2052609 - Hit MOZ_CRASH(index out of bounds: the len is 7 but the index is 4294967295) at gfx/wr/webrender/src/prepare.rs:1473

Status: VERIFIED FIXED

(Core :: Graphics: WebRender, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260529-08141cafdb33 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(index out of bounds: the len is 7 but the index is 4294967295) at gfx/wr/webrender/src/prepare.rs:1277

#0 0x6c0f683e0198 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x6c0f683e0198 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:402:3
#2 0x6c0f683e0198 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:17:3
#3 0x6c0f683df71c in mozglue_static::panic_hook /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:99:9
#4 0x6c0f683e00f5 in <mozglue_static::panic_hook as core::ops::function::Fn<(&std::panic::PanicHookInfo,)>>::call /builds/worker/fetches/rust/library/core/src/ops/function.rs:79:5
#5 0x6c0f6ca7126d in std::panicking::panic_with_hook std.47cca14ab0a19d89-cgu.14:0:0
#6 0x6c0f6ca3e8f7 in std::panicking::panic_handler::{closure#0} std.47cca14ab0a19d89-cgu.02:0:0
#7 0x6c0f6ca3b688 in std::sys::backtrace::__rust_end_short_backtrace::<std::panicking::panic_handler::{closure#0}, !> std.47cca14ab0a19d89-cgu.02:0:0
#8 0x6c0f6ca7065c in __rustc::rust_begin_unwind std.47cca14ab0a19d89-cgu.14:0:0
#9 0x6c0f6ca958bb in core::panicking::panic_fmt core.1abbfe9bb5ef3e72-cgu.13:0:0
#10 0x6c0f6ca9570b in core::panicking::panic_bounds_check core.1abbfe9bb5ef3e72-cgu.13:0:0
#11 0x6c0f6707ee2f in <usize as core::slice::index::SliceIndex<[webrender::picture::PictureScratch]>>::index_mut /builds/worker/fetches/rust/library/core/src/slice/index.rs:278:14
#12 0x6c0f6707ee2f in <[webrender::picture::PictureScratch] as core::ops::index::IndexMut<usize>>::index_mut /builds/worker/fetches/rust/library/core/src/slice/index.rs:31:15
#13 0x6c0f6707ee2f in <alloc::vec::Vec<webrender::picture::PictureScratch> as core::ops::index::IndexMut<usize>>::index_mut /builds/worker/fetches/rust/library/alloc/src/vec/mod.rs:3748:9
#14 0x6c0f6707ee2f in <webrender::prim_store::storage::Storage<webrender::picture::PictureScratch> as core::ops::index::IndexMut<webrender::prim_store::storage::Index<webrender::picture::PictureScratch>>>::index_mut /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prim_store/storage.rs:187:23
#15 0x6c0f6707ee2f in webrender::prepare::prepare_prim_for_render /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:1277:44
#16 0x6c0f670604e3 in webrender::prepare::prepare_primitives /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:171:17
#17 0x6c0f670604e3 in webrender::prepare::prepare_picture /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:100:5
#18 0x6c0f66cb07af in <webrender::frame_builder::FrameBuilder>::build_layer_screen_rects_and_cull_layers /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:616:13
#19 0x6c0f66cb07af in <webrender::frame_builder::FrameBuilder>::build /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:711:14
#20 0x6c0f66ba43e9 in <webrender::render_backend::Document>::build_frame /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:513:44
#21 0x6c0f66ce406d in <webrender::render_backend::RenderBackend>::update_document /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1648:45
#22 0x6c0f66cc5acf in <webrender::render_backend::RenderBackend>::prepare_transactions /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1475:33
#23 0x6c0f66cc5acf in <webrender::render_backend::RenderBackend>::process_api_msg /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1334:22
#24 0x6c0f6613524b in <webrender::render_backend::RenderBackend>::run /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:848:26
#25 0x6c0f6613524b in webrender::renderer::init::create_webrender_instance::{closure#6} /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/init.rs:724:17
#26 0x6c0f6613524b in std::sys::backtrace::__rust_begin_short_backtrace::<webrender::renderer::init::create_webrender_instance::{closure#6}, ()> /builds/worker/fetches/rust/library/std/src/sys/backtrace.rs:166:18
#27 0x6c0f66b333f6 in std::thread::lifecycle::spawn_unchecked::<webrender::renderer::init::create_webrender_instance::{closure#6}, ()>::{closure#1}::{closure#0} /builds/worker/fetches/rust/library/std/src/thread/lifecycle.rs:91:13
#28 0x6c0f66b333f6 in <core::panic::unwind_safe::AssertUnwindSafe<std::thread::lifecycle::spawn_unchecked<webrender::renderer::init::create_webrender_instance::{closure#6}, ()>::{closure#1}::{closure#0}> as core::ops::function::FnOnce<()>>::call_once /builds/worker/fetches/rust/library/core/src/panic/unwind_safe.rs:274:9
#29 0x6c0f66b333f6 in std::panicking::catch_unwind::do_call::<core::panic::unwind_safe::AssertUnwindSafe<std::thread::lifecycle::spawn_unchecked<webrender::renderer::init::create_webrender_instance::{closure#6}, ()>::{closure#1}::{closure#0}>, ()> /builds/worker/fetches/rust/library/std/src/panicking.rs:581:40
#30 0x6c0f66b333f6 in std::panicking::catch_unwind::<(), core::panic::unwind_safe::AssertUnwindSafe<std::thread::lifecycle::spawn_unchecked<webrender::renderer::init::create_webrender_instance::{closure#6}, ()>::{closure#1}::{closure#0}>> /builds/worker/fetches/rust/library/std/src/panicking.rs:544:19
#31 0x6c0f66b333f6 in std::panic::catch_unwind::<core::panic::unwind_safe::AssertUnwindSafe<std::thread::lifecycle::spawn_unchecked<webrender::renderer::init::create_webrender_instance::{closure#6}, ()>::{closure#1}::{closure#0}>, ()> /builds/worker/fetches/rust/library/std/src/panic.rs:359:14
#32 0x6c0f66b333f6 in std::thread::lifecycle::spawn_unchecked::<webrender::renderer::init::create_webrender_instance::{closure#6}, ()>::{closure#1} /builds/worker/fetches/rust/library/std/src/thread/lifecycle.rs:89:26
#33 0x6c0f66b333f6 in <std::thread::lifecycle::spawn_unchecked<webrender::renderer::init::create_webrender_instance::{closure#6}, ()>::{closure#1} as core::ops::function::FnOnce<()>>::call_once::{shim:vtable#0} /builds/worker/fetches/rust/library/core/src/ops/function.rs:250:5
#34 0x6c0f6ca61a7d in <std::sys::thread::unix::Thread>::new::thread_start std.47cca14ab0a19d89-cgu.09:0:0
#35 0x64e64cbbbcd6 in asan_thread_start(void*) _asan_rtl_:28
#36 0x700f7a69caa3 in start_thread ./nptl/pthread_create.c:447:8
#37 0x700f7a729c6b in clone3 ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0

Comment 1

[Tyson Smith [:tsmith]]

Attachment: part.html

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260705204834-2cf4824879e0.
The bug appears to have been introduced in the following build range:

Start: ce8b56d360b85df10b209b17dbd842312823e364 (20260430221658)
End: 4230efb6573f6d8530a626696c6c2b3944af31d5 (20260430234106)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=ce8b56d360b85df10b209b17dbd842312823e364&tochange=4230efb6573f6d8530a626696c6c2b3944af31d5

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Based on comment #2, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:nical, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit BugBot documentation.

Comment 4

[Nicolas Silva [:nical]]

I'm unable to reproduce this. Glenn, could this have been fixed by a recent change? It's an invalid scratch buffer handle used in the picture path.

Comment 5

[Glenn Watson [:gw]]

Attachment: Bug 2052609 - Don't cache invalid picture-scratch handles in prepare_picture

An invisible picture yields no scratch, but its slot was memoized as
Some(INVALID). On a re-visit (e.g. a view-transition snapshot picture also
reached in the main pass) the cache hit handed that INVALID handle back as
if valid, and it later indexed scratch.frame.pictures out of bounds. Only
cache successfully-prepared pictures; take_context's None path is a cheap,
side-effect-free query, so re-consulting it on a repeat visit is fine.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/d5057ec1f3c5
https://hg.mozilla.org/integration/autoland/rev/288db36c347c
Don't cache invalid picture-scratch handles in prepare_picture r=gfx-reviewers,lsalzman

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/58ecbd12a427
https://hg.mozilla.org/integration/autoland/rev/bedd1594cf92
Revert "Bug 2052609 - Don't cache invalid picture-scratch handles in prepare_picture r=gfx-reviewers,lsalzman" for causing reftest failures

Comment 8

[rperta]

Backed out for causing reftest failures
Backout link
Push with failures
Failure log(s)

Comment 9

[Glenn Watson [:gw]]

Fixed the asserts annotation for this test

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/96e3f59d9eaf
https://hg.mozilla.org/integration/autoland/rev/26c8191dfbef
Don't cache invalid picture-scratch handles in prepare_picture r=gfx-reviewers,lsalzman

Comment 11

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/26c8191dfbef

Comment 12

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260708035832-183d23dc3859.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.