1657189 - Assertion failure: [GFX1]: GLint mozilla::gl::GLContext::fGetFragDataLocation(GLuint, const GLchar *): Generated unexpected GL_INVALID_OPERATION error, at /builds/worker/checkouts/gecko/gfx/2d/Logging.h:754

Status: VERIFIED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 7cb90fa4f485 (built with --enable-debug).

Assertion failure: [GFX1]: GLint mozilla::gl::GLContext::fGetFragDataLocation(GLuint, const GLchar *): Generated unexpected GL_INVALID_OPERATION error, at /builds/worker/checkouts/gecko/gfx/2d/Logging.h:754

    #0 0x7f5e8a6fbd5e in AnnotateMozCrashReason /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:42:19
    #1 0x7f5e8a6fbd5e in mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::WriteLog(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /builds/worker/checkouts/gecko/gfx/2d/Logging.h:755:9
    #2 0x7f5e8a6fbc59 in mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::Flush() /builds/worker/checkouts/gecko/gfx/2d/Logging.h:277:7
    #3 0x7f5e8a7ff78f in ~Log /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Logging.h:270:12
    #4 0x7f5e8a7ff78f in mozilla::gl::GLContext::AfterGLCall_Debug(char const*) const /builds/worker/checkouts/gecko/gfx/gl/GLContext.cpp:2512:7
    #5 0x7f5e8c43f98c in AfterGLCall /builds/worker/checkouts/gecko/gfx/gl/GLContext.h:684:7
    #6 0x7f5e8c43f98c in mozilla::gl::GLContext::fGetFragDataLocation(unsigned int, char const*) /builds/worker/checkouts/gecko/gfx/gl/GLContext.h:2619:5
    #7 0x7f5e8c43f492 in mozilla::WebGLContext::GetFragDataLocation(mozilla::WebGLProgram const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /builds/worker/checkouts/gecko/dom/canvas/WebGLContext.cpp:2038:14
    #8 0x7f5e8c3f4284 in operator() /builds/worker/checkouts/gecko/dom/canvas/ClientWebGLContext.cpp:5540:25
    #9 0x7f5e8c3f4284 in mozilla::ClientWebGLContext::GetFragDataLocation(mozilla::WebGLProgramJS const&, nsTSubstring<char16_t> const&) const /builds/worker/checkouts/gecko/dom/canvas/ClientWebGLContext.cpp:5537:10
    #10 0x7f5e8bca7459 in mozilla::dom::WebGL2RenderingContext_Binding::getFragDataLocation(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WebGL2RenderingContextBinding.cpp:4566:39
    #11 0x7f5e8c32bce1 in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3221:13
    #12 0x7f5e8f19b601 in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:487:13
    #13 0x7f5e8f19ae79 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:579:12
    #14 0x7f5e8f19c93f in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:642:10
    #15 0x7f5e8f1902c8 in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:646:10
    #16 0x7f5e8f1902c8 in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3314:16
    #17 0x7f5e8f186b7a in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:459:10
    #18 0x7f5e8f19add6 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:614:13
    #19 0x7f5e8f19c93f in InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:642:10
    #20 0x7f5e8f19cb1f in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:659:8
    #21 0x7f5e8f2abfa7 in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/jsapi.cpp:2831:10
    #22 0x7f5e8c053bd3 in mozilla::dom::EventListener::HandleEvent(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/EventListenerBinding.cpp:55:8
    #23 0x7f5e8c6d5be6 in void mozilla::dom::EventListener::HandleEvent<mozilla::dom::EventTarget*>(mozilla::dom::EventTarget* const&, mozilla::dom::Event&, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*) /builds/worker/workspace/obj-build/dist/include/mozilla/dom/EventListenerBinding.h:66:12
    #24 0x7f5e8c6d590d in mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1082:43
    #25 0x7f5e8c6d65a3 in mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool) /builds/worker/checkouts/gecko/dom/events/EventListenerManager.cpp:1279:17
    #26 0x7f5e8c6cbf44 in HandleEvent /builds/worker/workspace/obj-build/dist/include/mozilla/EventListenerManager.h:354:5
    #27 0x7f5e8c6cbf44 in mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:355:17
    #28 0x7f5e8c6cb4e1 in mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:557:16
    #29 0x7f5e8c6ce0d9 in mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget*>*) /builds/worker/checkouts/gecko/dom/events/EventDispatcher.cpp:1054:11
    #30 0x7f5e8db62003 in nsDocumentViewer::LoadComplete(nsresult) /builds/worker/checkouts/gecko/layout/base/nsDocumentViewer.cpp:1092:7
