Skip to content

/ servo

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

assertion failed: rect.size.width >= Zero::zero() caused by layout::display_list::background::clip #23091

Open
mateon1 opened this issue Mar 25, 2019 · 0 comments
Open

assertion failed: rect.size.width >= Zero::zero() caused by layout::display_list::background::clip #23091

mateon1 opened this issue Mar 25, 2019 · 0 comments
Labels
A-gfx/displaylist A-layout/inline C-has-manual-testcase I-panic

Comments

@mateon1
Copy link
Contributor

@mateon1 mateon1 commented Mar 25, 2019

I keep running into this assertion while fuzzing, so I decided to investigate.
One of the causes of this panic is the background::clip function.

<span>x</span>
<span style="border-left-style: solid; background-clip: padding-box">
<video></video>
</span>

Relevant parts of the backtrace:

   9:     0x555559eed120 - <euclid::rect::TypedRect<T, U>>::inner_rect::h1b6e3a58314dc57f
                        at /shared/dev/rust/servo/<::core::macros::panic macros>:3
  10:     0x55555a0e17ea - layout::display_list::background::clip::h49ac24260afd0f39
                        at components/layout/display_list/background.rs:129
  11:     0x555559f0925c - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list_for_background_if_applicable_with_background::h90cce93f47cf7cdc
                        at components/layout/display_list/builder.rs:695
  12:     0x555559f08faa - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list_for_background_if_applicable::h3bfbf7610ae14f7a
                        at components/layout/display_list/builder.rs:663
  13:     0x555559f0f2a3 - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list_no_damage::h0b58a17370685ff4
                        at components/layout/display_list/builder.rs:1563
  14:     0x555559f0ec80 - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list::h4b255c722b449061
                        at components/layout/display_list/builder.rs:1523
  15:     0x555559f0060a - layout::inline::InlineFlow::build_display_list_for_inline_fragment_at_index::h4ef2b6bc44cf3304
                        at components/layout/inline.rs:1442
  16:     0x555559f03f66 - <layout::inline::InlineFlow as layout::flow::Flow>::build_display_list::he4df8a927e5cd41e
                        at components/layout/inline.rs:1914

I ran this example through a debugger, and it seems that background::clip is receiving a zero-sized rectangle as the absolute_bounds, which causes a panic in euclid code.

https://github.com/servo/servo/blob/master/components/layout/display_list/background.rs#L129

I believe the clip function should either gracefully handle this case, or document the panic and pass the blame to the caller.

Full backtrace 
VMware, Inc.
llvmpipe (LLVM 7.0, 256 bits)
3.3 (Core Profile) Mesa 18.3.4
assertion failed: rect.size.width >= Zero::zero() (thread LayoutThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(1) }, at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/euclid-0.19.4/src/rect.rs:270)
stack backtrace:
   0:     0x55555d084ed6 - backtrace::backtrace::libunwind::trace::h8af3b710f1a5e12e
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/backtrace/libunwind.rs:53
                         - backtrace::backtrace::trace::h2a1223234ae0346f
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/backtrace/mod.rs:42
   1:     0x55555d07f4e3 - backtrace::capture::Backtrace::new_unresolved::h2dd57ce7b77a7435
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/capture.rs:88
   2:     0x55555d07f43d - backtrace::capture::Backtrace::new::h8c6b161078e28d12
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/capture.rs:63
   3:     0x555556037351 - servo::main::{{closure}}::h5fe9a894213f10e8
                        at ports/servo/non_android_main.rs:110
   4:     0x55555f172a48 - rust_panic_with_hook
                        at src/libstd/panicking.rs:482
   5:     0x55555f1724e1 - continue_panic_fmt
                        at src/libstd/panicking.rs:385
   6:     0x55555f1723c5 - rust_begin_unwind
   7:     0x55555f191cac - panic_fmt
                        at src/libcore/panicking.rs:85
   8:     0x55555f191beb - panic
                        at src/libcore/panicking.rs:49
   9:     0x555559eed120 - <euclid::rect::TypedRect<T, U>>::inner_rect::h1b6e3a58314dc57f
                        at /shared/dev/rust/servo/<::core::macros::panic macros>:3
  10:     0x55555a0e17ea - layout::display_list::background::clip::h49ac24260afd0f39
                        at components/layout/display_list/background.rs:129
  11:     0x555559f0925c - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list_for_background_if_applicable_with_background::h90cce93f47cf7cdc
                        at components/layout/display_list/builder.rs:695
  12:     0x555559f08faa - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list_for_background_if_applicable::h3bfbf7610ae14f7a
                        at components/layout/display_list/builder.rs:663
  13:     0x555559f0f2a3 - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list_no_damage::h0b58a17370685ff4
                        at components/layout/display_list/builder.rs:1563
  14:     0x555559f0ec80 - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list::h4b255c722b449061
                        at components/layout/display_list/builder.rs:1523
  15:     0x555559f0060a - layout::inline::InlineFlow::build_display_list_for_inline_fragment_at_index::h4ef2b6bc44cf3304
                        at components/layout/inline.rs:1442
  16:     0x555559f03f66 - <layout::inline::InlineFlow as layout::flow::Flow>::build_display_list::he4df8a927e5cd41e
                        at components/layout/inline.rs:1914
  17:     0x555559ef7ad4 - layout::traversal::BuildDisplayList::traverse::h6b403fddd0b5ad37
                        at components/layout/traversal.rs:344
  18:     0x555559ef7cce - layout::traversal::BuildDisplayList::traverse::h6b403fddd0b5ad37
                        at components/layout/traversal.rs:350
  19:     0x555559ef7cce - layout::traversal::BuildDisplayList::traverse::h6b403fddd0b5ad37
                        at components/layout/traversal.rs:350
  20:     0x555559f9f1ef - layout::sequential::build_display_list_for_subtree::hb58463b7cb5cec03
                        at components/layout/sequential.rs:81
  21:     0x5555569ce5f9 - layout_thread::LayoutThread::compute_abs_pos_and_build_display_list::{{closure}}::h58075e51d552f326
                        at components/layout_thread/lib.rs:1035
  22:     0x555556a135f6 - profile_traits::time::profile::h9fe2e60f7ec7f2e7
                        at /shared/dev/rust/servo/components/profile_traits/time.rs:142
  23:     0x5555568a207b - layout_thread::LayoutThread::compute_abs_pos_and_build_display_list::h1ed2d9657645f024
                        at components/layout_thread/lib.rs:1010
  24:     0x5555568a9145 - layout_thread::LayoutThread::perform_post_main_layout_passes::h01232d83b35f4388
                        at components/layout_thread/lib.rs:1798
  25:     0x5555568a8e7e - layout_thread::LayoutThread::perform_post_style_recalc_layout_passes::he179434151a2cc3e
                        at components/layout_thread/lib.rs:1778
  26:     0x5555568a5762 - layout_thread::LayoutThread::handle_reflow::ha8796ca750bf9a52
                        at components/layout_thread/lib.rs:1459
  27:     0x5555569cd8e9 - layout_thread::LayoutThread::handle_request_helper::{{closure}}::hbfae2b3293339477
                        at components/layout_thread/lib.rs:726
  28:     0x555556a12dee - profile_traits::time::profile::h85dc10afe741d48b
                        at /shared/dev/rust/servo/components/profile_traits/time.rs:142
  29:     0x55555689e12d - layout_thread::LayoutThread::handle_request_helper::h57e1d40c3617997c
                        at components/layout_thread/lib.rs:722
  30:     0x55555689d334 - layout_thread::LayoutThread::handle_request::hb5fa803528c22ce9
                        at components/layout_thread/lib.rs:672
  31:     0x55555689bd72 - layout_thread::LayoutThread::start::hf920768435aa8160
                        at components/layout_thread/lib.rs:558
  32:     0x5555569cc492 - <layout_thread::LayoutThread as layout_traits::LayoutThreadFactory>::create::{{closure}}::{{closure}}::heb8dfaef58fad40e
                        at components/layout_thread/lib.rs:313
  33:     0x55555696da7e - profile_traits::mem::ProfilerChan::run_with_memory_reporting::hc617bc87948860f1
                        at /shared/dev/rust/servo/components/profile_traits/mem.rs:88
  34:     0x5555569ccd58 - <layout_thread::LayoutThread as layout_traits::LayoutThreadFactory>::create::{{closure}}::hb9e0a07a00999f71
                        at components/layout_thread/lib.rs:311
  35:     0x555556b35b94 - std::sys_common::backtrace::__rust_begin_short_backtrace::h69408bfd53070bc1
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/sys_common/backtrace.rs:136
  36:     0x555556a77413 - std::thread::Builder::spawn_unchecked::{{closure}}::{{closure}}::hff71ded556757c3e
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/thread/mod.rs:469
  37:     0x555556b34bf3 - <std::panic::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once::h6c192e3f82a95cfb
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/panic.rs:309
  38:     0x555556b50b29 - std::panicking::try::do_call::hde4e69918d8709c8
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/panicking.rs:297
  39:     0x55555f17d5f9 - __rust_maybe_catch_panic
                        at src/libpanic_unwind/lib.rs:87
  40:     0x555556b5024f - std::panicking::try::he65f80095cf99d71
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/panicking.rs:276
  41:     0x555556b34eb5 - std::panic::catch_unwind::h5f0795995ca0c47c
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/panic.rs:388
  42:     0x555556a771df - std::thread::Builder::spawn_unchecked::{{closure}}::hb09d73e49d72953c
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/thread/mod.rs:468
  43:     0x555556a774e8 - <F as alloc::boxed::FnBox<A>>::call_box::h9566bf7cccb22507
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/liballoc/boxed.rs:749
  44:     0x55555f17c93d - call_once<(),()>
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/liballoc/boxed.rs:759
                         - start_thread
                        at src/libstd/sys_common/thread.rs:14
                         - thread_start
                        at src/libstd/sys/unix/thread.rs:80
  45:     0x7ffff6f71fa2 - start_thread
  46:     0x7ffff6e8682e - clone
  47:                0x0 - <unknown>
[2019-03-25T11:18:09Z ERROR servo] assertion failed: rect.size.width >= Zero::zero()
Pipeline failed in hard-fail mode.  Crashing!

This is another example I reduced, I haven't ran this one through the debugger but the backtrace is similar.

<style>
:root {padding: 90%; border-collapse: collapse;}
</style>
<select style="background-clip:padding-box; padding:90%;"></select>

Relevant parts:

   9:     0x555559eed120 - <euclid::rect::TypedRect<T, U>>::inner_rect::h1b6e3a58314dc57f
                        at /shared/dev/rust/servo/<::core::macros::panic macros>:3
  10:     0x55555a0e17ea - layout::display_list::background::clip::h49ac24260afd0f39
                        at components/layout/display_list/background.rs:129
  11:     0x555559f0925c - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list_for_background_if_applicable_with_background::h90cce93f47cf7cdc
                        at components/layout/display_list/builder.rs:695
  12:     0x555559f08faa - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list_for_background_if_applicable::h3bfbf7610ae14f7a
                        at components/layout/display_list/builder.rs:663
  13:     0x555559f0f63c - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list_no_damage::h0b58a17370685ff4
                        at components/layout/display_list/builder.rs:1607
  14:     0x555559e8ab93 - layout::display_list::builder::<impl layout::block::BlockFlow>::build_display_list_for_block_no_damage::h1ea7415570973a74
                        at components/layout/display_list/builder.rs:2736
  15:     0x555559e8ac21 - layout::display_list::builder::<impl layout::block::BlockFlow>::build_display_list_for_block::h533e4e891282b938
                        at components/layout/display_list/builder.rs:2759
  16:     0x555559e84be0 - <layout::block::BlockFlow as layout::flow::Flow>::build_display_list::h28f8e49a20275abb
                        at components/layout/block.rs:2568
Full backtrace 
VMware, Inc.
llvmpipe (LLVM 7.0, 256 bits)
3.3 (Core Profile) Mesa 18.3.4
assertion failed: rect.size.width >= Zero::zero() (thread LayoutThread PipelineId { namespace_id: PipelineNamespaceId(1), index: PipelineIndex(1) }, at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/euclid-0.19.4/src/rect.rs:270)
stack backtrace:
   0:     0x55555d084ed6 - backtrace::backtrace::libunwind::trace::h8af3b710f1a5e12e
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/backtrace/libunwind.rs:53
                         - backtrace::backtrace::trace::h2a1223234ae0346f
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/backtrace/mod.rs:42
   1:     0x55555d07f4e3 - backtrace::capture::Backtrace::new_unresolved::h2dd57ce7b77a7435
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/capture.rs:88
   2:     0x55555d07f43d - backtrace::capture::Backtrace::new::h8c6b161078e28d12
                        at /home/mateon/.cargo/registry/src/github.com-1ecc6299db9ec823/backtrace-0.3.9/src/capture.rs:63
   3:     0x555556037351 - servo::main::{{closure}}::h5fe9a894213f10e8
                        at ports/servo/non_android_main.rs:110
   4:     0x55555f172a48 - rust_panic_with_hook
                        at src/libstd/panicking.rs:482
   5:     0x55555f1724e1 - continue_panic_fmt
                        at src/libstd/panicking.rs:385
   6:     0x55555f1723c5 - rust_begin_unwind
   7:     0x55555f191cac - panic_fmt
                        at src/libcore/panicking.rs:85
   8:     0x55555f191beb - panic
                        at src/libcore/panicking.rs:49
   9:     0x555559eed120 - <euclid::rect::TypedRect<T, U>>::inner_rect::h1b6e3a58314dc57f
                        at /shared/dev/rust/servo/<::core::macros::panic macros>:3
  10:     0x55555a0e17ea - layout::display_list::background::clip::h49ac24260afd0f39
                        at components/layout/display_list/background.rs:129
  11:     0x555559f0925c - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list_for_background_if_applicable_with_background::h90cce93f47cf7cdc
                        at components/layout/display_list/builder.rs:695
  12:     0x555559f08faa - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list_for_background_if_applicable::h3bfbf7610ae14f7a
                        at components/layout/display_list/builder.rs:663
  13:     0x555559f0f63c - layout::display_list::builder::<impl layout::fragment::Fragment>::build_display_list_no_damage::h0b58a17370685ff4
                        at components/layout/display_list/builder.rs:1607
  14:     0x555559e8ab93 - layout::display_list::builder::<impl layout::block::BlockFlow>::build_display_list_for_block_no_damage::h1ea7415570973a74
                        at components/layout/display_list/builder.rs:2736
  15:     0x555559e8ac21 - layout::display_list::builder::<impl layout::block::BlockFlow>::build_display_list_for_block::h533e4e891282b938
                        at components/layout/display_list/builder.rs:2759
  16:     0x555559e84be0 - <layout::block::BlockFlow as layout::flow::Flow>::build_display_list::h28f8e49a20275abb
                        at components/layout/block.rs:2568
  17:     0x555559ef7ad4 - layout::traversal::BuildDisplayList::traverse::h6b403fddd0b5ad37
                        at components/layout/traversal.rs:344
  18:     0x555559ef7cce - layout::traversal::BuildDisplayList::traverse::h6b403fddd0b5ad37
                        at components/layout/traversal.rs:350
