Hit MOZ_CRASH(Error in Device::create_render_bundle_encoder: number of color attachments exceeds the limit) at gfx/wgpu_bindings/src/client.rs:635
Categories
(Core :: Graphics: WebGPU, defect)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr91 | --- | unaffected |
firefox95 | --- | disabled |
firefox96 | --- | disabled |
firefox97 | --- | fixed |
People
(Reporter: tsmith, Assigned: kvark)
References
(Blocks 1 open bug, Regression)
Details
(Keywords: assertion, regression, Whiteboard: [bugmon:bisected,confirmed])
Crash Data
Attachments
(2 files)
Found while fuzzing m-c 20211203-356c52182625 (--enable-debug --enable-fuzzing)
Hit MOZ_CRASH(Error in Device::create_render_bundle_encoder: number of color attachments exceeds the limit) at gfx/wgpu_bindings/src/client.rs:635
#0 0x7f43fa51f310 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7f43fa51f310 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7f43fa51f236 in mozglue_static::panic_hook::h61696a4324a5d117 /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:91:9
#3 0x7f43fa51def5 in core::ops::function::Fn::call::h4225dabb1a2af65e /builds/worker/fetches/rust/library/core/src/ops/function.rs:70:5
#4 0x7f43fd27284f in std::panicking::rust_panic_with_hook::h12df1cde34faedfe (/home/user/workspace/browsers/m-c-20211213214351-fuzzing-asan-opt/libxul.so+0x1ecce84f)
#5 0x7f43fd28fc7f in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h1112bbc0bd387537 std.37975f9d-cgu.4
#6 0x7f43fd28efc3 in std::sys_common::backtrace::__rust_end_short_backtrace::h014d03f4c05b9aaa crtstuff.c
#7 0x7f43fd2722a1 in rust_begin_unwind (/home/user/workspace/browsers/m-c-20211213214351-fuzzing-asan-opt/libxul.so+0x1ecce2a1)
#8 0x7f43e69f5a3a in std::panicking::begin_panic_fmt::h0c1b1d350089ab7d (/home/user/workspace/browsers/m-c-20211213214351-fuzzing-asan-opt/libxul.so+0x8451a3a)
#9 0x7f43f6cf5292 in wgpu_device_create_render_bundle_encoder /builds/worker/checkouts/gecko/gfx/wgpu_bindings/src/client.rs:635:19
#10 0x7f43ed55158c in mozilla::webgpu::CreateRenderBundleEncoder(unsigned long, mozilla::dom::GPURenderBundleEncoderDescriptor const&) /builds/worker/checkouts/gecko/dom/webgpu/RenderBundleEncoder.cpp:59:10
#11 0x7f43ed551af2 in mozilla::webgpu::RenderBundleEncoder::RenderBundleEncoder(mozilla::webgpu::Device*, mozilla::webgpu::WebGPUChild*, mozilla::dom::GPURenderBundleEncoderDescriptor const&) /builds/worker/checkouts/gecko/dom/webgpu/RenderBundleEncoder.cpp:66:16
#12 0x7f43ed53eff8 in mozilla::webgpu::Device::CreateRenderBundleEncoder(mozilla::dom::GPURenderBundleEncoderDescriptor const&) /builds/worker/checkouts/gecko/dom/webgpu/Device.cpp:180:11
#13 0x7f43ec5ae831 in mozilla::dom::GPUDevice_Binding::createRenderBundleEncoder(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WebGPUBinding.cpp:16905:89
#14 0x7f43ece39dbd in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3306:13
#15 0x7f43f49379b4 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:388:13
#16 0x7f43f49379b4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:475:12
#17 0x7f43f4923e7e in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:539:10
#18 0x7f43f4923e7e in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3243:16
#19 0x7f43f4908c81 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:357:13
#20 0x7f43f4937aef in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:507:13
#21 0x7f43f4939c3b in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:552:8
#22 0x7f43f4ef0a77 in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/SelfHosting.cpp:1539:10
#23 0x7f43f4b81069 in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/AsyncFunction.cpp:152:8
#24 0x7f43f4d580bc in AsyncFunctionPromiseReactionJob /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:2000:12
#25 0x7f43f4d580bc in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:2160:12
#26 0x7f43f49379b4 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:388:13
#27 0x7f43f49379b4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:475:12
#28 0x7f43f4939c3b in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:552:8
#29 0x7f43f4bb334d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
#30 0x7f43ebc25dcc in mozilla::dom::PromiseJobCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/PromiseBinding.cpp:35:8
#31 0x7f43e75700e7 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:89:12
#32 0x7f43e75700e7 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:102:12
#33 0x7f43e75700e7 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:213:18
#34 0x7f43e754f567 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:674:17
#35 0x7f43e755054f in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:463:3
#36 0x7f43e9b5ea26 in XPCJSContext::AfterProcessTask(unsigned int) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1424:28
#37 0x7f43e77912c8 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1220:24
#38 0x7f43e779c26c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467:10
#39 0x7f43e8caa3ef in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#40 0x7f43e8b29c61 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331:10
#41 0x7f43e8b29c61 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324:3
#42 0x7f43e8b29c61 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306:3
#43 0x7f43efa16df7 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
#44 0x7f43f465550f in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:864:20
#45 0x7f43e8b29c61 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331:10
#46 0x7f43e8b29c61 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324:3
#47 0x7f43e8b29c61 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306:3
#48 0x7f43f4654742 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:701:34
#49 0x556a0af94e9d in content_process_main(mozilla::Bootstrap*, int, char**) /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#50 0x556a0af952c8 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:327:18
#51 0x7f440b89b0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#52 0x556a0aee3f69 in _start (/home/user/workspace/browsers/m-c-20211213214351-fuzzing-asan-opt/firefox+0x5cf69)
Reporter | ||
Comment 1•2 years ago
|
||
To reproduce via Grizzly Replay:
$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html --xvfb
Comment 2•2 years ago
|
||
got a crash in nightly : https://crash-stats.mozilla.org/report/index/5efa6583-ee58-4ad7-b9c6-299930211216#tab-bugzilla
Comment 3•2 years ago
|
||
Bugmon Analysis
Verified bug as reproducible on mozilla-central 20211215215113-66b5b425d27f.
The bug appears to have been introduced in the following build range:
Start: 60c6b98b954e8d31353f9934e4b7c1581fd07d37 (20210903164901)
End: ef5dc3e04e5f271eea0636ab3a495e95cc912f1d (20210903165630)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=60c6b98b954e8d31353f9934e4b7c1581fd07d37&tochange=ef5dc3e04e5f271eea0636ab3a495e95cc912f1d
Comment 4•2 years ago
|
||
The severity field is not set for this bug.
:kvark, could you have a look please?
For more information, please visit auto_nag documentation.
Assignee | ||
Updated•2 years ago
|
Assignee | ||
Comment 5•2 years ago
|
||
Comment 6•2 years ago
|
||
:kvark, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.
Updated•2 years ago
|
Pushed by dmalyshau@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/aef2a12d7819 Return WebGPU errors from RenderBundle creation r=jimb
Comment 8•2 years ago
|
||
bugherder |
Comment 9•2 years ago
|
||
Set release status flags based on info from the regressing bug 1726626
Comment 10•2 years ago
|
||
Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220105093353-d8c484f1a51c.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.
Updated•2 years ago
|
Updated•2 years ago
|
Description
•