Closed Bug 1746312 Opened 2 years ago Closed 2 years ago

Hit MOZ_CRASH(Error in Device::create_render_bundle_encoder: number of color attachments exceeds the limit) at gfx/wgpu_bindings/src/client.rs:635

Categories

(Core :: Graphics: WebGPU, defect)

defect

Tracking

()

VERIFIED FIXED
97 Branch
Tracking Status
firefox-esr91 --- unaffected
firefox95 --- disabled
firefox96 --- disabled
firefox97 --- fixed

People

(Reporter: tsmith, Assigned: kvark)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: assertion, regression, Whiteboard: [bugmon:bisected,confirmed])

Crash Data

Attachments

(2 files)

Attached file testcase.html

Found while fuzzing m-c 20211203-356c52182625 (--enable-debug --enable-fuzzing)

Hit MOZ_CRASH(Error in Device::create_render_bundle_encoder: number of color attachments exceeds the limit) at gfx/wgpu_bindings/src/client.rs:635

#0 0x7f43fa51f310 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7f43fa51f310 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7f43fa51f236 in mozglue_static::panic_hook::h61696a4324a5d117 /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:91:9
#3 0x7f43fa51def5 in core::ops::function::Fn::call::h4225dabb1a2af65e /builds/worker/fetches/rust/library/core/src/ops/function.rs:70:5
#4 0x7f43fd27284f in std::panicking::rust_panic_with_hook::h12df1cde34faedfe (/home/user/workspace/browsers/m-c-20211213214351-fuzzing-asan-opt/libxul.so+0x1ecce84f)
#5 0x7f43fd28fc7f in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h1112bbc0bd387537 std.37975f9d-cgu.4
#6 0x7f43fd28efc3 in std::sys_common::backtrace::__rust_end_short_backtrace::h014d03f4c05b9aaa crtstuff.c
#7 0x7f43fd2722a1 in rust_begin_unwind (/home/user/workspace/browsers/m-c-20211213214351-fuzzing-asan-opt/libxul.so+0x1ecce2a1)
#8 0x7f43e69f5a3a in std::panicking::begin_panic_fmt::h0c1b1d350089ab7d (/home/user/workspace/browsers/m-c-20211213214351-fuzzing-asan-opt/libxul.so+0x8451a3a)
#9 0x7f43f6cf5292 in wgpu_device_create_render_bundle_encoder /builds/worker/checkouts/gecko/gfx/wgpu_bindings/src/client.rs:635:19
#10 0x7f43ed55158c in mozilla::webgpu::CreateRenderBundleEncoder(unsigned long, mozilla::dom::GPURenderBundleEncoderDescriptor const&) /builds/worker/checkouts/gecko/dom/webgpu/RenderBundleEncoder.cpp:59:10
#11 0x7f43ed551af2 in mozilla::webgpu::RenderBundleEncoder::RenderBundleEncoder(mozilla::webgpu::Device*, mozilla::webgpu::WebGPUChild*, mozilla::dom::GPURenderBundleEncoderDescriptor const&) /builds/worker/checkouts/gecko/dom/webgpu/RenderBundleEncoder.cpp:66:16
#12 0x7f43ed53eff8 in mozilla::webgpu::Device::CreateRenderBundleEncoder(mozilla::dom::GPURenderBundleEncoderDescriptor const&) /builds/worker/checkouts/gecko/dom/webgpu/Device.cpp:180:11
#13 0x7f43ec5ae831 in mozilla::dom::GPUDevice_Binding::createRenderBundleEncoder(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WebGPUBinding.cpp:16905:89
#14 0x7f43ece39dbd in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/dom/bindings/BindingUtils.cpp:3306:13
#15 0x7f43f49379b4 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:388:13
#16 0x7f43f49379b4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:475:12
#17 0x7f43f4923e7e in CallFromStack /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:539:10
#18 0x7f43f4923e7e in Interpret(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:3243:16
#19 0x7f43f4908c81 in js::RunScript(JSContext*, js::RunState&) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:357:13
#20 0x7f43f4937aef in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:507:13
#21 0x7f43f4939c3b in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:552:8
#22 0x7f43f4ef0a77 in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/SelfHosting.cpp:1539:10
#23 0x7f43f4b81069 in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/AsyncFunction.cpp:152:8
#24 0x7f43f4d580bc in AsyncFunctionPromiseReactionJob /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:2000:12
#25 0x7f43f4d580bc in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /builds/worker/checkouts/gecko/js/src/builtin/Promise.cpp:2160:12
#26 0x7f43f49379b4 in CallJSNative /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:388:13
#27 0x7f43f49379b4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:475:12
#28 0x7f43f4939c3b in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /builds/worker/checkouts/gecko/js/src/vm/Interpreter.cpp:552:8
#29 0x7f43f4bb334d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/checkouts/gecko/js/src/vm/CallAndConstruct.cpp:117:10
#30 0x7f43ebc25dcc in mozilla::dom::PromiseJobCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/PromiseBinding.cpp:35:8
#31 0x7f43e75700e7 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:89:12
#32 0x7f43e75700e7 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:102:12
#33 0x7f43e75700e7 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:213:18
#34 0x7f43e754f567 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:674:17
#35 0x7f43e755054f in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) /builds/worker/checkouts/gecko/xpcom/base/CycleCollectedJSContext.cpp:463:3
#36 0x7f43e9b5ea26 in XPCJSContext::AfterProcessTask(unsigned int) /builds/worker/checkouts/gecko/js/xpconnect/src/XPCJSContext.cpp:1424:28
#37 0x7f43e77912c8 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1220:24
#38 0x7f43e779c26c in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467:10
#39 0x7f43e8caa3ef in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:85:21
#40 0x7f43e8b29c61 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331:10
#41 0x7f43e8b29c61 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324:3
#42 0x7f43e8b29c61 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306:3
#43 0x7f43efa16df7 in nsBaseAppShell::Run() /builds/worker/checkouts/gecko/widget/nsBaseAppShell.cpp:137:27
#44 0x7f43f465550f in XRE_RunAppShell() /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:864:20
#45 0x7f43e8b29c61 in RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:331:10
#46 0x7f43e8b29c61 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:324:3
#47 0x7f43e8b29c61 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:306:3
#48 0x7f43f4654742 in XRE_InitChildProcess(int, char**, XREChildData const*) /builds/worker/checkouts/gecko/toolkit/xre/nsEmbedFunctions.cpp:701:34
#49 0x556a0af94e9d in content_process_main(mozilla::Bootstrap*, int, char**) /builds/worker/checkouts/gecko/browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
#50 0x556a0af952c8 in main /builds/worker/checkouts/gecko/browser/app/nsBrowserApp.cpp:327:18
#51 0x7f440b89b0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#52 0x556a0aee3f69 in _start (/home/user/workspace/browsers/m-c-20211213214351-fuzzing-asan-opt/firefox+0x5cf69)
Flags: in-testsuite?

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html --xvfb
Crash Signature: [@ wgpu_bindings::client::wgpu_device_create_render_bundle_encoder ]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20211215215113-66b5b425d27f.
The bug appears to have been introduced in the following build range:

Start: 60c6b98b954e8d31353f9934e4b7c1581fd07d37 (20210903164901)
End: ef5dc3e04e5f271eea0636ab3a495e95cc912f1d (20210903165630)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=60c6b98b954e8d31353f9934e4b7c1581fd07d37&tochange=ef5dc3e04e5f271eea0636ab3a495e95cc912f1d

Whiteboard: [bugmon:bisected,confirmed]

The severity field is not set for this bug.
:kvark, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(dmalyshau)
Assignee: nobody → dmalyshau
Severity: -- → S3
Flags: needinfo?(dmalyshau)

:kvark, since this bug contains a bisection range, could you fill (if possible) the regressed_by field?
For more information, please visit auto_nag documentation.

Flags: needinfo?(dmalyshau)
Flags: needinfo?(dmalyshau)
Regressed by: 1726626
Has Regression Range: --- → yes
See Also: → 1731596
Pushed by dmalyshau@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/aef2a12d7819
Return WebGPU errors from RenderBundle creation r=jimb
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 97 Branch

Set release status flags based on info from the regressing bug 1726626

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220105093353-d8c484f1a51c.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED
Keywords: bugmon
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: