Closed Bug 2072292 Opened 1 day ago Closed 21 hours ago

Hit MOZ_CRASH(attempt to add with overflow) at gfx/wr/webrender_api/src/display_list.rs:941

Categories

(Core :: Graphics: WebRender, defect)

Product:
Core
Component:
Graphics: WebRender
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 2072044
Tracking Flags:
Tracking Status
firefox-esr140 --- unaffected
firefox-esr153 --- unaffected
firefox156 --- affected
firefox157 --- affected
firefox158 --- affected

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(1 file)

Testcase
136 bytes, text/html
Details

Testcase found while fuzzing mozilla-central rev bca8737c308d (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework pipx --upgrade
$ python -m pipx ensurepath
$ fuzzfetch --build bca8737c308d --debug --fuzzing  -n firefox
$ grizzly-replay-bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(attempt to add with overflow) at gfx/wr/webrender_api/src/display_list.rs:941

    ==137678==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x74e1fc7ead6f bp 0x7ffce3534140 sp 0x7ffce3534130 T137678)
    ==137678==The signal is caused by a WRITE memory access.
    ==137678==Hint: address points to the zero page.
        #0 0x74e1fc7ead6f in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
        #1 0x74e1fc7ead6f in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:402:3
        #2 0x74e1fc7ead6f in RustMozCrash /mozglue/static/rust/wrappers.cpp:17:3
        #3 0x74e1fc7ea4f1 in mozglue_static::panic_hook /mozglue/static/rust/lib.rs:99:9
        #4 0x74e1fc7eacfb in <mozglue_static::panic_hook as core::ops::function::Fn<(&std::panic::PanicHookInfo,)>>::call /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:79:5
        #5 0x74e1fe34ed91 in <alloc::boxed::Box<dyn for<'a, 'b> core::ops::function::Fn<(&'a std::panic::PanicHookInfo<'b>,), Output = ()> + core::marker::Sync + core::marker::Send> as core::ops::function::Fn<(&std::panic::PanicHookInfo,)>>::call /rustc/59807616e1fa2540724bfbac14d7976d7e4a3860/library/alloc/src/boxed.rs:2254:9
        #6 0x74e1fe34ed91 in std::panicking::panic_with_hook /rustc/59807616e1fa2540724bfbac14d7976d7e4a3860/library/std/src/panicking.rs:833:13
        #7 0x74e1fe33a899 in std::panicking::panic_handler::{closure#0} /rustc/59807616e1fa2540724bfbac14d7976d7e4a3860/library/std/src/panicking.rs:691:13
        #8 0x74e1fe331d18 in std::sys::backtrace::__rust_end_short_backtrace::<std::panicking::panic_handler::{closure#0}, !> /rustc/59807616e1fa2540724bfbac14d7976d7e4a3860/library/std/src/sys/backtrace.rs:182:18
        #9 0x74e1fe33b66c in __rustc::rust_begin_unwind /rustc/59807616e1fa2540724bfbac14d7976d7e4a3860/library/std/src/panicking.rs:689:5
        #10 0x74e1fe373acb in core::panicking::panic_fmt /rustc/59807616e1fa2540724bfbac14d7976d7e4a3860/library/core/src/panicking.rs:80:14
        #11 0x74e1fe374ad8 in core::panicking::panic_const::panic_const_add_overflow /rustc/59807616e1fa2540724bfbac14d7976d7e4a3860/library/core/src/panicking.rs:175:17
        #12 0x74e1fc0d21fe in _$LT$webrender_api..display_list..AuOffset$u20$as$u20$core..ops..arith..Add$GT$::add::h71da6f949b203aec /gfx/wr/webrender_api/src/display_list.rs:941:23
        #13 0x74e1fc0d21fe in webrender_api::display_list::DisplayListBuilder::define_scroll_frame::hd6b8851172e11acf /gfx/wr/webrender_api/src/display_list.rs:2420:52
        #14 0x74e1fb923049 in wr_dp_define_scroll_layer /gfx/webrender_bindings/src/bindings.rs:3515:57
        #15 0x74e1f314d4b6 in mozilla::wr::DisplayListBuilder::DefineScrollLayer(mozilla::ActiveScrolledRoot const*, unsigned long const&, mozilla::Maybe<mozilla::wr::WrSpatialId> const&, mozilla::wr::Box2D<float, mozilla::wr::LayoutPixel> const&, mozilla::wr::Box2D<float, mozilla::wr::LayoutPixel> const&, mozilla::wr::Vector2D<float, mozilla::wr::LayoutPixel> const&, unsigned long, mozilla::wr::HasScrollLinkedEffect) /builds/worker/workspace/obj-build/gfx/webrender_bindings/./../../../../checkouts/gecko/gfx/webrender_bindings/WebRenderAPI.cpp:1417:16
        #16 0x74e1f2c46020 in mozilla::layers::ClipManager::DefineSpatialNodes(mozilla::nsDisplayListBuilder*, mozilla::ActiveScrolledRoot const*, mozilla::nsDisplayItem*) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/ClipManager.cpp:629:25
        #17 0x74e1f2c44a39 in mozilla::layers::ClipManager::SwitchItem(mozilla::nsDisplayListBuilder*, mozilla::nsDisplayItem*) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/ClipManager.cpp:248:9
        #18 0x74e1f2c95a84 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:2252:43
        #19 0x74e1f807f29b in CreateWebRenderCommandsNewClipListOption /builds/worker/workspace/obj-build/layout/painting/./../../../../checkouts/gecko/layout/painting/nsDisplayList.cpp:4927:30
        #20 0x74e1f807f29b in CreateWebRenderCommands /builds/worker/workspace/obj-build/layout/painting/./../../../../checkouts/gecko/layout/painting/nsDisplayList.h:4997:12
        #21 0x74e1f807f29b in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*, bool) /builds/worker/workspace/obj-build/layout/painting/./../../../../checkouts/gecko/layout/painting/nsDisplayList.cpp:5602:29
        #22 0x74e1f8080f82 in mozilla::nsDisplayOwnLayer::CreateWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::layers::RenderRootStateManager*, mozilla::nsDisplayListBuilder*) /builds/worker/workspace/obj-build/layout/painting/./../../../../checkouts/gecko/layout/painting/nsDisplayList.h:5511:12
        #23 0x74e1f2c97c28 in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommands(mozilla::nsDisplayItem*, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::layers::StackingContextHelper const&, mozilla::nsDisplayListBuilder*) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1945:49
        #24 0x74e1f2c95afb in mozilla::layers::WebRenderCommandBuilder::CreateWebRenderCommandsFromDisplayList(mozilla::nsDisplayList*, mozilla::nsDisplayItem*, mozilla::nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, bool) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:2273:7
