1907457 - Hit MOZ_CRASH(RenderBundle[Id(4,1,vk)] does not exist) at /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/storage.rs:113

Status: NEW

(Core :: Graphics: WebGPU, defect, P2)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20240629-ca0abc9ab05e (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(RenderBundle[Id(4,1,vk)] does not exist) at /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/storage.rs:113

#0 0x760aa2e8b265 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:317:3
#1 0x760aa2e8b265 in RustMozCrash /builds/worker/checkouts/gecko/mozglue/static/rust/wrappers.cpp:18:3
#2 0x760aa2e8af63 in mozglue_static::panic_hook::h8e9c610dd28736f9 /builds/worker/checkouts/gecko/mozglue/static/rust/lib.rs:98:9
#3 0x760aa2e8a9eb in core::ops::function::Fn::call::h42a639b4f95a6842 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/ops/function.rs:79:5
#4 0x760aa3e5af15 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..Fn$LT$Args$GT$$GT$::call::ha9c3bc81d312fd83 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/alloc/src/boxed.rs:2036:9
#5 0x760aa3e5af15 in std::panicking::rust_panic_with_hook::hac8bdceee1e4fe2c /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/std/src/panicking.rs:799:13
#6 0x760aa3e5acc3 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h00d785e82757ce3c /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/std/src/panicking.rs:664:13
#7 0x760aa3e59c98 in std::sys_common::backtrace::__rust_end_short_backtrace::h1628d957bcd06996 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/std/src/sys_common/backtrace.rs:171:18
#8 0x760aa3e5a9f6 in rust_begin_unwind /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/std/src/panicking.rs:652:5
#9 0x760aa3e83062 in core::panicking::panic_fmt::hdc63834ffaaefae5 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/panicking.rs:72:14
#10 0x760aa2065180 in wgpu_core::storage::Storage$LT$T$GT$::get::h04ca45b9c631e4c3 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/storage.rs:113:39
#11 0x760aa1f373f0 in wgpu_core::storage::Storage$LT$T$GT$::get_owned::hd6a0f442fc29727f /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/storage.rs:128:23
#12 0x760aa1f373f0 in wgpu_core::command::render_command::RenderCommand::resolve_render_command_ids::_$u7b$$u7b$closure$u7d$$u7d$::h9a5921f77456578a /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/command/render_command.rs:369:25
#13 0x760aa1f373f0 in core::iter::adapters::map::map_try_fold::_$u7b$$u7b$closure$u7d$$u7d$::h5be2a297077d99ae /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/iter/adapters/map.rs:96:28
#14 0x760aa1f373f0 in core::iter::traits::iterator::Iterator::try_fold::h52b79cb27c708aab /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/iter/traits/iterator.rs:2410:21
#15 0x760aa1f373f0 in _$LT$core..iter..adapters..map..Map$LT$I$C$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::try_fold::h3ab96ac1df10cefd /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/iter/adapters/map.rs:122:9
#16 0x760aa1f373f0 in _$LT$core..iter..adapters..GenericShunt$LT$I$C$R$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::try_fold::hbc4b9b01c3bed930 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/iter/adapters/mod.rs:201:9
#17 0x760aa1f373f0 in core::iter::traits::iterator::Iterator::try_for_each::haa43099eaba2d0a4 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/iter/traits/iterator.rs:2472:9
#18 0x760aa1f373f0 in _$LT$core..iter..adapters..GenericShunt$LT$I$C$R$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::next::h58b1f82201d8e93e /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/iter/adapters/mod.rs:184:14
#19 0x760aa2052974 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..spec_from_iter_nested..SpecFromIterNested$LT$T$C$I$GT$$GT$::from_iter::hfde76199b1a97a90 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/alloc/src/vec/spec_from_iter_nested.rs:26:32
#20 0x760aa2052974 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$alloc..vec..spec_from_iter..SpecFromIter$LT$T$C$I$GT$$GT$::from_iter::ha619324777194bab /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/alloc/src/vec/spec_from_iter.rs:33:9
#21 0x760aa2052974 in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$core..iter..traits..collect..FromIterator$LT$T$GT$$GT$::from_iter::hc62507d874500356 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/alloc/src/vec/mod.rs:2972:9
#22 0x760aa2052974 in core::iter::traits::iterator::Iterator::collect::h129482f5217172e0 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/iter/traits/iterator.rs:2004:9
