css 3d FPS triggers subtraction underflow when culling layers

[jdm]

http://keithclark.co.uk/labs/css-fps/nojs/

* thread #9: tid = 0x4b82e9, 0x000000010601b864 servo`std::panicking::rust_panic + 4 at panicking.rs:586, stop reason = breakpoint 1.1
  * frame #0: 0x000000010601b864 servo`std::panicking::rust_panic + 4 at panicking.rs:586
    frame #1: 0x000000010601b835 servo`std::panicking::rust_panic_with_hook + 437 at panicking.rs:571
    frame #2: 0x000000010601b625 servo`std::panicking::begin_panic<collections::string::String> + 101 at panicking.rs:517
    frame #3: 0x000000010601b593 servo`std::panicking::begin_panic_fmt + 147 at panicking.rs:501
    frame #4: 0x000000010601b4f8 servo`std::panicking::rust_begin_panic + 56 at panicking.rs:477
    frame #5: 0x0000000106044c91 servo`core::panicking::panic_fmt + 129 at panicking.rs:69
    frame #6: 0x0000000106044b95 servo`core::panicking::panic + 101 at panicking.rs:49
    frame #7: 0x0000000101cc8390 servo`webrender::util::{{impl}}::new(rect=0x000000011c3985c8, transform=0x000000012a1a3840, device_pixel_ratio=2) + 2896 at util.rs:292
    frame #8: 0x0000000101cc19a1 servo`webrender::tiling::{{impl}}::cull_layers(self=0x000000011c39a0d8, screen_rect=0x000000011c398bd8, layer_map=0x000000011c39ed60, auxiliary_lists_map=0x000000011c39ed30, x_tile_count=8, y_tile_count=6, resource_cache=0x000000011c39eb20, profile_counters=0x000000011c398b70, device_pixel_ratio=2) + 1569 at tiling.rs:2484
    frame #9: 0x0000000101cc4d32 servo`webrender::tiling::{{impl}}::build(self=0x000000011c39a0d8, resource_cache=0x000000011c39eb20, frame_id=FrameId at 0x000000011c398b20, layer_map=0x000000011c39ed60, auxiliary_lists_map=0x000000011c39ed30, device_pixel_ratio=2) + 994 at tiling.rs:2794
    frame #10: 0x0000000101c8937e servo`webrender::frame::{{impl}}::build_frame::{{closure}}(builder=0x000000011c39a0d8) + 142 at frame.rs:959
    frame #11: 0x0000000101a6938a servo`core::option::{{impl}}::map<&mut webrender::tiling::FrameBuilder,webrender::tiling::Frame,closure>(self=Option<&mut webrender::tiling::FrameBuilder> at 0x000000011c399e10, f=closure at 0x000000011c399e18) + 394 at option.rs:383
    frame #12: 0x0000000101c890e8 servo`webrender::frame::{{impl}}::build_frame(self=0x000000011c39ed60, resource_cache=0x000000011c39eb20, auxiliary_lists_map=0x000000011c39ed30, device_pixel_ratio=2) + 296 at frame.rs:958
    frame #13: 0x0000000101c8821c servo`webrender::frame::{{impl}}::build(self=0x000000011c39ed60, resource_cache=0x000000011c39eb20, auxiliary_lists_map=0x000000011c39ed30, device_pixel_ratio=2) + 172 at frame.rs:880
    frame #14: 0x0000000101ca1a66 servo`webrender::render_backend::{{impl}}::render(self=0x000000011c39eaf8) + 118 at render_backend.rs:430
    frame #15: 0x0000000101ca0afd servo`webrender::render_backend::{{impl}}::run::{{closure}} + 461 at render_backend.rs:208
    frame #16: 0x0000000101c9838c servo`webrender::profiler::{{impl}}::profile<webrender::internal_types::RendererFrame,closure>(self=0x000000011c39c038, callback=closure at 0x000000011c39b700) + 252 at profiler.rs:150
    frame #17: 0x0000000101c9ecb4 servo`webrender::render_backend::{{impl}}::run(self=0x000000011c39eaf8) + 6724 at render_backend.rs:199
    frame #18: 0x0000000101cd1124 servo`webrender::renderer::{{impl}}::new::{{closure}} + 516 at renderer.rs:638
    frame #19: 0x0000000101c636cb servo`std::panic::{{impl}}::call_once<(self=AssertUnwindSafe<closure> at 0x000000011c39f240, _args=<unavailable>),closure> + 155 at panic.rs:296
    frame #20: 0x0000000101ac581a servo`std::panicking::try::do_call<std::panic::AssertUnwindSafe<closure>,(data=0x000000011c39fe90)> + 410 at panicking.rs:460
    frame #21: 0x000000010601c6ab servo`panic_unwind::__rust_maybe_catch_panic + 27 at lib.rs:98
    frame #22: 0x0000000101ac5004 servo`std::panicking::try<(f=AssertUnwindSafe<closure> at 0x000000011c39fc30),std::panic::AssertUnwindSafe<closure>> + 292 at panicking.rs:436
    frame #23: 0x0000000101ac2ee5 servo`std::panic::catch_unwind<std::panic::AssertUnwindSafe<closure>,(f=AssertUnwindSafe<closure> at 0x000000011c3a0508)> + 165 at panic.rs:361
    frame #24: 0x0000000101ac4c5c servo`std::thread::{{impl}}::spawn::{{closure}}<closure,()> + 396 at mod.rs:357
    frame #25: 0x0000000101b4baf3 servo`alloc::boxed::{{impl}}::call_box<(self=0x000000010fa963c0, args=<unavailable>),closure> + 83 at boxed.rs:605
    frame #26: 0x000000010601a715 servo`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] alloc::boxed::{{impl}}::call_once<(),()> + 37 at boxed.rs:615
    frame #27: 0x000000010601a70f servo`std::sys::imp::thread::{{impl}}::new::thread_start [inlined] std::sys_common::thread::start_thread + 15 at thread.rs:21
    frame #28: 0x000000010601a700 servo`std::sys::imp::thread::{{impl}}::new::thread_start + 16 at thread.rs:84
    frame #29: 0x00007fff8e409899 libsystem_pthread.dylib`_pthread_body + 138
    frame #30: 0x00007fff8e40972a libsystem_pthread.dylib`_pthread_start + 137
    frame #31: 0x00007fff8e40dfc9 libsystem_pthread.dylib`thread_start + 13
(lldb) f 7
frame #7: 0x0000000101cc8390 servo`webrender::util::{{impl}}::new(rect=0x000000011c3985c8, transform=0x000000012a1a3840, device_pixel_ratio=2) + 2896 at util.rs:292
   289 	                                                      DeviceIntSize::new(outer_max_dp.x - outer_min_dp.x,
   290 	                                                                         outer_max_dp.y - outer_min_dp.y)),
   291 	                    inner_rect: DeviceIntRect::new(inner_min_dp,
-> 292 	                                                   DeviceIntSize::new(inner_max_dp.x - inner_min_dp.x,
   293 	                                                                      inner_max_dp.y - inner_min_dp.y)),
   294 	                    kind: kind,
   295 	                }
(lldb) p inner_max_dp
(euclid::point::TypedPoint2D<i32, webrender_traits::units::DevicePixel>) $0 = TypedPoint2D<i32, webrender_traits::units::DevicePixel> {
x: 2132096768,
y: -2147483648,
_unit: PhantomData<webrender_traits::units::DevicePixel>
}
(lldb) p inner_min_dp
(euclid::point::TypedPoint2D<i32, webrender_traits::units::DevicePixel>) $1 = TypedPoint2D<i32, webrender_traits::units::DevicePixel> {
x: -899902272,
y: -2147483648,
_unit: PhantomData<webrender_traits::units::DevicePixel>
}

[pyfisch]

@jdm for me it does not panic for commit df67977 in release mode on Linux. It displays some broken 3D transforms. Does it still panic for you?

[jdm]

Keep in mind that underflow is not expected to panic in a release build. However, it also does not panic for me in a debug build.