Closed
Bug 1449264
Opened 6 years ago
Closed 6 years ago
Assertion failure: false (GFX: We should have caught all other errors.), at /builds/worker/workspace/build/src/dom/canvas/WebGLTextureUpload.cpp:1173
Categories
(Core :: Graphics: CanvasWebGL, defect, P3)
Tracking
()
RESOLVED
FIXED
mozilla61
People
(Reporter: jkratzer, Assigned: jgilbert)
References
(Blocks 1 open bug)
Details
(Keywords: assertion, testcase, Whiteboard: [gfx-noted])
Attachments
(2 files)
Testcase found while fuzzing mozilla-central rev f0d13136b358. rax = 0x0000000000000000 rdx = 0x0000000000000000 rcx = 0x00007f41f644a2dd rbx = 0x00007f41cb3f8000 rsi = 0x00007f41f6719770 rdi = 0x00007f41f6718540 rbp = 0x00007ffd0d1222c0 rsp = 0x00007ffd0d122210 r8 = 0x00007f41f6719770 r9 = 0x00007f41f77e4740 r10 = 0x0000000000000039 r11 = 0x0000000000000000 r12 = 0x0000000000000502 r13 = 0x0000000000000008 r14 = 0x0000000000000008 r15 = 0x00007ffd0d122370 rip = 0x00007f41e5cd9f7e OS|Linux|0.0.0 Linux 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 CPU|amd64|family 6 model 78 stepping 3|1 GPU||| Crash|SIGSEGV|0x0|0 0|0|libxul.so|mozilla::WebGLTexture::TexStorage|hg:hg.mozilla.org/mozilla-central:dom/canvas/WebGLTextureUpload.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1144|0x5 0|1|libxul.so|mozilla::WebGL2Context::TexStorage|hg:hg.mozilla.org/mozilla-central:dom/canvas/WebGL2ContextTextures.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|23|0x21 0|2|libxul.so|mozilla::dom::WebGL2RenderingContextBinding::texStorage3D|hg:hg.mozilla.org/mozilla-central:dom/canvas/WebGL2Context.h:f0d13136b3580182df241674cf97a3fbf1543c2a|108|0x18 0|3|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|3031|0x9 0|4|libxul.so|js::CallJSNative|hg:hg.mozilla.org/mozilla-central:js/src/vm/JSContext-inl.h:f0d13136b3580182df241674cf97a3fbf1543c2a|290|0x6 0|5|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|467|0xf 0|6|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|516|0xd 0|7|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|522|0xf 0|8|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|417|0xb 0|9|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|489|0xf 0|10|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|516|0xd 0|11|libxul.so|js::Call|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|535|0x5 0|12|libxul.so|JS::Call|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|3011|0x20 0|13|libxul.so|mozilla::dom::EventListener::HandleEvent|s3:gecko-generated-sources:4f12b90540cb165dd19eac1b88402159c76e59990061216cada90a154be8b234c7f9a8578831d6a0eb2b0cf1645daa7d853b12949e597c37d4557860ba4f42ae/dom/bindings/EventListenerBinding.cpp:|47|0x5 0|14|libxul.so|mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>|s3:gecko-generated-sources:0502cca494d7ae0441ada14535523caade9340fdd09934cf6d31cc421267c319ae3d6f5b43b2730d0b36ae1c87480f3b426c5fa4fec57d51047d83a51acde602/dist/include/mozilla/dom/EventListenerBinding.h:|66|0x1c 0|15|libxul.so|mozilla::EventListenerManager::HandleEventSubType|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1087|0x36 0|16|libxul.so|mozilla::EventListenerManager::HandleEventInternal|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1259|0x19 0|17|libxul.so|mozilla::EventTargetChainItem::HandleEvent|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.h:f0d13136b3580182df241674cf97a3fbf1543c2a|376|0xa 0|18|libxul.so|mozilla::EventTargetChainItem::HandleEventTargetChain|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|527|0xf 0|19|libxul.so|mozilla::EventDispatcher::Dispatch|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|918|0xb 0|20|libxul.so|mozilla::EventDispatcher::DispatchDOMEvent|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1000|0x19 0|21|libxul.so|nsINode::DispatchEvent|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1171|0x5 0|22|libxul.so|nsContentUtils::DispatchEvent|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|4608|0x1c 0|23|libxul.so|nsContentUtils::DispatchTrustedEvent|hg:hg.mozilla.org/mozilla-central:dom/base/nsContentUtils.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|4577|0xf 0|24|libxul.so|nsIDocument::DispatchContentLoadedEvents|hg:hg.mozilla.org/mozilla-central:dom/base/nsDocument.