Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at /builds/worker/checkouts/gecko/third_party/rust/euclid/src/size.rs:285
Categories
(Core :: Graphics: WebRender, defect)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr102 | --- | wontfix |
firefox85 | --- | wontfix |
firefox86 | --- | wontfix |
firefox88 | --- | wontfix |
firefox89 | --- | wontfix |
firefox90 | --- | wontfix |
firefox103 | --- | wontfix |
firefox104 | --- | wontfix |
firefox105 | --- | wontfix |
firefox106 | --- | wontfix |
firefox107 | --- | wontfix |
firefox108 | --- | wontfix |
firefox111 | --- | wontfix |
firefox112 | --- | wontfix |
firefox113 | --- | wontfix |
firefox114 | --- | wontfix |
People
(Reporter: tsmith, Unassigned)
References
(Blocks 3 open bugs, Regression)
Details
(5 keywords, Whiteboard: [bugmon:bisected,confirmed])
Crash Data
Attachments
(1 file, 3 obsolete files)
(deleted),
text/html
|
Details |
Found while fuzzing (--enable-debug --enable-fuzzing)
Hit MOZ_CRASH(called Option::unwrap()
on a None
value) at src/third_party/rust/euclid/src/size.rs:285
#0 0x7faba2ba1325 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:254:3
#1 0x7faba2ba1325 in RustMozCrash src/mozglue/static/rust/wrappers.cpp:17:3
#2 0x7faba2ba12d4 in mozglue_static::panic_hook::ha757622518ce090b src/mozglue/static/rust/lib.rs:89:9
#3 0x7faba2ba0bfb in core::ops::function::Fn::call::h2f0433a5b64f4daf /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:70:5
#4 0x7faba3b78465 in std::panicking::rust_panic_with_hook::h2bdec87b60580584 /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/std/src/panicking.rs:581:17
#5 0x7faba3b77fe8 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h101ca09d9df5db47 /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/std/src/panicking.rs:484:9
#6 0x7faba3b732db in std::sys_common::backtrace::__rust_end_short_backtrace::h3bb85654c20113ca /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/std/src/sys_common/backtrace.rs:153:18
#7 0x7faba3b77fa8 in rust_begin_unwind /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/std/src/panicking.rs:483:5
#8 0x7faba3bddcb0 in core::panicking::panic_fmt::h48c31e1e3d550146 /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/core/src/panicking.rs:85:14
#9 0x7faba3bddbfc in core::panicking::panic::h184ede6dd822ffb4 /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/core/src/panicking.rs:50:5
#10 0x7faba23f13f4 in webrender::clip::ClipNode::update::h4a75dbac60f14a04 src/gfx/wr/webrender/src/clip.rs
#11 0x7faba23f5b3c in webrender::clip::ClipStore::build_clip_chain_instance::h11166ac09e885e8b src/gfx/wr/webrender/src/clip.rs:1236:21
#12 0x7faba25bfa86 in webrender::visibility::update_primitive_visibility::hfcd34cd47223268a src/gfx/wr/webrender/src/visibility.rs:434:34
#13 0x7faba25bf3b2 in webrender::visibility::update_primitive_visibility::hfcd34cd47223268a src/gfx/wr/webrender/src/visibility.rs:337:44
#14 0x7faba25bf309 in webrender::visibility::update_primitive_visibility::hfcd34cd47223268a src/gfx/wr/webrender/src/visibility.rs:337:44
#15 0x7faba25bf3b2 in webrender::visibility::update_primitive_visibility::hfcd34cd47223268a src/gfx/wr/webrender/src/visibility.rs:337:44
#16 0x7faba242ee7d in webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::h7abbde2f8f8d0a4e src/gfx/wr/webrender/src/frame_builder.rs:347:13
#17 0x7faba242ee7d in webrender::frame_builder::FrameBuilder::build::h6ec0e1ff8d576e93 src/gfx/wr/webrender/src/frame_builder.rs:502:9
#18 0x7faba24b679e in webrender::render_backend::Document::build_frame::hf749c0b504b95746 src/gfx/wr/webrender/src/render_backend.rs:622:25
#19 0x7faba24c73cd in webrender::render_backend::RenderBackend::update_document::h8c51c808d439f7cf src/gfx/wr/webrender/src/render_backend.rs:1507:41
#20 0x7faba24bde21 in webrender::render_backend::RenderBackend::prepare_transactions::h3c8024283bfb4c7b src/gfx/wr/webrender/src/render_backend.rs:1357:28
