This was found by enabling the float-cast-overflow check in UBSan and running existing tests. This type of issue can create inconsistencies across platforms, architectures and optimization levels.

To enable this check add the following to your mozconfig:

ac_add_options --enable-undefined-sanitizer="float-cast-overflow"

This issue is found by the existing test: layout/reftests/svg/objectBoundingBox-and-fePointLight-02.svg == layout/reftests/svg/objectBoundingBox-and-fePointLight-02-ref.svg

INFO - REFTEST TEST-START | layout/reftests/svg/objectBoundingBox-and-fePointLight-02.svg == layout/reftests/svg/objectBoundingBox-and-fePointLight-02-ref.svg
INFO - REFTEST TEST-LOAD | file:///builds/worker/workspace/build/tests/reftest/tests/layout/reftests/svg/objectBoundingBox-and-fePointLight-02.svg | 268 / 496 (54%)
INFO - /builds/worker/checkouts/gecko/gfx/2d/FilterNodeSoftware.cpp:3722:16: runtime error: -nan is outside the range of representable values of type 'unsigned short'
INFO -     #0 0x7f9833193ff0 in mozilla::gfx::(anonymous namespace)::SpecularLightingSoftware::LightPixel(mozilla::gfx::Point3DTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::Point3DTyped<mozilla::gfx::UnknownUnits, float> const&, unsigned int) /builds/worker/checkouts/gecko/gfx/2d/FilterNodeSoftware.cpp:3722:16
INFO -     #1 0x7f98331921a2 in DoRender<int> /builds/worker/checkouts/gecko/gfx/2d/FilterNodeSoftware.cpp:3646:21
INFO -     #2 0x7f98331921a2 in mozilla::gfx::FilterNodeLightingSoftware<mozilla::gfx::(anonymous namespace)::PointLightSoftware, mozilla::gfx::(anonymous namespace)::SpecularLightingSoftware>::Render(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /builds/worker/checkouts/gecko/gfx/2d/FilterNodeSoftware.cpp:3547:12
INFO -     #3 0x7f983313b2c5 in mozilla::gfx::FilterNodeSoftware::GetOutput(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /builds/worker/checkouts/gecko/gfx/2d/FilterNodeSoftware.cpp:638:20
INFO -     #4 0x7f983313d0bb in mozilla::gfx::FilterNodeSoftware::GetInputDataSourceSurface(unsigned int, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::FilterNodeSoftware::FormatHint, mozilla::gfx::ConvolveMatrixEdgeMode, mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const*) /builds/worker/checkouts/gecko/gfx/2d/FilterNodeSoftware.cpp:770:25
INFO -     #5 0x7f9833156f0b in mozilla::gfx::FilterNodeCropSoftware::Render(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /builds/worker/checkouts/gecko/gfx/2d/FilterNodeSoftware.cpp:3168:10
INFO -     #6 0x7f983313b2c5 in mozilla::gfx::FilterNodeSoftware::GetOutput(mozilla::gfx::IntRectTyped<mozilla::gfx::UnknownUnits> const&) /builds/worker/checkouts/gecko/gfx/2d/FilterNodeSoftware.cpp:638:20
INFO -     #7 0x7f983311c707 in mozilla::gfx::FilterNodeSoftware::Draw(mozilla::gfx::DrawTarget*, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::DrawOptions const&) /builds/worker/checkouts/gecko/gfx/2d/FilterNodeSoftware.cpp:572:14
INFO -     #8 0x7f983312cc01 in mozilla::gfx::DrawTargetOffset::DrawFilter(mozilla::gfx::FilterNode*, mozilla::gfx::RectTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::PointTyped<mozilla::gfx::UnknownUnits, float> const&, mozilla::gfx::DrawOptions const&) /builds/worker/checkouts/gecko/gfx/2d/DrawTargetOffset.cpp:99:16
INFO -     #9 0x7f983309b4ac in mozilla::gfx::RecordedDrawFilter::PlayEvent(mozilla::gfx::Translator*) const /builds/worker/checkouts/gecko/gfx/2d/RecordedEventImpl.h:2897:7
INFO -     #10 0x7f98330cd3b9 in operator() /builds/worker/checkouts/gecko/gfx/2d/InlineTranslator.cpp:82:31
INFO -     #11 0x7f98330cd3b9 in std::_Function_handler<bool (mozilla::gfx::RecordedEvent*), mozilla::gfx::InlineTranslator::TranslateRecording(char*, unsigned long)::$_0>::_M_invoke(std::_Any_data const&, mozilla::gfx::RecordedEvent*&&) /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:301:9
INFO -     #12 0x7f98330a70f9 in operator() /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/std_function.h:706:14
INFO -     #13 0x7f98330a70f9 in DoWithEvent<MemReader> /builds/worker/checkouts/gecko/gfx/2d/RecordedEventImpl.h:4061:5
INFO -     #14 0x7f98330a70f9 in mozilla::gfx::InlineTranslator::TranslateRecording(char*, unsigned long) /builds/worker/checkouts/gecko/gfx/2d/InlineTranslator.cpp:72:20
INFO -     #15 0x7f983384b4d7 in Moz2DRenderCallback /builds/worker/checkouts/gecko/gfx/webrender_bindings/Moz2DImageRenderer.cpp:427:20
INFO -     #16 0x7f983384b4d7 in wr_moz2d_render_cb /builds/worker/checkouts/gecko/gfx/webrender_bindings/Moz2DImageRenderer.cpp:471:10
INFO -     #17 0x7f9840c6de1f in webrender_bindings::moz2d_renderer::rasterize_blob::_$u7b$$u7b$closure$u7d$$u7d$::ha14ba1eac1fce42d /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/moz2d_renderer.rs:608:16
INFO -     #18 0x7f9840c6de1f in webrender_bindings::moz2d_renderer::autoreleasepool::h63b060c9187b57e9 /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/moz2d_renderer.rs:590:9
INFO -     #19 0x7f9840c6de1f in webrender_bindings::moz2d_renderer::rasterize_blob::h135ccc0ecb3546af /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/moz2d_renderer.rs:606:18
INFO -     #20 0x7f9840c6c9c5 in core::ops::function::FnMut::call_mut::h151fb189c616422b /builds/worker/fetches/rust/library/core/src/ops/function.rs:150:5
INFO -     #21 0x7f9840c6c9c5 in core::iter::adapters::map::map_fold::_$u7b$$u7b$closure$u7d$$u7d$::hb6f654a8717e7e1e /builds/worker/fetches/rust/library/core/src/iter/adapters/map.rs:84:28
INFO -     #22 0x7f9840c6c9c5 in core::iter::traits::iterator::Iterator::fold::h1b80cd9be84c21f7 /builds/worker/fetches/rust/library/core/src/iter/traits/iterator.rs:2170:21
INFO -     #23 0x7f9840c6c9c5 in _$LT$core..iter..adapters..map..Map$LT$I$C$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::fold::h255111a5f6cb8704 /builds/worker/fetches/rust/library/core/src/iter/adapters/map.rs:124:9
INFO -     #24 0x7f9840c6c9c5 in core::iter::traits::iterator::Iterator::for_each::h60d830522d2a3110 /builds/worker/fetches/rust/library/core/src/iter/traits/iterator.rs:736:9
INFO -     #25 0x7f9840c6c9c5 in _$LT$alloc..vec..Vec$LT$T$C$A$GT$$u20$as$u20$alloc..vec..spec_extend..SpecExtend$LT$T$C$I$GT$$GT$::spec_extend::hcf1b96800c2c5ed3 /builds/worker/fetches/rust/library/alloc/src/vec/spec_extend.rs:40:17
INFO -     #26 0x7f9840c6c9c5 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..spec_from_iter_nested..SpecFromIterNested$LT$T$C$I$GT$$GT$::from_iter::hb7d5edbe7b9d2250 /builds/worker/fetches/rust/library/alloc/src/vec/spec_from_iter_nested.rs:56:9
INFO -     #27 0x7f9840c6c9c5 in alloc::vec::source_iter_marker::_$LT$impl$u20$alloc..vec..spec_from_iter..SpecFromIter$LT$T$C$I$GT$$u20$for$u20$alloc..vec..Vec$LT$T$GT$$GT$::from_iter::h86886368e4fca0db /builds/worker/fetches/rust/library/alloc/src/vec/source_iter_marker.rs:31:20
INFO -     #28 0x7f9840c6c9c5 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$core..iter..traits..collect..FromIterator$LT$T$GT$$GT$::from_iter::h8a9480ce1ec366d1 /builds/worker/fetches/rust/library/alloc/src/vec/mod.rs:2549:9
INFO -     #29 0x7f9840c6c9c5 in core::iter::traits::iterator::Iterator::collect::h2f104dcf112264c3 /builds/worker/fetches/rust/library/core/src/iter/traits/iterator.rs:1744:9
INFO -     #30 0x7f9840c6c9c5 in _$LT$webrender_bindings..moz2d_renderer..Moz2dBlobRasterizer$u20$as$u20$webrender_api..image..AsyncBlobImageRasterizer$GT$::rasterize::hb84bad0fd28774fb /builds/worker/checkouts/gecko/gfx/webrender_bindings/src/moz2d_renderer.rs:576:13
INFO -     #31 0x7f9840564c36 in webrender::scene_builder_thread::rasterize_blobs::h06d05a1f8bee1b25 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/scene_builder_thread.rs:44:36
INFO -     #32 0x7f98405f7501 in webrender::scene_builder_thread::LowPrioritySceneBuilderThread::process_transaction::h91b8866d9e98dae0 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/scene_builder_thread.rs:783:9
INFO -     #33 0x7f98405f7501 in webrender::scene_builder_thread::LowPrioritySceneBuilderThread::run::_$u7b$$u7b$closure$u7d$$u7d$::hf4d2de56f77952d9 /builds/worker/checkouts/gecko/gfx/wr/webrender/src/scene_builder_thread.rs:763:36
INFO -     #34 0x7f98405f7501 in core::iter::adapters::map::map_fold::_$u7b$$u7b$closure$u7d$$u7d$::h982e99154d54e665 /builds/worker/fetches/rust/library/core/src/iter/adapters/map.rs:84:28
INFO -     #35 0x7f98405f7501 in core::iter::traits::iterator::Iterator::fold::h6887575e8008b504 /builds/worker/fetches/rust/library/core/src/iter/traits/iterator.rs:2170:21
INFO -     #36 0x7f98405f7501 in _$LT$core..iter..adapters..map..Map$LT$I$C$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::fold::hd6047e171c78cde8 /builds/worker/fetches/rust/library/core/src/iter/adapters/map.rs:124:9
INFO -     #37 0x7f98405f7501 in core::iter::traits::iterator::Iterator::for_each::ha3667ac7c7c917d5 /builds/worker/fetches/rust/library/core/src/iter/traits/iterator.rs:736:9
INFO -     #38 0x7f98405f7501 in _$LT$alloc..vec..Vec$LT$T$C$A$GT$$u20$as$u20$alloc..vec..spec_extend..SpecExtend$LT$T$C$I$GT$$GT$::spec_extend::h717de6357bccbd72 /builds/worker/fetches/rust/library/alloc/src/vec/spec_extend.rs:40:17
INFO -     #39 0x7f98405f7501 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..spec_from_iter_nested..SpecFromIterNested$LT$T$C$I$GT$$GT$::from_iter::h8c6544b66dee6ee1 /builds/worker/fetches/rust/library/alloc/src/vec/spec_from_iter_nested.rs:56:9
INFO -     #40 0x7f98405f7501 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..spec_from_iter..SpecFromIter$LT$T$C$I$GT$$GT$::from_iter::h9f5d368972baab89 /builds/worker/fetches/rust/library/alloc/src/vec/spec_from_iter.rs:33:9
INFO -     #41 0x7f98405f7501 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$core..iter..traits..collect..FromIterator$LT$T$GT$$GT$::from_iter::h74272288a7f5b797 /builds/worker/fetches/rust/library/alloc/src/vec/mod.rs:2549:9
INFO -     #42 0x7f98405f7501 in core::iter::traits::iterator::Iterator::collect::h952c70a275cef256 /builds/worker/fetches/rust/library/core/src/iter/traits/iterator.rs:1744:9
INFO -     #43 0x7f98405f7501 in webrender::scene_builder_thread::LowPrioritySceneBuilderThread::run::h3808b36d7e9c182b /builds/worker/checkouts/gecko/gfx/wr/webrender/src/scene_builder_thread.rs:762:59
INFO -     #44 0x7f98405f7501 in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h4e95e195a21663eb /builds/worker/checkouts/gecko/gfx/wr/webrender/src/renderer/mod.rs:1254:17
INFO -     #45 0x7f98405f7501 in std::sys_common::backtrace::__rust_begin_short_backtrace::h410786af23eb886d /builds/worker/fetches/rust/library/std/src/sys_common/backtrace.rs:123:18
INFO -     #46 0x7f98405f6bfb in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h20c590c310dd8234 /builds/worker/fetches/rust/library/std/src/thread/mod.rs:484:17
INFO -     #47 0x7f98405f6bfb in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::hf23fd801c8edfded /builds/worker/fetches/rust/library/core/src/panic/unwind_safe.rs:271:9
INFO -     #48 0x7f98405f6bfb in std::panicking::try::do_call::h057e8bae3730482d /builds/worker/fetches/rust/library/std/src/panicking.rs:406:40
INFO -     #49 0x7f98405f6bfb in std::panicking::try::h6cf49dd2bc7a7ae3 /builds/worker/fetches/rust/library/std/src/panicking.rs:370:19
INFO -     #50 0x7f98405f6bfb in std::panic::catch_unwind::h88510dca9b803fd1 /builds/worker/fetches/rust/library/std/src/panic.rs:133:14
INFO -     #51 0x7f98405f6bfb in std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::hfdc504edbdbd5e41 /builds/worker/fetches/rust/library/std/src/thread/mod.rs:483:30
INFO -     #52 0x7f98405f6bfb in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::h29a794c9ee529115 /builds/worker/fetches/rust/library/core/src/ops/function.rs:227:5
INFO -     #53 0x7f983f6bf044 in std::sys::unix::thread::Thread::new::thread_start::he72929ede3520aea gkrust.6dcf022c-cgu.0
INFO -     #54 0x7f98540e26da in start_thread /tmp/glibc/nptl/pthread_create.c:463
INFO -     #55 0x7f98530c0a3e in __clone /tmp/glibc/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

This issue is currently triggered in CI when the 'float-cast-overflow' UBSan check is enabled. This issue will need to be addressed before the check can be enabled by default.

If it requires too much effort to fix immediately please ni? me and let me know. If necessary it will be added to a suppression list. Thank you :)

Lee, any chance you would be able to provide some insights on this?

https://hg.mozilla.org/mozilla-central/rev/5c32493252fd