1821432 - Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/id.rs:188

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebGPU, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20230126-b9c4ba784620 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Hit MOZ_CRASH(called Option::unwrap() on a None value) at /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/id.rs:188

#0 0x7fb7c846e105 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
#1 0x7fb7c846e105 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7fb7c846e07f in mozglue_static::panic_hook::hef68bc1b778da820 /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:91:9
#3 0x7fb7c846daab in core::ops::function::Fn::call::h42a394326fa8f33d /rustc/fc594f15669680fa70d255faec3ca3fb507c3405/library/core/src/ops/function.rs:161:5
#4 0x7fb7c941482c in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::ha7dbb2d260f78172 /rustc/fc594f15669680fa70d255faec3ca3fb507c3405/library/alloc/src/boxed.rs:2032:9
#5 0x7fb7c941482c in std::panicking::rust_panic_with_hook::hdb4da1ae79c845a5 /rustc/fc594f15669680fa70d255faec3ca3fb507c3405/library/std/src/panicking.rs:692:13
#6 0x7fb7c9414561 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h02b5b35b126d5cf2 /rustc/fc594f15669680fa70d255faec3ca3fb507c3405/library/std/src/panicking.rs:577:13
#7 0x7fb7c941198b in std::sys_common::backtrace::__rust_end_short_backtrace::h6c6853376cf416d1 /rustc/fc594f15669680fa70d255faec3ca3fb507c3405/library/std/src/sys_common/backtrace.rs:137:18
#8 0x7fb7c94142b1 in rust_begin_unwind /rustc/fc594f15669680fa70d255faec3ca3fb507c3405/library/std/src/panicking.rs:575:5
#9 0x7fb7c94706d2 in core::panicking::panic_fmt::hfd9e949092070b66 /rustc/fc594f15669680fa70d255faec3ca3fb507c3405/library/core/src/panicking.rs:64:14
#10 0x7fb7c94707ac in core::panicking::panic::h341545107301821d /rustc/fc594f15669680fa70d255faec3ca3fb507c3405/library/core/src/panicking.rs:111:5
#11 0x7fb7c772bcad in _$LT$wgpu_core..command..draw.._..$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..command..draw..RenderCommand$GT$..deserialize..__Visitor$u20$as$u20$serde..de..Visitor$GT$::visit_enum::hf21ec18054a48a85 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/command/draw.rs
#12 0x7fb7c772bcad in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_enum::h22fa2367992b066b /builds/worker/checkouts/gecko/third_party/rust/bincode/src/de/mod.rs:290:9
#13 0x7fb7c772bcad in wgpu_core::command::draw::_::_$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..command..draw..RenderCommand$GT$::deserialize::h30639d83aaa9d143 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/command/draw.rs:145:12
#14 0x7fb7c772bcad in _$LT$core..marker..PhantomData$LT$T$GT$$u20$as$u20$serde..de..DeserializeSeed$GT$::deserialize::hfd2fb0a1e7d7b9cf /builds/worker/checkouts/gecko/third_party/rust/serde/src/de/mod.rs:791:9
#15 0x7fb7c772bcad in _$LT$$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$..deserialize_tuple..Access$LT$R$C$O$GT$$u20$as$u20$serde..de..SeqAccess$GT$::next_element_seed::h2c4fd5b09bd726b2 /builds/worker/checkouts/gecko/third_party/rust/bincode/src/de/mod.rs:314:25
#16 0x7fb7c772bcad in serde::de::SeqAccess::next_element::h0083511447dd9fe6 /builds/worker/checkouts/gecko/third_party/rust/serde/src/de/mod.rs:1731:9
#17 0x7fb7c772bcad in _$LT$serde..de..impls..$LT$impl$u20$serde..de..Deserialize$u20$for$u20$alloc..vec..Vec$LT$T$GT$$GT$..deserialize..VecVisitor$LT$T$GT$$u20$as$u20$serde..de..Visitor$GT$::visit_seq::h7b38269c43aa4e06 /builds/worker/checkouts/gecko/third_party/rust/serde/src/de/impls.rs:1037:46
#18 0x7fb7c772bcad in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_tuple::h7f60ced0529e8951 /builds/worker/checkouts/gecko/third_party/rust/bincode/src/de/mod.rs:326:9
#19 0x7fb7c772bcad in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_seq::h123841a53fdf6ba7 /builds/worker/checkouts/gecko/third_party/rust/bincode/src/de/mod.rs:350:9
#20 0x7fb7c772bcad in serde::de::impls::_$LT$impl$u20$serde..de..Deserialize$u20$for$u20$alloc..vec..Vec$LT$T$GT$$GT$::deserialize::hb97b1f6c3cbf1d9e /builds/worker/checkouts/gecko/third_party/rust/serde/src/de/impls.rs:1048:9
#21 0x7fb7c772bcad in _$LT$core..marker..PhantomData$LT$T$GT$$u20$as$u20$serde..de..DeserializeSeed$GT$::deserialize::h4ad989fca98fcc5a /builds/worker/checkouts/gecko/third_party/rust/serde/src/de/mod.rs:791:9
#22 0x7fb7c772bcad in _$LT$$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$..deserialize_tuple..Access$LT$R$C$O$GT$$u20$as$u20$serde..de..SeqAccess$GT$::next_element_seed::h167b8c512e9b135a /builds/worker/checkouts/gecko/third_party/rust/bincode/src/de/mod.rs:314:25
#23 0x7fb7c772bcad in serde::de::SeqAccess::next_element::haad0846a9f603060 /builds/worker/checkouts/gecko/third_party/rust/serde/src/de/mod.rs:1731:9
#24 0x7fb7c772bcad in _$LT$wgpu_core..command.._..$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..command..BasePass$LT$C$GT$$GT$..deserialize..__Visitor$LT$C$GT$$u20$as$u20$serde..de..Visitor$GT$::visit_seq::h055ec25a90d3d050 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/command/mod.rs:270:12
#25 0x7fb7c772bcad in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_tuple::h6193539624aff56a /builds/worker/checkouts/gecko/third_party/rust/bincode/src/de/mod.rs:326:9
#26 0x7fb7c772bcad in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_struct::h119b40b0dda1d4f2 /builds/worker/checkouts/gecko/third_party/rust/bincode/src/de/mod.rs:411:9
#27 0x7fb7c772bcad in wgpu_core::command::_::_$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..command..BasePass$LT$C$GT$$GT$::deserialize::h709c54967ca43030 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/command/mod.rs:270:12
#28 0x7fb7c772bcad in _$LT$core..marker..PhantomData$LT$T$GT$$u20$as$u20$serde..de..DeserializeSeed$GT$::deserialize::h92bd5cea74dfff28 /builds/worker/checkouts/gecko/third_party/rust/serde/src/de/mod.rs:791:9
#29 0x7fb7c772bcad in _$LT$$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$..deserialize_tuple..Access$LT$R$C$O$GT$$u20$as$u20$serde..de..SeqAccess$GT$::next_element_seed::hbcfad204c795494c /builds/worker/checkouts/gecko/third_party/rust/bincode/src/de/mod.rs:314:25
#30 0x7fb7c772bcad in serde::de::SeqAccess::next_element::h6f5083eef35756fe /builds/worker/checkouts/gecko/third_party/rust/serde/src/de/mod.rs:1731:9
#31 0x7fb7c77f36b7 in _$LT$$LT$wgpu_core..device..trace.._..$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..device..trace..Command$GT$..deserialize..__Visitor$u20$as$u20$serde..de..Visitor$GT$..visit_enum..__Visitor$u20$as$u20$serde..de..Visitor$GT$::visit_seq::h4a748d93314d0aca /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/device/trace.rs:130:39
#32 0x7fb7c77f36b7 in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_tuple::h147c264ba1dd0794 /builds/worker/checkouts/gecko/third_party/rust/bincode/src/de/mod.rs:326:9
#33 0x7fb7c77f36b7 in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..VariantAccess$GT$::struct_variant::h19165aedc6f97925 /builds/worker/checkouts/gecko/third_party/rust/bincode/src/de/mod.rs:490:9
#34 0x7fb7c77f36b7 in _$LT$wgpu_core..device..trace.._..$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..device..trace..Command$GT$..deserialize..__Visitor$u20$as$u20$serde..de..Visitor$GT$::visit_enum::hbd65ab6db917f892 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/device/trace.rs:130:39
#35 0x7fb7c77f36b7 in _$LT$$RF$mut$u20$bincode..de..Deserializer$LT$R$C$O$GT$$u20$as$u20$serde..de..Deserializer$GT$::deserialize_enum::h69fc2607ed648a12 /builds/worker/checkouts/gecko/third_party/rust/bincode/src/de/mod.rs:290:9
#36 0x7fb7c77f36b7 in wgpu_core::device::trace::_::_$LT$impl$u20$serde..de..Deserialize$u20$for$u20$wgpu_core..device..trace..Command$GT$::deserialize::hb6032fe17fa713c5 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/device/trace.rs:130:39
#37 0x7fb7c77f36b7 in _$LT$core..marker..PhantomData$LT$T$GT$$u20$as$u20$serde..de..DeserializeSeed$GT$::deserialize::hef6393857e7baf93 /builds/worker/checkouts/gecko/third_party/rust/serde/src/de/mod.rs:791:9
#38 0x7fb7c77f36b7 in bincode::internal::deserialize_seed::h6c68a5ae8cc26929 /builds/worker/checkouts/gecko/third_party/rust/bincode/src/internal.rs:118:15
#39 0x7fb7c77f36b7 in bincode::internal::deserialize::h621891dd28f74fe2 /builds/worker/checkouts/gecko/third_party/rust/bincode/src/internal.rs:106:5
#40 0x7fb7c77f36b7 in bincode::config::Options::deserialize::h696b997ba80d6968 /builds/worker/checkouts/gecko/third_party/rust/bincode/src/config/mod.rs:200:9
#41 0x7fb7c77f36b7 in bincode::deserialize::h6c7fb3f0c779358b /builds/worker/checkouts/gecko/third_party/rust/bincode/src/lib.rs:181:5
#42 0x7fb7c77f36b7 in wgpu_server_command_encoder_action /builds/worker/checkouts/gecko/gfx/wgpu_bindings/src/server.rs:697:18
#43 0x7fb7c1ebf09e in mozilla::webgpu::WebGPUParent::RecvCommandEncoderAction(unsigned long, unsigned long, mozilla::ipc::ByteBuf const&) /builds/worker/checkouts/gecko/dom/webgpu/ipc/WebGPUParent.cpp:1059:3
#44 0x7fb7c1ed74ad in mozilla::webgpu::PWebGPUParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PWebGPUParent.cpp:462:80
#45 0x7fb7bfe19340 in mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCanvasManagerParent.cpp:214:32
#46 0x7fb7bf3ec6ba in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25
#47 0x7fb7bf3e9337 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
#48 0x7fb7bf3e9e65 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
#49 0x7fb7bf3eb19f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
#50 0x7fb7be799622 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1233:16
#51 0x7fb7be79f9ad in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:477:10
#52 0x7fb7bf3f38b2 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
#53 0x7fb7bf313fc8 in MessageLoop::RunInternal() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:381:10
#54 0x7fb7bf313ed1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:374:3
#55 0x7fb7bf313ed1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:356:3
#56 0x7fb7be7949c7 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:391:10
#57 0x7fb7d1985c86 in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#58 0x7fb7d222eb42 in start_thread nptl/pthread_create.c:442:8
#59 0x7fb7d22c09ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230309214328-8aea0e783414.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: 6f0a8dddad511ef68fae3a4ab07cc9336516cc3a (20220311094123)
End: b9c4ba78462076c06f3938d19954c88a9504d8fb (20230126094703)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jimb, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20230126094703-b9c4ba784620) but not with tip (mozilla-central 20230421211246-38967ad7e8f2.)

The bug appears to have been fixed in the following build range:

Start: 07aa1efdf65fea586bf4d2a0c6a5a8620fd8cc96 (20230412184105)
End: 26012bc0b7fe3d60462f200f280b610b88a8f375 (20230412205820)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=07aa1efdf65fea586bf4d2a0c6a5a8620fd8cc96&tochange=26012bc0b7fe3d60462f200f280b610b88a8f375

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 4

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Update test.

Comment 5

[Darkspirit]

bp-caccbf78-20cb-4b95-a852-cbe610230520

Comment 6

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20230519115028-225c5ab0d999.
Unable to bisect testcase (Testcase reproduces on start build!):

Start: e1d1107d438bbdad13a5c4f62911295ac8a16fcf (20220521094723)
End: b9c4ba78462076c06f3938d19954c88a9504d8fb (20230126094703)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Comment 7

[Bugmon [:jkratzer for issues]]

Bugmon was unable reproduce this issue.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 8

[Jason Kratzer [:jkratzer]]

A change to the Taskcluster build definitions over the weekend caused Bugmon to fail when reproducing issues. This issue has been corrected. Re-enabling bugmon.

Comment 9

[Jeff Muizelaar [:jrmuizel]]

I also saw this when running https://webgpu.github.io/webgpu-samples/samples/A-buffer

Comment 10

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20230126094703-b9c4ba784620) but not with tip (mozilla-central 20231027211343-ec7d4cb306bc.)

The bug appears to have been fixed in the following build range:

Start: 6013b7df2b9133416d4244ef4d45c492f215c3d0 (20231027130502)
End: cda838e04db16590f96ddeaa7d7d54cc80e12a03 (20231027135458)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=6013b7df2b9133416d4244ef4d45c492f215c3d0&tochange=cda838e04db16590f96ddeaa7d7d54cc80e12a03

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 11

[Erich Gubler [:ErichDonGubler]]

:jkratzner: I believe that would make this bug a dupe of 1856371, then. CC :nical.

Comment 12

[Tyson Smith [:tsmith]]

The attached test case no longer reproduces the issue. It was last reported by fuzzers targeting m-c 20231122-ed20a8b98a8f.