1771250 - Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at gfx/wgpu_bindings/src/client.rs:55

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebGPU, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 41271d27d65a (built with: --enable-address-sanitizer --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 41271d27d65a --asan --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at gfx/wgpu_bindings/src/client.rs:55

    =================================================================
    ==1656493==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x7f781b92abe0 bp 0x7ffe7cd27cb0 sp 0x7ffe7cd27ca0 T0)
    ==1656493==The signal is caused by a WRITE memory access.
    ==1656493==Hint: address points to the zero page.
        #0 0x7f781b92abe0 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
        #1 0x7f781b92abe0 in RustMozCrash /mozglue/static/rust/wrappers.cpp:18:3
        #2 0x7f781b92a206 in mozglue_static::panic_hook::h3395d9151612f644 /mozglue/static/rust/lib.rs:91:9
        #3 0x7f781b929735 in core::ops::function::Fn::call::h123068b42f5e1fd5 /builds/worker/fetches/rust/library/core/src/ops/function.rs:70:5
        #4 0x7f781e92a1af in std::panicking::rust_panic_with_hook::hd4b01d10d132fdc5 (/home/jkratzer/builds/mc-asan/libxul.so+0x1f9c31af) (BuildId: 296feae269509c33fdba619b138afd6a0b713763)
        #5 0x7f781e94c478 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::head537b50d915cd5 std.19cbab4a-cgu.7
        #6 0x7f781e94bca3 in std::sys_common::backtrace::__rust_end_short_backtrace::h3809453eea6ed96e crtstuff.c
        #7 0x7f781e929c81 in rust_begin_unwind (/home/jkratzer/builds/mc-asan/libxul.so+0x1f9c2c81) (BuildId: 296feae269509c33fdba619b138afd6a0b713763)
        #8 0x7f7807728642 in core::panicking::panic_fmt::heea304e80a792787 (/home/jkratzer/builds/mc-asan/libxul.so+0x87c1642) (BuildId: 296feae269509c33fdba619b138afd6a0b713763)
        #9 0x7f780772850c in core::panicking::panic::ha8af15b6dd7f78ea (/home/jkratzer/builds/mc-asan/libxul.so+0x87c150c) (BuildId: 296feae269509c33fdba619b138afd6a0b713763)
        #10 0x7f7817c3f132 in wgpu_client_create_render_pipeline /gfx/wgpu_bindings/src/client.rs
        #11 0x7f780dd4d741 in mozilla::webgpu::WebGPUChild::DeviceCreateRenderPipelineImpl(mozilla::webgpu::PipelineCreationContext*, mozilla::dom::GPURenderPipelineDescriptor const&, mozilla::ipc::ByteBuf*) /dom/webgpu/ipc/WebGPUChild.cpp:953:14
        #12 0x7f780dd4e960 in mozilla::webgpu::WebGPUChild::DeviceCreateRenderPipeline(mozilla::webgpu::PipelineCreationContext*, mozilla::dom::GPURenderPipelineDescriptor const&) /dom/webgpu/ipc/WebGPUChild.cpp:969:20
        #13 0x7f780dd1ac5b in mozilla::webgpu::Device::CreateRenderPipeline(mozilla::dom::GPURenderPipelineDescriptor const&) /dom/webgpu/Device.cpp:294:19
        #14 0x7f780ccda8e9 in mozilla::dom::GPUDevice_Binding::createRenderPipeline(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /builds/worker/workspace/obj-build/dom/bindings/WebGPUBinding.cpp:17091:84
        #15 0x7f780d58e0ad in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /dom/bindings/BindingUtils.cpp:3271:13
        #16 0x7f78176b0cf4 in CallJSNative /js/src/vm/Interpreter.cpp:420:13
        #17 0x7f78176b0cf4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:507:12
        #18 0x7f781769dfde in InternalCall /js/src/vm/Interpreter.cpp:574:10
        #19 0x7f781769dfde in CallFromStack /js/src/vm/Interpreter.cpp:578:10
        #20 0x7f781769dfde in Interpret(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:3314:16
        #21 0x7f7817682b61 in js::RunScript(JSContext*, js::RunState&) /js/src/vm/Interpreter.cpp:389:13
        #22 0x7f78176b0e2f in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:539:13
        #23 0x7f78176b29ba in InternalCall /js/src/vm/Interpreter.cpp:574:10
        #24 0x7f78176b29ba in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:605:8
        #25 0x7f78161761bc in js::CallSelfHostedFunction(JSContext*, JS::Handle<js::PropertyName*>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /js/src/vm/SelfHosting.cpp:1590:10
        #26 0x7f7815daea89 in AsyncFunctionResume(JSContext*, JS::Handle<js::AsyncFunctionGeneratorObject*>, ResumeKind, JS::Handle<JS::Value>) /js/src/vm/AsyncFunction.cpp:152:8
        #27 0x7f7816081b1a in AsyncFunctionPromiseReactionJob /js/src/builtin/Promise.cpp:2113:12
        #28 0x7f7816081b1a in PromiseReactionJob(JSContext*, unsigned int, JS::Value*) /js/src/builtin/Promise.cpp:2176:12
        #29 0x7f78176b0cf4 in CallJSNative /js/src/vm/Interpreter.cpp:420:13
        #30 0x7f78176b0cf4 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /js/src/vm/Interpreter.cpp:507:12
        #31 0x7f78176b29ba in InternalCall /js/src/vm/Interpreter.cpp:574:10
        #32 0x7f78176b29ba in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /js/src/vm/Interpreter.cpp:605:8
        #33 0x7f7815de6c5d in JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /js/src/vm/CallAndConstruct.cpp:117:10
        #34 0x7f780c3959dc in mozilla::dom::PromiseJobCallback::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::ErrorResult&) /builds/worker/workspace/obj-build/dom/bindings/PromiseBinding.cpp:35:8
        #35 0x7f78083b9277 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:89:12
        #36 0x7f78083b9277 in Call /builds/worker/workspace/obj-build/dist/include/mozilla/dom/PromiseBinding.h:102:12
        #37 0x7f78083b9277 in mozilla::PromiseJobRunnable::Run(mozilla::AutoSlowOperation&) /xpcom/base/CycleCollectedJSContext.cpp:213:18
        #38 0x7f7808398ca7 in mozilla::CycleCollectedJSContext::PerformMicroTaskCheckPoint(bool) /xpcom/base/CycleCollectedJSContext.cpp:674:17
        #39 0x7f7808399cef in mozilla::CycleCollectedJSContext::AfterProcessTask(unsigned int) /xpcom/base/CycleCollectedJSContext.cpp:463:3
        #40 0x7f7809fb2770 in XPCJSContext::AfterProcessTask(unsigned int) /js/xpconnect/src/XPCJSContext.cpp:1481:28
        #41 0x7f78085c61d8 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1217:24
        #42 0x7f78085cfdec in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #43 0x7f7809ce6064 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:107:5
        #44 0x7f7809b6c011 in RunInternal /ipc/chromium/src/base/message_loop.cc:380:10
        #45 0x7f7809b6c011 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #46 0x7f7809b6c011 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #47 0x7f7810aa74b7 in nsBaseAppShell::Run() /widget/nsBaseAppShell.cpp:137:27
        #48 0x7f781599339f in XRE_RunAppShell() /toolkit/xre/nsEmbedFunctions.cpp:874:20
        #49 0x7f7809b6c011 in RunInternal /ipc/chromium/src/base/message_loop.cc:380:10
        #50 0x7f7809b6c011 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #51 0x7f7809b6c011 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #52 0x7f781599254b in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:733:34
        #53 0x55cb05e7ac1d in content_process_main(mozilla::Bootstrap*, int, char**) /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #54 0x55cb05e7b050 in main /browser/app/nsBrowserApp.cpp:338:18
        #55 0x7f782e2df082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
        #56 0x55cb05dbb069 in _start (/home/jkratzer/builds/mc-asan/firefox+0x5f069) (BuildId: ebb6e7c39345c5198ff4b2abb10b7ea242fb234b)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3 in MOZ_Crash
    ==1656493==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220525150600-41271d27d65a.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 257c3c51ab2338a35634610b9d3c6c4c305e6005 (20210527031253)
End: 41271d27d65a17e29ea8cfeacc2bbaf9ddd43975 (20220525150600)
BuildFlags: BuildFlags(asan=True, tsan=False, debug=False, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False)

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jimb, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20220525150600-41271d27d65a) but not with tip (mozilla-central 20230203160655-a356e2d3cf46.)

The bug appears to have been fixed in the following build range:

Start: 591ee1cc97208fa579d150512368fcea2488fdfc (20230127215948)
End: f4f63f0138feb7535fa58c3f77fd8a51361371d8 (20230128112735)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=591ee1cc97208fa579d150512368fcea2488fdfc&tochange=f4f63f0138feb7535fa58c3f77fd8a51361371d8

jkratzer, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 5

[Jason Kratzer [:jkratzer]]

Appears to have been fixed via bug 1799753.