    #31 0x7f5e8eb5de60 in nsDocShell::EndPageLoad(nsIWebProgress*, nsIChannel*, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:6190:20
    #32 0x7f5e8eb5d85b in nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp:5517:7
    #33 0x7f5e8eb5f33f in non-virtual thunk to nsDocShell::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) /builds/worker/checkouts/gecko/docshell/base/nsDocShell.cpp
    #34 0x7f5e8a5f1dfa in nsDocLoader::DoFireOnStateChange(nsIWebProgress*, nsIRequest*, int&, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:1331:3
    #35 0x7f5e8a5f15ea in nsDocLoader::doStopDocumentLoad(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:937:14
    #36 0x7f5e8a5efb48 in nsDocLoader::DocLoaderIsEmpty(bool, mozilla::Maybe<nsresult> const&) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:757:9
    #37 0x7f5e8a5f0a08 in nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp:640:5
    #38 0x7f5e8a5f125c in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/uriloader/base/nsDocLoader.cpp
    #39 0x7f5e8924bf96 in mozilla::net::nsLoadGroup::NotifyRemovalObservers(nsIRequest*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:615:22
    #40 0x7f5e8924d493 in mozilla::net::nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, nsresult) /builds/worker/checkouts/gecko/netwerk/base/nsLoadGroup.cpp:522:10
    #41 0x7f5e8afb6a5f in mozilla::dom::Document::DoUnblockOnload() /builds/worker/checkouts/gecko/dom/base/Document.cpp:10790:18
    #42 0x7f5e8af960b0 in mozilla::dom::Document::UnblockOnload(bool) /builds/worker/checkouts/gecko/dom/base/Document.cpp:10720:9
    #43 0x7f5e8afa60d8 in mozilla::dom::Document::DispatchContentLoadedEvents() /builds/worker/checkouts/gecko/dom/base/Document.cpp:7338:3
    #44 0x7f5e8b013f16 in applyImpl<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1188:12
    #45 0x7f5e8b013f16 in apply<mozilla::dom::Document, void (mozilla::dom::Document::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1194:12
    #46 0x7f5e8b013f16 in mozilla::detail::RunnableMethodImpl<mozilla::dom::Document*, void (mozilla::dom::Document::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1240:13
    #47 0x7f5e890b7ba2 in mozilla::SchedulerGroup::Runnable::Run() /builds/worker/checkouts/gecko/xpcom/threads/SchedulerGroup.cpp:146:20
    #48 0x7f5e890bd9b4 in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:242:16
    #49 0x7f5e890bb77d in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:512:26
    #50 0x7f5e890ba744 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:371:15
    #51 0x7f5e890ba8f7 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:168:36
    #52 0x7f5e890c2376 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:83:37
    #53 0x7f5e890c2376 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_4>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:577:5
    #54 0x7f5e890d5748 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1234:14
    #55 0x7f5e890db0ba in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:513:10
    #56 0x7f5e899e8f3f in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #57 0x7f5e8995a3e3 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #58 0x7f5e8995a2fd in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #59 0x7f5e8995a2fd in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #60 0x7f5e8d842538 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #61 0x7f5e8f059853 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:913:20
    #62 0x7f5e899e9d07 in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #63 0x7f5e8995a3e3 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #64 0x7f5e8995a2fd in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #65 0x7f5e8995a2fd in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #66 0x7f5e8f0593f2 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:744:34
    #67 0x5642ebabffff in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:56:28
    #68 0x5642ebabffff in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:303:18
    #69 0x7f5ea46e8b96 in __libc_start_main /build/glibc-2ORdQG/glibc-2.27/csu/../csu/libc-start.c:310

Comment 1

[Jason Kratzer [:jkratzer]]

The fuzzers are frequently tripping over this issue and has been marked as a fuzzblocker[1]. Please prioritize this issue accordingly.

