panic: called Option::unwrap() on a None value (thread WRRenderBackend#0, at /home/runner/.cargo/git/checkouts/webrender-a8b399ecb6c2da85/6cafc60/webrender/src/prim_store/image.rs:183) #42216
Description
Something similar was fixed in #41130 but fuzzers can still hit the panic.
cc @mrobinson
Minimal testcase:
<!DOCTYPE html>
<style>
#span { background-image: url(data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImb5Gm2hB0SlBCB0Uj); background-repeat: round round; border-right-style: solid; }
</style>
<span id="span"></span>System: Linux
Version: Version: Servo 0.0.4-e137bec9c
Command: ./servo/servo
called `Option::unwrap()` on a `None` value (thread WRRenderBackend#0, at /home/runner/.cargo/git/checkouts/webrender-a8b399ecb6c2da85/6cafc60/webrender/src/prim_store/image.rs:183)
0: servoshell::backtrace::print
1: servoshell::panic_hook::panic_hook
2: std::panicking::panic_with_hook
3: std::panicking::panic_handler::{{closure}}
4: std::sys::backtrace::__rust_end_short_backtrace
5: __rustc::rust_begin_unwind
6: core::panicking::panic_fmt
7: core::panicking::panic
8: core::option::unwrap_failed
9: webrender::prepare::prepare_prim_for_render
10: webrender::prepare::prepare_picture
11: webrender::frame_builder::FrameBuilder::build
12: webrender::render_backend::Document::build_frame
13: webrender::render_backend::RenderBackend::update_document
14: webrender::render_backend::RenderBackend::process_transaction
15: webrender::render_backend::RenderBackend::run
16: std::sys::backtrace::__rust_begin_short_backtrace
17: core::ops::function::FnOnce::call_once{{vtable.shim}}
18: std::sys::thread::unix::Thread::new::thread_start
19: start_thread
at ./nptl/pthread_create.c:447:8
20: clone3
at ./misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78:0