Debug build panics with UB error

[wezm]

A build of master (ddde421) panics for me when I try to view any PDF:

     Running `target/debug/miro-pdf '/home/wmoore/Downloads/Print MacWrite 5 from Clari.pdf/Print MacWrite 5 from Clari.pdf'`
2025-10-16T03:48:42.544106Z  INFO miro_pdf: Using system config file located at /home/wmoore/.dotfiles/config/miro-pdf/miro.conf
WARNING: radv is not a conformant Vulkan implementation, testing use only.
2025-10-16T03:48:42.690723Z  INFO miro_pdf::pdf::widget: Setting scale factor from 1 to 2

thread 'main' panicked at /home/wmoore/.cargo/git/checkouts/mupdf-rs-86201c76a14f8d86/2425c14/src/pixmap.rs:151:18:
unsafe precondition(s) violated: slice::from_raw_parts_mut requires the pointer to be aligned and non-null, and the total size of the slice not to exceed `isize::MAX`

This indicates a bug in the program. This Undefined Behavior check is optional, and cannot be relied on for safety.
stack backtrace:
   0: __rustc::rust_begin_unwind
             at /rustc/1159e78c4747b02ef996e55082b704c09b970588/library/std/src/panicking.rs:697:5
   1: core::panicking::panic_nounwind_fmt::runtime
             at /rustc/1159e78c4747b02ef996e55082b704c09b970588/library/core/src/panicking.rs:117:22
   2: core::panicking::panic_nounwind_fmt
             at /rustc/1159e78c4747b02ef996e55082b704c09b970588/library/core/src/intrinsics/mod.rs:2367:9
   3: core::slice::raw::from_raw_parts_mut::precondition_check
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ub_checks.rs:72:21
   4: core::slice::raw::from_raw_parts_mut
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ub_checks.rs:77:17
   5: mupdf::pixmap::Pixmap::samples_mut
             at /home/wmoore/.cargo/git/checkouts/mupdf-rs-86201c76a14f8d86/2425c14/src/pixmap.rs:151:18
   6: miro_pdf::pdf::widget::PdfViewer::draw_pdf_to_pixmap
             at ./src/pdf/widget.rs:544:31
   7: miro_pdf::pdf::widget::PdfViewer::view
             at ./src/pdf/widget.rs:416:14
   8: miro_pdf::app::App::view::{{closure}}
             at ./src/app.rs:591:49
   9: iced_widget::pane_grid::PaneGrid<Message,Theme,Renderer>::new::{{closure}}
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced_widget-0.13.4/src/pane_grid.rs:198:33
  10: core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &mut F>::call_once
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:313:21
  11: core::option::Option<T>::map
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/option.rs:1158:29
  12: <core::iter::adapters::map::Map<I,F> as core::iter::traits::iterator::Iterator>::next
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/iter/adapters/map.rs:107:26
  13: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter_nested::SpecFromIterNested<T,I>>::from_iter
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/vec/spec_from_iter_nested.rs:25:41
  14: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter::SpecFromIter<T,I>>::from_iter
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/vec/spec_from_iter.rs:34:9
  15: <alloc::vec::Vec<T> as core::iter::traits::collect::FromIterator<T>>::from_iter
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/alloc/src/vec/mod.rs:3633:9
  16: core::iter::traits::iterator::Iterator::collect
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:2027:9
  17: iced_widget::pane_grid::PaneGrid<Message,Theme,Renderer>::new
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced_widget-0.13.4/src/pane_grid.rs:200:22
  18: miro_pdf::app::App::view
             at ./src/app.rs:583:18
  19: core::ops::function::Fn::call
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:80:5
  20: <T as iced::application::View<State,Message,Theme,Renderer>>::view
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced-0.13.1/src/application.rs:484:9
  21: <iced::application::application::Instance<State,Message,Theme,Renderer,Update,View> as iced::program::Program>::view
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced-0.13.1/src/application.rs:121:23
  22: <iced::program::with_title::WithTitle<P,Title> as iced::program::Program>::view
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced-0.13.1/src/program.rs:233:26
  23: <iced::program::with_theme::WithTheme<P,F> as iced::program::Program>::view
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced-0.13.1/src/program.rs:384:26
  24: <iced::program::with_subscription::WithSubscription<P,F> as iced::program::Program>::view
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced-0.13.1/src/program.rs:306:26
  25: <iced::program::Program::run_with::Instance<P,I> as iced_winit::program::Program>::view
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced-0.13.1/src/program.rs:145:30
  26: iced_winit::program::build_user_interface
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced_winit-0.13.0/src/program.rs:1135:24
  27: iced_winit::program::build_user_interfaces::{{closure}}
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced_winit-0.13.0/src/program.rs:1508:17
  28: core::iter::adapters::filter_map::filter_map_fold::{{closure}}
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/iter/adapters/filter_map.rs:39:28
  29: core::iter::traits::iterator::Iterator::fold
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:2602:21
  30: <hashbrown::map::Drain<K,V,A> as core::iter::traits::iterator::Iterator>::fold
             at /rust/deps/hashbrown-0.15.4/src/map.rs:3447:20
  31: <std::collections::hash::map::Drain<K,V> as core::iter::traits::iterator::Iterator>::fold
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/collections/hash/map.rs:2273:19
  32: <core::iter::adapters::filter_map::FilterMap<I,F> as core::iter::traits::iterator::Iterator>::fold
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/iter/adapters/filter_map.rs:146:19
  33: core::iter::traits::iterator::Iterator::for_each
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:827:14
  34: <hashbrown::map::HashMap<K,V,S,A> as core::iter::traits::collect::Extend<(K,V)>>::extend
             at /rust/deps/hashbrown-0.15.4/src/map.rs:4496:14
  35: <std::collections::hash::map::HashMap<K,V,S> as core::iter::traits::collect::Extend<(K,V)>>::extend
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/collections/hash/map.rs:2796:19
  36: <std::collections::hash::map::HashMap<K,V,S> as core::iter::traits::collect::FromIterator<(K,V)>>::from_iter
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/collections/hash/map.rs:2781:13
  37: core::iter::traits::iterator::Iterator::collect
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/iter/traits/iterator.rs:2027:9
  38: iced_winit::program::build_user_interfaces
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced_winit-0.13.0/src/program.rs:1518:10
  39: iced_winit::program::run_instance::{{closure}}
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced_winit-0.13.0/src/program.rs:1100:51
  40: iced_winit::program::run::Runner<Message,F,C>::process_event
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced_winit-0.13.0/src/program.rs:467:51
  41: <iced_winit::program::run::Runner<Message,F,C> as winit::application::ApplicationHandler<iced_runtime::Action<Message>>>::about_to_wait
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced_winit-0.13.0/src/program.rs:443:18
  42: winit::event_loop::dispatch_event_for_app
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winit-0.30.9/src/event_loop.rs:647:35
  43: winit::event_loop::EventLoop<T>::run_app::{{closure}}
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winit-0.30.9/src/event_loop.rs:265:49
  44: core::ops::function::impls::<impl core::ops::function::FnMut<A> for &mut F>::call_mut
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:301:21
  45: core::ops::function::impls::<impl core::ops::function::FnMut<A> for &mut F>::call_mut
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:301:21
  46: winit::platform_impl::linux::x11::EventLoop<T>::single_iteration
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winit-0.30.9/src/platform_impl/linux/x11/mod.rs:572:13
  47: winit::platform_impl::linux::x11::EventLoop<T>::poll_events_with_timeout
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winit-0.30.9/src/platform_impl/linux/x11/mod.rs:504:14
  48: winit::platform_impl::linux::x11::EventLoop<T>::pump_events
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winit-0.30.9/src/platform_impl/linux/x11/mod.rs:424:18
  49: winit::platform_impl::linux::x11::EventLoop<T>::run_on_demand
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winit-0.30.9/src/platform_impl/linux/x11/mod.rs:385:24
  50: winit::platform_impl::linux::EventLoop<T>::run_on_demand
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winit-0.30.9/src/platform_impl/linux/mod.rs:819:61
  51: winit::platform_impl::linux::EventLoop<T>::run
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winit-0.30.9/src/platform_impl/linux/mod.rs:812:14
  52: winit::event_loop::EventLoop<T>::run_app
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/winit-0.30.9/src/event_loop.rs:265:25
  53: iced_winit::program::run
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced_winit-0.13.0/src/program.rs:605:28
  54: iced::program::Program::run_with
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced-0.13.1/src/program.rs:177:12
  55: iced::application::Application<P>::run_with
             at /home/wmoore/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iced-0.13.1/src/application.rs:177:14
  56: miro_pdf::main
             at ./src/main.rs:74:10
  57: core::ops::function::FnOnce::call_once
             at /home/wmoore/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:253:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.
thread caused non-unwinding panic. aborting.

I'm on Linux X11. It happens with all documents I've tried, but I'm attaching the one in the backtrace here:

Print MacWrite 5 from Clari.pdf

[vincent-uden]

It seems that I have been aware of this in the past

miro/src/pdf/widget.rs

Line 542 in ddde421

// TODO: Might contain undefined behvaiour. Seems to work fine in release mode.

Right now I am waiting on mupdf-rs 0.6.0 to be release as it is done, hopefully that might fix things. But the merge seems to be moving slowly.

[wezm]

Seems to work fine in release mode.

Given the possibilities I expect that it's not NULL, or size larger than isize::MAX, which leaves alignment. I think x86-64 tolerates unaligned reads, but on other architectures it may trap, resulting in a crash in release builds.

[vincent-uden]

Damn, this seems like a mupdf-rs internal issue. If I remove my call to samples_mut, the program crashes all the same in inner.rs when I call samples.

[wezm]

Damn, this seems like a mupdf-rs internal issue.

If there's a small reproducer that can be built then it's probably worth opening a bug against the upstream repo.

[wezm]

I created a reproducer and opened an issue on the mupdf-rs repo: messense/mupdf-rs#175

I think it's because the Pixmap has 0×0 dimensions. You might be able to work around it on your end by ensuring Pixmaps are always created with non-zero sizes.

[src/pdf/widget.rs:568:13] pix.width() = 0
[src/pdf/widget.rs:568:13] pix.height() = 0

diff --git a/src/pdf/widget.rs b/src/pdf/widget.rs
index 1ca4f4b..d964fb0 100644
--- a/src/pdf/widget.rs
+++ b/src/pdf/widget.rs
@@ -556,7 +556,7 @@ impl PdfViewer {
             let render_height = (state.bounds.height() * self.scale_factor as f32).round() as i32;

             state.pix = Some(
-                Pixmap::new_with_w_h(&Colorspace::device_rgb(), render_width, render_height, true)
+                Pixmap::new_with_w_h(&Colorspace::device_rgb(), render_width.max(1), render_height.max(1), true)
                     .unwrap(),
             );
         }

[wezm]

This has been fixed upstream, now we still need that 0.6 release of mupdf-rs.

[vincent-uden]

Lovely! 0.6 is kinda blocking on me creating a Github action so I better get started

[vincent-uden]

Aaand done. messense/mupdf-rs#165 is now fixed, we'll wait and see if my PR is approved messense/mupdf-rs#177 and then this can be closed.