1888175 - Hit MOZ_CRASH(Texture[Id(1,1,d3d12)] does not exist) at /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/storage.rs:110

Status: RESOLVED FIXED

(Core :: Graphics: WebGPU, defect, P1)

Description

[Tyson Smith [:tsmith]]

Found while fuzzing m-c 20240322-5d6efea5e0bb (--enable-debug --enable-fuzzing)

This issue is being reported frequently but is not reliably reproducible. A reduced test case is unavailable at this time.

Hit MOZ_CRASH(Texture[Id(1,1,d3d12)] does not exist) at /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/storage.rs:110

#0 0x7ff8d9180fe7 in AnnotateMozCrashReason /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:55
#1 0x7ff8d9180fe7 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:316
#2 0x7ff8d9180fe7 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:17
#3 0x7ff8d723f32f in mozglue_static::panic_hook /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:96
#4 0x7ff8d723f32f in core::ops::function::FnOnce::call_once /rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\ops\function.rs:250
#5 0x7ff8d723f32f in core::ops::function::FnOnce::call_once<void (*)(ref$<core::panic::panic_info::PanicInfo>),tuple$<ref$<core::panic::panic_info::PanicInfo> > > /rustc/aedd173a2c086e558c2b66d3743b344f977621a7\library\core\src\ops\function.rs:79
#6 0x7ff8d7534fa7 in alloc::boxed::impl$49::call /rustc/aedd173a2c086e558c2b66d3743b344f977621a7/library\alloc\src\boxed.rs:2029
#7 0x7ff8d7534fa7 in std::panicking::rust_panic_with_hook /rustc/aedd173a2c086e558c2b66d3743b344f977621a7/library\std\src\panicking.rs:785
#8 0x7ff8d7534e28 in std::panicking::begin_panic_handler::closure$0 /rustc/aedd173a2c086e558c2b66d3743b344f977621a7/library\std\src\panicking.rs:659
#9 0x7ff8d7534d68 in std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$> /rustc/aedd173a2c086e558c2b66d3743b344f977621a7/library\std\src\sys_common\backtrace.rs:171
#10 0x7ff8d7534d55 in std::panicking::begin_panic_handler /rustc/aedd173a2c086e558c2b66d3743b344f977621a7/library\std\src\panicking.rs:647
#11 0x7ff8d99dea96 in core::panicking::panic_fmt /rustc/aedd173a2c086e558c2b66d3743b344f977621a7/library\core\src\panicking.rs:72
#12 0x7ff8d7c05829 in wgpu_core::storage::Storage<wgpu_core::resource::Buffer<wgpu_hal::dx12::Api> >::get<wgpu_core::resource::Buffer<wgpu_hal::dx12::Api> > /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/storage.rs:110
#13 0x7ff8d7ca676e in wgpu_core::storage::Storage<wgpu_core::resource::Texture<wgpu_hal::dx12::Api> >::get_owned /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/storage.rs:125
#14 0x7ff8d7ca676e in wgpu_core::registry::Registry<wgpu_core::resource::Texture<wgpu_hal::dx12::Api> >::get /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/registry.rs:133
#15 0x7ff8d7ca676e in wgpu_core::global::Global::command_encoder_copy_texture_to_texture /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/command/transfer.rs:1102
#16 0x7ff8d7ca676e in wgpu_bindings::server::Global::command_encoder_action<wgpu_hal::dx12::Api> /builds/worker/checkouts/gecko/gfx/wgpu_bindings/src/server.rs:939
#17 0x7ff8d7c9abc3 in wgpu_server_command_encoder_action /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/lib.rs:294
#18 0x7ff8cdbb8ba6 in mozilla::webgpu::WebGPUParent::RecvCommandEncoderAction(unsigned __int64, unsigned __int64, class mozilla::ipc::ByteBuf const &) /builds/worker/checkouts/gecko/dom/webgpu/ipc/WebGPUParent.cpp:1358
#19 0x7ff8cdbe0c4c in mozilla::webgpu::PWebGPUParent::OnMessageReceived(class IPC::Message const &) /builds/worker/workspace/obj-build/ipc/ipdl/PWebGPUParent.cpp:492
#20 0x7ff8ca2adc35 in mozilla::gfx::PCanvasManagerParent::OnMessageReceived(class IPC::Message const &) /builds/worker/workspace/obj-build/ipc/ipdl/PCanvasManagerParent.cpp:290
#21 0x7ff8c8e13e5f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(class mozilla::ipc::ActorLifecycleProxy *, class IPC::Message const &) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1818
