1904596 - Assertion failure: false (MOZ_ASSERT_UNREACHABLE: unexpected to be called), at /dom/webgpu/ipc/WebGPUParent.cpp:1139

Status: NEW

(Core :: Graphics: WebGPU, defect, P2)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 653f0dc8442d (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build 653f0dc8442d --debug --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla .\firefox\firefox.exe <bugid>

Assertion failure: false (MOZ_ASSERT_UNREACHABLE: unexpected to be called), at /dom/webgpu/ipc/WebGPUParent.cpp:1139

    r10 = 0x00007ffce7f90000	r11 = 0x00000027b0dfe0b0	r12 = 0x00000100000001b3
    r13 = 0x0000000000000000	r14 = 0x0000016fbbdfab80	r15 = 0x0000000000000004
     r8 = 0x000000000000000e	 r9 = 0x00007ffce811ebf8	rax = 0x00007ffc8791db8d
    rbp = 0x0000000000000000	rbx = 0x0000000000000001	rcx = 0x00007ffcc846a240
    rdi = 0x0000016fbfd8ae00	rdx = 0x0000000000000000	rip = 0x00007ffc81203050
    rsi = 0x00000027b0dff018	rsp = 0x00000027b0dfeb10
    OS|Windows NT|10.0.22631
    CPU|amd64|family 6 model 186 stepping 2|6
    Crash|EXCEPTION_BREAKPOINT|0x00007ffc81203050|8
    8|0|xul.dll|mozilla::webgpu::WebGPUParent::RecvSwapChainPresent(unsigned long long, unsigned long long, mozilla::layers::RemoteTextureId const&, mozilla::layers::RemoteTextureOwnerId const&)|hg:hg.mozilla.org/mozilla-central:dom/webgpu/ipc/WebGPUParent.cpp:653f0dc8442dd9cae70845896eb3c0a0252677b3|1139|0xc10
    8|1|xul.dll|mozilla::webgpu::PWebGPUParent::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:47bbe745ddd5d774c8b28b94a15a30d0c2b51d32236f2269b64c2209640d3d0d59f72a5cdded24a132809fa845b6b0208aa2a984c32c4fc16d8023e42d7fef95/ipc/ipdl/PWebGPUParent.cpp:|2336|0x58d8
    8|2|xul.dll|mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:2a09974927c3a9297526e05900b64346983c27d832ea0fdc24bf0c3d03516cee7b107272179c85b49898f6a5c0b677101d0d1c19d5df61b832cf87275f635380/ipc/ipdl/PCanvasManagerParent.cpp:|248|0x346
    8|3|xul.dll|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:653f0dc8442dd9cae70845896eb3c0a0252677b3|1820|0x14e
    8|4|xul.dll|mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message,mozilla::DefaultDelete<IPC::Message> >)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:653f0dc8442dd9cae70845896eb3c0a0252677b3|1739|0x2a4
    8|5|xul.dll|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:653f0dc8442dd9cae70845896eb3c0a0252677b3|1530|0x193
    8|6|xul.dll|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:653f0dc8442dd9cae70845896eb3c0a0252677b3|1630|0xdd
    8|7|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:653f0dc8442dd9cae70845896eb3c0a0252677b3|1198|0xb1e
    8|8|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:653f0dc8442dd9cae70845896eb3c0a0252677b3|480|0x6c
    8|9|xul.dll|mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:653f0dc8442dd9cae70845896eb3c0a0252677b3|300|0xd5
    8|10|xul.dll|MessageLoop::RunHandler()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:653f0dc8442dd9cae70845896eb3c0a0252677b3|363|0x4c
    8|11|xul.dll|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:653f0dc8442dd9cae70845896eb3c0a0252677b3|345|0x6e
    8|12|xul.dll|nsThread::ThreadFunc(void*)|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:653f0dc8442dd9cae70845896eb3c0a0252677b3|370|0x15a
    8|13|nss3.dll|_PR_NativeRunThread(void*)|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/combined/pruthr.c:653f0dc8442dd9cae70845896eb3c0a0252677b3|399|0x120
    8|14|nss3.dll|pr_root(void*)|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/md/windows/w95thred.c:653f0dc8442dd9cae70845896eb3c0a0252677b3|139|0x10
    8|15|ucrtbase.dll||||
    8|16|KERNELBASE.dll||||
    8|17|kernel32.dll||||
    8|18|mozglue.dll|patched_BaseThreadInitThunk(int, void*, void*)|hg:hg.mozilla.org/mozilla-central:toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp:653f0dc8442dd9cae70845896eb3c0a0252677b3|562|0x8a
    8|19|ntdll.dll||||
    8|20|KERNELBASE.dll||||

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Detailed Crash Information

Comment 2

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 3

[Bugmon [:jkratzer for issues]]

Unable to reproduce bug 1904596 using build mozilla-central 20240625093602-653f0dc8442d. Without a baseline, bugmon is unable to analyze this bug.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 4

[Jason Kratzer [:jkratzer]]

I'm not sure why bugmon wasn't able to reproduce this issue. I've confirmed that I can still reproduce it using the attached testcase.

Comment 5

[Erich Gubler [:ErichDonGubler]]

WebGPU bugs, if contained, are S3 or lower until shipping from Nightly.

Comment 6

[Erich Gubler [:ErichDonGubler]]

This test case seems similar to bug 1905383 with incorrectly using a texture as a depth-stencil attachment? 🤔