Closed Bug 1535373 Opened 5 years ago Closed 5 years ago

Assertion failure: !mStillNeedsToCheckContextLost, at /builds/worker/workspace/build/src/dom/canvas/WebGLContext.cpp:2298

Tracking

()

Status:

RESOLVED FIXED

Milestone:

mozilla70

Tracking Flags:

Tracking

Status

firefox-esr60

---

unaffected

firefox-esr68

---

wontfix

firefox68

---

wontfix

firefox69

---

wontfix

firefox70

---

fixed

People

(Reporter: jkratzer, Assigned: jgilbert)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase)

Attachments

(2 files)

testcase.html 5 years ago Jason Kratzer [:jkratzer] 434 bytes, text/html		Details
Bug 1535373 - IsContextLost() before early-out. 5 years ago Kelsey Gilbert [:jgilbert] 47 bytes, text/x-phabricator-request		Details \| Review

Jason Kratzer [:jkratzer]

Reporter

Description

•

5 years ago

Attached file testcase.html — Details

Testcase found while fuzzing mozilla-central rev ab709310d23f.

Assertion failure: !mStillNeedsToCheckContextLost, at /builds/worker/workspace/build/src/dom/canvas/WebGLContext.cpp:2298

rax = 0x0000560aa0b98e40 rdx = 0x0000000000000000
rcx = 0x00007fee20f39c5f rbx = 0x00007ffeedf5ea40
rsi = 0x00007fee2dcb78b0 rdi = 0x00007fee2dcb6680
rbp = 0x00007ffeedf5ea20 rsp = 0x00007ffeedf5ea20
r8 = 0x00007fee2dcb78b0 r9 = 0x00007fee2ee14740
r10 = 0x0000000000000000 r11 = 0x0000000000000000
r12 = 0x00007fee14ea1000 r13 = 0x00007ffeedf5eb58
r14 = 0x00007ffeedf5eb10 r15 = 0x0000000000000001
rip = 0x00007fee1cdfb48c
OS|Linux|0.0.0 Linux 4.18.0-16-generic #17~18.04.1-Ubuntu SMP Tue Feb 12 13:35:51 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|0
0|0|libxul.so|mozilla::WebGLContext::FuncScope::~FuncScope()|hg:hg.mozilla.org/mozilla-central:dom/canvas/WebGLContext.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|2298|0x0
0|1|libxul.so|mozilla::WebGLContext::ReadPixels(int, int, int, int, unsigned int, unsigned int, mozilla::dom::Nullable<mozilla::dom::ArrayBufferView_base<&js::UnwrapArrayBufferView, &js::GetArrayBufferViewLengthAndData, &(JS_GetArrayBufferViewType(JSObject*))> > const&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/canvas/WebGLContext.h:ab709310d23f9b7b17ba50731c63666aaf67945b|719|0xc
0|2|libxul.so|mozilla::dom::WebGLRenderingContext_Binding::readPixels|s3:gecko-generated-sources:2a0397acdcd711cca8a7396408e0eba94382fa9576a86e360d6e008b160279f795f34defe21d2920cc0e86e9bb062e96d28d83f1bb82a0f89af8f292bc3372fb/dom/bindings/WebGLRenderingContextBinding.cpp:|12602|0x4c
0|3|libxul.so|bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|3144|0x9
0|4|libxul.so|CallJSNative(JSContext*, bool ()(JSContext, unsigned int, JS::Value*), JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|442|0x6
0|5|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|534|0xf
0|6|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|589|0xd
0|7|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|593|0xf
0|8|libxul.so|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|422|0xb
0|9|libxul.so|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|562|0xf
0|10|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|589|0xd
0|11|libxul.so|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|605|0x5
0|12|libxul.so|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|2623|0x1c
0|13|libxul.so|mozilla::dom::Function::Call(JSContext*, JS::Handle<JS::Value>, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:8608c2289a1d9871b163cf64eb28fe0535b7c0d76562f972c9fc16519592354acf8928f3a87d7291ad2787d69def3a71373afde07f5a14adfa582e642eb71bd4/dom/bindings/FunctionBinding.cpp:|41|0x5
0|14|libxul.so|void mozilla::dom::Function::Call<nsCOMPtr<nsISupports> >(nsCOMPtr<nsISupports> const&, nsTArray<JS::Value> const&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:22d0e043233e792b3171635349a7c96c260b02daf1d3a3863f1117e8ce67835c880f3e1615498f0338066a4757ac95face8a6a3a49bfe840d14f59c75432afce/dist/include/mozilla/dom/FunctionBinding.h:|73|0x23
0|15|libxul.so|nsGlobalWindowInner::RunTimeoutHandler(mozilla::dom::Timeout*, nsIScriptContext*)|hg:hg.mozilla.org/mozilla-central:dom/base/nsGlobalWindowInner.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|5635|0x31
0|16|libxul.so|mozilla::dom::TimeoutManager::RunTimeout(mozilla::TimeStamp const&, mozilla::TimeStamp const&, bool)|hg:hg.mozilla.org/mozilla-central:dom/base/TimeoutManager.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|980|0x5
0|17|libxul.so|mozilla::dom::TimeoutExecutor::MaybeExecute()|hg:hg.mozilla.org/mozilla-central:dom/base/TimeoutExecutor.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|177|0x13
0|18|libxul.so|mozilla::dom::TimeoutExecutor::Notify(nsITimer*)|hg:hg.mozilla.org/mozilla-central:dom/base/TimeoutExecutor.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|241|0x5
0|19|libxul.so|nsTimerImpl::Fire(int)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsTimerImpl.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|562|0x11
0|20|libxul.so|nsTimerEvent::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TimerThread.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|260|0x18
0|21|libxul.so|mozilla::ThrottledEventQueue::Inner::ExecuteRunnable()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/ThrottledEventQueue.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|243|0x11
0|22|libxul.so|mozilla::ThrottledEventQueue::Inner::Executor::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/ThrottledEventQueue.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|80|0xd
0|23|libxul.so|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|295|0x15
0|24|libxul.so|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|1179|0x15
0|25|libxul.so|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|482|0x11
0|26|libxul.so|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|110|0xd
0|27|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ab709310d23f9b7b17ba50731c63666aaf67945b|315|0x17
0|28|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ab709310d23f9b7b17ba50731c63666aaf67945b|308|0x8
0|29|libxul.so|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|137|0xd
0|30|libxul.so|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|933|0x11
0|31|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|238|0x5
0|32|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ab709310d23f9b7b17ba50731c63666aaf67945b|315|0x17
0|33|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:ab709310d23f9b7b17ba50731c63666aaf67945b|308|0x8
0|34|libxul.so|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|771|0xc
0|35|firefox-bin|content_process_main(mozilla::Bootstrap*, int, char**)|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|56|0x14
0|36|firefox-bin|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:ab709310d23f9b7b17ba50731c63666aaf67945b|265|0x11
0|37|libc-2.27.so||||0x21b97
0|38|firefox-bin|MOZ_ReportCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:ab709310d23f9b7b17ba50731c63666aaf67945b|184|0x5

