1314978 - WebGL crash: [@mozilla::WebGLTexture::CompressedTexSubImage]

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect, P1)

Description

[Christoph Diehl [:posidron]]

The following testcase crashes on mozilla-inbound revision 59d33178b0cd

See attachment.

Backtrace:

==19819==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000114295333 bp 0x7fff58668590 sp 0x7fff58668460 T0)
==19819==WARNING: invalid path to external symbolizer!
==19819==WARNING: Failed to use and restart external symbolizer!
#0 0x114295332 in mozilla::WebGLTexture::CompressedTexSubImage(char const*, StrongGLenum<TexImageTargetDetails>, int, int, int, int, int, int, int, unsigned int, mozilla::TexImageSource const&) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x4f51332)
#1 0x1141ee46e in mozilla::WebGLContext::CompressedTexSubImage(char const*, unsigned char, unsigned int, int, int, int, int, int, int, int, unsigned int, mozilla::TexImageSource const&) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x4eaa46e)
#2 0x1136b33f4 in mozilla::dom::WebGL2RenderingContextBinding::compressedTexSubImage2D(JSContext*, JS::Handle<JSObject*>, mozilla::WebGL2Context*, JSJitMethodCallArgs const&) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x436f3f4)
#3 0x11400313a in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x4cbf13a)
#4 0x11a746883 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xb402883)
#5 0x11a727271 in Interpret(JSContext*, js::RunState&) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xb3e3271)
#6 0x11a70d7e5 in js::RunScript(JSContext*, js::RunState&) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xb3c97e5)
#7 0x11a749364 in js::ExecuteKernel(JSContext*, JS::Handle<JSScript*>, JSObject&, JS::Value const&, js::AbstractFramePtr, JS::Value*) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xb405364)
#8 0x11aac370a in EvalKernel(JSContext*, JS::Handle<JS::Value>, EvalType, js::AbstractFramePtr, JS::Handle<JSObject*>, unsigned char*, JS::MutableHandle<JS::Value>) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xb77f70a)
#9 0x11aac43b6 in js::DirectEval(JSContext*, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xb7803b6)
#10 0x119a42f41 in js::jit::DoCallFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICCall_Fallback*, unsigned int, JS::Value*, JS::MutableHandle<JS::Value>) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xa6fef41)
#11 0x1221c9a05  (<unknown module>)
#12 0x621000c482ff  (<unknown module>)
#13 0x2c6af5670  (<unknown module>)
#14 0x6210028ebe0f  (<unknown module>)
#15 0x1221c2887  (<unknown module>)
#16 0x119a6b247 in EnterBaseline(JSContext*, js::jit::EnterJitData&) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xa727247)
#17 0x119a6c62b in js::jit::EnterBaselineAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xa72862b)
#18 0x11a7379da in Interpret(JSContext*, js::RunState&) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xb3f39da)
#19 0x11a70d7e5 in js::RunScript(JSContext*, js::RunState&) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xb3c97e5)
#20 0x11a747067 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xb403067)
#21 0x11a747ae9 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xb403ae9)
#22 0x11a1dc77d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0xae9877d)
#23 0x113a2a98b in mozilla::dom::EventListener::HandleEvent(JSContext*, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x46e698b)
#24 0x11442fbd2 in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, nsIDOMEvent*, mozilla::dom::EventTarget*) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x50ebbd2)
#25 0x114431625 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent**, mozilla::dom::EventTarget*, nsEventStatus*) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x50ed625)
#26 0x11441b1b4 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x50d71b4)
#27 0x11441f174 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, nsIDOMEvent*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x50db174)
#28 0x11442154b in mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, nsIDOMEvent*, nsPresContext*, nsEventStatus*) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x50dd54b)
#29 0x1124b4725 in nsINode::DispatchEvent(nsIDOMEvent*, bool*) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x3170725)
#30 0x111fbe3c1 in nsContentUtils::DispatchEvent(nsIDocument*, nsISupports*, nsAString_internal const&, bool, bool, bool, bool*, bool) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x2c7a3c1)
#31 0x111fbe175 in nsContentUtils::DispatchTrustedEvent(nsIDocument*, nsISupports*, nsAString_internal const&, bool, bool, bool*) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x2c7a175)
#32 0x1123b89d4 in nsDocument::DispatchContentLoadedEvents() (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x30749d4)
#33 0x112481107 in mozilla::detail::RunnableMethodImpl<void (nsDocument::*)(), true, false>::Run() (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x313d107)
#34 0x10f586b5c in nsThread::ProcessNextEvent(bool, bool*) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x242b5c)
#35 0x10f610b63 in NS_ProcessPendingEvents(nsIThread*, unsigned int) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x2ccb63)
#36 0x115d7eabf in nsBaseAppShell::NativeEventCallback() (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x6a3aabf)
#37 0x115e7f93b in nsAppShell::ProcessGeckoEvents(void*) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x6b3b93b)
#38 0x7fff925824b0 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xa74b0)
#39 0x7fff9256361c in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x8861c)
#40 0x7fff92562b15 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87b15)
#41 0x7fff92562513 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x87513)
#42 0x7fff91afffbb in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30fbb)
#43 0x7fff91affdf0 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30df0)
#44 0x7fff91affc25 in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x30c25)
#45 0x7fff901e9b78 in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x46b78)
#46 0x7fff908ff1c2 in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x75c1c2)
#47 0x115e7ddbc in -[GeckoNSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x6b39dbc)
#48 0x7fff901de53c in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x3b53c)
#49 0x115e80acf in nsAppShell::Run() (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x6b3cacf)
#50 0x117e05de6 in nsAppStartup::Run() (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x8ac1de6)
#51 0x117f84180 in XREMain::XRE_mainRun() (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x8c40180)
#52 0x117f85663 in XREMain::XRE_main(int, char**, nsXREAppData const*) (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x8c41663)
#53 0x117f8614e in XRE_main (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x8c4214e)
#54 0x10758b279 in main (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/firefox+0x100002279)
#55 0x10758a513 in start (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/firefox+0x100001513)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/XUL+0x4f51332) in mozilla::WebGLTexture::CompressedTexSubImage(char const*, StrongGLenum<TexImageTargetDetails>, int, int, int, int, int, int, int, unsigned int, mozilla::TexImageSource const&)

