1781961 - Large allocation [@ wgpu_core::device::Device$LT$A$GT$::create_bind_group_layout]

Status: VERIFIED FIXED

(Core :: Graphics: WebGPU, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20220725-823b580f3a92 (--enable-address-sanitizer --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -a --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

To help catch this issue ASAN_OPTIONS=max_allocation_size_mb=12288 was used. See Bug 1715316 for details about fuzzing triggered OOMs.

Hit MOZ_CRASH(out of memory: 0x000000064CB217D8 bytes requested) at src/memory/mozalloc/mozalloc_abort.cpp:35

==200809==WARNING: AddressSanitizer failed to allocate 0x64cb217d8 bytes
=================================================================
==200809==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x558b61885073 bp 0x7fd529a4b290 sp 0x7fd529a4b270 T30)
==200809==The signal is caused by a WRITE memory access.
==200809==Hint: address points to the zero page.
    #0 0x558b61885073 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
    #1 0x558b61885073 in mozalloc_abort src/memory/mozalloc/mozalloc_abort.cpp:35:3
    #2 0x558b618847c5 in mozalloc_handle_oom(unsigned long) src/memory/mozalloc/mozalloc_oom.cpp:51:3
    #3 0x7fd5634d93b6 in mozglue_static::oom_hook::hook::h50cf97f565b59932 src/mozglue/static/rust/lib.rs:115:13
    #4 0x7fd566be2307 in rust_oom (/home/user/workspace/browsers/m-c-20220725161534-fuzzing-asan-opt/libxul.so+0x21366307) (BuildId: d9c182f5e93a33763d381da570748e09908903f2)
    #5 0x7fd566c29756 in __rg_oom crtstuff.c
    #6 0x7fd566c293e6 in alloc::alloc::handle_alloc_error::rt_error::h0f0cef0b1f7fae80 (/home/user/workspace/browsers/m-c-20220725161534-fuzzing-asan-opt/libxul.so+0x213ad3e6) (BuildId: d9c182f5e93a33763d381da570748e09908903f2)
    #7 0x7fd566c29226 in core::ops::function::FnOnce::call_once::h0c14d51cbb5833de (.llvm.16445399339973007591) crtstuff.c
    #8 0x7fd566c291b5 in core::intrinsics::const_eval_select::hf0f7f377a4ede30b (.llvm.16445399339973007591) crtstuff.c
    #9 0x7fd54f1a42b5 in alloc::alloc::handle_alloc_error::h9af2e230ffc0d1dd (/home/user/workspace/browsers/m-c-20220725161534-fuzzing-asan-opt/libxul.so+0x99282b5) (BuildId: d9c182f5e93a33763d381da570748e09908903f2)
    #10 0x7fd54edd8292 in alloc::raw_vec::handle_reserve::h165690cd2c25365c /builds/worker/fetches/rust/library/alloc/src/raw_vec.rs:489:43
    #11 0x7fd54edd8292 in alloc::raw_vec::RawVec$LT$T$C$A$GT$::reserve::do_reserve_and_handle::h204f112c1871fa65 /builds/worker/fetches/rust/library/alloc/src/raw_vec.rs:285:13
    #12 0x7fd5606c57ad in alloc::raw_vec::RawVec$LT$T$C$A$GT$::reserve::heefe01b7b3944087 /builds/worker/fetches/rust/library/alloc/src/raw_vec.rs:289:13
    #13 0x7fd5606c57ad in alloc::vec::Vec$LT$T$C$A$GT$::reserve::h6784669cf3da7a43 /builds/worker/fetches/rust/library/alloc/src/vec/mod.rs:815:9
    #14 0x7fd5606c57ad in alloc::vec::Vec$LT$T$C$A$GT$::extend_with::h9e091e584a5d6d99 /builds/worker/fetches/rust/library/alloc/src/vec/mod.rs:2365:9
    #15 0x7fd5606c57ad in alloc::vec::Vec$LT$T$C$A$GT$::resize::h2f8d3f88f6fe7d59 /builds/worker/fetches/rust/library/alloc/src/vec/mod.rs:2221:13
    #16 0x7fd5606c57ad in wgpu_hal::vulkan::device::_$LT$impl$u20$wgpu_hal..Device$LT$wgpu_hal..vulkan..Api$GT$$u20$for$u20$wgpu_hal..vulkan..Device$GT$::create_bind_group_layout::h44526c8a616c39f8 src/third_party/rust/wgpu-hal/src/vulkan/device.rs:1074:17
    #17 0x7fd55fe17e89 in wgpu_core::device::Device$LT$A$GT$::create_bind_group_layout::h829f7ccc4b255e3f src/third_party/rust/wgpu-core/src/device/mod.rs:1552:13
    #18 0x7fd560107fd6 in wgpu_core::device::_$LT$impl$u20$wgpu_core..hub..Global$LT$G$GT$$GT$::device_create_bind_group_layout::h3248bc6aa19e28f7 src/third_party/rust/wgpu-core/src/device/mod.rs:4047:32
    #19 0x7fd560107fd6 in wgpu_bindings::server::Global::device_action::hafea540624c41ea9 src/gfx/wgpu_bindings/src/server.rs:435:34
    #20 0x7fd5601785a6 in wgpu_server_device_action src/gfx/wgpu_bindings/src/server.rs:652:5
    #21 0x7fd555947e96 in mozilla::webgpu::WebGPUParent::RecvDeviceAction(unsigned long, mozilla::ipc::ByteBuf const&) src/dom/webgpu/ipc/WebGPUParent.cpp:929:3
    #22 0x7fd555977a0e in mozilla::webgpu::PWebGPUParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PWebGPUParent.cpp:237:80
    #23 0x7fd552a37adc in mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCanvasManagerParent.cpp:214:32
    #24 0x7fd55178c079 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) src/ipc/glue/MessageChannel.cpp:1749:25
    #25 0x7fd5517890e7 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >) src/ipc/glue/MessageChannel.cpp:1674:9
    #26 0x7fd551789d34 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) src/ipc/glue/MessageChannel.cpp:1474:3
    #27 0x7fd55178afc2 in mozilla::ipc::MessageChannel::MessageTask::Run() src/ipc/glue/MessageChannel.cpp:1572:14
    #28 0x7fd55001073e in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1199:16
    #29 0x7fd55001a394 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:465:10
    #30 0x7fd551795131 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:330:5
    #31 0x7fd551613ba1 in RunInternal src/ipc/chromium/src/base/message_loop.cc:380:10
    #32 0x7fd551613ba1 in RunHandler src/ipc/chromium/src/base/message_loop.cc:373:3
    #33 0x7fd551613ba1 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:355:3
    #34 0x7fd550007888 in nsThread::ThreadFunc(void*) src/xpcom/threads/nsThread.cpp:384:10
    #35 0x7fd5772c8b7e in _pt_root src/nsprpub/pr/src/pthreads/ptthread.c:201:5
    #36 0x7fd577f06608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
    #37 0x7fd577acd132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3 in MOZ_Crash
Thread T30 (CanvasRenderer) created by T0 here:
    #0 0x558b618296ac in __interceptor_pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:208:3
    #1 0x7fd5772b8c2c in _PR_CreateThread src/nsprpub/pr/src/pthreads/ptthread.c:458:14
    #2 0x7fd5772a9fce in PR_CreateThread src/nsprpub/pr/src/pthreads/ptthread.c:533:12
    #3 0x7fd55000a805 in nsThread::Init(nsTSubstring<char> const&) src/xpcom/threads/nsThread.cpp:618:18
    #4 0x7fd550017c38 in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, unsigned int, nsIThread**) src/xpcom/threads/nsThreadManager.cpp:534:12
    #5 0x7fd550024099 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, unsigned int) src/xpcom/threads/nsThreadUtils.cpp:161:57
    #6 0x7fd552a03c7a in NS_NewNamedThread<15UL> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:74:10
    #7 0x7fd552a03c7a in mozilla::gfx::CanvasRenderThread::Start() src/gfx/ipc/CanvasRenderThread.cpp:41:17
    #8 0x7fd552889a18 in gfxPlatform::InitLayersIPC() src/gfx/thebes/gfxPlatform.cpp:1298:9
    #9 0x7fd552885f51 in gfxPlatform::Init() src/gfx/thebes/gfxPlatform.cpp:956:3
    #10 0x7fd5528895be in GetPlatform src/gfx/thebes/gfxPlatform.cpp:461:5
    #11 0x7fd5528895be in gfxPlatform::InitializeCMS() src/gfx/thebes/gfxPlatform.cpp:2067:9
    #12 0x7fd558826a9c in EnsureCMSInitialized /builds/worker/workspace/obj-build/dist/include/gfxPlatform.h:971:7
    #13 0x7fd558826a9c in gfxPlatform::GetCMSMode() /builds/worker/workspace/obj-build/dist/include/gfxPlatform.h:526:5
    #14 0x7fd55882603e in nsXPLookAndFeel::GetUncachedColor(mozilla::StyleSystemColor, mozilla::ColorScheme, mozilla::LookAndFeel::UseStandins) src/widget/nsXPLookAndFeel.cpp:926:9
    #15 0x7fd558825bd5 in nsXPLookAndFeel::GetColorValue(mozilla::StyleSystemColor, mozilla::ColorScheme, mozilla::LookAndFeel::UseStandins, unsigned int&) src/widget/nsXPLookAndFeel.cpp:906:17
    #16 0x7fd558829ee6 in mozilla::LookAndFeel::GetColor(mozilla::StyleSystemColor, mozilla::ColorScheme, mozilla::LookAndFeel::UseStandins) src/widget/nsXPLookAndFeel.cpp:1323:47
    #17 0x7fd558793f51 in Color /builds/worker/workspace/obj-build/dist/include/mozilla/LookAndFeel.h:440:12
    #18 0x7fd558793f51 in GetAccentColor src/widget/ThemeColors.cpp:90:7
    #19 0x7fd558793f51 in mozilla::widget::ThemeColors::RecomputeAccentColors() src/widget/ThemeColors.cpp:193:20
    #20 0x7fd558793b8d in mozilla::widget::Theme::LookAndFeelChanged() src/widget/Theme.cpp:180:3
    #21 0x7fd558823f6e in nsXPLookAndFeel::GetInstance() src/widget/nsXPLookAndFeel.cpp:383:3
    #22 0x7fd55882a9a5 in mozilla::LookAndFeel::GetThemeInfo(nsTSubstring<char>&) src/widget/nsXPLookAndFeel.cpp:1436:3
    #23 0x7fd54fe697ca in nsSystemInfo::Init() src/xpcom/base/nsSystemInfo.cpp:1047:5
    #24 0x7fd54ff826b2 in mozilla::xpcom::CreateInstanceImpl(mozilla::xpcom::ModuleID, nsID const&, void**) /builds/worker/workspace/obj-build/xpcom/components/StaticComponents.cpp:10004:7
    #25 0x7fd54ffbcd2e in CreateInstance src/xpcom/components/nsComponentManager.cpp:184:46
    #26 0x7fd54ffbcd2e in nsComponentManagerImpl::GetServiceLocked(mozilla::Maybe<mozilla::detail::BaseMonitorAutoLock<mozilla::Monitor> >&, (anonymous namespace)::EntryWrapper&, nsID const&, void**) src/xpcom/components/nsComponentManager.cpp:975:17
    #27 0x7fd54ffbd7f8 in nsComponentManagerImpl::GetService(mozilla::xpcom::ModuleID, nsID const&, void**) src/xpcom/components/nsComponentManager.cpp:1065:10
    #28 0x7fd54ffa370d in mozilla::xpcom::GetServiceHelper::operator()(nsID const&, void**) const /builds/worker/workspace/obj-build/xpcom/components/StaticComponents.cpp:12761:50
    #29 0x7fd54fe1fdf1 in nsCOMPtr_base::assign_from_helper(nsCOMPtr_helper const&, nsID const&) src/xpcom/base/nsCOMPtr.cpp:109:7
    #30 0x7fd551aa8ab1 in nsCOMPtr /builds/worker/workspace/obj-build/dist/include/nsCOMPtr.h:999:5
    #31 0x7fd551aa8ab1 in xpc::GetServiceImpl(JSContext*, mozilla::xpcom::JSServiceEntry const&, JS::MutableHandle<JSObject*>, mozilla::ErrorResult&) src/js/xpconnect/src/JSServices.cpp:83:32
    #32 0x7fd551aa8538 in xpc::GetService(JSContext*, mozilla::xpcom::JSServiceEntry const&, mozilla::ErrorResult&) src/js/xpconnect/src/JSServices.cpp:130:8
    #33 0x7fd551aa7461 in xpc::Services_Resolve(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, bool*) src/js/xpconnect/src/JSServices.cpp:153:25
    #34 0x7fd55de90d46 in CallResolveOp src/js/src/vm/NativeObject-inl.h:641:8
    #35 0x7fd55de90d46 in NativeLookupOwnPropertyInline<js::CanGC, js::LookupResolveMode::CheckResolve> src/js/src/vm/NativeObject-inl.h:753:14
    #36 0x7fd55de90d46 in NativeGetPropertyInline<js::CanGC> src/js/src/vm/NativeObject.cpp:2126:10
    #37 0x7fd55de90d46 in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) src/js/src/vm/NativeObject.cpp:2174:10
    #38 0x7fd55db3bc74 in GetProperty src/js/src/vm/ObjectOperations-inl.h:120:10
    #39 0x7fd55db3bc74 in js::GetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, js::PropertyName*, JS::MutableHandle<JS::Value>) src/js/src/vm/ObjectOperations-inl.h:127:10
    #40 0x7fd55f5fd1b3 in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) src/js/src/vm/Interpreter.cpp:4658:10
    #41 0x7fd55f5ceea5 in Interpret(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:2983:12
    #42 0x7fd55f5c9cd9 in js::RunScript(JSContext*, js::RunState&) src/js/src/vm/Interpreter.cpp:389:13
    #43 0x7fd55f5f6060 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) src/js/src/vm/Interpreter.cpp:536:13
    #44 0x7fd55f5f7afe in InternalCall src/js/src/vm/Interpreter.cpp:571:10
    #45 0x7fd55f5f7afe in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) src/js/src/vm/Interpreter.cpp:602:8
    #46 0x7fd55dcad934 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) src/js/src/vm/CallAndConstruct.cpp:53:10
    #47 0x7fd551aeec15 in nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) src/js/xpconnect/src/XPCWrappedJSClass.cpp:981:17
    #48 0x7fd550068922 in PrepareAndDispatch src/xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_linux.cpp:115:37
    #49 0x7fd550067672 in SharedStub xptcstubs_x86_64_linux.cpp
    #50 0x7fd54ffb65bd in NS_CreateServicesFromCategory(char const*, nsISupports*, char const*, char16_t const*) src/xpcom/components/nsCategoryManager.cpp:682:19
    #51 0x7fd55d7f8bd9 in nsXREDirProvider::DoStartup() src/toolkit/xre/nsXREDirProvider.cpp:958:11
    #52 0x7fd55d7d0480 in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:5443:18
    #53 0x7fd55d7d2d4e in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:5894:8
    #54 0x7fd55d7d3acb in XRE_main(int, char**, mozilla::BootstrapConfig const&) src/toolkit/xre/nsAppRunner.cpp:5962:21
    #55 0x558b6187e931 in do_main(int, char**, char**) src/browser/app/nsBrowserApp.cpp:227:22
    #56 0x558b6187dc6e in main src/browser/app/nsBrowserApp.cpp:414:16
    #57 0x7fd5779d2082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

Comment 1

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220801153341-bc1d41e88ae3.
The bug appears to have been introduced in the following build range:

Start: 60c6b98b954e8d31353f9934e4b7c1581fd07d37 (20210903164901)
End: ef5dc3e04e5f271eea0636ab3a495e95cc912f1d (20210903165630)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=60c6b98b954e8d31353f9934e4b7c1581fd07d37&tochange=ef5dc3e04e5f271eea0636ab3a495e95cc912f1d

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Setting regressed_by field after analyzing regression range found by bugmon.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1726626

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jimb, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1726626

Comment 6

[Tyson Smith [:tsmith]]

This also appears to have been fixed by bug 1791297.

Last reported while fuzzing m-c 20220918-95d4708dc680.

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220922214429-4ce68ee50da2.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.