1808818 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: unexpected to be called), at /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:476

Status: VERIFIED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20221120-d2c628738330 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: unexpected to be called), at /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:476

#0 0x7fbb477f9f88 in mozilla::layers::RemoteTextureMap::GetRemoteTextureForDisplayList(mozilla::layers::RemoteTextureHostWrapper*) /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:476:9
#1 0x7fbb479599c3 in mozilla::layers::RemoteTextureHostWrapper::CheckIsReadyForRendering() /builds/worker/checkouts/gecko/gfx/layers/composite/RemoteTextureHostWrapper.cpp:189:30
#2 0x7fbb47a5b73d in mozilla::layers::WebRenderImageHost::UseRemoteTexture(mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, int, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>, mozilla::layers::TextureFlags) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderImageHost.cpp:133:11
#3 0x7fbb479734fa in mozilla::layers::CompositableParentManager::ReceiveCompositableUpdate(mozilla::layers::CompositableOperationDetail const&, mozilla::NotNull<mozilla::layers::CompositableHost*>, mozilla::layers::CompositableHandle const&) /builds/worker/checkouts/gecko/gfx/layers/ipc/CompositableTransactionParent.cpp:90:22
#4 0x7fbb47972f65 in mozilla::layers::CompositableParentManager::ReceiveCompositableUpdate(mozilla::layers::CompositableOperation const&) /builds/worker/checkouts/gecko/gfx/layers/ipc/CompositableTransactionParent.cpp:38:10
#5 0x7fbb47a21bdc in mozilla::layers::WebRenderBridgeParent::ProcessWebRenderParentCommands(nsTArray<mozilla::layers::WebRenderParentCommand> const&, mozilla::wr::TransactionBuilder&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderBridgeParent.cpp:1495:14
#6 0x7fbb47a2165b in mozilla::layers::WebRenderBridgeParent::ProcessDisplayListData(mozilla::layers::DisplayListData&, mozilla::wr::Epoch, mozilla::TimeStamp const&, bool, bool) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderBridgeParent.cpp:1159:18
#7 0x7fbb47a22723 in mozilla::layers::WebRenderBridgeParent::RecvSetDisplayList(mozilla::layers::DisplayListData&&, nsTArray<mozilla::layers::OpDestroy>&&, unsigned long const&, mozilla::layers::BaseTransactionId<mozilla::layers::TransactionIdType> const&, bool const&, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, mozilla::TimeStamp const&, nsTSubstring<char> const&, mozilla::TimeStamp const&, nsTArray<mozilla::layers::CompositionPayload>&&) /builds/worker/checkouts/gecko/gfx/layers/wr/WebRenderBridgeParent.cpp:1222:18
#8 0x7fbb4786c83f in mozilla::layers::PWebRenderBridgeParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PWebRenderBridgeParent.cpp:461:52
#9 0x7fbb4783791a in mozilla::layers::PCompositorManagerParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCompositorManagerParent.cpp:194:32
#10 0x7fbb4722341a in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25
#11 0x7fbb47220097 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
#12 0x7fbb47220bc5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
#13 0x7fbb47221eff in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
#14 0x7fbb46632598 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1191:16
#15 0x7fbb46638a1d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:476:10
#16 0x7fbb4722a593 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:330:5
#17 0x7fbb4714ce28 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#18 0x7fbb4714cd31 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#19 0x7fbb4714cd31 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#20 0x7fbb4662da97 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:383:10
#21 0x7fbb593d3c86 in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#22 0x7fbb59c7cb42 in start_thread nptl/pthread_create.c:442:8
#23 0x7fbb59d0e9ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230106214742-7968ae37c117.
The bug appears to have been introduced in the following build range:

Start: 9dd268c4cf21f8bcbb1036af9572710623a33591 (20221011001249)
End: 5cbd3d92a78c54b324b6009a25d196adaa8a669b (20221011042303)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=9dd268c4cf21f8bcbb1036af9572710623a33591&tochange=5cbd3d92a78c54b324b6009a25d196adaa8a669b

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Based on comment #1, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:sotaro, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit auto_nag documentation.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1791693

Comment 4

[Sotaro Ikeda [:sotaro]]

Attachment: Bug 1808818 - Add RemoteTextureOwnerClient::PushDummyTexture() for handling remote texture allocation failure

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/539f28c1de72
Add RemoteTextureOwnerClient::PushDummyTexture() for handling remote texture allocation failure r=gfx-reviewers,lsalzman

Comment 6

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/539f28c1de72

Comment 7

[Bugmon [:jkratzer for issues]]

Bug marked as FIXED but still reproduces on mozilla-central 20230112041059-539f28c1de72. If you believe this to be incorrect, please remove the bugmon keyword to prevent further analysis.

Comment 8

[Sotaro Ikeda [:sotaro]]

assert failure was changed to the following.

Result: Assertion failure: mRemoteTextureForDisplayList, at /builds/worker/checkouts/gecko/gfx/layers/composite/RemoteTextureHostWrapper.cpp:190 (ec663283:8f36f31c)

Comment 9

[Sotaro Ikeda [:sotaro]]

Attachment: Bug 1808818 - Remove assert in RemoteTextureHostWrapper::CheckIsReadyForRendering()

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/dbc39370214d
Remove assert in RemoteTextureHostWrapper::CheckIsReadyForRendering() r=gfx-reviewers,lsalzman

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1791693

Comment 12

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/dbc39370214d

Comment 13

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230117161302-455aa95a34de.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.