#22 0x7ff8c8e11631 in mozilla::ipc::MessageChannel::DispatchMessage(class mozilla::ipc::ActorLifecycleProxy *, class mozilla::UniquePtr<class IPC::Message, class mozilla::DefaultDelete<class IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1737
#23 0x7ff8c8e124cd in mozilla::ipc::MessageChannel::RunMessage(class mozilla::ipc::ActorLifecycleProxy *, class mozilla::ipc::MessageChannel::MessageTask &) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1530
#24 0x7ff8c8e12c31 in mozilla::ipc::MessageChannel::MessageTask::Run(void) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1628
#25 0x7ff8c76a13f6 in nsThread::ProcessNextEvent(bool, bool *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1193
#26 0x7ff8c76b2a5a in NS_ProcessNextEvent(class nsIThread *, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480
#27 0x7ff8c8e1d39b in mozilla::ipc::MessagePumpForNonMainThreads::Run(class base::MessagePump::Delegate *) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300
#28 0x7ff8c8d29263 in MessageLoop::RunInternal /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:370
#29 0x7ff8c8d29263 in MessageLoop::RunHandler(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363
#30 0x7ff8c8d2902a in MessageLoop::Run(void) /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345
#31 0x7ff8c769777d in nsThread::ThreadFunc(void *) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:370
#32 0x7ff8eee2b277 in _PR_NativeRunThread /builds/worker/checkouts/gecko/nsprpub/pr/src/threads/combined/pruthr.c:399
#33 0x7ff8eee0360c in pr_root /builds/worker/checkouts/gecko/nsprpub/pr/src/md/windows/w95thred.c:139
#34 0x7ff90cea6b4b  (C:\Windows\System32\ucrtbase.dll+0x180026b4b)
#35 0x7ff8f7bc0715 in __asan::AsanThread::ThreadStart(unsigned __int64) /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_thread.cpp:291
#36 0x12efdba5002e  (<unknown module>)
#37 0x8db95ffa7f  (<unknown module>)
#38 0x7ff8f7bc225e in CreateThread (C:\Users\task_171154134995355\builds\m-c-20240327093620-fuzzing-asan-opt\clang_rt.asan_dynamic-x86_64.dll+0x18005225e)
#39 0x2f  (<unknown module>)
#40 0x8db95ff9f7  (<unknown module>)
#41 0x8db95ffa7f  (<unknown module>)
#42 0x7ff8fd597e7e in mozilla::interceptor::FuncHook<mozilla::interceptor::WindowsDllInterceptor<mozilla::interceptor::VMSharingPolicyShared>,void (*)(int, void *, void *)>::operator() /builds/worker/checkouts/gecko/toolkit/xre/dllservices/mozglue/nsWindowsDllInterceptor.h:150
#43 0x7ff8fd597e7e in patched_BaseThreadInitThunk /builds/worker/checkouts/gecko/toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp:558
#44 0x7ff90f73e8aa  (C:\Windows\SYSTEM32\ntdll.dll+0x18007e8aa)

Comment 1

[Erich Gubler [:ErichDonGubler]]

S3 is appropriate, because WebGPU isn't shipped yet. This may, however, be indicative of needing a higher priority.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

This bug prevents fuzzing from making progress; however, it has low severity. It is important for fuzz blocker bugs to be addressed in a timely manner (see here why?).
:jimb, could you consider increasing the severity?

For more information, please visit BugBot documentation.

Comment 3

[Jim Blandy :jimb]

(In reply to BugBot [:suhaib / :marco/ :calixte] from comment #2)

This bug prevents fuzzing from making progress; however, it has low severity. It is important for fuzz blocker bugs to be addressed in a timely manner (see here why?).
:jimb, could you consider increasing the severity?

See comment 1.

Comment 4

[Erich Gubler [:ErichDonGubler]]

:tsmith, we on the WebGPU team suspect that the resolution to bug 1888178 might also resolve this. Can you confirm whether this has reproduced since 1ddf59a206f4?

Comment 5

[Tyson Smith [:tsmith]]

This appears to be the case. This issue was first reported while fuzzing m-c 5d6efea5e0bb and last reported m-c f697ba433dda.