        #25 0x74e1f2c944ba in mozilla::layers::WebRenderCommandBuilder::BuildWebRenderCommands(mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&, mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, mozilla::layers::WebRenderScrollData&, WrFiltersHolder&&) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/WebRenderCommandBuilder.cpp:1830:5
        #26 0x74e1f2ca8acc in mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer(mozilla::nsDisplayList*, mozilla::nsDisplayListBuilder*, WrFiltersHolder&&, mozilla::layers::WebRenderBackgroundData*, double, bool) /builds/worker/workspace/obj-build/gfx/layers/./../../../../checkouts/gecko/gfx/layers/wr/WebRenderLayerManager.cpp:381:30
        #27 0x74e1f806f15c in mozilla::nsDisplayList::PaintRoot(mozilla::nsDisplayListBuilder*, gfxContext*, unsigned int, mozilla::Maybe<double>) /builds/worker/workspace/obj-build/layout/painting/./../../../../checkouts/gecko/layout/painting/nsDisplayList.cpp:2375:18
        #28 0x74e1f7d0f050 in nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, mozilla::nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/nsLayoutUtils.cpp:3362:9
        #29 0x74e1f7c8f4e0 in mozilla::PresShell::PaintInternal(nsIFrame*, mozilla::WindowRenderer*, mozilla::PaintInternalFlags) /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:6817:5
        #30 0x74e1f7ca69e4 in mozilla::PresShell::PaintSynchronously() /builds/worker/workspace/obj-build/layout/base/./../../../../checkouts/gecko/layout/base/PresShell.cpp:12707:3
        #31 0x74e1f7c48df4 in nsRefreshDriver::PaintIfNeeded() /layout/base/nsRefreshDriver.cpp:2667:9
        #32 0x74e1f7c48667 in operator() /layout/base/nsRefreshDriver.cpp:2582:60
        #33 0x74e1f7c48667 in void nsRefreshDriver::RunRenderingPhaseLegacy<nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_14>(mozilla::RenderingPhase, nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick)::$_14&&) /layout/base/nsRefreshDriver.cpp:1281:3
        #34 0x74e1f7c41cf0 in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsRefreshDriver::IsExtraTick) /layout/base/nsRefreshDriver.cpp:2580:3
        #35 0x74e1f7c4d1b1 in TickDriver /layout/base/nsRefreshDriver.cpp:365:13
        #36 0x74e1f7c4d1b1 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver>>&) /layout/base/nsRefreshDriver.cpp:343:7
        #37 0x74e1f7c4d0b0 in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:359:5
        #38 0x74e1f7c4cf5d in mozilla::VsyncRefreshDriverTimer::RunRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:946:5
        #39 0x74e1f7c4c5aa in mozilla::VsyncRefreshDriverTimer::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /layout/base/nsRefreshDriver.cpp:856:5
        #40 0x74e1f7c4b916 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsyncTimerOnMainThread() /layout/base/nsRefreshDriver.cpp:587:14
        #41 0x74e1f6eeb9bb in mozilla::dom::VsyncMainChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /dom/ipc/VsyncMainChild.cpp:64:15
        #42 0x74e1f7193259 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/dom/ipc/./../../ipc/ipdl/PVsyncChild.cpp:241:94
        #43 0x74e1f23ef95c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../ipdl/PBackgroundChild.cpp:4949:32
        #44 0x74e1f238602e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1797:25
        #45 0x74e1f23835b4 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1723:9
        #46 0x74e1f2383fb7 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1512:3
        #47 0x74e1f2384f99 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessageChannel.cpp:1614:14
        #48 0x74e1f22591b7 in mozilla::RunnableTask::Run() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:721:16
        #49 0x74e1f224e155 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1367:20
        #50 0x74e1f224ccb7 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:1190:15
        #51 0x74e1f224d125 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:657:36
        #52 0x74e1f22588d6 in operator() /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/TaskController.cpp:349:37
        #53 0x74e1f22588d6 in mozilla::detail::RunnableFunction<mozilla::TaskController::TaskController()::$_0>::Run() /xpcom/threads/nsThreadUtils.h:535:5
        #54 0x74e1f226e123 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThread.cpp:1319:16
        #55 0x74e1f22739ff in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/workspace/obj-build/xpcom/threads/./../../../../checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:471:32
        #56 0x74e1f238bf05 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:83:21
        #57 0x74e1f22e70e1 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
        #58 0x74e1f22e70e1 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
        #59 0x74e1f77f7048 in nsBaseAppShell::Run() /builds/worker/workspace/obj-build/widget/./../../../checkouts/gecko/widget/nsBaseAppShell.cpp:151:27
        #60 0x74e1f78d8624 in nsAppShell::Run() /builds/worker/workspace/obj-build/widget/gtk/./../../../../checkouts/gecko/widget/gtk/nsAppShell.cpp:580:33
        #61 0x74e1f8971c8b in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:644:20
        #62 0x74e1f238cdb4 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/workspace/obj-build/ipc/glue/./../../../../checkouts/gecko/ipc/glue/MessagePump.cpp:233:19
        #63 0x74e1f22e70e1 in RunHandler /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:364:3
        #64 0x74e1f22e70e1 in MessageLoop::Run() /builds/worker/workspace/obj-build/ipc/chromium/./../../../../checkouts/gecko/ipc/chromium/src/base/message_loop.cc:346:3
        #65 0x74e1f89713d4 in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:582:34
        #66 0x5e3e7bf9006c in main /browser/app/nsBrowserApp.cpp:469:22
        #67 0x74e203e2a1c9 in __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #68 0x74e203e2a28a in __libc_start_main ./csu/../csu/libc-start.c:360:3
        #69 0x5e3e7bf635a8 in _start ??:0:0
    