#21 0x7faba24bde21 in webrender::render_backend::RenderBackend::process_api_msg::h3c9d3b4f0a1dfc6b src/gfx/wr/webrender/src/render_backend.rs:1217:17
#22 0x7faba22b17ed in webrender::render_backend::RenderBackend::run::h8506c0ad20f763a5 src/gfx/wr/webrender/src/render_backend.rs:892:21
#23 0x7faba22b17ed in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h14fd868c2decd410 src/gfx/wr/webrender/src/renderer.rs:2564:13
#24 0x7faba22b17ed in std::sys_common::backtrace::__rust_begin_short_backtrace::hb923b58588469b20 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/sys_common/backtrace.rs:137:18
#25 0x7faba22d023f in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h25acfb4e93949b50 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:464:17
#26 0x7faba22d023f in _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h423d6549a48bcb44 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:308:9
#27 0x7faba22d023f in std::panicking::try::do_call::hdd29b4f4c23911e6 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:381:40
#28 0x7faba22d023f in std::panicking::try::h59406bcb282efed2 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panicking.rs:345:19
#29 0x7faba22d023f in std::panic::catch_unwind::h85822dd2828a4422 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/panic.rs:382:14
#30 0x7faba22d023f in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::h4f8874e6220b3410 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/std/src/thread/mod.rs:463:30
#31 0x7faba22d023f in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h9b31292093927ac9 /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:227:5
#32 0x7faba3b86f09 in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::hbb39a3e615f69ef9 /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/alloc/src/boxed.rs:1042:9
#33 0x7faba3b86f09 in _$LT$alloc..boxed..Box$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$A$GT$$GT$::call_once::h79630a683aed732c /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/alloc/src/boxed.rs:1042:9
#34 0x7faba3b86f09 in std::sys::unix::thread::Thread::new::thread_start::h4afaeade0da13617 /rustc/7eac88abb2e57e752f3302f02be5f3ce3d7adfb4/library/std/src/sys/unix/thread.rs:87:17
#35 0x7fabb759b6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
#36 0x7fabb6579a3e in clone /build/glibc-2ORdQG/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Reporter | ||
Comment 1•4 years ago
|
||
Reporter | ||
Comment 2•4 years ago
|
||
A Pernosco session is available here: https://pernos.co/debug/Ng5_-w0G6M-Pq9-mquuDdQ/index.html
Comment 3•4 years ago
|
||
Bugmon Analysis:
Unable to reproduce bug using the following builds:
mozilla-central 20201222215026-be30820869d8
mozilla-central 20201222093533-54a95a4088a2
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.
Reporter | ||
Comment 4•4 years ago
|
||
An updated Pernosco session is available here: https://pernos.co/debug/IKWGI46wfp_si3RSRExfNA/index.html
Comment 5•4 years ago
|
||
Bugmon Analysis:
Unable to reproduce bug using the following builds:
mozilla-central 20210426213158-6f8320a4798f
mozilla-central 20201222093533-54a95a4088a2
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.
Reporter | ||
Comment 6•3 years ago
|
||
Comment 7•3 years ago
|
||
Bugmon Analysis
Unable to reproduce bug 1683946 using build mozilla-central 20210213095234-6c32d769ff9a. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Reporter | ||
Comment 8•2 years ago
|
||
Hopefully this testcase works with bugmon.
Reporter | ||
Updated•2 years ago
|
Comment 9•2 years ago
|
||
Bugmon Analysis
Unable to reproduce bug 1683946 using build mozilla-central 20210804035633-4fc8a8759035. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Comment 10•2 years ago
|
||
Not sure why bugmon is failing on this. I can reproduce it locally. I'll investigate.
Comment 11•2 years ago
|
||
Ah, it appears that the testcase is not reproducible on the earliest available build (4fc8a8759035) however it does reproduce on tip. I'll re-enable bugmon and set it to verify once this bug has been fixed.
Comment 12•2 years ago
|
||
Bugmon Analysis
Unable to reproduce bug 1683946 using build mozilla-central 20210807092614-7338d7d94091. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Comment 13•2 years ago
|
||
Should this be closed now, if bugmon is still unable to repro?
Reporter | ||
Comment 14•2 years ago
|
||
I am able to reproduce the issue. I guess bugmon is still failing on this test. Tested with m-c 20221017-ac1330b68d3e.
Reporter | ||
Updated•2 years ago
|
Comment 15•2 years ago
|
||
The problem appears to be that the most recent testcase does not trigger on the build nearest the date this bug was filed (20211019-1e37fc4a7f53).
Comment 16•2 years ago
|
||
Got a crash on the latest Nightly from the testcase: https://crash-stats.mozilla.org/report/index/bf69bc2c-6ecb-4449-b526-9c7420221019
Comment 17•2 years ago
|
||
A mozregression on the the latest testcase points to this:
2022-10-19T08:21:17.703000: DEBUG : Found commit message:
Bug 1749380 - Part 2 - Performance and quality fixes for part 1. r=gfx-reviewers,nical
Differential Revision: https://phabricator.services.mozilla.com/D138982
2022-10-19T08:21:17.709000: INFO : Stopped
Reporter | ||
Updated•2 years ago
|
Updated•2 years ago
|
Comment 18•2 years ago
|
||
comment 8 = bp-a61391fc-1735-4783-b3f7-343200230331 [@ webrender::clip::ClipNode::update ]
Comment 19•2 years ago
|
||
Any chance we can get this in Pernosco, Tyson? We continue to see these crashes in the wild.
Reporter | ||
Comment 20•2 years ago
|
||
bugmon should be able to do this for us.
Reporter | ||
Comment 21•2 years ago
|
||
Looks like bugmon is MIA.
A Pernosco session is available here: https://pernos.co/debug/6gWtXUyTTPlOGI87qxjX3A/index.html
Reporter | ||
Updated•2 years ago
|
Comment 22•2 years ago
|
||
Hi Glenn, does the Pernosco trace help narrow this down?
Comment 23•2 years ago
|
||
With Flatpak (bug 1653852) I got a slighty different crash.
$ flatpak run --allow=devel org.mozilla.firefox https://bug1683946.bmoattachments.org/attachment.cgi?id=9288209
= bp-34a80c97-7329-426a-95ca-258810230406 [@ euclid::size::Size2D<T>::cast ]
vs.
Nightly binary: bp-eb3c42ff-1df5-4c76-8b0c-921d90230406 [@ webrender::clip::ClipNode::update ]
Comment 24•2 years ago
|
||
(In reply to Tyson Smith [:tsmith] from comment #21)
Looks like bugmon is MIA.
A Pernosco session is available here: https://pernos.co/debug/6gWtXUyTTPlOGI87qxjX3A/index.html
Bugmon never picked this up because the bugmon keyword was missing. It likely wouldn't have been able to get a pernosco session anyway because it never reproduced the testcase using the original rev in comment 0.
Updated•2 years ago
|
Updated•2 years ago
|
Updated•2 years ago
|
Updated•2 years ago
|
Comment 25•1 year ago
|
||
Tyson, this seems to be a dup of https://bugzilla.mozilla.org/show_bug.cgi?id=1822677, which has a patch attached. I can repro without that patch but not with it. Are you happy to close as dup, or do you want to leave open for now until that patch lands to confirm?
Reporter | ||
Comment 26•1 year ago
|
||
Yeah let's mark it as a dup, thanks.
Updated•1 year ago
|
Description
•