1811632 - Hit MOZ_CRASH(BindGroupLayout[2] does not exist) at /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/hub.rs:344

Status: RESOLVED DUPLICATE of bug 1821219

(Core :: Graphics: WebGPU, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20221125-9f4fd5a62c72 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Hit MOZ_CRASH(BindGroupLayout[2] does not exist) at /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/hub.rs:344

#0 0x7f37baca4345 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7f37baca4345 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7f37baca42c2 in mozglue_static::panic_hook::h54d936b166c9baa9 /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:91:9
#3 0x7f37baca3d8b in core::ops::function::Fn::call::hca13bd9519fdde34 /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/core/src/ops/function.rs:78:5
#4 0x7f37bbd6c9c8 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::h44df53ea2a13204b /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/alloc/src/boxed.rs:2001:9
#5 0x7f37bbd6c9c8 in std::panicking::rust_panic_with_hook::hfd45b6b6c12d9fa5 /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/panicking.rs:692:13
#6 0x7f37bbd6c746 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::hf591e8609a75bd4b /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/panicking.rs:579:13
#7 0x7f37bbd69a7b in std::sys_common::backtrace::__rust_end_short_backtrace::h81899558795e4ff7 /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/sys_common/backtrace.rs:137:18
#8 0x7f37bbd6c461 in rust_begin_unwind /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/std/src/panicking.rs:575:5
#9 0x7f37bbdc3122 in core::panicking::panic_fmt::h4235fa9b4675b332 /rustc/69f9c33d71c871fc16ac445211281c6e7a340943/library/core/src/panicking.rs:65:14
#10 0x7f37b9fdc2c2 in wgpu_core::hub::Storage$LT$T$C$I$GT$::get::hdd4212defb6e6abc /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/hub.rs:344:39
#11 0x7f37ba058c64 in wgpu_core::device::_$LT$impl$u20$wgpu_core..hub..Global$LT$G$GT$$GT$::device_create_bind_group::h30a78b395415a736 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/device/mod.rs:4360:43
#12 0x7f37ba058c64 in wgpu_bindings::server::Global::device_action::h8111992ae12d73d1 /builds/worker/checkouts/gecko/gfx/wgpu_bindings/src/server.rs:468:34
#13 0x7f37ba07510f in wgpu_server_device_action /builds/worker/checkouts/gecko/gfx/wgpu_bindings/src/server.rs:673:5
#14 0x7f37b49b4709 in mozilla::webgpu::WebGPUParent::RecvDeviceAction(unsigned long, mozilla::ipc::ByteBuf const&) /builds/worker/checkouts/gecko/dom/webgpu/ipc/WebGPUParent.cpp:1021:3
#15 0x7f37b49c88e6 in mozilla::webgpu::PWebGPUParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PWebGPUParent.cpp:239:80
#16 0x7f37b29587a0 in mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCanvasManagerParent.cpp:214:32
#17 0x7f37b1f7321a in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25
#18 0x7f37b1f6fe97 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
#19 0x7f37b1f709c5 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
#20 0x7f37b1f71cff in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
#21 0x7f37b1379ed8 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1191:16
#22 0x7f37b138013d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:477:10
#23 0x7f37b1f7a393 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:330:5
#24 0x7f37b1e9af18 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#25 0x7f37b1e9ae21 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#26 0x7f37b1e9ae21 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#27 0x7f37b13753d7 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:383:10
#28 0x7f37c425dc86 in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#29 0x7f37c4b06b42 in start_thread nptl/pthread_create.c:442:8
#30 0x7f37c4b989ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230122211034-4ffae7ad22de.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: e40a136dc8760f3fdd8a29fad47581d16d646c80 (20220124093541)
End: 9f4fd5a62c727c6622576b94cdd7b2d5190ebd7a (20221125092806)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jimb, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20221125092806-9f4fd5a62c72) but not with tip (mozilla-central 20230421211246-38967ad7e8f2.)

The bug appears to have been fixed in the following build range:

Start: 07aa1efdf65fea586bf4d2a0c6a5a8620fd8cc96 (20230412184105)
End: 26012bc0b7fe3d60462f200f280b610b88a8f375 (20230412205820)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=07aa1efdf65fea586bf4d2a0c6a5a8620fd8cc96&tochange=26012bc0b7fe3d60462f200f280b610b88a8f375

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 4

[Brad Werth [:bradwerth]]

This is fixed, probably by Bug 1821219.