    ==137678==Register values:
    rax = 0x00000000000003ad  rbx = 0x00007ffce3534160  rcx = 0x0000000000000000  rdx = 0x000074e204005563
    rdi = 0x000074e204006700  rsi = 0x0000000000000000  rbp = 0x00007ffce3534140  rsp = 0x00007ffce3534130
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000002  r11 = 0x0000000000000293
    r12 = 0x000074e1fea26268  r13 = 0x000074e2014ad208  r14 = 0x00000000000003ad  r15 = 0x00000000000003ad
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV (/home/jkratzer/builds/m-c-20260915091605-fuzzing-debug/libxul.so+0xf9ead6f) (BuildId: cb2d65c98c050680ba6e6f1407aee7ccd2c70047)
    ==137678==ABORTING
Attached file Testcase —

Verified bug as reproducible on mozilla-central 20260915153044-46d93393954c.
The bug appears to have been introduced in the following build range:

Start: 09b321c1cb8733220b81c7dcb2be7787607a2f9e (20260802201228)
End: baed5659f21a3cbc4e158e43b8cdd25f31bbe949 (20260802211014)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=09b321c1cb8733220b81c7dcb2be7787607a2f9e&tochange=baed5659f21a3cbc4e158e43b8cdd25f31bbe949

Keywords: regression
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
Regressed by: 2059570

Maybe dupe of bug 2072044

See Also: → 2072044

Set release status flags based on info from the regressing bug 2059570

:gw, since you are the author of the regressor, bug 2059570, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

status-firefox156: --- → affected
status-firefox157: --- → affected
status-firefox158: --- → affected
status-firefox-esr140: --- → unaffected
status-firefox-esr153: --- → unaffected
Flags: needinfo?(mozilla)
Status: NEW → RESOLVED
Closed: 21 hours ago
Duplicate of bug: 2072044
Flags: needinfo?(mozilla)
Resolution: --- → DUPLICATE
See Also: 2072044 →

No valid actions for resolution (DUPLICATE).
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: