1860579 - Assertion failure: !Failed(), at /builds/worker/workspace/obj-build/dist/include/mozilla/ErrorResult.h:583

Status: RESOLVED DUPLICATE of bug 1859825

(Core :: Graphics: WebGPU, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev ffe93e4e0835 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build ffe93e4e0835 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Assertion failure: !Failed(), at /builds/worker/workspace/obj-build/dist/include/mozilla/ErrorResult.h:583

    ==275570==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f09353aecd9 bp 0x7ffc783145a0 sp 0x7ffc78314590 T275570)
    ==275570==The signal is caused by a WRITE memory access.
    ==275570==Hint: address points to the zero page.
        #0 0x7f09353aecd9 in AssertReportedOrSuppressed /builds/worker/workspace/obj-build/dist/include/mozilla/ErrorResult.h:583:5
        #1 0x7f09353aecd9 in mozilla::binding_danger::TErrorResult<mozilla::binding_danger::AssertAndSuppressCleanupPolicy>::~TErrorResult() /builds/worker/workspace/obj-build/dist/include/mozilla/ErrorResult.h:185:7
        #2 0x7f0938b21039 in mozilla::webgpu::Device::ResolveLost(mozilla::Maybe<mozilla::dom::GPUDeviceLostReason>, nsTSubstring<char16_t> const&) /dom/webgpu/Device.cpp:143:1
        #3 0x7f0938b44165 in mozilla::webgpu::WebGPUChild::ActorDestroy(mozilla::ipc::IProtocol::ActorDestroyReason) /dom/webgpu/ipc/WebGPUChild.cpp:1218:13
        #4 0x7f0936162830 in mozilla::ipc::IProtocol::DestroySubtree(mozilla::ipc::IProtocol::ActorDestroyReason) /ipc/glue/ProtocolUtils.cpp:626:3
        #5 0x7f09361627c7 in mozilla::ipc::IProtocol::DestroySubtree(mozilla::ipc::IProtocol::ActorDestroyReason) /ipc/glue/ProtocolUtils.cpp:614:14
        #6 0x7f0936bd3542 in mozilla::gfx::PCanvasManagerChild::OnChannelClose() /builds/worker/workspace/obj-build/ipc/ipdl/PCanvasManagerChild.cpp:597:5
        #7 0x7f093614a9db in mozilla::ipc::MessageChannel::Close() /ipc/glue/MessageChannel.cpp:2169:7
        #8 0x7f0936bb21a3 in Destroy /gfx/ipc/CanvasManagerChild.cpp:48:3
        #9 0x7f0936bb21a3 in mozilla::gfx::CanvasManagerChild::Shutdown() /gfx/ipc/CanvasManagerChild.cpp:61:16
        #10 0x7f0936aabd7f in gfxPlatform::ShutdownLayersIPC() /gfx/thebes/gfxPlatform.cpp:1331:5
        #11 0x7f09354d677d in mozilla::ShutdownXPCOM(nsIServiceManager*) /xpcom/build/XPCOMInit.cpp:617:5
        #12 0x7f093cbdcb2c in XRE_InitChildProcess(int, char**, XREChildData const*) /toolkit/xre/nsEmbedFunctions.cpp:660:16
        #13 0x55693c1f2276 in content_process_main /browser/app/../../ipc/contentproc/plugin-container.cpp:57:28
        #14 0x55693c1f2276 in main /browser/app/nsBrowserApp.cpp:375:18
        #15 0x7f0949883d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
        #16 0x7f0949883e3f in __libc_start_main csu/../csu/libc-start.c:392:3
        #17 0x55693c1c7fa8 in _start (/home/jkratzer/builds/m-c-20231022214411-fuzzing-debug/firefox-bin+0x58fa8) (BuildId: fda96b4782f9c87044d16e9f39c7fcc29fc69f23)
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/ErrorResult.h:583:5 in AssertReportedOrSuppressed
    ==275570==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20231023141548-0dce3814f2ad.
The bug appears to have been introduced in the following build range:

Start: e0dd0b10e8fd0ea751f11fb0a6548ad9b6780e16 (20231016153418)
End: fa12efd7ca249d06b27ea86690ae0d0478f5dcce (20231016182434)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=e0dd0b10e8fd0ea751f11fb0a6548ad9b6780e16&tochange=fa12efd7ca249d06b27ea86690ae0d0478f5dcce

Comment 3

[Erich Gubler [:ErichDonGubler]]

This looks relevant to Brad's recent work on device loss.

Comment 4

[Brad Werth [:bradwerth]]

This is fixed by the patch for Bug 1859825.

Comment 5

[Bugmon [:jkratzer for issues]]

No valid actions for resolution (DUPLICATE).
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.