Found while fuzzing m-c 20221213-300b0ac8eb7b (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Hit MOZ_CRASH(assertion failed: !(vecTangent * vecTangent < rLastTangentFuzz)) at /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/bezierflattener.rs:824

#0 0x7f181cb339e5 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7f181cb339e5 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7f181cb33962 in mozglue_static::panic_hook::hd18ed6809dbf28d1 /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:91:9
#3 0x7f181cb3342b in core::ops::function::Fn::call::h07766207557d1e22 /rustc/897e37553bba8b42751c67658967889d11ecd120/library/core/src/ops/function.rs:77:5
#4 0x7f181dbccffc in std::panicking::rust_panic_with_hook::h7b190ce1a948faac /rustc/897e37553bba8b42751c67658967889d11ecd120/library/std/src/panicking.rs:702:17
#5 0x7f181dbcce10 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::hbafbfdc3e1b97f68 /rustc/897e37553bba8b42751c67658967889d11ecd120/library/std/src/panicking.rs:586:13
#6 0x7f181dbc9fbb in std::sys_common::backtrace::__rust_end_short_backtrace::hda93e5fef243b4c0 /rustc/897e37553bba8b42751c67658967889d11ecd120/library/std/src/sys_common/backtrace.rs:138:18
#7 0x7f181dbccb71 in rust_begin_unwind /rustc/897e37553bba8b42751c67658967889d11ecd120/library/std/src/panicking.rs:584:5
#8 0x7f181dc22732 in core::panicking::panic_fmt::h8d17ca1073d9a733 /rustc/897e37553bba8b42751c67658967889d11ecd120/library/core/src/panicking.rs:142:14
#9 0x7f181dc2257c in core::panicking::panic::hf0565452d0d0936c /rustc/897e37553bba8b42751c67658967889d11ecd120/library/core/src/panicking.rs:48:5
#10 0x7f181bc95a0d in aa_stroke::bezierflattener::CBezierFlattener::GetLastTangent::h5e4db97174555b36 /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/bezierflattener.rs:824:5
#11 0x7f181bc95a0d in aa_stroke::bezierflattener::CBezierFlattener::Flatten::ha9a5bd0b24348498 /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/bezierflattener.rs:595:73
#12 0x7f181bc97b08 in aa_stroke::arc_segment_tri::ha9d318ce8ebd7a85 /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/lib.rs:300:5
#13 0x7f181bc994cc in aa_stroke::Stroker::line_to::h82ac83dda19b6fe6 /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/lib.rs:685:21
#14 0x7f181bc99da3 in _$LT$aa_stroke..Stroker..curve_to_internal..Target$u20$as$u20$aa_stroke..bezierflattener..CFlatteningSink$GT$::AcceptPoint::h7b53143fe47151da /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/lib.rs:759:21
#15 0x7f181bc95427 in aa_stroke::bezierflattener::CBezierFlattener::Step::h7bb61c6a3996e529 /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/bezierflattener.rs:654:14
#16 0x7f181bc95427 in aa_stroke::bezierflattener::CBezierFlattener::Flatten::ha9a5bd0b24348498 /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/bezierflattener.rs:571:14
#17 0x7f181bc96f44 in aa_stroke_curve_to /builds/worker/checkouts/gecko/third_party/rust/aa-stroke/src/c_bindings.rs
#18 0x7f181643ef79 in mozilla::gfx::GenerateStrokeVertexBuffer(mozilla::gfx::QuantizedPath const&, mozilla::gfx::StrokeOptions const*, float, WGR::OutputVertex*, unsigned long) /builds/worker/checkouts/gecko/dom/canvas/DrawTargetWebgl.cpp:2656:11
#19 0x7f181643d28f in mozilla::gfx::DrawTargetWebgl::SharedContext::DrawPathAccel(mozilla::gfx::Path const*, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&, mozilla::gfx::StrokeOptions const*, mozilla::gfx::ShadowOptions const*, bool) /builds/worker/checkouts/gecko/dom/canvas/DrawTargetWebgl.cpp:2863:22
#20 0x7f181643ad6d in mozilla::gfx::DrawTargetWebgl::DrawPath(mozilla::gfx::Path const*, mozilla::gfx::Pattern const&, mozilla::gfx::DrawOptions const&, mozilla::gfx::StrokeOptions const*) /builds/worker/checkouts/gecko/dom/canvas/DrawTargetWebgl.cpp:3033:23
#21 0x7f18164415bd in mozilla::gfx::DrawTargetWebgl::Stroke(mozilla::gfx::Path const*, mozilla::gfx::Pattern const&, mozilla::gfx::StrokeOptions const&, mozilla::gfx::DrawOptions const&) /builds/worker/checkouts/gecko/dom/canvas/DrawTargetWebgl.cpp:3287:3
#22 0x7f181646a61e in mozilla::dom::AdjustedTarget::Stroke(mozilla::gfx::Path const*, mozilla::gfx::Pattern const&, mozilla::gfx::StrokeOptions const&, mozilla::gfx::DrawOptions const&) /builds/worker/checkouts/gecko/dom/canvas/CanvasRenderingContext2D.cpp:703:14
#23 0x7f181646a3b3 in mozilla::dom::CanvasRenderingContext2D::Stroke() /builds/worker/checkouts/gecko/dom/canvas/CanvasRenderingContext2D.cpp:2932:10
#24 0x7f1815828190 in mozilla::dom::CanvasRenderingContext2D_Binding::stroke(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/CanvasRenderingContext2DBinding.cpp:3226:28
#25 0x7f1816378132 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3287:13
#26 0x7f181a68c3a6 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:459:13
#27 0x7f181a68bccf in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:547:12
#28 0x7f181a67d90f in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:619:10
#29 0x7f181a67d90f in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3379:16
#30 0x7f181a670fce in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:431:13
#31 0x7f181a68bbcb in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:579:13
#32 0x7f181a68d0fc in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:646:8
#33 0x7f181a74796c in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
#34 0x7f18160780e3 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventListenerBinding.cpp:62:8
#35 0x7f181693cdb6 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:65:12
#36 0x7f181693cadc in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1311:43
#37 0x7f181693d789 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1507:17
#38 0x7f1816932736 in HandleEvent /builds/worker/checkouts/gecko/dom/events/EventListenerManager.h:395:5
#39 0x7f1816932736 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:347:17
#40 0x7f1816931c6b in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:549:16
#41 0x7f181693442b in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1122:11
#42 0x7f1816936f06 in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp
#43 0x7f1814ebf3db in nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&) /builds/worker/checkouts/gecko/dom/base/nsINode.cpp:1373:17
#44 0x7f1814a0af16 in nsContentUtils::DispatchEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, mozilla::Trusted, bool*, mozilla::ChromeOnlyDispatch) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:4547:28
#45 0x7f1814a0ad15 in nsContentUtils::DispatchTrustedEvent(mozilla::dom::Document*, nsISupports*, nsTSubstring<char16_t> const&, mozilla::CanBubble, mozilla::Cancelable, mozilla::Composed, bool*) /builds/worker/checkouts/gecko/dom/base/nsContentUtils.cpp:4517:10
#46 0x7f1814c41a43 in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/checkouts/gecko/dom/base/Document.cpp:7876:3
#47 0x7f1814cf3078 in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
#48 0x7f1814cf3078 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1168:12
#49 0x7f1814cf3078 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1215:13
#50 0x7f18131e2712 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:140:20
#51 0x7f18131ec9a5 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:539:16
#52 0x7f18131e7f7c in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:852:26
#53 0x7f18131e6b4a in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:684:15
#54 0x7f18131e6ea5 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:462:36
#55 0x7f18131f02a6 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:188:37
#56 0x7f18131f02a6 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_2>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:546:5
#57 0x7f1813205c58 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1204:16
#58 0x7f181320c49d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:474:10
#59 0x7f1813dfdfa3 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#60 0x7f1813d22f38 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#61 0x7f1813d22e41 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#62 0x7f1813d22e41 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#63 0x7f1818219348 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:150:27
#64 0x7f181a44709b in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:884:20
#65 0x7f1813dfee69 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:235:9
#66 0x7f1813d22f38 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#67 0x7f1813d22e41 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#68 0x7f1813d22e41 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#69 0x7f181a44662c in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:743:34
#70 0x5583c8919ca0 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#71 0x5583c8919ca0 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:359:18
#72 0x7f18285f6d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#73 0x7f18285f6e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#74 0x5583c88f0308 in _start (/home/user/workspace/browsers/m-c-20221213165020-fuzzing-debug/firefox-bin+0x5b308) (BuildId: 632b23276e3228be633d34f1ac3c66957e03ca4b)

Verified bug as reproducible on mozilla-central 20221213165020-300b0ac8eb7b.
The bug appears to have been introduced in the following build range:

Start: 38ad87bc6f42df650e19616ba8bf27b5d5a68afe (20221203092459)
End: d17c3b5d62f062cb82f540a210afb05ff87f9c70 (20221203213736)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=38ad87bc6f42df650e19616ba8bf27b5d5a68afe&tochange=d17c3b5d62f062cb82f540a210afb05ff87f9c70

Set release status flags based on info from the regressing bug 1803604

:lsalzman, since you are the author of the regressor, bug 1803604, could you take a look?

For more information, please visit auto_nag documentation.

Testcase crashes using the initial build (mozilla-central 20221213165020-300b0ac8eb7b) but not with tip (mozilla-central 20230317210204-c6b709a45852.)

The bug appears to have been fixed in the following build range:

Start: b8472c1213cb9bf7fd96d1139a9fd15cf10b3bd1 (20230311175853)
End: b8472c1213cb9bf7fd96d1139a9fd15cf10b3bd1 (20230311212417)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=b8472c1213cb9bf7fd96d1139a9fd15cf10b3bd1&tochange=b8472c1213cb9bf7fd96d1139a9fd15cf10b3bd1

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

I am able to reproduce this. Bugmon has been updated since this report so let's retry.

A Pernosco session is available here: https://pernos.co/debug/CqDI1LJ5JyOuju1p2eVTlQ/index.html

Verified bug as reproducible on mozilla-central 20230519115028-225c5ab0d999.
The bug appears to have been introduced in the following build range:

Start: 38ad87bc6f42df650e19616ba8bf27b5d5a68afe (20221203092459)
End: 63b85eeb214b1166b26019c73d5e1dd67d6a43bf (20221203112756)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=38ad87bc6f42df650e19616ba8bf27b5d5a68afe&tochange=63b85eeb214b1166b26019c73d5e1dd67d6a43bf

:lsalzman looks like there is a missing NI for you. This is still repro based on Comment 6 and regressed by Bug 1803604.
Are the Severity and Priority still accurate? Wondering if this will be looked at during the 115 cycle, or will it be a later release?

Testcase crashes using the initial build (mozilla-central 20221213165020-300b0ac8eb7b) but not with tip (mozilla-central 20230527093530-b45b68be3f9b.)

The bug appears to have been fixed in the following build range:

Start: 6aeb0b124f5887237e9c0582197d34d3596842b8 (20230422094547)
End: 59455d15fb58c0e5bcf1a485d11e52904ea3cbff (20230422123310)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6aeb0b124f5887237e9c0582197d34d3596842b8&tochange=59455d15fb58c0e5bcf1a485d11e52904ea3cbff

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

bugmon is incorrect here, this issue is still reproducible using the attached test case and the fuzzers are still reporting it.

Adding back the needinfo for Comment 7

This is just a debug assert. I don't think it represents anything serious. Jeff?

Side note, I can also reproduce this on a local build trying to run https://absorb-initial-cost-in-perf-dashboard--speedometer-preview.netlify.app/?developerMode=&tags=webcomponents