1746224 - Crash in [@ mozilla::layers::Image::GetDescFromTexClient]

Status: RESOLVED DUPLICATE of bug 1746135

(Core :: Graphics: CanvasWebGL, defect)

Description

[Calixte Denizet (:calixte)]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/d40662c2-de3c-49f4-8606-3aada0211215

Reason: EXCEPTION_ACCESS_VIOLATION_READ

Top 8 frames of crashing thread:

0 xul.dll mozilla::layers::Image::GetDescFromTexClient gfx/layers/ImageContainer.cpp:226
1 xul.dll mozilla::layers::Image::GetDesc gfx/layers/ImageContainer.cpp:217
2 xul.dll mozilla::webgl::FromDomElem dom/canvas/WebGLTextureUpload.cpp:190
3 xul.dll mozilla::ClientWebGLContext::TexImage const dom/canvas/ClientWebGLContext.cpp:3995
4 xul.dll mozilla::ClientWebGLContext::TexImage2D<mozilla::dom::HTMLCanvasElement> const dom/canvas/ClientWebGLContext.h:1763
5 xul.dll mozilla::dom::WebGL2RenderingContext_Binding::texImage2D dom/bindings/WebGL2RenderingContextBinding.cpp:2067
6 xul.dll mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3306
7 None @0x0000002397064cd9 

There are 2 crashes (from 1 installation) in nightly 97 with buildid 20211215091158. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1746111.

[1] https://hg.mozilla.org/mozilla-central/rev?node=3d201ea88341

Comment 1

[Christian Holler (:decoder)]

Bug 1746308 is likely a related fuzzbug and apparently that has a fix range. In that range, there is one bug that stands out, which is for bug 1746135. Could be a dup of this and since fixed (there is only a very negligible volume after this fix).

Comment 2

[Kelsey Gilbert [:jgilbert]]

Yeah, probably!