED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260623-2bd40f4e8d68 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(attempt to subtract with overflow) at /builds/worker/checkouts/gecko/third_party/rust/euclid/src/point.rs:611

#0 0x7fffeb48c0af in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7fffeb48c0af in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:402:3
#2 0x7fffeb48c0af in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:17:3
#3 0x7fffeb48bae1 in mozglue_static::panic_hook /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:99:9
#4 0x7fffeb48c03b in <mozglue_static::panic_hook as core::ops::function::Fn<(&std::panic::PanicHookInfo,)>>::call /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:79:5
#5 0x7fffecfac4a1 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::h575effa6ce691fba /rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library/alloc/src/boxed.rs:2220:9
#6 0x7fffecfac4a1 in std::panicking::panic_with_hook::h0fc23abecf35c6bd /rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library/std/src/panicking.rs:833:13
#7 0x7fffecfac269 in std::panicking::panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::ha111c1a3ccf85d19 /rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library/std/src/panicking.rs:691:13
#8 0x7fffecfa6748 in std::sys::backtrace::__rust_end_short_backtrace::h41d63216e1ba5fa4 /rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library/std/src/sys/backtrace.rs:182:18
#9 0x7fffecf9065c in __rustc::rust_begin_unwind /rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library/std/src/panicking.rs:689:5
#10 0x7fffecfea60b in core::panicking::panic_fmt::hc13412975f563dde /rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library/core/src/panicking.rs:80:14
#11 0x7fffecfea298 in core::panicking::panic_const::panic_const_sub_overflow::h8c581caf7eaeb99e /rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library/core/src/panicking.rs:175:17
#12 0x7fffead073cd in _$LT$i32$u20$as$u20$core..ops..arith..Sub$GT$::sub::hedeb4a9372d02367 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/arith.rs:218:45
#13 0x7fffead073cd in _$LT$euclid..point..Point2D$LT$T$C$U$GT$$u20$as$u20$core..ops..arith..Sub$GT$::sub::h1b2b1eec504ec36d /builds/worker/checkouts/gecko/third_party/rust/euclid/src/point.rs:611:14
#14 0x7fffead073cd in euclid::box2d::Box2D$LT$T$C$U$GT$::size::h05fa3b33855a28ce /builds/worker/checkouts/gecko/third_party/rust/euclid/src/box2d.rs:340:9
#15 0x7fffead073cd in webrender::border_image::add_border_segment::h20c81c14f8ad6026 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/border_image.rs:348:18
#16 0x7fffead073cd in webrender::border_image::for_each_border_image_segment::h14c7f5cab7bf090f /builds/worker/checkouts/gecko/gfx/wr/webrender/src/border_image.rs:163:5
#17 0x7fffead073cd in webrender::border_image::prepare_border_image_nine_patch::h203900a1ad1753c7 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/border_image.rs:55:5
#18 0x7fffead073cd in webrender::prepare::prepare_prim_for_render::h853929568e3574d3 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:798:13
#19 0x7fffeacf95e2 in webrender::prepare::prepare_primitives::h88d10959abd21310 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:170:17
#20 0x7fffeacf95e2 in webrender::prepare::prepare_picture::h428c28a4d0ee073b /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:99:5
#21 0x7fffeaae5c59 in webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::h044e44637bc96f48 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:616:13
#22 0x7fffeaae5c59 in webrender::frame_builder::FrameBuilder::build::hf03b85e67c8affe5 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:711:14
#23 0x7fffeab45a20 in webrender::render_backend::Document::build_frame::he3e2aa1a32cbfed8 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:513:44
#24 0x7fffeab2d7fd in webrender::render_backend::RenderBackend::update_document::ha5f4c899518bbedd /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1648:45
#25 0x7fffeab20182 in webrender::render_backend::RenderBackend::prepare_transactions::h239cf190ad93fd5d /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1475:33
#26 0x7fffeab20182 in webrender::render_backend::RenderBackend::process_api_msg::h8cee09684eeec5c0 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1334:22
#27 0x7fffea6fb8c6 in webrender::render_backend::RenderBackend::run::hb21d2bb08b58ffa8 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:848:26
#28 0x7fffea6fb8c6 in webrender::renderer::init::create_webrender_instance::_$u7b$$u7b$closure$u7d$$u7d$::hbcf493e25c8147fc /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/init.rs:724:17
#29 0x7fffea6fb8c6 in std::sys::backtrace::__rust_begin_short_backtrace::h1573f39ca58724e1 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys/backtrace.rs:166:18
#30 0x7fffea708e50 in std::thread::lifecycle::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::ha2577b343c239bc7 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/lifecycle.rs:91:13
#31 0x7fffea708e50 in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hf71b49da4609741d /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/panic/unwind_safe.rs:274:9
#32 0x7fffea708e50 in std::panicking::catch_unwind::do_call::h3c79d940ed732e8f /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:581:40
#33 0x7fffea708e50 in std::panicking::catch_unwind::hd0e0f2d67d744579 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:544:19
#34 0x7fffea708e50 in std::panic::catch_unwind::ha283e5178fbf1280 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:359:14
#35 0x7fffea708e50 in std::thread::lifecycle::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h6d584be472d3c547 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/lifecycle.rs:89:26
#36 0x7fffea708e50 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h1894d8293f867bd5 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
#37 0x7fffecfa4a9e in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::hf477931d93d2e366 /rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library/alloc/src/boxed.rs:2206:9
#38 0x7fffecfa4a9e in std::sys::thread::unix::Thread::new::thread_start::h96f969bf98c6e59d /rustc/e408947bfd200af42db322daf0fadfe7e26d3bd1/library/std/src/sys/thread/unix.rs:130:17
#39 0x7ffff7abbac2 in start_thread ./nptl/pthread_create.c:442:8

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260702212026-c9b51eea20db.
The bug appears to have been introduced in the following build range:

Start: 451d379b815e444275a4c62867d0fb73f8cb95ad (20260617201419)
End: 4e93ea6701ca33fad5ca7a501359c75f93568426 (20260617201818)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=451d379b815e444275a4c62867d0fb73f8cb95ad&tochange=4e93ea6701ca33fad5ca7a501359c75f93568426

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

:nical, since you are the author of the regressor, bug 2025264, could you take a look?

For more information, please visit BugBot documentation.

Comment 3

[Nicolas Silva [:nical]]

Attachment: Bug 2052341 - Guard against empty nine-patches. r=#gfx-reviewers

Early-out before we get into NaN/Overflow territory.

Comment 4

[Tyson Smith [:tsmith]]

This issue has also been reported via live site testing.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/1ca995a80d22
https://hg.mozilla.org/integration/autoland/rev/313dbf7d96d4
Guard against empty nine-patches. r=gfx-reviewers,lsalzman

Comment 6

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/313dbf7d96d4

Comment 7

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260706214124-843b141a4b58.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.