[1] https://firefox-source-docs.mozilla.org/tools/fuzzing/index.html#fuzz-blockers

Comment 2

[Jason Kratzer [:jkratzer]]

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200804215246-02be42e5105b.
The bug appears to have been introduced in the following build range:
> Start: 5cbf5bb11c585d69321b420f67ffb62544141427 (20200108215517)
> End: e1b0906509efa6433978b9f980ec639b7eafbc6d (20200108222028)
> Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5cbf5bb11c585d69321b420f67ffb62544141427&tochange=e1b0906509efa6433978b9f980ec639b7eafbc6d

Comment 3

[Jason Kratzer [:jkratzer]]

The fuzzers are frequently tripping over this issue and has been marked as a fuzzblocker[1]. Please prioritize this issue accordingly.
[1] https://firefox-source-docs.mozilla.org/tools/fuzzing/index.html#fuzz-blockers

Edit: Apologies for posting this twice. I missed my own earlier comment.

Comment 4

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/iy-wihVzlBzL-idkDy2nog/index.html

Comment 5

[Tyson Smith [:tsmith]]

Hi Jeff is anyone available to have a look at this? If this is benign could it possibly be downgraded to a non-fatal assertion? Even temporarily would be helpful. This would be help save us cycles since the fuzzers are tripping over it constantly. We have > 21000 reported instances of it (that is with reporting throttled). Thanks!

Comment 6

[Kelsey Gilbert [:jgilbert]]

Hey, sorry about that!

I'm not seeing any restrictions that would forbid GetFragDataLocation('gl_FragColor') in the GL or GLES specs, and ANGLE (which is notoriously strict) has no problem here, so I had a hunch:
https://github.com/mesa3d/mesa/blob/43dd023bd1eb23a5cdb1470c6a30595c3fbf319a/src/mesa/main/shader_query.cpp#L448

_mesa_GetFragDataLocation(GLuint program, const GLchar *name)
{
   GET_CURRENT_CONTEXT(ctx);
   struct gl_shader_program *const shProg =
      _mesa_lookup_shader_program_err(ctx, program, "glGetFragDataLocation");

   if (!shProg) {
      return -1;
   }

   if (!shProg->data->LinkStatus) {
      _mesa_error(ctx, GL_INVALID_OPERATION,
                  "glGetFragDataLocation(program not linked)");
      return -1;
   }

   if (!name)
      return -1;

   if (strncmp(name, "gl_", 3) == 0) {
      _mesa_error(ctx, GL_INVALID_OPERATION,
                  "glGetFragDataLocation(illegal name)");
      return -1;
   }

I'm pretty sure this is Mesa doing incorrect over-strict validation.
We can work around this, for sure.

Comment 7

[Kelsey Gilbert [:jgilbert]]

I filed an issue upstream: https://gitlab.freedesktop.org/mesa/mesa/-/issues/5221

Comment 8

[Kelsey Gilbert [:jgilbert]]

Attachment: Bug 1657189 - Avoid GetFragDataLocation('gl_*') on Mesa.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c9cca7d22cd0
Avoid GetFragDataLocation('gl_*') on Mesa. r=gfx-reviewers,lsalzman

Comment 10

[Kelsey Gilbert [:jgilbert]]

New CTS test: https://github.com/KhronosGroup/WebGL/pull/3314

Comment 11

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/c9cca7d22cd0

Comment 12

[Kelsey Gilbert [:jgilbert]]

jsfiddle: https://jsfiddle.net/wf4r12Le/2/

Comment 13

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20210812092607-610ae1bbeff8.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.