#23 0x760aa2052974 in _$LT$core..result..Result$LT$V$C$E$GT$$u20$as$u20$core..iter..traits..collect..FromIterator$LT$core..result..Result$LT$A$C$E$GT$$GT$$GT$::from_iter::_$u7b$$u7b$closure$u7d$$u7d$::h8f85e285473c3122 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/result.rs:1935:51
#24 0x760aa2052974 in core::iter::adapters::try_process::hab936c788ad93c97 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/iter/adapters/mod.rs:170:17
#25 0x760aa2052974 in _$LT$core..result..Result$LT$V$C$E$GT$$u20$as$u20$core..iter..traits..collect..FromIterator$LT$core..result..Result$LT$A$C$E$GT$$GT$$GT$::from_iter::hd2df87c5273fa8f7 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/result.rs:1935:9
#26 0x760aa2052974 in core::iter::traits::iterator::Iterator::collect::h0fbb765884d94ce7 /rustc/129f3b9964af4d4a709d1383930ade12dfe7c081/library/core/src/iter/traits/iterator.rs:2004:9
#27 0x760aa2052974 in wgpu_core::command::render_command::RenderCommand::resolve_render_command_ids::h7c06e81622276394 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/command/render_command.rs:378:14
#28 0x760aa2052974 in wgpu_core::command::render::_$LT$impl$u20$wgpu_core..global..Global$GT$::render_pass_end_with_unresolved_commands::h19bd18172752b153 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/command/render.rs:1355:24
#29 0x760aa20ae7e0 in wgpu_core::command::render::_$LT$impl$u20$wgpu_core..global..Global$GT$::render_pass_end::hdc7fc2d41bfb4899 /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/command/render.rs:1335:9
#30 0x760aa20ae7e0 in wgpu_bindings::command::replay_render_pass::hb4320f2e4865abd3 /builds/worker/checkouts/gecko/gfx/wgpu_bindings/src/command.rs:733:11
#31 0x760aa20ae7e0 in _$LT$wgpu_bindings..server..Global$u20$as$u20$wgpu_bindings..server..wgpu_server_render_pass..ReplayRenderPass$GT$::replay_render_pass::hdb1025cac61354cc /builds/worker/checkouts/gecko/gfx/wgpu_bindings/src/server.rs:1109:13
#32 0x760aa20ae7e0 in wgpu_server_render_pass /builds/worker/checkouts/gecko/third_party/rust/wgpu-core/src/lib.rs:296:67
#33 0x760a9d68d479 in mozilla::webgpu::WebGPUParent::RecvRenderPass(unsigned long, unsigned long, mozilla::ipc::ByteBuf const&) /builds/worker/checkouts/gecko/dom/webgpu/ipc/WebGPUParent.cpp:1367:3
#34 0x760a9d69a094 in mozilla::webgpu::PWebGPUParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PWebGPUParent.cpp:539:80
#35 0x760a9b90f197 in mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&) /builds/worker/workspace/obj-build/ipc/ipdl/PCanvasManagerParent.cpp:248:32
#36 0x760a9ad4796f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1820:25
#37 0x760a9ad446c2 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1739:9
#38 0x760a9ad45342 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1530:3
#39 0x760a9ad4648f in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1630:14
#40 0x760a9a1ebbcc in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1198:16
#41 0x760a9a1f273f in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:480:10
#42 0x760a9ad4e75e in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:300:20
#43 0x760a9aca41f1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:363:3
#44 0x760a9aca41f1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:345:3
#45 0x760a9a1e6ec3 in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:370:10
#46 0x760aad7116ef in _pt_root /builds/worker/checkouts/gecko/nsprpub/pr/src/pthreads/ptthread.c:201:5
#47 0x760aad494ac2 in start_thread nptl/pthread_create.c:442:8
#48 0x760aad52684f  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20240711215213-9881aaa9dcd6.
The bug appears to have been introduced in the following build range:

Start: 058dc2e8394c7361874508e49f2bbbfc3173f1a9 (20240423154445)
End: 95eda02f60c4827fd10d6e6c3b72a3a4aa6c8122 (20240423155714)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=058dc2e8394c7361874508e49f2bbbfc3173f1a9&tochange=95eda02f60c4827fd10d6e6c3b72a3a4aa6c8122

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1712963

:bradwerth, since you are the author of the regressor, bug 1712963, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[Brad Werth [:bradwerth] | Out until March 3]

I'll figure this out.

Comment 4

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20240629193753-ca0abc9ab05e) but not with tip (mozilla-central 20240802153712-c38029641964.)

Unable to bisect testcase (Unable to launch the end build!):

Start: ca0abc9ab05e329c1d945ec3b8c1c44458e9ddbe (20240629193753)
End: c38029641964591e518535856e2d7b3038b134ad (20240802153712)
BuildFlags: BuildFlags(asan=False, tsan=False, debug=True, fuzzing=True, coverage=False, valgrind=False, no_opt=False, fuzzilli=False, nyx=False)

Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.