Closed Bug 1897047 Opened 1 month ago Closed 1 month ago

Hit MOZ_CRASH(bug: nine-patch segments should be axis-aligned only) at gfx/wr/webrender/src/quad.rs:277

Categories

(Core :: Graphics: WebRender, defect)

defect

Tracking

()

RESOLVED DUPLICATE of bug 1896979
Tracking Status
firefox128 --- affected

People

(Reporter: tsmith, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file testcase.html

Found while fuzzing m-c 20240514-b2c1906d3f6e (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(bug: nine-patch segments should be axis-aligned only) at gfx/wr/webrender/src/quad.rs:277

#0 0x7fa3a7bce4a5 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:317:3
#1 0x7fa3a7bce4a5 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7fa3a7bcd95d in mozglue_static::panic_hook::h84fa5ac8977588fc /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:98:9
#3 0x7fa3a7bcd95d in core::ops::function::Fn::call::he0b21f672efaebae /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/core/src/ops/function.rs:79:5
#4 0x7fa3a8ce17c5 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::h4dd5cc3b5605ae1a /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/alloc/src/boxed.rs:2029:9
#5 0x7fa3a8ce17c5 in std::panicking::rust_panic_with_hook::hb164d19c0c1e71d4 /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panicking.rs:785:13
#6 0x7fa3a7445dee in std::panicking::begin_panic::_$u7b$$u7b$closure$u7d$$u7d$::h8080b8e83049183f /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panicking.rs:689:9
#7 0x7fa3a7440848 in std::sys_common::backtrace::__rust_end_short_backtrace::h38b98f4d18187ba2 /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/sys_common/backtrace.rs:171:18
#8 0x7fa3a7445dbc in std::panicking::begin_panic::h41953e2f549eee4b /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panicking.rs:688:12
#9 0x7fa3a76c98f1 in webrender::quad::push_quad::h1d91e5f50a23fc36 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/quad.rs:277:58
#10 0x7fa3a76a450f in webrender::prepare::prepare_interned_prim_for_render::h31ce89cb6063f1e2 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs
#11 0x7fa3a76a263b in webrender::prepare::prepare_prim_for_render::h4377cf8985790727 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:291:5
#12 0x7fa3a76a263b in webrender::prepare::prepare_primitives::h81901d599da5054c /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:81:17
#13 0x7fa3a76a21de in webrender::prepare::prepare_prim_for_render::h4377cf8985790727 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:182:17
#14 0x7fa3a76a21de in webrender::prepare::prepare_primitives::h81901d599da5054c /builds/worker/checkouts/gecko/gfx/wr/webrender/src/prepare.rs:81:17
#15 0x7fa3a76637b7 in webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::h729d97c460737a45 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:463:17
#16 0x7fa3a76637b7 in webrender::frame_builder::FrameBuilder::build::h5365d28b89c682f3 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/frame_builder.rs:567:9
#17 0x7fa3a76cb34e in webrender::render_backend::Document::build_frame::hbb702f146d03352e /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:521:25
#18 0x7fa3a76e1c1e in webrender::render_backend::RenderBackend::update_document::hecafc1e18432bcb0 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1437:41
#19 0x7fa3a76d85ed in webrender::render_backend::RenderBackend::prepare_transactions::h97a92ccb4d191562 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1281:28
#20 0x7fa3a76d85ed in webrender::render_backend::RenderBackend::process_api_msg::h2a2739baf963bcec /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:1134:17
#21 0x7fa3a7441daa in webrender::render_backend::RenderBackend::run::hdbc7b21091401a89 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/render_backend.rs:785:21
#22 0x7fa3a7441daa in webrender::renderer::init::create_webrender_instance::_$u7b$$u7b$closure$u7d$$u7d$::h29897025eac674bc /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/init.rs:685:9
#23 0x7fa3a7441daa in std::sys_common::backtrace::__rust_begin_short_backtrace::h85985692357dbf6a /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/sys_common/backtrace.rs:155:18
#24 0x7fa3a744c022 in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h5a81a39d1a7bcdaa /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/thread/mod.rs:529:17
#25 0x7fa3a744c022 in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hcb5cb93d9d0268d1 /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/core/src/panic/unwind_safe.rs:272:9
#26 0x7fa3a744c022 in std::panicking::try::do_call::h531f164e2f5e05ab /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panicking.rs:554:40
#27 0x7fa3a744c022 in std::panicking::try::h1f997003652480a5 /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panicking.rs:518:19
#28 0x7fa3a744c022 in std::panic::catch_unwind::hd84adb8889a487fc /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/panic.rs:142:14
#29 0x7fa3a744c022 in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::h6e33ab156a6cd435 /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/thread/mod.rs:528:30
#30 0x7fa3a744c022 in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h78004af819189080 /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/core/src/ops/function.rs:250:5
#31 0x7fa3a8ceae64 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h6b630278c760b971 /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/alloc/src/boxed.rs:2015:9
#32 0x7fa3a8ceae64 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h70462b441b6c0e1f /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/alloc/src/boxed.rs:2015:9
#33 0x7fa3a8ceae64 in std::sys::pal::unix::thread::Thread::new::thread_start::h3631815ad38387d6 /rustc/25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04/library/std/src/sys/pal/unix/thread.rs:108:17
#34 0x7fa3b2694ac2 in start_thread nptl/pthread_create.c:442:8
#35 0x7fa3b272684f  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
Flags: in-testsuite?
Status: NEW → RESOLVED
Closed: 1 month ago
Duplicate of bug: 1896979
Resolution: --- → DUPLICATE

No valid actions for resolution (DUPLICATE).
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: