Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

attempt to multiply with overflow in texture_allocator on filter:blur with large radius #18711

Closed
mateon1 opened this issue Oct 2, 2017 · 2 comments

Comments

@mateon1
Copy link
Contributor

@mateon1 mateon1 commented Oct 2, 2017

This should be gracefully handled. Either use saturating multiplication, or detect the issue early.

This is caused by the same line as #18655, but with a different root cause.

<div style="filter: blur(999999px)">x</div>
attempt to multiply with overflow (thread RenderBackend, at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/texture_allocator.rs:55)
stack backtrace:
   0:     0x55d9d5820fb4 - backtrace::backtrace::libunwind::trace
                        at /shared/dev/rust/servo/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.2/src/backtrace/libunwind.rs:53
                         - backtrace::backtrace::trace<closure>
                        at /shared/dev/rust/servo/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.2/src/backtrace/mod.rs:42
   1:     0x55d9d581c9df - backtrace::capture::{{impl}}::new
                        at /shared/dev/rust/servo/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.2/src/capture.rs:64
   2:     0x55d9cfa363fe - servo::main::{{closure}}
                        at /shared/dev/rust/servo/ports/servo/main.rs:130
   3:     0x55d9d67ec2b6 - std::panicking::rust_panic_with_hook
                        at /checkout/src/libstd/panicking.rs:578
   4:     0x55d9d67ec0d4 - std::panicking::begin_panic<alloc::string::String>
                        at /checkout/src/libstd/panicking.rs:538
   5:     0x55d9d67ec049 - std::panicking::begin_panic_fmt
                        at /checkout/src/libstd/panicking.rs:522
   6:     0x55d9d67ebfda - std::panicking::rust_begin_panic
                        at /checkout/src/libstd/panicking.rs:498
   7:     0x55d9d6826410 - core::panicking::panic_fmt
                        at /checkout/src/libcore/panicking.rs:71
   8:     0x55d9d6826346 - core::panicking::panic
                        at /checkout/src/libcore/panicking.rs:51
   9:     0x55d9d3c10f33 - webrender::texture_allocator::{{impl}}::find_index_of_best_rect_in_bin
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/texture_allocator.rs:55
  10:     0x55d9d3c110a1 - webrender::texture_allocator::{{impl}}::find_index_of_best_rect
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/texture_allocator.rs:73
  11:     0x55d9d3c111b1 - webrender::texture_allocator::{{impl}}::allocate
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/texture_allocator.rs:86
  12:     0x55d9d3e96daf - webrender::tiling::{{impl}}::allocate
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/tiling.rs:912
  13:     0x55d9d3e97d05 - webrender::tiling::{{impl}}::allocate
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/tiling.rs:1056
  14:     0x55d9d3e979b9 - webrender::tiling::{{impl}}::allocate<webrender::tiling::ColorRenderTarget>
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/tiling.rs:1016
  15:     0x55d9d3e99a2c - webrender::tiling::{{impl}}::build
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/tiling.rs:1398
  16:     0x55d9d3be13a2 - webrender::frame_builder::{{impl}}::build
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/frame_builder.rs:2357
  17:     0x55d9d3e82a05 - webrender::frame::{{impl}}::build_frame::{{closure}}
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/frame.rs:1253
  18:     0x55d9d3da5e75 - core::option::{{impl}}::map<&mut webrender::frame_builder::FrameBuilder,webrender::tiling::Frame,closure>
                        at /checkout/src/libcore/option.rs:398
  19:     0x55d9d3e8270c - webrender::frame::{{impl}}::build_frame
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/frame.rs:1252
  20:     0x55d9d3e824f8 - webrender::frame::{{impl}}::build
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/frame.rs:1229
  21:     0x55d9d3e8f62a - webrender::render_backend::{{impl}}::render
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/render_backend.rs:106
  22:     0x55d9d3e91141 - webrender::render_backend::{{impl}}::process_document
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/render_backend.rs:400
  23:     0x55d9d3e91cf7 - webrender::render_backend::{{impl}}::run
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/render_backend.rs:468
  24:     0x55d9d3c1ea80 - webrender::renderer::{{impl}}::new::{{closure}}
                        at /shared/dev/rust/servo/.cargo/git/checkouts/webrender-c3596abe1cf4f320/0fd01ba/webrender/src/renderer.rs:1713
  25:     0x55d9d3b4bbaa - std::sys_common::backtrace::__rust_begin_short_backtrace<closure,()>
                        at /checkout/src/libstd/sys_common/backtrace.rs:136
  26:     0x55d9d3db0d53 - std::thread::{{impl}}::spawn::{{closure}}::{{closure}}<closure,()>
                        at /checkout/src/libstd/thread/mod.rs:400
  27:     0x55d9d3d757ea - std::panic::{{impl}}::call_once<(),closure>
                        at /checkout/src/libstd/panic.rs:296
  28:     0x55d9d3db24f2 - std::panicking::try::do_call<std::panic::AssertUnwindSafe<closure>,()>
                        at /checkout/src/libstd/panicking.rs:480
  29:     0x55d9d67f344c - panic_unwind::__rust_maybe_catch_panic
                        at /checkout/src/libpanic_unwind/lib.rs:99
  30:     0x55d9d3db10ec - std::panicking::try<(),std::panic::AssertUnwindSafe<closure>>
                        at /checkout/src/libstd/panicking.rs:459
  31:     0x55d9d3db0835 - std::panic::catch_unwind<std::panic::AssertUnwindSafe<closure>,()>
                        at /checkout/src/libstd/panic.rs:361
  32:     0x55d9d3b4eb8b - std::thread::{{impl}}::spawn::{{closure}}<closure,()>
                        at /checkout/src/libstd/thread/mod.rs:399
  33:     0x55d9d3b87aa3 - alloc::boxed::{{impl}}::call_box<(),closure>
                        at /checkout/src/liballoc/boxed.rs:728
  34:     0x55d9d67eaf3b - alloc::boxed::{{impl}}::call_once<(),()>
                        at /checkout/src/liballoc/boxed.rs:738
                         - std::sys_common::thread::start_thread
                        at /checkout/src/libstd/sys_common/thread.rs:24
                         - std::sys::imp::thread::{{impl}}::new::thread_start
                        at /checkout/src/libstd/sys/unix/thread.rs:90
  35:     0x7fdb32e2c493 - start_thread
  36:     0x7fdb32959abe - __clone
  37:                0x0 - <unknown>
ERROR:servo: attempt to multiply with overflow
@jdm
Copy link
Member

@jdm jdm commented Oct 2, 2017

cc @glennw

@glennw
Copy link
Member

@glennw glennw commented Feb 6, 2018

The code in question here no longer exists - the texture allocator was replaced with a deterministic slab-style allocator.

@glennw glennw closed this Feb 6, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
3 participants
You can’t perform that action at this time.