1610383 - Assertion failure: error == 0x0505, at dom/canvas/WebGLBuffer.cpp:133

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect, P1)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c 20200120-59873ee30955

Assertion failure: error == 0x0505, at dom/canvas/WebGLBuffer.cpp:133

#0 mozilla::WebGLBuffer::BufferData src\dom\canvas\WebGLBuffer.cpp:133
#1 mozilla::WebGLContext::BufferData src\dom\canvas\WebGLContextBuffers.cpp:250
#2 mozilla::RunOn<void (mozilla::HostWebGLContext::*)(unsigned int, const mozilla::RawBuffer<const unsigned char,unsigned char,0> &, unsigned int) const,&mozilla::HostWebGLContext::BufferData,void,85,unsigned int &,const mozilla::RawBuffer<const unsigned char,unsigned char,0> &,unsigned int &> src\dom\canvas\ClientWebGLContext.cpp:371
#3 mozilla::ClientWebGLContext::BufferData src\dom\canvas\ClientWebGLContext.cpp:2608
#4 mozilla::dom::WebGLRenderingContext_Binding::bufferData src\obj-firefox\dom\bindings\WebGLRenderingContextBinding.cpp:13243
#5 mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy,mozilla::dom::binding_detail::ThrowExceptions> src\dom\bindings\BindingUtils.cpp:3151
#6 CallJSNative src\js\src\vm\Interpreter.cpp:452
#7 js::InternalCallOrConstruct src\js\src\vm\Interpreter.cpp:544
#8 InternalCall src\js\src\vm\Interpreter.cpp:608
#9 Interpret src\js\src\vm\Interpreter.cpp:3021
#10 js::RunScript src\js\src\vm\Interpreter.cpp:424
#11 js::InternalCallOrConstruct src\js\src\vm\Interpreter.cpp:580
#12 InternalCall src\js\src\vm\Interpreter.cpp:608
#13 js::Call src\js\src\vm\Interpreter.cpp:625
#14 JS::Call src\js\src\jsapi.cpp:2787
#15 mozilla::dom::EventHandlerNonNull::Call src\obj-firefox\dom\bindings\EventHandlerBinding.cpp:267
#16 mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> > src\obj-firefox\dist\include\mozilla\dom\EventHandlerBinding.h:364
#17 mozilla::JSEventHandler::HandleEvent src\dom\events\JSEventHandler.cpp:201
#18 mozilla::EventListenerManager::HandleEventSubType src\dom\events\EventListenerManager.cpp:1078
#19 mozilla::EventListenerManager::HandleEventInternal src\dom\events\EventListenerManager.cpp:1270
#20 mozilla::EventTargetChainItem::HandleEvent src\dom\events\EventDispatcher.cpp:356
#21 mozilla::EventTargetChainItem::HandleEventTargetChain src\dom\events\EventDispatcher.cpp:558
#22 mozilla::EventDispatcher::Dispatch src\dom\events\EventDispatcher.cpp:1056
#23 nsDocumentViewer::LoadComplete src\layout\base\nsDocumentViewer.cpp:1142
#24 nsDocShell::EndPageLoad src\docshell\base\nsDocShell.cpp:6117
#25 nsDocShell::OnStateChange src\docshell\base\nsDocShell.cpp:5900
#26 nsDocLoader::DoFireOnStateChange src\uriloader\base\nsDocLoader.cpp:1347
#27 nsDocLoader::doStopDocumentLoad src\uriloader\base\nsDocLoader.cpp:906
#28 nsDocLoader::DocLoaderIsEmpty src\uriloader\base\nsDocLoader.cpp:726
#29 nsDocLoader::OnStopRequest src\uriloader\base\nsDocLoader.cpp:614
#30 mozilla::net::nsLoadGroup::NotifyRemovalObservers src\netwerk\base\nsLoadGroup.cpp:604
#31 mozilla::net::nsLoadGroup::RemoveRequest src\netwerk\base\nsLoadGroup.cpp:511
#32 imgRequestProxy::RemoveFromLoadGroup src\image\imgRequestProxy.cpp:385
#33 imgRequestProxy::OnLoadComplete src\image\imgRequestProxy.cpp:1039
#34 mozilla::image::ImageObserverNotifier<const mozilla::image::ObserverTable *>::operator()<`lambda at z:/build/build/src/image/ProgressTracker.cpp:351:12'> src\image\ProgressTracker.cpp:282