Flags: in-testsuite?

Andrew Osmond [:aosmond] (he/him)

Comment 1

•

5 years ago

I was able to reproduce without issue on a recent Linux debug build.

Blocks: 1478909

Flags: needinfo?(jgilbert)

Priority: -- → P3

Kelsey Gilbert [:jgilbert]

Assignee

Comment 2

•

5 years ago

Attached file Bug 1535373 - IsContextLost() before early-out. — Details

Kelsey Gilbert [:jgilbert]

Assignee

Updated

•

5 years ago

Assignee: nobody → jgilbert

Flags: needinfo?(jgilbert)

Pulsebot

Comment 3

•

5 years ago

Pushed by jgilbert@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/58fced48cd5d
IsContextLost() before early-out. r=lsalzman

Raul Gurzau (:RaulG)

Comment 4

•

5 years ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/58fced48cd5d

Status: NEW → RESOLVED

Closed: 5 years ago

status-firefox70: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → mozilla70

Ryan VanderMeulen [:RyanVM]

Comment 5

•

5 years ago

Is there a user impact which justifies uplift consideration or can this ride the trains? Also, can we land the attached testcase as a crashtest?

No longer blocks: 1478909

status-firefox68: --- → wontfix

status-firefox69: --- → affected

status-firefox-esr60: --- → unaffected

status-firefox-esr68: --- → affected

Flags: needinfo?(jgilbert)

Regressed by: 1478909

BMO Automation

Updated

•

5 years ago

Keywords: regression

Kelsey Gilbert [:jgilbert]

Assignee

Comment 6

•

5 years ago

It's just an assert, but it's safe. No uplift needed, and I don't think this warrants a crashtest.

status-firefox69: affected → wontfix

status-firefox-esr68: affected → wontfix

Flags: needinfo?(jgilbert)

BugBot [:suhaib / :marco/ :calixte]

Updated

•

2 years ago

Has Regression Range: --- → yes

You need to log in before you can comment on or make changes to this bug.

Bugzilla

Quick Search

Assertion failure: !mStillNeedsToCheckContextLost, at /builds/worker/workspace/build/src/dom/canvas/WebGLContext.cpp:2298

Categories

(Core :: Graphics: CanvasWebGL, defect, P3)

Tracking

()

People

(Reporter: jkratzer, Assigned: jgilbert)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, testcase)

Crash Data

Security

(public)

User Story

Attachments

(2 files)

Description

Comment 1

Comment 2

Updated

Comment 3

Comment 4

Comment 5

Updated

Comment 6

Updated

Attachment

General

Description

File Name

Content Type