Command: /srv/repos/mozilla/mozilla-inbound/ff64-asan-release/dist/Nightly.app/Contents/MacOS/firefox -width 512 -height 512 file:///Users/posidron/Google Drive/Projects/framboise/index.html?timeout=0&ws-logger=0&debug=True&with-events=True&max-commands=300&seed=None&with-set-interval=True&fuzzer=1:WebGL,1:WebGL2&with-set-timeout=False

==19819==ABORTING

Comment 1

[Christoph Diehl [:posidron]]

Attachment: Testcase

Comment 2

[Kelsey Gilbert [:jgilbert]]

Please attach an html testcase next time. It looks like I can just wrap this in a script tag?

Comment 3

[Kelsey Gilbert [:jgilbert]]

Attachment: a70c6b3cfa7993a9a9200129af1a128af8d9a825.html

Comment 4

[Christoph Diehl [:posidron]]

Yea. It's running newly on our cluster. You can just rename and surround it by a script tag.

Comment 5

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

This is an assigned P1 bug without activity in two weeks. 

If you intend to continue working on this bug for the current release/iteration/sprint, remove the 'stale-bug' keyword.

Otherwise we'll reset the priority of the bug back to '--' on Monday, August 28th.

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Reopening because crash bugs **with testcases** should not be resolved **as WONTFIX** based on queries of crash-stats.  Other resolutions may be appropriate for other reasons.

(Crash signatures are not the same as bug identity; they're merely a search aid to find and group similar crashes.  The bug may still be present, but the signature may have changed slightly, or the bug may even still be present with the same signature but there are simply no recent reports of crashes in that function.)

Comment 8

[Kelsey Gilbert [:jgilbert]]

Crash reports say Win10, not Mac, but this doesn't immediately repro on Win10 for me.

Comment 9

[Greyson Gilbert]

Revision 167ee7c46b84 fixed this crash for me on Win10.

Comment 10

[Kelsey Gilbert [:jgilbert]]

Thanks! That's certainly good to hear. TBD is whether this is just ANGLE saving us from ourselves, and native GL drivers may still crash.

Comment 11

[Kelsey Gilbert [:jgilbert]]

I only see crash reports on Windows and Firefox v<=66, I can't repro, and Comment #9 says it's fixed now.

Please reopen if you can repro still!