Open Bug 1761588 Opened 3 years ago Updated 3 years ago

Hit MOZ_CRASH(assertion failed: (content_origin_f.y - content_origin.y).abs() < 0.15) at gfx/wr/webrender/src/picture.rs:4758

Categories

(Core :: Graphics: WebRender, defect)

Unspecified
Android
defect

Tracking

()

Tracking Status
firefox100 --- affected

People

(Reporter: tsmith, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: assertion, testcase)

Attachments

(1 file)

Attached file testcase.html (deleted) —

Found while fuzzing m-c 20220324-5b0962239a45 (--enable-debug --enable-fuzzing)

This only seems to reproduce on Android.

Hit MOZ_CRASH(assertion failed: (content_origin_f.y - content_origin.y).abs() < 0.15) at gfx/wr/webrender/src/picture.rs:4758

eip = 0xb628777a   esp = 0xa76dd780   ebp = 0xa76dd798   ebx = 0xba4dabc4
esi = 0xa76dd9ba   edi = 0x00001296   eax = 0xbb0acc74   ecx = 0x6c7a582d
edx = 0x00000001   efl = 0x00210282
OS|Android|0.0.0 Linux 5.4.86-android11-2-00006-gae78026f427c-ab7595864 #1 SMP PREEMPT Thu Jul 29 20:54:47 UTC 2021 i686
CPU|x86|GenuineIntel family 6 model 6 stepping 3|4
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|36
36|0|libxul.so|RustMozCrash|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/wrappers.cpp:5b0962239a45c0cdae5d495e8ee3786a7c5a07f3|18|0x12
36|1|libxul.so|mozglue_static::panic_hook|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/lib.rs:5b0962239a45c0cdae5d495e8ee3786a7c5a07f3|91|0x10
36|2|libxul.so|core::ops::function::Fn::call|git:github.com/rust-lang/rust:library/core/src/ops/function.rs:9d1b2106e23b1abd32fce1f17267604a5102f57a|70|0x19
36|3|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:library/std/src/panicking.rs:9d1b2106e23b1abd32fce1f17267604a5102f57a|610|0x14
36|4|libxul.so|std::panicking::begin_panic_handler::{{closure}}|git:github.com/rust-lang/rust:library/std/src/panicking.rs:9d1b2106e23b1abd32fce1f17267604a5102f57a|500|0x24
36|5|libxul.so|std::sys_common::backtrace::__rust_end_short_backtrace|git:github.com/rust-lang/rust:library/std/src/sys_common/backtrace.rs:9d1b2106e23b1abd32fce1f17267604a5102f57a|139|0x12
36|6|libxul.so|rust_begin_unwind|git:github.com/rust-lang/rust:library/std/src/panicking.rs:9d1b2106e23b1abd32fce1f17267604a5102f57a|498|0x15
36|7|libxul.so|core::panicking::panic_fmt|git:github.com/rust-lang/rust:library/core/src/panicking.rs:9d1b2106e23b1abd32fce1f17267604a5102f57a|116|0x8
36|8|libxul.so|core::panicking::panic|git:github.com/rust-lang/rust:library/core/src/panicking.rs:9d1b2106e23b1abd32fce1f17267604a5102f57a|48|0x40
36|9|libxul.so|webrender::picture::PicturePrimitive::take_context|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/picture.rs:5b0962239a45c0cdae5d495e8ee3786a7c5a07f3|4894|0x1b
36|10|libxul.so|webrender::frame_builder::FrameBuilder::build|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/frame_builder.rs:5b0962239a45c0cdae5d495e8ee3786a7c5a07f3|634|0xbdd
36|11|libxul.so|webrender::render_backend::Document::build_frame|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:5b0962239a45c0cdae5d495e8ee3786a7c5a07f3|493|0x3b
36|12|libxul.so|webrender::render_backend::RenderBackend::update_document|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:5b0962239a45c0cdae5d495e8ee3786a7c5a07f3|1379|0x24
36|13|libxul.so|webrender::render_backend::RenderBackend::process_api_msg|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:5b0962239a45c0cdae5d495e8ee3786a7c5a07f3|1081|0x270
36|14|libxul.so|std::sys_common::backtrace::__rust_begin_short_backtrace|git:github.com/rust-lang/rust:library/std/src/sys_common/backtrace.rs:9d1b2106e23b1abd32fce1f17267604a5102f57a|123|0x6f9
36|15|libxul.so|core::ops::function::FnOnce::call_once{{vtable.shim}}|git:github.com/rust-lang/rust:library/core/src/ops/function.rs:9d1b2106e23b1abd32fce1f17267604a5102f57a|227|0x95
36|16|libxul.so|std::sys::unix::thread::Thread::new::thread_start|git:github.com/rust-lang/rust:library/std/src/sys/unix/thread.rs:9d1b2106e23b1abd32fce1f17267604a5102f57a|108|0xe
36|17|libc.so||||0xe42c5
36|18|libc.so||||0x785f8
36|19|libc.so||||0x5ac27
36|20|libc.so||||0xe4260
36|21|libxul.so||||0x7218d20
Flags: in-testsuite?
Severity: -- → S3
Flags: needinfo?(gwatson)
Blocks: fuzzing-gv

Looking at the test case, I'm guessing that this is a floating point accuracy issue related to the height of the document.

Flags: needinfo?(gwatson)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: