Open Bug 1766443 Opened 2 years ago Updated 7 months ago

Assertion failure: [GFX1]: texImage: Unexpected error <enum 0x0502> during upload. (dui: 8d62/1907/8363), at /gfx/2d/Logging.h:754

Categories

(Core :: Graphics: CanvasWebGL, defect)

Product:
Core
Component:
Graphics: CanvasWebGL
Platform:
x86_64
Linux
Type:
defect

Tracking

()

People

(Reporter: jkratzer, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: bugmon, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files)

Testcase
763 bytes, text/html
Details
about_support.txt
44.52 KB, text/plain
Details

Testcase found while fuzzing mozilla-central rev 31346aa577d3 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 31346aa577d3 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: [GFX1]: texImage: Unexpected error <enum 0x0502> during upload. (dui: 8d62/1907/8363), at /gfx/2d/Logging.h:754

    ==271902==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f38d902a43f bp 0x7f38c41957e0 sp 0x7f38c41957d0 T271992)
    ==271902==The signal is caused by a WRITE memory access.
    ==271902==Hint: address points to the zero page.
        #0 0x7f38d902a43f in mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::WriteLog(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /gfx/2d/Logging.h:755:9
        #1 0x7f38d902a34e in mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::Flush() /gfx/2d/Logging.h:277:7
        #2 0x7f38d90f637e in mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::~Log() /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Logging.h:270:12
        #3 0x7f38db21abf1 in mozilla::WebGLTexture::TexImage(unsigned int, unsigned int, mozilla::avec3<unsigned int> const&, mozilla::webgl::PackingInfo const&, mozilla::webgl::TexUnpackBlobDesc const&) /dom/canvas/WebGLTextureUpload.cpp:1113:5
        #4 0x7f38db1915d8 in mozilla::WebGLContext::TexImage(unsigned int, unsigned int, mozilla::avec3<unsigned int>, mozilla::webgl::PackingInfo const&, mozilla::webgl::TexUnpackBlobDesc const&) const /dom/canvas/WebGLContextTextures.cpp:211:8
        #5 0x7f38db1de463 in TexImage /dom/canvas/HostWebGLContext.h:560:15
        #6 0x7f38db1de463 in auto bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 74ul, void (mozilla::HostWebGLContext::*)(unsigned int, unsigned int, mozilla::avec3<unsigned int> const&, mozilla::webgl::PackingInfo const&, mozilla::webgl::TexUnpackBlobDesc const&) const, &(mozilla::HostWebGLContext::TexImage(unsigned int, unsigned int, mozilla::avec3<unsigned int> const&, mozilla::webgl::PackingInfo const&, mozilla::webgl::TexUnpackBlobDesc const&) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&)::'lambda'(auto&...)::operator()<unsigned int, unsigned int, mozilla::avec3<unsigned int>, mozilla::webgl::PackingInfo, mozilla::webgl::TexUnpackBlobDesc>(auto&...) const /dom/canvas/WebGLCommandQueue.h:246:13
        #7 0x7f38db1dc377 in __invoke_impl<bool, (lambda at /dom/canvas/WebGLCommandQueue.h:238:11), unsigned int &, unsigned int &, mozilla::avec3<unsigned int> &, mozilla::webgl::PackingInfo &, mozilla::webgl::TexUnpackBlobDesc &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/invoke.h:60:14
        #8 0x7f38db1dc377 in __invoke<(lambda at /dom/canvas/WebGLCommandQueue.h:238:11), unsigned int &, unsigned int &, mozilla::avec3<unsigned int> &, mozilla::webgl::PackingInfo &, mozilla::webgl::TexUnpackBlobDesc &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/bits/invoke.h:95:14
        #9 0x7f38db1dc377 in __apply_impl<(lambda at /dom/canvas/WebGLCommandQueue.h:238:11), std::tuple<unsigned int, unsigned int, mozilla::avec3<unsigned int>, mozilla::webgl::PackingInfo, mozilla::webgl::TexUnpackBlobDesc> &, 0UL, 1UL, 2UL, 3UL, 4UL> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/tuple:1662:14
        #10 0x7f38db1dc377 in apply<(lambda at /dom/canvas/WebGLCommandQueue.h:238:11), std::tuple<unsigned int, unsigned int, mozilla::avec3<unsigned int>, mozilla::webgl::PackingInfo, mozilla::webgl::TexUnpackBlobDesc> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/7.5.0/../../../../include/c++/7.5.0/tuple:1671:14
        #11 0x7f38db1dc377 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:237:14
        #12 0x7f38db1dc377 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 73ul, void (mozilla::HostWebGLContext::*)(unsigned int, unsigned int, unsigned int, mozilla::avec3<unsigned int> const&) const, &(mozilla::HostWebGLContext::TexStorage(unsigned int, unsigned int, unsigned int, mozilla::avec3<unsigned int> const&) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #13 0x7f38db1db615 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #14 0x7f38db1db615 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #15 0x7f38db1db615 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 70ul, void (mozilla::HostWebGLContext::*)(unsigned int, unsigned long) const, &(mozilla::HostWebGLContext::BindTexture(unsigned int, unsigned long) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #16 0x7f38db1da862 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #17 0x7f38db1da862 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #18 0x7f38db1da862 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 67ul, void (mozilla::HostWebGLContext::*)(unsigned int) const, &(mozilla::HostWebGLContext::ReadBuffer(unsigned int) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #19 0x7f38db1d9985 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #20 0x7f38db1d9985 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 65ul, void (mozilla::HostWebGLContext::*)(unsigned int, mozilla::RawBuffer<unsigned int const> const&) const, &(mozilla::HostWebGLContext::InvalidateFramebuffer(unsigned int, mozilla::RawBuffer<unsigned int const> const&) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #21 0x7f38db1d8f68 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #22 0x7f38db1d8f68 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 63ul, void (mozilla::HostWebGLContext::*)(unsigned int, unsigned long, mozilla::RawBuffer<unsigned char> const&) const, &(mozilla::HostWebGLContext::BufferSubData(unsigned int, unsigned long, mozilla::RawBuffer<unsigned char> const&) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #23 0x7f38db1d8645 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #24 0x7f38db1d8645 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 61ul, void (mozilla::HostWebGLContext::*)(unsigned int, unsigned int, unsigned long, unsigned long, unsigned long) const, &(mozilla::HostWebGLContext::CopyBufferSubData(unsigned int, unsigned int, unsigned long, unsigned long, unsigned long) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #25 0x7f38db1d7a44 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #26 0x7f38db1d7a44 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #27 0x7f38db1d7a44 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 58ul, void (mozilla::HostWebGLContext::*)(int, int, int, int) const, &(mozilla::HostWebGLContext::Viewport(int, int, int, int) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #28 0x7f38db1d6fe7 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #29 0x7f38db1d6fe7 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #30 0x7f38db1d6fe7 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 55ul, void (mozilla::HostWebGLContext::*)(unsigned int, unsigned int, int, unsigned int) const, &(mozilla::HostWebGLContext::StencilFuncSeparate(unsigned int, unsigned int, int, unsigned int) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #31 0x7f38db1d64ee in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #32 0x7f38db1d64ee in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 53ul, void (mozilla::HostWebGLContext::*)(int, int, int, int) const, &(mozilla::HostWebGLContext::Scissor(int, int, int, int) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #33 0x7f38db1d4b6f in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #34 0x7f38db1d4b6f in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #35 0x7f38db1d4b6f in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 50ul, void (mozilla::HostWebGLContext::*)(float, float) const, &(mozilla::HostWebGLContext::PolygonOffset(float, float) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #36 0x7f38db1d41bc in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #37 0x7f38db1d41bc in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #38 0x7f38db1d41bc in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 47ul, void (mozilla::HostWebGLContext::*)(unsigned int, unsigned int) const, &(mozilla::HostWebGLContext::Hint(unsigned int, unsigned int) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #39 0x7f38db1d39f3 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #40 0x7f38db1d39f3 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #41 0x7f38db1d39f3 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 44ul, void (mozilla::HostWebGLContext::*)() const, &(mozilla::HostWebGLContext::Flush() const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #42 0x7f38db1d2f3f in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #43 0x7f38db1d2f3f in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #44 0x7f38db1d2f3f in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 41ul, void (mozilla::HostWebGLContext::*)(bool) const, &(mozilla::HostWebGLContext::DepthMask(bool) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #45 0x7f38db1d23e4 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #46 0x7f38db1d23e4 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #47 0x7f38db1d23e4 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 38ul, void (mozilla::HostWebGLContext::*)(unsigned long) const, &(mozilla::HostWebGLContext::CompileShader(unsigned long) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #48 0x7f38db1d1082 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #49 0x7f38db1d1082 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #50 0x7f38db1d1082 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 35ul, void (mozilla::HostWebGLContext::*)(float) const, &(mozilla::HostWebGLContext::ClearDepth(float) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #51 0x7f38db1d05da in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #52 0x7f38db1d05da in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #53 0x7f38db1d05da in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 32ul, void (mozilla::HostWebGLContext::*)(mozilla::Maybe<unsigned int>, unsigned int, unsigned int, unsigned int, unsigned int) const, &(mozilla::HostWebGLContext::BlendFuncSeparate(mozilla::Maybe<unsigned int>, unsigned int, unsigned int, unsigned int, unsigned int) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #54 0x7f38db1cf0b7 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #55 0x7f38db1cf0b7 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #56 0x7f38db1cf0b7 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 29ul, void (mozilla::HostWebGLContext::*)(unsigned int, unsigned long) const, &(mozilla::HostWebGLContext::BindFramebuffer(unsigned int, unsigned long) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #57 0x7f38db1cea1c in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #58 0x7f38db1cea1c in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 27ul, void (mozilla::HostWebGLContext::*)(unsigned long, unsigned long) const, &(mozilla::HostWebGLContext::AttachShader(unsigned long, unsigned long) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #59 0x7f38db1ccea5 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #60 0x7f38db1ccea5 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #61 0x7f38db1ccea5 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 24ul, void (mozilla::HostWebGLContext::*)(mozilla::avec2<unsigned int> const&), &(mozilla::HostWebGLContext::Resize(mozilla::avec2<unsigned int> const&))>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #62 0x7f38db1cba4f in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #63 0x7f38db1cba4f in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 22ul, void (mozilla::HostWebGLContext::*)(unsigned int, mozilla::Maybe<unsigned int>, bool) const, &(mozilla::HostWebGLContext::SetEnabled(unsigned int, mozilla::Maybe<unsigned int>, bool) const)>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #64 0x7f38db1cb1d6 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #65 0x7f38db1cb1d6 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #66 0x7f38db1cb1d6 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 19ul, void (mozilla::HostWebGLContext::*)(unsigned long), &(mozilla::HostWebGLContext::DeleteTexture(unsigned long))>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #67 0x7f38db1ca986 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #68 0x7f38db1ca986 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #69 0x7f38db1ca986 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 16ul, void (mozilla::HostWebGLContext::*)(unsigned long), &(mozilla::HostWebGLContext::DeleteSampler(unsigned long))>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #70 0x7f38db1ca136 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #71 0x7f38db1ca136 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #72 0x7f38db1ca136 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 13ul, void (mozilla::HostWebGLContext::*)(unsigned long), &(mozilla::HostWebGLContext::DeleteProgram(unsigned long))>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #73 0x7f38db1c98e6 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #74 0x7f38db1c98e6 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #75 0x7f38db1c98e6 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 10ul, void (mozilla::HostWebGLContext::*)(unsigned long), &(mozilla::HostWebGLContext::CreateVertexArray(unsigned long))>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #76 0x7f38db1c87f6 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #77 0x7f38db1c87f6 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #78 0x7f38db1c87f6 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 7ul, void (mozilla::HostWebGLContext::*)(unsigned long), &(mozilla::HostWebGLContext::CreateSync(unsigned long))>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #79 0x7f38db1c7fb0 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #80 0x7f38db1c7fb0 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #81 0x7f38db1c7fb0 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 4ul, void (mozilla::HostWebGLContext::*)(unsigned long), &(mozilla::HostWebGLContext::CreateRenderbuffer(unsigned long))>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #82 0x7f38db1c7756 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #83 0x7f38db1c7756 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #84 0x7f38db1c7756 in bool mozilla::MethodDispatcher<mozilla::WebGLMethodDispatcher, 1ul, void (mozilla::HostWebGLContext::*)(unsigned long), &(mozilla::HostWebGLContext::CreateFramebuffer(unsigned long))>::DispatchCommand<mozilla::HostWebGLContext>(mozilla::HostWebGLContext&, unsigned long, mozilla::webgl::RangeConsumerView&) /dom/canvas/WebGLCommandQueue.h:251:12
        #85 0x7f38db1b3a07 in DispatchCommand<mozilla::HostWebGLContext> /dom/canvas/WebGLCommandQueue.h:251:12
        #86 0x7f38db1b3a07 in mozilla::dom::WebGLParent::RecvDispatchCommands(mozilla::ipc::Shmem&&, unsigned long) /dom/canvas/WebGLParent.cpp:64:21
        #87 0x7f38db253d32 in mozilla::dom::PWebGLParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PWebGLParent.cpp:241:55
        #88 0x7f38d9520b5e in mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCanvasManagerParent.cpp:213:32
        #89 0x7f38d8be6581 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1707:25
        #90 0x7f38d8be3806 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message&&) /ipc/glue/MessageChannel.cpp:1632:9
        #91 0x7f38d8be4309 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1493:3
        #92 0x7f38d8be4e54 in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1528:14
        #93 0x7f38d80451e7 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1174:16
        #94 0x7f38d804b50d in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #95 0x7f38d8bed1e5 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:300:20
        #96 0x7f38d8b0ab47 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:380:10
        #97 0x7f38d8b0aa52 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #98 0x7f38d8b0aa52 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #99 0x7f38d80406d6 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:378:10
        #100 0x7f38edbdc2e7 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #101 0x7f38ee94e608 in start_thread /build/glibc-sMfBJT/glibc-2.31/nptl/pthread_create.c:477:8
        #102 0x7f38ee515162 in __clone /build/glibc-sMfBJT/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /gfx/2d/Logging.h:755:9 in mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::WriteLog(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)
    ==271902==ABORTING
Attached file Testcase — 

    
    

    
  
Bugmon Analysis

Verified bug as reproducible on mozilla-central 20220426094609-31346aa577d3.

Unable to bisect testcase (Testcase reproduces on start build!):




Start: 1c01cb995fc94cb8d7971f9cd31ff6c9d5a7d8c9 (20210427095509)

End: 31346aa577d363be6c1139d1a134507b93f3784f (20220426094609)

BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)




Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

    
    

    
  
The severity field is not set for this bug.

:jgilbert, could you have a look please?


For more information, please visit auto_nag documentation.


Flags: needinfo?(jgilbert)

    
    

    
  
Bugmon was unable reproduce this issue.

Removing bugmon keyword as no further action possible.  Please review the bug and re-add the keyword for further analysis.


Keywords: bugmon

    
  
Keywords: bugmon

    
    

    
  
A change to the Taskcluster build definitions over the weekend caused Bugmon to fail when reproducing issues. This issue has been corrected. Re-enabling bugmon.



    
    

    
  
Can you attach about:support, here and in any subsequent fuzz bugs that hit graphics?


Flags: needinfo?(jgilbert) → needinfo?(jkratzer)

        Attachment #9273848 -
        Attachment mime type: text/plain → text/html

    
    

    
  
This doesn't seem to repro for me on my Windows laptop.



    
    

    
  

      
      
      
      

        Attached file
          
        about_support.txt
        — 
      

    


  
Flags: needinfo?(jkratzer)
Severity: -- → S2

    
    

    
  
->S3. Not S2 unless it's a fuzzblocker.


Severity: S2 → S3

    
    

    
  
Jason, I attempted to do the Grizzly repro (on macOS -- not Linux as in your repro case) and the command python -m fuzzfetch --build 31346aa577d3 --debug --fuzzing -n firefox gives me Unable to find usable archive for revision 31346aa577d3. The testcase doesn't repro for me on macOS Nightly. Can you offer a new grizzly repro build?



    
    

    
  
:bradwerth, Taskcluster only retains builds for a year.  Since build 31346aa577d3 is more than 2 years old, you'll need to call fuzzfetch with --nearest-newer to get the oldest available build.


With that said, I can reproduce this issue using the latest available debug build.


$ fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox 1766443
[2024-02-09 12:27:29] Loaded Bug 1766443 from Bugzilla
[2024-02-09 12:27:29] Starting Grizzly Replay
[2024-02-09 12:27:29] Ignoring: log-limit, timeout
[2024-02-09 12:27:29] Using time limit: 30s, timeout: 45s
[2024-02-09 12:27:29] Repeat: 1, Minimum crashes: 1, Relaunch 1
[2024-02-09 12:27:34] Running test (1/1)...
[2024-02-09 12:27:36] Processing result...
[2024-02-09 12:27:36] Result: Assertion failure: [GFX1]: texImage: Unexpected error <enum 0x0502> during upload. (dui: 8d62/1907/8363), at /builds/worker/workspace/obj-build/dist/include/mozilla/gfx/Logging.h:756 (8114169f:38c5688f)
[2024-02-09 12:27:36] Results successfully reproduced
[2024-02-09 12:27:36] Shutting down...
[2024-02-09 12:27:36] Done.




          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: