1772557 - Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at /third_party/rust/wgpu-core/src/id.rs:151

Reporter

Description

•

2 years ago

Testcase found while fuzzing mozilla-central rev 2f53c261903e (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 2f53c261903e --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at /third_party/rust/wgpu-core/src/id.rs:151

    ==671704==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f433d947795 bp 0x7f42be76f9d0 sp 0x7f42be76f9c0 T671916)
    ==671704==The signal is caused by a WRITE memory access.
    ==671704==Hint: address points to the zero page.
        #0 0x7f433d947795 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
        #1 0x7f433d947795 in RustMozCrash /mozglue/static/rust/wrappers.cpp:18:3
        #2 0x7f433d947714 in mozglue_static::panic_hook::h48e37746cd0167e5 /mozglue/static/rust/lib.rs:91:9
        #3 0x7f433d94717b in core::ops::function::Fn::call::h97f65c94ad4cad45 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:70:5
        #4 0x7f433e72e71f in std::panicking::rust_panic_with_hook::habfdcc2e90f9fd4c /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:702:17
        #5 0x7f433e72e518 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::he054b2a83a51d2cd /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:586:13
        #6 0x7f433e72b393 in std::sys_common::backtrace::__rust_end_short_backtrace::ha48b94ab49b30915 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:138:18
        #7 0x7f433e72e288 in rust_begin_unwind /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:584:5
        #8 0x7f4334051502 in core::panicking::panic_fmt::h366d3a309ae17c94 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:143:14
        #9 0x7f43340513cc in core::panicking::panic::h8705e81f284be8a5 /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/panicking.rs:48:5
        #10 0x7f433ca6993b in _$LT$wgpu_core..command..draw.._..$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..command..draw..RenderCommand$GT$..deserialize..__Visitor$u20$as$u20$serde..de..Visitor$GT$::visit_enum::h4fa165dbfcb80ba4 /third_party/rust/wgpu-core/src/command/draw.rs
        #11 0x7f433ca6993b in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_enum::hebd0db1404f8755f /third_party/rust/bincode/src/de/mod.rs:290:9
        #12 0x7f433ca6993b in wgpu_core::command::draw::_::_$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..command..draw..RenderCommand$GT$::deserialize::h0869e22b1cd1c2da /third_party/rust/wgpu-core/src/command/draw.rs:141:12
        #13 0x7f433ca6993b in _$LT$core..marker..PhantomData$LT$T$GT$$u20$as$u20$serde..de..DeserializeSeed$GT$::deserialize::h5d31f917284dd500 /third_party/rust/serde/src/de/mod.rs:787:9
        #14 0x7f433ca6993b in _$LT$$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$..deserialize_tuple..Access$LT$R$C$O$GT$$u20$as$u20$serde..de..SeqAccess$GT$::next_element_seed::hf5c1231780a0c306 /third_party/rust/bincode/src/de/mod.rs:314:25
        #15 0x7f433ca6993b in serde::de::SeqAccess::next_element::hd2324830a99d00f0 /third_party/rust/serde/src/de/mod.rs:1727:9
        #16 0x7f433ca6993b in _$LT$serde..de..impls..$LT$impl$u20$serde..de..Deserialize$u20$for$u20$alloc..vec..Vec$LT$T$GT$$GT$..deserialize..VecVisitor$LT$T$GT$$u20$as$u20$serde..de..Visitor$GT$::visit_seq::hf3f390cf0680bb90 /third_party/rust/serde/src/de/impls.rs:1038:46
        #17 0x7f433ca6993b in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_tuple::h6662b6a47d33f7c9 /third_party/rust/bincode/src/de/mod.rs:326:9
        #18 0x7f433ca6993b in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_seq::hc33b129f6bc31e0a /third_party/rust/bincode/src/de/mod.rs:350:9
        #19 0x7f433ca6993b in serde::de::impls::_$LT$impl$u20$serde..de..Deserialize$u20$for$u20$alloc..vec..Vec$LT$T$GT$$GT$::deserialize::h0271ec7db0e5a2be /third_party/rust/serde/src/de/impls.rs:1049:9
        #20 0x7f433ca6993b in _$LT$core..marker..PhantomData$LT$T$GT$$u20$as$u20$serde..de..DeserializeSeed$GT$::deserialize::h1d1c19b972d3c509 /third_party/rust/serde/src/de/mod.rs:787:9
        #21 0x7f433ca6993b in _$LT$$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$..deserialize_tuple..Access$LT$R$C$O$GT$$u20$as$u20$serde..de..SeqAccess$GT$::next_element_seed::hc1077fecaaba3b11 /third_party/rust/bincode/src/de/mod.rs:314:25
        #22 0x7f433ca6993b in serde::de::SeqAccess::next_element::h24f9d4bb4a027f6e /third_party/rust/serde/src/de/mod.rs:1727:9
        #23 0x7f433ca6993b in _$LT$wgpu_core..command.._..$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..command..BasePass$LT$C$GT$$GT$..deserialize..__Visitor$LT$C$GT$$u20$as$u20$serde..de..Visitor$GT$::visit_seq::h5fb07bca2a2ab0fd /third_party/rust/wgpu-core/src/command/mod.rs:230:12
        #24 0x7f433ca6993b in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_tuple::h78d57bf63716ef75 /third_party/rust/bincode/src/de/mod.rs:326:9
        #25 0x7f433ca6993b in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_struct::hcb84aaa3cc5997cf /third_party/rust/bincode/src/de/mod.rs:411:9
        #26 0x7f433ca6993b in wgpu_core::command::_::_$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..command..BasePass$LT$C$GT$$GT$::deserialize::h16dd521c34a5c532 /third_party/rust/wgpu-core/src/command/mod.rs:230:12
        #27 0x7f433ca6993b in _$LT$core..marker..PhantomData$LT$T$GT$$u20$as$u20$serde..de..DeserializeSeed$GT$::deserialize::h4c49c44f72bd5cdf /third_party/rust/serde/src/de/mod.rs:787:9
        #28 0x7f433ca6993b in _$LT$$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$..deserialize_tuple..Access$LT$R$C$O$GT$$u20$as$u20$serde..de..SeqAccess$GT$::next_element_seed::h4df6f1bda88fd90b /third_party/rust/bincode/src/de/mod.rs:314:25
        #29 0x7f433ca6993b in serde::de::SeqAccess::next_element::h54cc2c7414a8bf66 /third_party/rust/serde/src/de/mod.rs:1727:9
        #30 0x7f433cbacb57 in _$LT$$LT$wgpu_core..device..trace.._..$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..device..trace..Command$GT$..deserialize..__Visitor$u20$as$u20$serde..de..Visitor$GT$..visit_enum..__Visitor$u20$as$u20$serde..de..Visitor$GT$::visit_seq::h63d2ba925c9dcb4d /third_party/rust/wgpu-core/src/device/trace.rs:127:39
        #31 0x7f433cbacb57 in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_tuple::h38d82cb7809f39ae /third_party/rust/bincode/src/de/mod.rs:326:9
        #32 0x7f433cbacb57 in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..VariantAccess$GT$::struct_variant::h24d853ecc6cfd6b0 /third_party/rust/bincode/src/de/mod.rs:490:9
        #33 0x7f433cbacb57 in _$LT$wgpu_core..device..trace.._..$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..device..trace..Command$GT$..deserialize..__Visitor$u20$as$u20$serde..de..Visitor$GT$::visit_enum::hbf10745a5308748f /third_party/rust/wgpu-core/src/device/trace.rs:127:39
        #34 0x7f433cbacb57 in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_enum::h164888f5848104f8 /third_party/rust/bincode/src/de/mod.rs:290:9
        #35 0x7f433cbacb57 in wgpu_core::device::trace::_::_$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..device..trace..Command$GT$::deserialize::h2a2f85eeb641c604 /third_party/rust/wgpu-core/src/device/trace.rs:127:39
        #36 0x7f433cbacb57 in _$LT$core..marker..PhantomData$LT$T$GT$$u20$as$u20$serde..de..DeserializeSeed$GT$::deserialize::ha68569b7dec4b5fc /third_party/rust/serde/src/de/mod.rs:787:9
        #37 0x7f433cbacb57 in bincode::internal::deserialize_seed::h978dbfd362d78c08 /third_party/rust/bincode/src/internal.rs:118:15
        #38 0x7f433cbacb57 in bincode::internal::deserialize::hef474e0b0972fd51 /third_party/rust/bincode/src/internal.rs:106:5
        #39 0x7f433cbacb57 in bincode::config::Options::deserialize::h1bb47673bf883d33 /third_party/rust/bincode/src/config/mod.rs:200:9
        #40 0x7f433cbacb57 in bincode::deserialize::h82be53ecb444581e /third_party/rust/bincode/src/lib.rs:181:5
        #41 0x7f433cbacb57 in wgpu_server_command_encoder_action /gfx/wgpu_bindings/src/server.rs:536:18
        #42 0x7f433780d1ae in mozilla::webgpu::WebGPUParent::RecvCommandEncoderAction(unsigned long, unsigned long, mozilla::ipc::ByteBuf const&) /dom/webgpu/ipc/WebGPUParent.cpp:907:3
        #43 0x7f43378200ab in mozilla::webgpu::PWebGPUParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PWebGPUParent.cpp:420:80
        #44 0x7f433592c89e in mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCanvasManagerParent.cpp:214:32
        #45 0x7f4334fe1631 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /ipc/glue/MessageChannel.cpp:1781:25
        #46 0x7f4334fde185 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >) /ipc/glue/MessageChannel.cpp:1706:9
        #47 0x7f4334fded26 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /ipc/glue/MessageChannel.cpp:1506:3
        #48 0x7f4334fe00b1 in mozilla::ipc::MessageChannel::MessageTask::Run() /ipc/glue/MessageChannel.cpp:1604:14
        #49 0x7f433441e887 in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1174:16
        #50 0x7f4334424dbd in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:465:10
        #51 0x7f4334fe8334 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:330:5
        #52 0x7f4334f0e1c7 in MessageLoop::RunInternal() /ipc/chromium/src/base/message_loop.cc:380:10
        #53 0x7f4334f0e0d2 in RunHandler /ipc/chromium/src/base/message_loop.cc:373:3
        #54 0x7f4334f0e0d2 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:355:3
        #55 0x7f4334419d76 in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:378:10
        #56 0x7f434b827557 in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:201:5
        #57 0x7f434c599608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
        #58 0x7f434c160132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3 in MOZ_Crash
    ==671704==ABORTING

Jason Kratzer [:jkratzer]

Reporter

Comment 1

•

2 years ago

Attached file Testcase (obsolete) — Details

Mayank Bansal

Comment 2

•

2 years ago

https://crash-stats.mozilla.org/report/index/227f383e-17c8-48bc-830f-7da0c0220603

Crash Signature: [@ wgpu_core::id::impl$11::zip<T> ]

Keywords: crash

Bugmon [:jkratzer for issues]

Comment 3

•

2 years ago

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220603155506-68727ef04ccf.
The bug appears to have been introduced in the following build range:

Start: 60c6b98b954e8d31353f9934e4b7c1581fd07d37 (20210903164901)
End: ef5dc3e04e5f271eea0636ab3a495e95cc912f1d (20210903165630)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=60c6b98b954e8d31353f9934e4b7c1581fd07d37&tochange=ef5dc3e04e5f271eea0636ab3a495e95cc912f1d

Keywords: regression

Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

BugBot [:suhaib / :marco/ :calixte]

Comment 4

•

2 years ago

Setting regressed_by field after analyzing regression range found by bugmon.

Regressed by: 1726626

BugBot [:suhaib / :marco/ :calixte]

Comment 5

•

2 years ago

Set release status flags based on info from the regressing bug 1726626

status-firefox101: --- → affected

status-firefox102: --- → affected

status-firefox103: --- → affected

status-firefox-esr91: --- → unaffected

BugBot [:suhaib / :marco/ :calixte]

Updated

•

2 years ago

Has Regression Range: --- → yes

Ryan VanderMeulen [:RyanVM]

Updated

•

2 years ago

status-firefox101: affected → disabled

status-firefox102: affected → disabled

status-firefox103: affected → fix-optional

BugBot [:suhaib / :marco/ :calixte]

Comment 6

•

2 years ago

Set release status flags based on info from the regressing bug 1726626

status-firefox104: --- → affected

status-firefox-esr102: --- → affected

BugBot [:suhaib / :marco/ :calixte]

Comment 7

•

2 years ago

The severity field is not set for this bug.
:jimb, could you have a look please?

For more information, please visit auto_nag documentation.

Flags: needinfo?(jimb)

Ryan VanderMeulen [:RyanVM]

Updated

•

2 years ago

status-firefox103: fix-optional → disabled

status-firefox104: affected → disabled

status-firefox105: --- → disabled

status-firefox106: --- → fix-optional

status-firefox-esr102: affected → disabled

Mayank Bansal

Updated

•

1 year ago

Crash Signature: [@ wgpu_core::id::impl$11::zip<T> ] → [@ wgpu_core::id::impl$11::zip<T> ] [@ core::num::nonzero::NonZeroU64::new ]

Tyson Smith [:tsmith]

Comment 8

•

1 year ago

We have seen a fairly large spike in reports of this issue from the fuzzers lately. ~2K total ~1.5K in the last week or so.

status-firefox106: fix-optional → disabled

status-firefox109: --- → disabled

status-firefox110: --- → disabled

status-firefox111: --- → affected

Donal Meehan [:dmeehan]

Updated

•

1 year ago

status-firefox111: affected → disabled

Tyson Smith [:tsmith]

Comment 9

•

1 year ago

This is still one of the top WebGPU issues reported by the fuzzers.

status-firefox112: --- → disabled

Jason Kratzer [:jkratzer]

Reporter

Updated

•

1 year ago

Whiteboard: [bugmon:bisected,confirmed] → [bugmon:bisected,confirmed][fuzzblocker]

Jim Blandy :jimb

Assignee

Comment 10

•

1 year ago

I can reproduce this, although endPass in the testcase needs to be changed to end.

Assignee: nobody → jimb

Flags: needinfo?(jimb)

Jim Blandy :jimb

Assignee

Comment 11

•

1 year ago

The assertion is reporting that an attempt to deserialize an ID failed because its value was zero. Specifically, this call to NonZeroId::new is returning None:

https://searchfox.org/mozilla-central/rev/54c533e94ae786056a43231f230c7d9b0773cb80/third_party/rust/wgpu-core/src/id.rs#188

Id(NonZeroId::new(v).unwrap(), PhantomData)

That is invoked from the attempt to deserialize a wgpu_core::device::trace::Command here:

https://searchfox.org/mozilla-central/rev/54c533e94ae786056a43231f230c7d9b0773cb80/gfx/wgpu_bindings/src/server.rs#707

let action = bincode::deserialize(byte_buf.as_slice()).unwrap();

I don't exactly know which id is zero yet, but I suspect it's the texture view's, because we're getting the following error from the Vulkan validation layers (reformatted for legibility):

[ERROR wgpu_hal::vulkan::instance] VALIDATION [VUID-VkImageViewCreateInfo-image-04441 (0xb75da543)]
  Validation Error: [ VUID-VkImageViewCreateInfo-image-04441 ]
  Object 0: handle = 0x80000000008, type = VK_OBJECT_TYPE_IMAGE;
  | MessageID = 0xb75da543
  | Invalid usage flag for VkImage 0x80000000008[] used by vkCreateImageView().
    In this case, VkImage should have VK_IMAGE_USAGE_[SAMPLED|STORAGE|COLOR_ATTACHMENT|
    DEPTH_STENCIL_ATTACHMENT|INPUT_ATTACHMENT|TRANSIENT_ATTACHMENT|SHADING_RATE_IMAGE|
    FRAGMENT_DENSITY_MAP]_BIT set during creation. The Vulkan spec states: image must have been
    created with a usage value containing at least one of the usages defined in the valid image
    usage list for image views
    (https://www.khronos.org/registry/vulkan/specs/1.3-extensions/html/vkspec.html#VUID-VkImageViewCreateInfo-image-04441)
[ERROR wgpu_hal::vulkan::instance] 	objects: (type: IMAGE, hndl: 0x80000000008, name: ?)

Jim Blandy :jimb

Assignee

Comment 12

•

1 year ago

Actually, the relevant error is this:

JavaScript warning: , line 0: Error in Device::create_render_bundle_encoder: the number of color attachments 9 exceeds the limit 8

This is reported here, I think:

https://searchfox.org/mozilla-central/rev/54c533e94ae786056a43231f230c7d9b0773cb80/third_party/rust/wgpu-core/src/command/bundle.rs#182-187

return Err(CreateRenderBundleError::ColorAttachment(
    ColorAttachmentError::TooMany {
        given: desc.color_formats.len(),
        limit: hal::MAX_COLOR_ATTACHMENTS,
    },
));

It's caused by this call in the test case:

        const encoder = device.createRenderBundleEncoder({
          'colorFormats': ['rg8uint', 'bc6h-rgb-ufloat', 'rg32float', 'rg32float', 'depth32float', 'r8unorm', 'rg32uint', 'rgba32sint', 'rg8unorm'],
        })

This provides formats for nine color attachments, but only eight are supported. It seems like something is not dealing with the failure to create the render bundle encoder.

Jim Blandy :jimb

Assignee

Comment 13

•

1 year ago

Indeed, the crash stack shows that we're trying to deserialize an Id<RenderBundle>:

#25 0x00007f1c80fc0dde in serde::de::{impl#5}::deserialize<wgpu_core::id::Id<wgpu_core::command::bundle::RenderBundle<wgpu_hal::empty::Api>>, &mut bincode::de::Deserializer<bincode::de::read::SliceReader, bincode::config::WithOtherLimit<bincode::config::WithOtherTrailing<bincode::config::WithOtherIntEncoding<bincode::config::DefaultOptions, bincode::config::int::FixintEncoding>, bincode::config::trailing::AllowTrailing>, bincode::config::limit::Infinite>>>

I've verified that RenderBundleEncoder::Finish returns a RenderBundle whose mId is zero.

Jim Blandy :jimb

Assignee

Comment 14

•

1 year ago

•

Edited

Attached file Stack trace with inline functions — Details

Here's a more complete stack trace, that includes inline functions.

Bugmon [:jkratzer for issues]

Comment 15

•

1 year ago

Testcase crashes using the initial build (mozilla-central 20220603093350-2f53c261903e) but not with tip (mozilla-central 20230421211246-38967ad7e8f2.)

The bug appears to have been fixed in the following build range:

Start: 07aa1efdf65fea586bf4d2a0c6a5a8620fd8cc96 (20230412184105)
End: 26012bc0b7fe3d60462f200f280b610b88a8f375 (20230412205820)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=07aa1efdf65fea586bf4d2a0c6a5a8620fd8cc96&tochange=26012bc0b7fe3d60462f200f280b610b88a8f375

jimb, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Flags: needinfo?(jimb)

Keywords: bugmon

Jim Blandy :jimb

Assignee

Comment 16

•

1 year ago

The bug is still present. Other changes have just updated WebGPU's IDL in a way that invalidates the test case. I'll attach an updated test case.

Flags: needinfo?(jimb)

Jim Blandy :jimb

Assignee

Comment 17

•

1 year ago

Attached file Updated test case, reproduces on 17ea6f29654b (2023-4-26) — Details

The original test case has been invalidated by updates to WebGPU's WebIDL, but the bug is still present.

Jason Kratzer [:jkratzer]

Reporter

Updated

•

1 year ago

Flags: needinfo?(jkratzer)

Jason Kratzer [:jkratzer]

Reporter

Updated

•

1 year ago

Flags: needinfo?(jkratzer)

Keywords: bugmon

Whiteboard: [bugmon:bisected,confirmed][fuzzblocker] → [bugmon:bisected,confirmed,origRev=17ea6f29654b][fuzzblocker]

Jason Kratzer [:jkratzer]

Reporter

Updated

•

1 year ago

Attachment #9279612 - Attachment is obsolete: true

Jim Blandy :jimb

Assignee

Comment 18

•

1 year ago

Fixing this depends on getting wgpu#3746 merged.

Jim Blandy :jimb

Assignee

Comment 19

•

1 year ago

Attached file Bug 1772557: Assign WebGPU RenderBundles ids even if encoding fails. r?#webgpu-reviewers — Details

In RenderBundleEncoder::Finish, never construct RenderBundles with
an id of zero, as this will cause a panic in the GPU process when we
deserialize command buffers that refer to such bundles.

Instead, assign the invalid RenderBundle an id, and report to the GPU
process that this id is associated with an error.

This patch depends on merging wgpu#3746:
https://github.com/gfx-rs/wgpu/pull/3746

Erich Gubler [:ErichDonGubler]

Comment 20

•

11 months ago

:jimb: I think this was fixed with one of the recent wgpu vendor update patches?

Jim Blandy :jimb

Assignee

Comment 21

•

11 months ago

Oh, yes, hg 2c0b7df71e57 brought in the fix for wgpu#3746, so I can land the Mozilla-Central side of this now.

Bugmon [:jkratzer for issues]

Comment 22

•

11 months ago

Bugmon was unable reproduce this issue.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Keywords: bugmon

Jason Kratzer [:jkratzer]

Reporter

Comment 23

•

11 months ago

A change to the Taskcluster build definitions over the weekend caused Bugmon to fail when reproducing issues. This issue has been corrected. Re-enabling bugmon.

Keywords: bugmon

Pulsebot

Comment 24

•

11 months ago

Pushed by jblandy@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/9e72228ed1e3
Assign WebGPU RenderBundles ids even if encoding fails. r=webgpu-reviewers,ErichDonGubler

Noemi Erli[:noemi_erli]

Comment 25

•

11 months ago

Backed out changeset 9e72228ed1e3 (Bug 1772557) for causing failures in test_too_many_color_attachments.html CLOSED TREE

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&collapsedPushes=842382&selectedTaskRun=bFDJYi6pSyqn84VeLB6HPA.0&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=9e72228ed1e3f61fbaf9bf4d179d6a25220f1912

Log: https://treeherder.mozilla.org/logviewer?job_id=419334888&repo=autoland&lineNumber=2737

Backout: https://hg.mozilla.org/integration/autoland/rev/4b1c6fc1fc0f3e664d546c4bf5c24f0c157bc2c5

Flags: needinfo?(jimb)

Jim Blandy :jimb

Assignee

Comment 26

•

11 months ago

Added fail-if directive for dom/webgpu/mochitest/test_too_many_color_attachments.html matching other tests in that directory.

Flags: needinfo?(jimb)

Pulsebot

Comment 27

•

11 months ago

Pushed by jblandy@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/46e2145e66dd
Assign WebGPU RenderBundles ids even if encoding fails. r=webgpu-reviewers,ErichDonGubler

Treeherder Bug Filer

Updated

•

11 months ago

Regressions: 1838551

Iulian Moraru

Comment 28

•

10 months ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/46e2145e66dd

Status: NEW → RESOLVED

Closed: 10 months ago

status-firefox116: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 116 Branch

Donal Meehan [:dmeehan]

Updated

•

10 months ago

status-firefox114: --- → disabled

status-firefox115: --- → disabled

Bugmon [:jkratzer for issues]

Comment 29

•

10 months ago

Verified bug as fixed on rev mozilla-central 20230615094111-6a3e55888810.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Status: RESOLVED → VERIFIED

status-firefox116: fixed → verified

Keywords: bugmon

Testcase 2 years ago Jason Kratzer [:jkratzer] 1.26 KB, text/plain		Details
Stack trace with inline functions 1 year ago Jim Blandy :jimb 24.49 KB, text/plain		Details
Updated test case, reproduces on 17ea6f29654b (2023-4-26) 1 year ago Jim Blandy :jimb 1.20 KB, text/html		Details
Bug 1772557: Assign WebGPU RenderBundles ids even if encoding fails. r?#webgpu-reviewers 1 year ago Jim Blandy :jimb 48 bytes, text/x-phabricator-request		Details \| Review