1790169 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: unexpected to be called), at /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:303

Status: VERIFIED FIXED

(Core :: Graphics: Canvas2D, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20220907-49a271c42001 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html --xvfb

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: unexpected to be called), at /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:303

#0 0x7f5c7b85aefa in mozilla::layers::RemoteTextureMap::GetRemoteTextureHost(mozilla::layers::RemoteTextureHostWrapper*) /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:303:9
#1 0x7f5c7b9c7d4e in mozilla::layers::RemoteTextureHostWrapper::CheckIsReadyForRendering() /builds/worker/checkouts/gecko/gfx/layers/composite/RemoteTextureHostWrapper.cpp:172:30
#2 0x7f5c7bac74df in mozilla::layers::WebRenderImageHost::UseRemoteTexture(mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>, mozilla::layers::TextureFlags) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderImageHost.cpp:125:11
#3 0x7f5c7b9e249b in mozilla::layers::CompositableParentManager::ReceiveCompositableUpdate(mozilla::layers::CompositableOperationDetail const&, mozilla::NotNull<mozilla::layers::CompositableHost*>, mozilla::layers::CompositableHandle const&) /builds/worker/checkouts/gecko/gfx/layers/ipc/CompositableTransactionParent.cpp:90:22
#4 0x7f5c7b9e1edf in mozilla::layers::CompositableParentManager::ReceiveCompositableUpdate(mozilla::layers::CompositableOperation const&) /builds/worker/checkouts/gecko/gfx/layers/ipc/CompositableTransactionParent.cpp:38:10
#5 0x7f5c7baa2a7c in mozilla::layers::WebRenderBridgeParent::ProcessWebRenderParentCommands(nsTArray<mozilla::layers::WebRenderParentCommand> const&, mozilla::wr::TransactionBuilder&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderBridgeParent.cpp:1497:14
#6 0x7f5c7baa2480 in mozilla::layers::WebRenderBridgeParent::ProcessDisplayListData(mozilla::layers::DisplayListData&, mozilla::wr::Epoch, mozilla::TimeStamp const&, bool, bool) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderBridgeParent.cpp:1161:18
#7 0x7f5c7baa34d2 in mozilla::layers::WebRenderBridgeParent::RecvSetDisplayList(mozilla::layers::DisplayListData&&, nsTArray<mozilla::layers::OpDestroy>&&, unsigned long const&, mozilla::layers::BaseTransactionId<mozilla::layers::TransactionIdType> const&, bool const&, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, nsTSubstring<char> const&, mozilla::TimeStamp const&, nsTArray<mozilla::layers::CompositionPayload>&&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderBridgeParent.cpp:1224:18
#8 0x7f5c7b8d8137 in mozilla::layers::PWebRenderBridgeParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PWebRenderBridgeParent.cpp:461:52
#9 0x7f5c7b89db05 in mozilla::layers::PCompositorManagerParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCompositorManagerParent.cpp:194:32
#10 0x7f5c7b29a1f1 in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1755:25
#11 0x7f5c7b296d45 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message> >) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1680:9
#12 0x7f5c7b2978e6 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1480:3
#13 0x7f5c7b298c71 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1578:14
#14 0x7f5c7a6bdeb7 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1199:16
#15 0x7f5c7a6c43fd in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:465:10
#16 0x7f5c7b2a0ef4 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:330:5
#17 0x7f5c7b1c5657 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#18 0x7f5c7b1c5562 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#19 0x7f5c7b1c5562 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#20 0x7f5c7a6b91e6 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:384:10
#21 0x7f5c9082d557 in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#22 0x7f5c915a7608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
#23 0x7f5c9116e132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Comment 1

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/Qng1IUIHqFugXiJKHk_kjA/index.html

Comment 2

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as reproducible on mozilla-central 20220909212835-b84775bfccf2.
The bug appears to have been introduced in the following build range:

Start: 3028c8c7847cc1be81d4bec6cad0481735610428 (20220906221951)
End: a827c7146c5f6a340d91a1f8763d7f6e0da68269 (20220907010100)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=3028c8c7847cc1be81d4bec6cad0481735610428&tochange=a827c7146c5f6a340d91a1f8763d7f6e0da68269

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1781740

:sotaro, since you are the author of the regressor, bug 1781740, could you take a look? Also, could you set the severity field?

For more information, please visit auto_nag documentation.

Comment 4

[Sotaro Ikeda [:sotaro]]

(In reply to Tyson Smith [:tsmith] from comment #1)
A Pernosco session is available here: https://pernos.co/debug/Qng1IUIHqFugXiJKHk_kjA/index.html

"[GFX3-]: Surface size too large (exceeds allocation limit)!" log was printed in the following function.

• DrawTargetWebgl::Init()
• BufferTextureData::Create()

BufferTextureData allocation of remote texture was failed because of the allocation size.

Comment 5

[Sotaro Ikeda [:sotaro]]

Attachment: Bug 1790169 - Add buffer size check to DrawTargetWebgl::Init()

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/94d3127c0fa7
Add buffer size check to DrawTargetWebgl::Init() r=lsalzman

Comment 7

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/94d3127c0fa7

Comment 8

[Bugmon [:jkratzer for issues]]

Bugmon Analysis
Verified bug as fixed on rev mozilla-central 20220913092817-c7037dbd2de3.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.