1874472 - Hit MOZ_CRASH(called `Result::unwrap()` on an `Err` value: InvalidQueue) at gfx/wgpu_bindings/src/server.rs:1034

Status: NEW

(Core :: Graphics: WebGPU, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20231119-c3021f5ece18 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(called Result::unwrap() on an Err value: InvalidQueue) at gfx/wgpu_bindings/src/server.rs:1034

33|0|xul.dll|RustMozCrash(char const*, int, char const*)|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/wrappers.cpp:44d7819ed2426592e789668b885b90ed9ae6eafa|17|0x23
33|1|xul.dll|core::ops::function::Fn::call<void (*)(ref$<core::panic::panic_info::PanicInfo>),tuple$<ref$<core::panic::panic_info::PanicInfo> > >(void (**)(core::panic::panic_info::PanicInfo*), core::panic::panic_info::PanicInfo*)|/rustc/82e1608dfa6e0b5569232559e3d385fea5a93112/library/core/src/ops/function.rs|79|0xd5
33|2|xul.dll|std::panicking::rust_panic_with_hook()|git:github.com/rust-lang/rust:library/std/src/panicking.rs:82e1608dfa6e0b5569232559e3d385fea5a93112|783|0x112
33|3|xul.dll|std::panicking::begin_panic_handler::closure$0()|git:github.com/rust-lang/rust:library/std/src/panicking.rs:82e1608dfa6e0b5569232559e3d385fea5a93112|657|0xb4
33|4|xul.dll|std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$>()|git:github.com/rust-lang/rust:library/std/src/sys_common/backtrace.rs:82e1608dfa6e0b5569232559e3d385fea5a93112|170|0x8
33|5|xul.dll|std::panicking::begin_panic_handler()|git:github.com/rust-lang/rust:library/std/src/panicking.rs:82e1608dfa6e0b5569232559e3d385fea5a93112|645|0x43
33|6|xul.dll|core::panicking::panic_fmt()|git:github.com/rust-lang/rust:library/core/src/panicking.rs:82e1608dfa6e0b5569232559e3d385fea5a93112|72|0x36
33|7|xul.dll|core::result::unwrap_failed()|git:github.com/rust-lang/rust:library/core/src/result.rs:82e1608dfa6e0b5569232559e3d385fea5a93112|1653|0x92
33|8|xul.dll|wgpu_bindings::server::wgpu_server_on_submitted_work_done(wgpu_bindings::server::Global*, wgpu_core::id::Id<wgpu_core::device::resource::Device<wgpu_hal::empty::Api> >, wgpu_core::device::queue::SubmittedWorkDoneClosureC)|hg:hg.mozilla.org/mozilla-central:gfx/wgpu_bindings/src/server.rs:44d7819ed2426592e789668b885b90ed9ae6eafa|1034|0x48e
33|9|xul.dll|mozilla::webgpu::WebGPUParent::RecvQueueOnSubmittedWorkDone(unsigned long long, std::function<void (mozilla::void_t)>&&)|hg:hg.mozilla.org/mozilla-central:dom/webgpu/ipc/WebGPUParent.cpp:44d7819ed2426592e789668b885b90ed9ae6eafa|810|0x18e
33|10|xul.dll|mozilla::webgpu::PWebGPUParent::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:85393181a5ffde4e11dad421efc07e4b2d0a109daeceeef2df974f8498d418981237b460d14bc23a53c2262639ae57ff6efb6f2728f15e8bd3022d48043d55e9/ipc/ipdl/PWebGPUParent.cpp:|1669|0x3f4e
33|11|xul.dll|mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:ceb7e64fd0ce42a1b22d5dca663dc7eec58f9d0d1c0297017155352960d2976033f040ffc48a59519bf00df63de5f50b982c61ee046d840411ab4a0fb1bf0a28/ipc/ipdl/PCanvasManagerParent.cpp:|279|0x35e
33|12|xul.dll|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:44d7819ed2426592e789668b885b90ed9ae6eafa|1813|0x14e
33|13|xul.dll|mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message,mozilla::DefaultDelete<IPC::Message> >)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:44d7819ed2426592e789668b885b90ed9ae6eafa|1732|0x2a7
33|14|xul.dll|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:44d7819ed2426592e789668b885b90ed9ae6eafa|1525|0x193
33|15|xul.dll|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:44d7819ed2426592e789668b885b90ed9ae6eafa|1623|0xdd
33|16|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:44d7819ed2426592e789668b885b90ed9ae6eafa|1193|0xa68
33|17|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:44d7819ed2426592e789668b885b90ed9ae6eafa|480|0x44
33|18|xul.dll|mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:44d7819ed2426592e789668b885b90ed9ae6eafa|330|0x124
33|19|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:44d7819ed2426592e789668b885b90ed9ae6eafa|363|0x4f
33|20|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:44d7819ed2426592e789668b885b90ed9ae6eafa|345|0x6e
33|21|xul.dll|nsThread::ThreadFunc(void*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:44d7819ed2426592e789668b885b90ed9ae6eafa|370|0x15a
33|22|nss3.dll|_PR_NativeRunThread(void*)|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/combined/pruthr.c:44d7819ed2426592e789668b885b90ed9ae6eafa|399|0x120
33|23|nss3.dll|pr_root(void*)|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/md/windows/w95thred.c:44d7819ed2426592e789668b885b90ed9ae6eafa|139|0x10
33|24|ucrtbase.dll||||
33|25|KERNELBASE.dll||||
33|26|kernel32.dll||||
33|27|mozglue.dll|patched_BaseThreadInitThunk(int, void*, void*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp:44d7819ed2426592e789668b885b90ed9ae6eafa|561|0x74
33|28|ntdll.dll||||
33|29|KERNELBASE.dll||||

Comment 1

[Mayank Bansal]

https://crash-stats.mozilla.org/report/index/1f8e875e-bd3f-4307-9736-8663e0240113#tab-bugzilla (crash from testcase)

Comment 2

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240112173417-734e2e027196.
The bug appears to have been introduced in the following build range:

Start: 776fbad509150f69418e1f44fa2580c651211253 (20230817214619)
End: c3eb980ed303634502f61048d3a2c98fdfe274b7 (20230817144545)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=776fbad509150f69418e1f44fa2580c651211253&tochange=c3eb980ed303634502f61048d3a2c98fdfe274b7

Comment 3

[Bob Hood [:bhood]]

WebGPU is as-yet unreleased, and locked to Nightly. Do we really need tracking on this?

Comment 4

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20231119091854-c3021f5ece18) but not with tip (mozilla-central 20240209214145-9c7562b79131.)

The bug appears to have been fixed in the following build range:

Start: f3efca74da0f43269bd8ac07e2a5d27e89c4d7c3 (20240123145016)
End: 936300bf2ee78e086143fb3718e2c0af755385b0 (20240123160955)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=f3efca74da0f43269bd8ac07e2a5d27e89c4d7c3&tochange=936300bf2ee78e086143fb3718e2c0af755385b0

tsmith, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 5

[Erich Gubler [:ErichDonGubler]]

Confirmed.