Found while fuzzing m-c 20211031-6e81bb1b5c7b (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html --xvfb

Hit MOZ_CRASH(Unable to find a bin!) at gfx/wr/webrender/src/texture_pack/guillotine.rs:29

#0 0x7fde9d1d4505 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7fde9d1d4505 in RustMozCrash src/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7fde9d1d4487 in mozglue_static::panic_hook::heacae7afaf9bf8bc src/mozglue/static/rust/lib.rs:91:9
#3 0x7fde9d1d40fb in core::ops::function::Fn::call::hb79486ceb681b1e3 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/core/src/ops/function.rs:70:5
#4 0x7fde9da79438 in std::panicking::rust_panic_with_hook::h50680ff4b44510c6 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/panicking.rs:628:17
#5 0x7fde9da78edf in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h9371c0fbb1e8465a /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/panicking.rs:521:13
#6 0x7fde9da75be3 in std::sys_common::backtrace::__rust_end_short_backtrace::h9b3efa22a5768c0f /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/sys_common/backtrace.rs:139:18
#7 0x7fde9da78e48 in rust_begin_unwind /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/panicking.rs:517:5
#8 0x7fde93f34950 in core::panicking::panic_fmt::h23b9203e89cc61cf /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/core/src/panicking.rs:100:14
#9 0x7fde9dacf6d0 in core::panicking::panic_display::h0b2b4cc4e8e79e2e /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/core/src/panicking.rs:64:5
#10 0x7fde93f3484a in core::option::expect_failed::h111c62e88059319b /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/core/src/option.rs:1638:5
#11 0x7fde9cdecbd8 in core::option::Option$LT$T$GT$::expect::h56991bd32f60f601 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/core/src/option.rs:709:21
#12 0x7fde9cdecbd8 in webrender::texture_pack::guillotine::FreeListBin::for_size::heb76e593d2f32126 src/gfx/wr/webrender/src/texture_pack/guillotine.rs:23:9
#13 0x7fde9cdecbd8 in webrender::texture_pack::guillotine::GuillotineAllocator::push::h2f2eb1de933404cc src/gfx/wr/webrender/src/texture_pack/guillotine.rs:99:18
#14 0x7fde9cd659e4 in webrender::texture_pack::guillotine::GuillotineAllocator::new::hce199047dff85789 src/gfx/wr/webrender/src/texture_pack/guillotine.rs:89:13
#15 0x7fde9cd659e4 in webrender::render_task_graph::RenderTaskGraphBuilder::end_frame::h54f44392c7480a13 src/gfx/wr/webrender/src/render_task_graph.rs:492:44
#16 0x7fde9ccf9a4c in webrender::frame_builder::FrameBuilder::build::h064a0ba1fc71195f src/gfx/wr/webrender/src/frame_builder.rs:615:28
#17 0x7fde9cd492b3 in webrender::render_backend::Document::build_frame::h9984182cbaca065c src/gfx/wr/webrender/src/render_backend.rs:451:25
#18 0x7fde9cd58e95 in webrender::render_backend::RenderBackend::update_document::h77ead49aa6668580 src/gfx/wr/webrender/src/render_backend.rs:1345:41
#19 0x7fde9cd524be in webrender::render_backend::RenderBackend::prepare_transactions::h496f85b6992e810e src/gfx/wr/webrender/src/render_backend.rs:1194:28
#20 0x7fde9cd524be in webrender::render_backend::RenderBackend::process_api_msg::h4a093f5153a644ad src/gfx/wr/webrender/src/render_backend.rs:1046:17
#21 0x7fde9cc28f2b in webrender::render_backend::RenderBackend::run::hc281f4071ae32264 src/gfx/wr/webrender/src/render_backend.rs:716:21
#22 0x7fde9cc28f2b in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h5267d521289eefe0 src/gfx/wr/webrender/src/renderer/mod.rs:1325:13
#23 0x7fde9cc28f2b in std::sys_common::backtrace::__rust_begin_short_backtrace::hbdbf0148d397f721 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/sys_common/backtrace.rs:123:18
#24 0x7fde9cc3f99f in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h4762cd1fd358f306 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/thread/mod.rs:483:17
#25 0x7fde9cc3f99f in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h489af0dc995876fd /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/core/src/panic/unwind_safe.rs:271:9
#26 0x7fde9cc3f99f in std::panicking::try::do_call::hcce296c92e75a7cc /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/panicking.rs:403:40
#27 0x7fde9cc3f99f in std::panicking::try::hef31ac73df8188d3 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/panicking.rs:367:19
#28 0x7fde9cc3f99f in std::panic::catch_unwind::h7ca768c241b12321 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/panic.rs:133:14
#29 0x7fde9cc3f99f in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::hcac967473824ff61 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/thread/mod.rs:482:30
#30 0x7fde9cc3f99f in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h0231c78dc28601e1 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/core/src/ops/function.rs:227:5
#31 0x7fde9da845f2 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h7bd677a5dc988be6 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/alloc/src/boxed.rs:1691:9
#32 0x7fde9da845f2 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h7b1c1ba11c4db785 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/alloc/src/boxed.rs:1691:9
#33 0x7fde9da845f2 in std::sys::unix::thread::Thread::new::thread_start::h9c58c0d12d84e854 /rustc/f1edd0429582dd29cccacaf50fd134b05593bd9c/library/std/src/sys/unix/thread.rs:106:17
#34 0x7fdea94db608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
#35 0x7fdea90a3292 in __clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

A Pernosco session is available here: https://pernos.co/debug/vIjk6SiWtKsDwfQ2RpBXGg/index.html

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20211229214859-649a1395ee6c.
The bug appears to have been introduced in the following build range:

Start: da505302e90f32f8b11f479d571a203daf157f15 (20211020220440)
End: 61ecccbc80e6cfc6e83e172a557efeed4c7d6405 (20211021010124)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=da505302e90f32f8b11f479d571a203daf157f15&tochange=61ecccbc80e6cfc6e83e172a557efeed4c7d6405

The pernosco trace was very helpful.

:nical, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

It doesn't look like the bug came from the provided range.

The severity field is not set for this bug.
:jimm, could you have a look please?

For more information, please visit auto_nag documentation.

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:nical, could you have a look please?
For more information, please visit auto_nag documentation.

My fix avoids this crash signature but we end up crashing somewhere else. I'll get back to this when I have some time.

Bugmon Analysis
Testcase crashes using the initial build (mozilla-central 20211031095403-6e81bb1b5c7b) but not with tip (mozilla-central 20220211164352-46048399bf0f.)
The bug appears to have been fixed in the following build range:

Start: 8e9c1ffdeed84e460a9ba7f9e83ca24319a15c87 (20220207222603)
End: 858cdf7acc36f5c2fcf348188fdcb3461ba1672f (20220208033131)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=8e9c1ffdeed84e460a9ba7f9e83ca24319a15c87&tochange=858cdf7acc36f5c2fcf348188fdcb3461ba1672f
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Redirect a needinfo that is pending on an inactive user to the triage owner.
:gw, since the bug has recent activity, could you have a look please?

For more information, please visit auto_nag documentation.

Nical, is this still something you're able to look at?

This was fixed in another bug let's close.