Closed Bug 1688686 Opened 3 years ago Closed 3 years ago

Assertion failure: surf, at /builds/worker/checkouts/gecko/dom/canvas/ClientWebGLContext.cpp:1023

Categories

(Core :: Graphics: CanvasWebGL, defect)

defect

Tracking

()

VERIFIED FIXED
97 Branch
Tracking Status
firefox-esr91 --- wontfix
firefox87 --- wontfix
firefox91 --- wontfix
firefox92 --- wontfix
firefox93 --- wontfix
firefox95 --- wontfix
firefox96 --- wontfix
firefox97 --- verified

People

(Reporter: jkratzer, Assigned: jgilbert)

References

(Blocks 1 open bug)

Details

(Keywords: assertion, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files)

Attached file testcase.html

Testcase found while fuzzing mozilla-central rev 130c2c4e36d6 (built with --enable-debug).

Assertion failure: surf, at /builds/worker/checkouts/gecko/dom/canvas/ClientWebGLContext.cpp:1023

    #0 0x7f83dcd43e3a in mozilla::ClientWebGLContext::BackBufferSnapshot() /builds/worker/checkouts/gecko/dom/canvas/ClientWebGLContext.cpp:1023:3
    #1 0x7f83dcd435bd in mozilla::ClientWebGLContext::GetSurfaceSnapshot(gfxAlphaType*) /builds/worker/checkouts/gecko/dom/canvas/ClientWebGLContext.cpp:863:14
    #2 0x7f83dd1595c4 in GetSurfaceSnapshot /builds/worker/checkouts/gecko/dom/html/HTMLCanvasElement.cpp:1269:27
    #3 0x7f83dd1595c4 in mozilla::dom::RequestedFrameRefreshObserver::WillRefresh(mozilla::TimeStamp) /builds/worker/checkouts/gecko/dom/html/HTMLCanvasElement.cpp:146:34
    #4 0x7f83de6410fe in nsRefreshDriver::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:2139:12
    #5 0x7f83de6493e1 in TickDriver /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:357:13
    #6 0x7f83de6493e1 in mozilla::RefreshDriverTimer::TickRefreshDrivers(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:336:7
    #7 0x7f83de6492bf in mozilla::RefreshDriverTimer::Tick(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:351:5
    #8 0x7f83de648868 in RunRefreshDrivers /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:799:5
    #9 0x7f83de648868 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::layers::BaseTransactionId<mozilla::VsyncIdType>, mozilla::TimeStamp) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:722:16
    #10 0x7f83de648180 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyParentProcessVsync() /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:624:7
    #11 0x7f83de647bf9 in mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::VsyncEvent const&) /builds/worker/checkouts/gecko/layout/base/nsRefreshDriver.cpp:545:9
    #12 0x7f83dde462f6 in mozilla::dom::VsyncChild::RecvNotify(mozilla::VsyncEvent const&, float const&) /builds/worker/checkouts/gecko/dom/ipc/VsyncChild.cpp:68:15
    #13 0x7f83dabc4350 in mozilla::dom::PVsyncChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PVsyncChild.cpp:178:54
    #14 0x7f83da96d39c in mozilla::ipc::PBackgroundChild::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PBackgroundChild.cpp:6286:32
    #15 0x7f83da628b6e in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2153:25
    #16 0x7f83da62516d in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2077:9
    #17 0x7f83da626616 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1925:3
    #18 0x7f83da62735b in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1956:13
    #19 0x7f83d9d0454f in mozilla::RunnableTask::Run() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:461:16
    #20 0x7f83d9d02b2a in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:741:26
    #21 0x7f83d9d01bd4 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:600:15
    #22 0x7f83d9d01d87 in mozilla::TaskController::ProcessPendingMTTask(bool) /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:384:36
    #23 0x7f83d9d07e16 in operator() /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:123:37
    #24 0x7f83d9d07e16 in mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_3>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:534:5
    #25 0x7f83d9d194f5 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1200:14
    #26 0x7f83d9d1f5ba in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:548:10
    #27 0x7f83da62e456 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:87:21
    #28 0x7f83da59a143 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #29 0x7f83da59a05d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #30 0x7f83da59a05d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #31 0x7f83de3990b8 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
    #32 0x7f83dfbb5273 in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:902:20
    #33 0x7f83da62f33c in mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:237:9
    #34 0x7f83da59a143 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:334:10
    #35 0x7f83da59a05d in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:327:3
    #36 0x7f83da59a05d in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:309:3
    #37 0x7f83dfbb4e48 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:733:34
    #38 0x558d4d78bf26 in content_process_main /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
    #39 0x558d4d78bf26 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:306:18
    #40 0x7f83f0a0b0b2 in __libc_start_main /build/glibc-ZN95T4/glibc-2.31/csu/../csu/libc-start.c:308:16
Flags: in-testsuite?

Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20210125172739-17f61493037d.
The bug appears to have been introduced in the following build range:

Start: 7917b3a4a9a72295f3c4d5f00c839fc336e72d26 (20200221031207)
End: e030be1d2dd9b0bb47680fac29f20447c9d66f8c (20200221033136)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=7917b3a4a9a72295f3c4d5f00c839fc336e72d26&tochange=e030be1d2dd9b0bb47680fac29f20447c9d66f8c

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]
No longer blocks: domino
Depends on: domino
Blocks: domino
No longer depends on: domino

It's more common to hit the 500MB limit for e.g. 13k x 13k requests than
OOM, but we can treat them the same.

Assignee: nobody → jgilbert
Status: NEW → ASSIGNED

:jgilbert, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Flags: needinfo?(jgilbert)
Pushed by jgilbert@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/2d5ff6c2237c
Don't assert on OOM/throttle in ClientWebGLContext::BackBufferSnapshot. r=gfx-reviewers,aosmond
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → 97 Branch

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20211230212924-7b2c3d8ab474.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: