1793526 - Assertion failure: gl->IsCurrent(), at /builds/worker/checkouts/gecko/dom/canvas/WebGLRenderbuffer.cpp:27

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect, P1)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20220930-8d15b6719c22 (--enable-debug --enable-fuzzing). This was found with a x86 Windows build.

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: gl->IsCurrent(), at /builds/worker/checkouts/gecko/dom/canvas/WebGLRenderbuffer.cpp:27

0|0|xul.dll|mozilla::WebGLRenderbuffer::WebGLRenderbuffer(mozilla::WebGLContext*)|hg:hg.mozilla.org/mozilla-central:dom/canvas/WebGLRenderbuffer.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|48|0x249
0|1|xul.dll|mozilla::WebGLContext::CreateRenderbuffer()|hg:hg.mozilla.org/mozilla-central:dom/canvas/WebGLContextGL.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|1427|0x73
0|2|xul.dll|mozilla::HostWebGLContext::CreateRenderbuffer(unsigned long long)|hg:hg.mozilla.org/mozilla-central:dom/canvas/HostWebGLContext.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|155|0x50
0|3|xul.dll|mozilla::ClientWebGLContext::Run<void (mozilla::HostWebGLContext::*)(unsigned long long) __attribute__((thiscall)),&mozilla::HostWebGLContext::CreateRenderbuffer,const unsigned long long &>(unsigned long long const&) const|hg:hg.mozilla.org/mozilla-central:dom/canvas/ClientWebGLContext.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|350|0x4a
0|4|xul.dll|mozilla::ClientWebGLContext::CreateRenderbuffer() const|hg:hg.mozilla.org/mozilla-central:dom/canvas/ClientWebGLContext.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|1278|0xf0
0|5|xul.dll|mozilla::dom::WebGLRenderingContext_Binding::createRenderbuffer(JSContext*, JS::Handle<JSObject *>, void*, JSJitMethodCallArgs const&)|s3:gecko-generated-sources:a52feeac3d08fde8fed5f30ca8494add433c2d4031a2f9bca8fe774191cb961b6fd79728fa1bd66e3fb37cfc0f13d37f36b81cc0dad4e96f25689a232113d824/dom/bindings/WebGLRenderingContextBinding.cpp:|16936|0x78
0|6|xul.dll|mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy,mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|3287|0x18d
0|7|xul.dll|CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|459|0xc5
0|8|xul.dll|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|547|0x24f
0|9|xul.dll|InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|614|0x54
0|10|xul.dll|Interpret(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|3375|0x7704
0|11|xul.dll|js::RunScript(JSContext*, js::RunState&)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|431|0x1e2
0|12|xul.dll|js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|579|0x267
0|13|xul.dll|InternalCall(JSContext*, js::AnyInvokeArgs const&, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|614|0x54
0|14|xul.dll|js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason)|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|646|0x10b
0|15|xul.dll|JS::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>)|hg:hg.mozilla.org/mozilla-central:js/src/vm/CallAndConstruct.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|117|0x1dc
0|16|xul.dll|mozilla::dom::EventHandlerNonNull::Call(mozilla::dom::BindingCallContext&, JS::Handle<JS::Value>, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&)|s3:gecko-generated-sources:95dfd3b3ce19d33aab012fb3f81f744c99d0ff59173e79d115daa6f34215ae333d7cc5289f11e404db7509fcfe5f293575dff53179ee199d2f82841995248780/dom/bindings/EventHandlerBinding.cpp:|65|0x225
0|17|xul.dll|mozilla::dom::EventHandlerNonNull::Call<nsCOMPtr<mozilla::dom::EventTarget> >(nsCOMPtr<mozilla::dom::EventTarget> const&, mozilla::dom::Event&, JS::MutableHandle<JS::Value>, mozilla::ErrorResult&, char const*, mozilla::dom::CallbackObject::ExceptionHandling, JS::Realm*)|s3:gecko-generated-sources:c5f8921fd86ed58b783b0a6344adf9d2ae1f0bdd0f3e1cdb482196f05e904ff6b9a6d6f05905eb5c591c162f9c8693243d92775198195dcf2a59cf9012f9cf29/dist/include/mozilla/dom/EventHandlerBinding.h:|82|0x15d
0|18|xul.dll|mozilla::JSEventHandler::HandleEvent(mozilla::dom::Event*)|hg:hg.mozilla.org/mozilla-central:dom/events/JSEventHandler.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|201|0x51a
0|19|xul.dll|mozilla::EventListenerManager::HandleEventSubType(mozilla::EventListenerManager::Listener*, mozilla::dom::Event*, mozilla::dom::EventTarget*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|1315|0x12a
0|20|xul.dll|mozilla::EventListenerManager::HandleEventInternal(nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event**, mozilla::dom::EventTarget*, nsEventStatus*, bool)|hg:hg.mozilla.org/mozilla-central:dom/events/EventListenerManager.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|1505|0x639
0|21|xul.dll|mozilla::EventTargetChainItem::HandleEvent(mozilla::EventChainPostVisitor&, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|348|0x1c4
0|22|xul.dll|mozilla::EventTargetChainItem::HandleEventTargetChain(nsTArray<mozilla::EventTargetChainItem>&, mozilla::EventChainPostVisitor&, mozilla::EventDispatchingCallback*, mozilla::ELMCreationDetector&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|550|0x5a7
0|23|xul.dll|mozilla::EventDispatcher::Dispatch(nsISupports*, nsPresContext*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsEventStatus*, mozilla::EventDispatchingCallback*, nsTArray<mozilla::dom::EventTarget *>*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|1119|0x15fd
0|24|xul.dll|mozilla::EventDispatcher::DispatchDOMEvent(nsISupports*, mozilla::WidgetEvent*, mozilla::dom::Event*, nsPresContext*, nsEventStatus*)|hg:hg.mozilla.org/mozilla-central:dom/events/EventDispatcher.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|1236|0xe8
0|25|xul.dll|nsINode::DispatchEvent(mozilla::dom::Event&, mozilla::dom::CallerType, mozilla::ErrorResult&)|hg:hg.mozilla.org/mozilla-central:dom/base/nsINode.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|1373|0xdc
0|26|xul.dll|mozilla::dom::EventTarget::DispatchEvent(mozilla::dom::Event&)|hg:hg.mozilla.org/mozilla-central:dom/events/EventTarget.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|180|0x4e
0|27|xul.dll|mozilla::AsyncEventDispatcher::Run()|hg:hg.mozilla.org/mozilla-central:dom/events/AsyncEventDispatcher.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|69|0x17a
0|28|xul.dll|mozilla::SchedulerGroup::Runnable::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|140|0x54
0|29|xul.dll|mozilla::RunnableTask::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|538|0xef
0|30|xul.dll|mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|851|0xa0b
0|31|xul.dll|mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex &> const&)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|683|0x27
0|32|xul.dll|mozilla::TaskController::ProcessPendingMTTask(bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/TaskController.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|461|0x45
0|33|xul.dll|mozilla::detail::RunnableFunction<`lambda at /builds/worker/checkouts/gecko/xpcom/threads/TaskController.cpp:187:7'>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:8d15b6719c225ba8f7916c2103f9211fc56d75b6|531|0x13
0|34|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|1205|0x910
0|35|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|465|0x40
0|36|xul.dll|mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|85|0xaf
0|37|xul.dll|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8d15b6719c225ba8f7916c2103f9211fc56d75b6|381|0x82
0|38|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8d15b6719c225ba8f7916c2103f9211fc56d75b6|374|0x72
0|39|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8d15b6719c225ba8f7916c2103f9211fc56d75b6|356|0x57
0|40|xul.dll|nsBaseAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|150|0x24
0|41|xul.dll|nsAppShell::Run()|hg:hg.mozilla.org/mozilla-central:widget/windows/nsAppShell.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|614|0x290
0|42|xul.dll|XRE_RunAppShell()|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|880|0x60
0|43|xul.dll|mozilla::ipc::MessagePumpForChildProcess::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|235|0x37
0|44|xul.dll|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8d15b6719c225ba8f7916c2103f9211fc56d75b6|381|0x82
0|45|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8d15b6719c225ba8f7916c2103f9211fc56d75b6|374|0x72
0|46|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8d15b6719c225ba8f7916c2103f9211fc56d75b6|356|0x57
0|47|xul.dll|XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|739|0x9bc
0|48|xul.dll|mozilla::BootstrapImpl::XRE_InitChildProcess(int, char**, XREChildData const*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/Bootstrap.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|67|0x10
0|49|firefox.exe|NS_internal_main(int, char**, char**)|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|359|0x74a
0|50|firefox.exe|wmain(int, wchar_t**)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsWindowsWMain.cpp:8d15b6719c225ba8f7916c2103f9211fc56d75b6|167|0x303
0|51|firefox.exe|__scrt_common_main_seh()|/builds/worker/workspace/obj-build/browser/app/d:/agent/_work/3/s/src/vctools/crt/vcstartup/src/startup/exe_common.inl|288|0xf9
0|52|kernel32.dll||||
0|53|ntdll.dll||||
0|54|ntdll.dll||||

Comment 1

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:jgilbert, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Kelsey Gilbert [:jgilbert]]

Attachment: Bug 1793526 - Remove IsCurrent checks in webgl code.

Webgl uses mImplicitMakeCurrent these days, so don't worry about it
directly.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/287d48c59023
Remove IsCurrent checks in webgl code. r=gfx-reviewers,lsalzman

Comment 4

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/287d48c59023