  19:     0x555559ef7cce - layout::traversal::BuildDisplayList::traverse::h6b403fddd0b5ad37
                        at components/layout/traversal.rs:350
  20:     0x555559ef7cce - layout::traversal::BuildDisplayList::traverse::h6b403fddd0b5ad37
                        at components/layout/traversal.rs:350
  21:     0x555559f9f1ef - layout::sequential::build_display_list_for_subtree::hb58463b7cb5cec03
                        at components/layout/sequential.rs:81
  22:     0x5555569ce5f9 - layout_thread::LayoutThread::compute_abs_pos_and_build_display_list::{{closure}}::h58075e51d552f326
                        at components/layout_thread/lib.rs:1035
  23:     0x555556a135f6 - profile_traits::time::profile::h9fe2e60f7ec7f2e7
                        at /shared/dev/rust/servo/components/profile_traits/time.rs:142
  24:     0x5555568a207b - layout_thread::LayoutThread::compute_abs_pos_and_build_display_list::h1ed2d9657645f024
                        at components/layout_thread/lib.rs:1010
  25:     0x5555568a9145 - layout_thread::LayoutThread::perform_post_main_layout_passes::h01232d83b35f4388
                        at components/layout_thread/lib.rs:1798
  26:     0x5555568a8e7e - layout_thread::LayoutThread::perform_post_style_recalc_layout_passes::he179434151a2cc3e
                        at components/layout_thread/lib.rs:1778
  27:     0x5555568a5762 - layout_thread::LayoutThread::handle_reflow::ha8796ca750bf9a52
                        at components/layout_thread/lib.rs:1459
  28:     0x5555569cd8e9 - layout_thread::LayoutThread::handle_request_helper::{{closure}}::hbfae2b3293339477
                        at components/layout_thread/lib.rs:726
  29:     0x555556a12dee - profile_traits::time::profile::h85dc10afe741d48b
                        at /shared/dev/rust/servo/components/profile_traits/time.rs:142
  30:     0x55555689e12d - layout_thread::LayoutThread::handle_request_helper::h57e1d40c3617997c
                        at components/layout_thread/lib.rs:722
  31:     0x55555689d334 - layout_thread::LayoutThread::handle_request::hb5fa803528c22ce9
                        at components/layout_thread/lib.rs:672
  32:     0x55555689bd72 - layout_thread::LayoutThread::start::hf920768435aa8160
                        at components/layout_thread/lib.rs:558
  33:     0x5555569cc492 - <layout_thread::LayoutThread as layout_traits::LayoutThreadFactory>::create::{{closure}}::{{closure}}::heb8dfaef58fad40e
                        at components/layout_thread/lib.rs:313
  34:     0x55555696da7e - profile_traits::mem::ProfilerChan::run_with_memory_reporting::hc617bc87948860f1
                        at /shared/dev/rust/servo/components/profile_traits/mem.rs:88
  35:     0x5555569ccd58 - <layout_thread::LayoutThread as layout_traits::LayoutThreadFactory>::create::{{closure}}::hb9e0a07a00999f71
                        at components/layout_thread/lib.rs:311
  36:     0x555556b35b94 - std::sys_common::backtrace::__rust_begin_short_backtrace::h69408bfd53070bc1
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/sys_common/backtrace.rs:136
  37:     0x555556a77413 - std::thread::Builder::spawn_unchecked::{{closure}}::{{closure}}::hff71ded556757c3e
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/thread/mod.rs:469
  38:     0x555556b34bf3 - <std::panic::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once::h6c192e3f82a95cfb
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/panic.rs:309
  39:     0x555556b50b29 - std::panicking::try::do_call::hde4e69918d8709c8
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/panicking.rs:297
  40:     0x55555f17d5f9 - __rust_maybe_catch_panic
                        at src/libpanic_unwind/lib.rs:87
  41:     0x555556b5024f - std::panicking::try::he65f80095cf99d71
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/panicking.rs:276
  42:     0x555556b34eb5 - std::panic::catch_unwind::h5f0795995ca0c47c
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/panic.rs:388
  43:     0x555556a771df - std::thread::Builder::spawn_unchecked::{{closure}}::hb09d73e49d72953c
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/libstd/thread/mod.rs:468
  44:     0x555556a774e8 - <F as alloc::boxed::FnBox<A>>::call_box::h9566bf7cccb22507
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/liballoc/boxed.rs:749
  45:     0x55555f17c93d - call_once<(),()>
                        at /rustc/0ea22717a1e01fa535534b85a5347a7e49fc79de/src/liballoc/boxed.rs:759
                         - start_thread
                        at src/libstd/sys_common/thread.rs:14
                         - thread_start
                        at src/libstd/sys/unix/thread.rs:80
  46:     0x7ffff6f71fa2 - start_thread
  47:     0x7ffff6e8682e - clone
  48:                0x0 - <unknown>
[2019-03-25T11:17:54Z ERROR servo] assertion failed: rect.size.width >= Zero::zero()
Pipeline failed in hard-fail mode.  Crashing!
@CYBAI CYBAI mentioned this issue Apr 22, 2019
Open
3 of 4 tasks complete
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
A-gfx/displaylist A-layout/inline C-has-manual-testcase I-panic
Projects
None yet
Milestone
No milestone
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants
@jdm @mateon1
You can’t perform that action at this time.