#35 mozilla::image::SyncNotifyInternal<const mozilla::image::ObserverTable *> src\image\ProgressTracker.cpp:351
#36 mozilla::image::ProgressTracker::SyncNotifyProgress src\image\ProgressTracker.cpp:369
#37 mozilla::image::VectorImage::OnSVGDocumentLoaded src\image\VectorImage.cpp:1431
#38 mozilla::image::SVGLoadEventListener::HandleEvent src\image\VectorImage.cpp:212
#39 mozilla::EventListenerManager::HandleEventSubType src\dom\events\EventListenerManager.cpp:1078
#40 mozilla::EventListenerManager::HandleEventInternal src\dom\events\EventListenerManager.cpp:1270
#41 mozilla::EventTargetChainItem::HandleEvent src\dom\events\EventDispatcher.cpp:356
#42 mozilla::EventTargetChainItem::HandleEventTargetChain src\dom\events\EventDispatcher.cpp:558
#43 mozilla::EventDispatcher::Dispatch src\dom\events\EventDispatcher.cpp:1056
#44 mozilla::EventDispatcher::DispatchDOMEvent src\dom\events\EventDispatcher.cpp
#45 nsINode::DispatchEvent src\dom\base\nsINode.cpp:1119
#46 mozilla::dom::EventTarget::DispatchEvent src\dom\events\EventTarget.cpp:178
#47 mozilla::AsyncEventDispatcher::Run src\dom\events\AsyncEventDispatcher.cpp:69
#48 nsThread::ProcessNextEvent src\xpcom\threads\nsThread.cpp:1220
#49 NS_ProcessNextEvent src\xpcom\threads\nsThreadUtils.cpp:486
#50 mozilla::ipc::MessagePump::Run src\ipc\glue\MessagePump.cpp:87
#51 MessageLoop::RunInternal src\ipc\chromium\src\base\message_loop.cc:315
#52 MessageLoop::RunHandler src\ipc\chromium\src\base\message_loop.cc:308
#53 MessageLoop::Run src\ipc\chromium\src\base\message_loop.cc:290
#54 nsBaseAppShell::Run src\widget\nsBaseAppShell.cpp:137
#55 nsAppShell::Run src\widget\windows\nsAppShell.cpp:406
#56 XRE_RunAppShell src\toolkit\xre\nsEmbedFunctions.cpp:943
#57 mozilla::ipc::MessagePumpForChildProcess::Run src\ipc\glue\MessagePump.cpp:237
#58 MessageLoop::RunInternal src\ipc\chromium\src\base\message_loop.cc:315
#59 MessageLoop::RunHandler src\ipc\chromium\src\base\message_loop.cc:308
#60 MessageLoop::Run src\ipc\chromium\src\base\message_loop.cc:290
#61 XRE_InitChildProcess src\toolkit\xre\nsEmbedFunctions.cpp:778
#62 content_process_main src\ipc\contentproc\plugin-container.cpp:56
#63 NS_internal_main src\browser\app\nsBrowserApp.cpp:303
#64 wmain src\toolkit\xre\nsWindowsWMain.cpp:131
#65 __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#66 BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017bd3)
#67 RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18006ced0)

Comment 1

[Kelsey Gilbert [:jgilbert]]

ANGLE bug:
https://searchfox.org/mozilla-central/source/gfx/angle/checkout/src/libANGLE/renderer/d3d/d3d11/Buffer11.cpp#1115
size is 0x0000_0001_0000_0000
static_cast<unsigned int>(size) -> 0x0 as in "oops"!

Comment 2

[Kelsey Gilbert [:jgilbert]]

Looks like UINT32_T-4 also explodes, but this time with a GL_OUT_OF_MEMORY coming from glFlush?? Weird. Guess ANGLE is stuck with uint31_t like everyone else.

Comment 3

[Kelsey Gilbert [:jgilbert]]

Attachment: Bug 1610383 - Restrict BufferData size to int32_t for ANGLE.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6d4602f18c77
Restrict BufferData size to int32_t for ANGLE. r=lsalzman

Comment 5

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/6d4602f18c77