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|5257|0x5 0|25|libxul.so|mozilla::detail::RunnableMethodImpl<nsIDocument*, void (nsIDocument::*)(), true, (mozilla::RunnableKind)0u>::Run|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:f0d13136b3580182df241674cf97a3fbf1543c2a|1164|0x13 0|26|libxul.so|mozilla::SchedulerGroup::Runnable::Run|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|415|0x1c 0|27|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|1096|0x15 0|28|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|519|0x11 0|29|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|97|0xa 0|30|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f0d13136b3580182df241674cf97a3fbf1543c2a|326|0x17 0|31|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f0d13136b3580182df241674cf97a3fbf1543c2a|319|0x8 0|32|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|157|0xd 0|33|libxul.so|XRE_RunAppShell|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|893|0x11 0|34|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|269|0x5 0|35|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f0d13136b3580182df241674cf97a3fbf1543c2a|326|0x17 0|36|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:f0d13136b3580182df241674cf97a3fbf1543c2a|319|0x8 0|37|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|719|0x8 0|38|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|50|0x14 0|39|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:f0d13136b3580182df241674cf97a3fbf1543c2a|280|0x11 0|40|libc-2.23.so||||0x20830 0|41|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:f0d13136b3580182df241674cf97a3fbf1543c2a|164|0x5
Flags: in-testsuite?
Updated•6 years ago
|
OS: Unspecified → Linux
Priority: -- → P3
Hardware: Unspecified → x86_64
Whiteboard: [gfx-noted]
Assignee | ||
Updated•6 years ago
|
Assignee: nobody → jgilbert
Assignee | ||
Comment 1•6 years ago
|
||
We do depth >> (levels-1) even for TEXTURE_2D_ARRAY, oops. This should have been fixed by bug 1445980, let me check.
Assignee | ||
Comment 2•6 years ago
|
||
Yeah, but 1445980 doesn't quite get it. We should just treat all level>=32 as too-large.
Comment hidden (mozreview-request) |
Comment 4•6 years ago
|
||
mozreview-review |
Comment on attachment 8964407 [details] Bug 1449264 - Handle texStorage3D's `levels` better. - https://reviewboard.mozilla.org/r/233134/#review238876 ::: dom/canvas/WebGLTextureUpload.cpp (Diff revision 1) > : target.get(); > WebGLTexture::ImageInfo* baseImageInfo; > - WebGLTexture::ImageInfo* lastImageInfo; > if (!ValidateTexImageSpecification(funcName, testTarget, 0, width, height, depth, > - &baseImageInfo) || > + &baseImageInfo)) > - !ValidateTexImageSpecification(funcName, testTarget, levels-1, 1, 1, 1, what's the reason we aren't validating the last level here any more?
Attachment #8964407 -
Flags: review?(kvark) → review+
Assignee | ||
Comment 5•6 years ago
|
||
mozreview-review-reply |
Comment on attachment 8964407 [details] Bug 1449264 - Handle texStorage3D's `levels` better. - https://reviewboard.mozilla.org/r/233134/#review238876 > what's the reason we aren't validating the last level here any more? That approach doesn't handle TEXTURE_2D_ARRAYS, where depth is constant across levels. It shouldn't be necessary with the changes added in this cset.
Pushed by jgilbert@mozilla.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/bf28d5d5678c Handle texStorage3D's `levels` better. - r=kvark
Comment 7•6 years ago
|
||
bugherder |
https://hg.mozilla.org/mozilla-central/rev/bf28d5d5678c
Status: NEW → RESOLVED
Closed: 6 years ago
status-firefox61:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
Comment 8•6 years ago
|
||
Can we land this testcase as a crashtest? Also, should we consider backporting this to 60? AFAICT, this crash goes back a long ways.
status-firefox59:
--- → wontfix
status-firefox60:
--- → affected
status-firefox-esr52:
--- → wontfix
Flags: needinfo?(jgilbert)
Comment 9•6 years ago
|
||
Guess we won't be backporting to 60 at this point.
Updated•6 years ago
|
Updated•5 years ago
|
Flags: needinfo?(jgilbert)
Flags: in-testsuite?
Flags: in-testsuite-
You need to log in
before you can comment on or make changes to this bug.
Description
•