1860920 - Hit MOZ_CRASH(assertion failed: `(left == right)` left: `1`, right: `2`: Texture[0] is no longer alive) at /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/storage.rs:128

Status: RESOLVED DUPLICATE of bug 1860921

(Core :: Graphics: WebGPU, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20231024-bcdbc81d4adf (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Hit MOZ_CRASH(assertion failed: (left == right) left: 1, right: 2: Texture[0] is no longer alive) at /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/storage.rs:128

#0 0x7fefc7093e95 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:281:3
#1 0x7fefc7093e95 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x7fefc7093e2a in mozglue_static::panic_hook::habfbf582d66d5c86 /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:96:9
#3 0x7fefc709382b in core::ops::function::Fn::call::h081d0c2d4ea076dc /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/core/src/ops/function.rs:79:5
#4 0x7fefc81031ed in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::hb3a915ffd78277c6 /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/alloc/src/boxed.rs:2007:9
#5 0x7fefc81031ed in std::panicking::rust_panic_with_hook::h75cd912a39a34e8a /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/std/src/panicking.rs:709:13
#6 0x7fefc8102f76 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h1498b46f7849e167 /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/std/src/panicking.rs:597:13
#7 0x7fefc8100235 in std::sys_common::backtrace::__rust_end_short_backtrace::hd36a39b27b98086b /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/std/src/sys_common/backtrace.rs:151:18
#8 0x7fefc8102cc1 in rust_begin_unwind /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/std/src/panicking.rs:593:5
#9 0x7fefc81629a2 in core::panicking::panic_fmt::h98ef273141454c23 /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/core/src/panicking.rs:67:14
#10 0x7fefc8162f30 in core::panicking::assert_failed_inner::hb4b889049d545ac5 /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/core/src/panicking.rs
#11 0x7fefc616a996 in core::panicking::assert_failed::hd7547e58e00367b3 /rustc/d5c2e9c342b358556da91d61ed4133f6f50fc0c3/library/core/src/panicking.rs:229:5
#12 0x7fefc6221d71 in wgpu_core::storage::Storage$LT$T$C$I$GT$::get_mut::h537edeff8ff6ce63 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/storage.rs:128:9
#13 0x7fefc6265f7d in wgpu_core::device::queue::_$LT$impl$u20$wgpu_core..global..Global$LT$G$GT$$GT$::queue_write_texture::ha9f54ea04e7f0777 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/device/queue.rs:633:19
#14 0x7fefc6265f7d in wgpu_server_queue_write_action /builds/worker/checkouts/gecko/gfx/wgpu_bindings/src/server.rs:1000:13
#15 0x7fefc043b379 in mozilla::webgpu::WebGPUParent::RecvQueueWriteAction(unsigned long, unsigned long, mozilla::ipc::ByteBuf const&, mozilla::ipc::UnsafeSharedMemoryHandle&&) /builds/worker/checkouts/gecko/dom/webgpu/ipc/WebGPUParent.cpp:798:3
#16 0x7fefc044cec3 in mozilla::webgpu::PWebGPUParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PWebGPUParent.cpp:1724:80
#17 0x7fefbe4ca47d in mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCanvasManagerParent.cpp:269:32
#18 0x7fefbda36f2f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1800:25
#19 0x7fefbda33c82 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
#20 0x7fefbda34902 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1525:3
#21 0x7fefbda35a4f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1623:14
#22 0x7fefbcd7eb3d in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1192:16
#23 0x7fefbcd85acd in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#24 0x7fefbda3e0e5 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:330:5
#25 0x7fefbd956e81 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#26 0x7fefbd956e81 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#27 0x7fefbcd79e23 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:370:10
#28 0x7fefd16d1d0f in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#29 0x7fefd1094ac2 in start_thread nptl/pthread_create.c:442:8
#30 0x7fefd1126a3f  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20231024215736-bfd2855924f2.
The bug appears to have been introduced in the following build range:

Start: ed9d130c38a8858740845db8ec5c8bb7e68cce65 (20231024004955)
End: bcdbc81d4adffb0c3b1e04e1854e43cf49314d92 (20231024050629)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=ed9d130c38a8858740845db8ec5c8bb7e68cce65&tochange=bcdbc81d4adffb0c3b1e04e1854e43cf49314d92

Comment 2

[Mayank Bansal]

got this crash : https://crash-stats.mozilla.org/report/index/4dc2a250-a1b6-4eb8-b0a7-bec620231025#tab-bugzilla

Comment 3

[Erich Gubler [:ErichDonGubler] (he/him)]

This looks related to Sotaro's recent work.

Comment 4

[Sotaro Ikeda [:sotaro]]

I take the bug.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1856787

Comment 7

[Bugmon [:jkratzer for issues]]

No valid actions for resolution (DUPLICATE).
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.