1814533 - Assertion failure: IsRegistered(aOwnerId), at /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:68

Status: VERIFIED FIXED

(Core :: Graphics: WebGPU, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20230126-b9c4ba784620 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: IsRegistered(aOwnerId), at /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:68

#0 0x7fae8030df99 in mozilla::layers::RemoteTextureOwnerClient::PushTexture(mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, mozilla::UniquePtr<mozilla::layers::TextureData, mozilla::DefaultDelete<mozilla::layers::TextureData>>&&, std::shared_ptr<mozilla::gl::SharedSurface> const&) /builds/worker/checkouts/gecko/gfx/layers/RemoteTextureMap.cpp:68:3
#1 0x7fae82795b2f in mozilla::webgpu::PresentCallback(mozilla::webgpu::ffi::WGPUBufferMapAsyncStatus, unsigned char*) /builds/worker/checkouts/gecko/dom/webgpu/ipc/WebGPUParent.cpp:813:33
#2 0x7fae87ff0910 in wgpu_core::device::UserClosures::fire::h3a367c4a0f8f00e6 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/device/mod.rs:148:13
#3 0x7fae87f4375e in wgpu_core::device::_$LT$impl$u20$wgpu_core..hub..Global$LT$G$GT$$GT$::poll_all_devices::hc1001900d17195b9 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/device/mod.rs:5467:9
#4 0x7fae87f4375e in wgpu_server_poll_all_devices /builds/worker/checkouts/gecko/gfx/wgpu_bindings/src/server.rs:127:5
#5 0x7fae82796238 in mozilla::webgpu::WebGPUParent::ActorDestroy(mozilla::ipc::IProtocol::ActorDestroyReason) /builds/worker/checkouts/gecko/dom/webgpu/ipc/WebGPUParent.cpp:1014:3
#6 0x7fae7fd54450 in mozilla::ipc::IProtocol::DestroySubtree(mozilla::ipc::IProtocol::ActorDestroyReason) /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:585:3
#7 0x7fae7fd543e4 in mozilla::ipc::IProtocol::DestroySubtree(mozilla::ipc::IProtocol::ActorDestroyReason) /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:573:14
#8 0x7fae8071eef5 in mozilla::gfx::PCanvasManagerParent::OnChannelClose() /builds/worker/workspace/obj-build/ipc/ipdl/PCanvasManagerParent.cpp:471:5
#9 0x7fae7fd3ca1a in mozilla::ipc::MessageChannel::OnNotifyMaybeChannelError() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:2078:3
#10 0x7fae7fd5f6b8 in applyImpl<mozilla::ipc::MessageChannel, void (mozilla::ipc::MessageChannel::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1162:12
#11 0x7fae7fd5f6b8 in apply<mozilla::ipc::MessageChannel, void (mozilla::ipc::MessageChannel::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1168:12
#12 0x7fae7fd5f6b8 in mozilla::detail::RunnableMethodImpl<mozilla::ipc::MessageChannel*, void (mozilla::ipc::MessageChannel::*)(), false, (mozilla::RunnableKind)1>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1215:13
#13 0x7fae7f1381a8 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1191:16
#14 0x7fae7f13e40d in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:477:10
#15 0x7fae7fd42503 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:330:5
#16 0x7fae7fc62ec8 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#17 0x7fae7fc62dd1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#18 0x7fae7fc62dd1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#19 0x7fae7f1336a7 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:383:10
#20 0x7fae936e3c86 in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#21 0x7fae93f8cb42 in start_thread nptl/pthread_create.c:442:8
#22 0x7fae9401e9ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230201215112-b7f075124503.
The bug appears to have been introduced in the following build range:

Start: b1fa33ea226963e423b24648aef55f814fbb3648 (20221223200034)
End: dfbd00b278b023a3f187d55d8caf245f6a057ce4 (20221223222547)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=b1fa33ea226963e423b24648aef55f814fbb3648&tochange=dfbd00b278b023a3f187d55d8caf245f6a057ce4

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1805209

Comment 3

[Sotaro Ikeda [:sotaro]]

Attachment: Bug 1814533 - Add IsRegistered() check in PresentCallback()

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8b432bc4fad8
Add IsRegistered() check in PresentCallback() r=gfx-reviewers,lsalzman

Comment 5

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/8b432bc4fad8

Comment 6

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20230206154344-b06e825a4d81.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.