Reporter

Description

•

6 months ago

Attached file 2.html — Details

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15

Steps to reproduce:

Steps to reproduce the problem:

Prepare the asan-instrumented Firefox build with version 138.0a1 (2025-04-14) (64bit) (Nightly).
Launch the browser and open the 2.html
The browser will crash in several seconds.

Some Additional Informarion

Settings

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0

OS Version: Ubuntu 22.04.4 LTS

Firefox Version: Nightly 138.0a1 (2025-04-14) (64-bit).

Firefox compile settings: We used the officially recommended ASan build configuration parameters

mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/objdir-ff-asan
ac_add_options --enable-address-sanitizer
ac_add_options --disable-jemalloc
ac_add_options --disable-crashreporter
ac_add_options --disable-elf-hack
ac_add_options --disable-install-strip
ac_add_options --enable-debug-symbols=-gline-tables-only

Profile settings:

user_pref("app.update.auto", false);
user_pref("app.update.enabled", false);
user_pref("accessibility.blockautorefresh",true);
user_pref("dom.report_all_js_exceptions", false);

Asan Report

The following is the Firefox runtime log, which includes ASan report.

console.error: [Exception... "Component returned failure code: 0x80004001 (NS_ERROR_NOT_IMPLEMENTED) [nsIAppStartup.secondsSinceLastOSRestart]"  nsresult: "0x80004001 (NS_ERROR_NOT_IMPLEMENTED)"  location: "JS frame :: resource:///modules/BrowserGlue.sys.mjs :: _collectStartupConditionsTelemetry :: line 1869"  data: no]
console.error: "Experiment firefox-labs-link-previews has unknown featureId: linkPreviews"
console.error: "SearchSuggestionController found an unexpected string value:" "HTTP request timeout"
libEGL warning: DRI2: failed to authenticate
ATTENTION: default value of option mesa_glthread overridden by environment.
console.warn: TopSitesFeed: Failed to fetch data from MARS server: NetworkError when attempting to fetch resource.
AddressSanitizer:DEADLYSIGNAL
=================================================================
==190355==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000014 (pc 0x7f9bc87f04c2 bp 0x7f9b81db59c0 sp 0x7f9b81db5140 T57)
==190355==The signal is caused by a READ memory access.
==190355==Hint: address points to the zero page.
    #0 0x7f9bc87f04c2 in DoBindFB /home/mojo/firefox/mozilla-unified/dom/canvas/WebGLContext.cpp
    #1 0x7f9bc87f04c2 in operator() /home/mojo/firefox/mozilla-unified/dom/canvas/WebGLContext.cpp:1533:5
    #2 0x7f9bc87f04c2 in ~ScopeExit /home/mojo/firefox/mozilla-unified/objdir-ff-asan/dist/include/mozilla/ScopeExit.h:106:7
    #3 0x7f9bc87f04c2 in mozilla::WebGLContext::SnapshotInto(unsigned int, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> const&, mozilla::Range<unsigned char> const&, mozilla::Maybe<unsigned long>) /home/mojo/firefox/mozilla-unified/dom/canvas/WebGLContext.cpp:1577:1
    #4 0x7f9bc87eefcb in mozilla::WebGLContext::FrontBufferSnapshotInto(std::shared_ptr<mozilla::gl::SharedSurface> const&, mozilla::Maybe<mozilla::Range<unsigned char>>, mozilla::Maybe<unsigned long>) /home/mojo/firefox/mozilla-unified/dom/canvas/WebGLContext.cpp:1496:10
    #5 0x7f9bc87f1201 in mozilla::WebGLContext::FrontBufferSnapshotInto(mozilla::Maybe<mozilla::Range<unsigned char>>, mozilla::Maybe<unsigned long>) /home/mojo/firefox/mozilla-unified/dom/canvas/WebGLContext.cpp:1475:10
    #6 0x7f9bc8878a95 in FrontBufferSnapshotInto /home/mojo/firefox/mozilla-unified/dom/canvas/HostWebGLContext.h:191:22
    #7 0x7f9bc8878a95 in operator() /home/mojo/firefox/mozilla-unified/dom/canvas/WebGLParent.cpp:160:19
    #8 0x7f9bc8878a95 in mozilla::dom::WebGLParent::GetFrontBufferSnapshot(mozilla::webgl::FrontBufferSnapshotIpc*, mozilla::ipc::IProtocol*) /home/mojo/firefox/mozilla-unified/dom/canvas/WebGLParent.cpp:145:19
    #9 0x7f9bc8b83a24 in mozilla::dom::PWebGLParent::OnMessageReceived(IPC::Message const&, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>&) /home/mojo/firefox/mozilla-unified/objdir-ff-asan/ipc/ipdl/PWebGLParent.cpp:678:79
    #10 0x7f9bc51a1b9a in mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>&) /home/mojo/firefox/mozilla-unified/objdir-ff-asan/ipc/ipdl/PCanvasManagerParent.cpp:483:32
    #11 0x7f9bc36c655f in mozilla::ipc::MessageChannel::DispatchSyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>&) /home/mojo/firefox/mozilla-unified/ipc/glue/MessageChannel.cpp:1762:25
    #12 0x7f9bc36c40e1 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::UniquePtr<IPC::Message, mozilla::DefaultDelete<IPC::Message>>) /home/mojo/firefox/mozilla-unified/ipc/glue/MessageChannel.cpp:1714:9
    #13 0x7f9bc36c4d13 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /home/mojo/firefox/mozilla-unified/ipc/glue/MessageChannel.cpp:1507:3
    #14 0x7f9bc36c5b5b in mozilla::ipc::MessageChannel::MessageTask::Run() /home/mojo/firefox/mozilla-unified/ipc/glue/MessageChannel.cpp:1607:14
    #15 0x7f9bc1f70a2a in nsThread::ProcessNextEvent(bool, bool*) /home/mojo/firefox/mozilla-unified/xpcom/threads/nsThread.cpp:1153:16
    #16 0x7f9bc1f7a940 in NS_ProcessNextEvent(nsIThread*, bool) /home/mojo/firefox/mozilla-unified/xpcom/threads/nsThreadUtils.cpp:480:10
    #17 0x7f9bc36ce86a in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /home/mojo/firefox/mozilla-unified/ipc/glue/MessagePump.cpp:299:20
    #18 0x7f9bc3543b04 in RunInternal /home/mojo/firefox/mozilla-unified/ipc/chromium/src/base/message_loop.cc:369:10
    #19 0x7f9bc3543b04 in RunHandler /home/mojo/firefox/mozilla-unified/ipc/chromium/src/base/message_loop.cc:362:3
    #20 0x7f9bc3543b04 in MessageLoop::Run() /home/mojo/firefox/mozilla-unified/ipc/chromium/src/base/message_loop.cc:344:3
    #21 0x7f9bc1f68f58 in nsThread::ThreadFunc(void*) /home/mojo/firefox/mozilla-unified/xpcom/threads/nsThread.cpp:366:10
    #22 0x7f9bdc9954a1 in _pt_root /home/mojo/firefox/mozilla-unified/nsprpub/pr/src/pthreads/ptthread.c:191:3
    #23 0x55f96bc48e26 in asan_thread_start(void*) /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:28
    #24 0x7f9bdcfcc608 in start_thread /build/glibc-FcRMwW/glibc-2.31/nptl/pthread_create.c:477:8
    #25 0x7f9bdceae352 in __clone /build/glibc-FcRMwW/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

==190355==Register values:
rax = 0x000051d000290ea0  rbx = 0x000051d000290e80  rcx = 0x00000a3a000521d4  rdx = 0x0000000000000000  
rdi = 0x0000000000000014  rsi = 0x00007f9b7ad7f000  rbp = 0x00007f9b81db59c0  rsp = 0x00007f9b81db5140  
 r8 = 0x0000000000000030   r9 = 0x000052400028e000  r10 = 0x00007fffffffff01  r11 = 0x296c438a5c876701  
r12 = 0xf8f8f8f8f8f8f8f8  r13 = 0x0000000000000000  r14 = 0x00000ff3f03aea38  r15 = 0x00007f9b81db5cd0  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/mojo/firefox/mozilla-unified/dom/canvas/WebGLContext.cpp in DoBindFB
Thread T57 (CanvasRenderer) created by T0 here:
    #0 0x55f96bc32401 in pthread_create /builds/worker/fetches/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3
    #1 0x7f9bdc9854bc in _PR_CreateThread /home/mojo/firefox/mozilla-unified/nsprpub/pr/src/pthreads/ptthread.c:429:10
    #2 0x7f9bdc97069e in PR_CreateThread /home/mojo/firefox/mozilla-unified/nsprpub/pr/src/pthreads/ptthread.c:496:10
    #3 0x7f9bc1f6bf67 in nsThread::Init(nsTSubstring<char> const&) /home/mojo/firefox/mozilla-unified/xpcom/threads/nsThread.cpp:615:20
    #4 0x7f9bc1f792a6 in nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::ThreadCreationOptions, nsIThread**) /home/mojo/firefox/mozilla-unified/xpcom/threads/nsThreadManager.cpp:619:22
    #5 0x7f9bc1f854d1 in NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<nsIRunnable>, nsIThreadManager::ThreadCreationOptions) /home/mojo/firefox/mozilla-unified/xpcom/threads/nsThreadUtils.cpp:176:57
    #6 0x7f9bc515e5eb in NS_NewNamedThread<15UL> /home/mojo/firefox/mozilla-unified/xpcom/threads/nsThreadUtils.h:76:10
    #7 0x7f9bc515e5eb in mozilla::gfx::CanvasRenderThread::Start() /home/mojo/firefox/mozilla-unified/gfx/ipc/CanvasRenderThread.cpp:115:17
    #8 0x7f9bc4fb08f0 in gfxPlatform::Init() /home/mojo/firefox/mozilla-unified/gfx/thebes/gfxPlatform.cpp:973:3
    #9 0x7f9bcd38bed4 in GetPlatform /home/mojo/firefox/mozilla-unified/objdir-ff-asan/dist/include/gfxPlatform.h:182:7
    #10 0x7f9bcd38bed4 in mozilla::widget::GfxInfoBase::GetContentBackend(nsTSubstring<char16_t>&) /home/mojo/firefox/mozilla-unified/widget/GfxInfoBase.cpp:1809:25
    #11 0x7f9bc1fbcd65 in NS_InvokeByIndex /home/mojo/firefox/mozilla-unified/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:101
    #12 0x7f9bc397ac51 in Invoke /home/mojo/firefox/mozilla-unified/js/xpconnect/src/XPCWrappedNative.cpp:1620:10
    #13 0x7f9bc397ac51 in Call /home/mojo/firefox/mozilla-unified/js/xpconnect/src/XPCWrappedNative.cpp:1174:19
    #14 0x7f9bc397ac51 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) /home/mojo/firefox/mozilla-unified/js/xpconnect/src/XPCWrappedNative.cpp:1120:23
    #15 0x7f9bc397f6e3 in GetAttribute /home/mojo/firefox/mozilla-unified/js/xpconnect/src/xpcprivate.h:1451:12
    #16 0x7f9bc397f6e3 in XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*) /home/mojo/firefox/mozilla-unified/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:1006:10
    #17 0x7f9bcfa131cf in CallJSNative /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:493:13
    #18 0x7f9bcfa131cf in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:589:12
    #19 0x7f9bcfa14aaa in InternalCall /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:656:10
    #20 0x7f9bcfa14aaa in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:688:8
    #21 0x7f9bcfa16489 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:810:10
    #22 0x7f9bcfd8bee2 in CallGetter /home/mojo/firefox/mozilla-unified/js/src/vm/NativeObject.cpp:2092:12
    #23 0x7f9bcfd8bee2 in GetExistingProperty<(js::AllowGC)1> /home/mojo/firefox/mozilla-unified/js/src/vm/NativeObject.cpp:2120:12
    #24 0x7f9bcfd8bee2 in NativeGetPropertyInline<(js::AllowGC)1> /home/mojo/firefox/mozilla-unified/js/src/vm/NativeObject.cpp:2273:14
    #25 0x7f9bcfd8bee2 in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /home/mojo/firefox/mozilla-unified/js/src/vm/NativeObject.cpp:2303:10
    #26 0x7f9bcfa2f2d8 in GetProperty /home/mojo/firefox/mozilla-unified/js/src/vm/ObjectOperations-inl.h:113:10
    #27 0x7f9bcfa2f2d8 in GetObjectElementOperation /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter-inl.h:390:10
    #28 0x7f9bcfa2f2d8 in GetElementOperationWithStackIndex /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter-inl.h:473:10
    #29 0x7f9bcfa2f2d8 in js::Interpret(JSContext*, js::RunState&) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:3055:12
    #30 0x7f9bcfa1201e in MaybeEnterInterpreterTrampoline /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:394:10
    #31 0x7f9bcfa1201e in js::RunScript(JSContext*, js::RunState&) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:463:13
    #32 0x7f9bcfa132de in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:621:13
    #33 0x7f9bcfa14aaa in InternalCall /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:656:10
    #34 0x7f9bcfa14aaa in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:688:8
    #35 0x7f9bcfa16489 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:810:10
    #36 0x7f9bcfd8bee2 in CallGetter /home/mojo/firefox/mozilla-unified/js/src/vm/NativeObject.cpp:2092:12
    #37 0x7f9bcfd8bee2 in GetExistingProperty<(js::AllowGC)1> /home/mojo/firefox/mozilla-unified/js/src/vm/NativeObject.cpp:2120:12
    #38 0x7f9bcfd8bee2 in NativeGetPropertyInline<(js::AllowGC)1> /home/mojo/firefox/mozilla-unified/js/src/vm/NativeObject.cpp:2273:14
    #39 0x7f9bcfd8bee2 in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<JS::PropertyKey>, JS::MutableHandle<JS::Value>) /home/mojo/firefox/mozilla-unified/js/src/vm/NativeObject.cpp:2303:10
    #40 0x7f9bcfa3c7af in GetProperty /home/mojo/firefox/mozilla-unified/js/src/vm/ObjectOperations-inl.h:113:10
    #41 0x7f9bcfa3c7af in GetProperty /home/mojo/firefox/mozilla-unified/js/src/vm/ObjectOperations-inl.h:120:10
    #42 0x7f9bcfa3c7af in js::GetProperty(JSContext*, JS::Handle<JS::Value>, JS::Handle<js::PropertyName*>, JS::MutableHandle<JS::Value>) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:4609:10
    #43 0x7f9bcfa2512c in GetPropertyOperation /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:279:10
    #44 0x7f9bcfa2512c in js::Interpret(JSContext*, js::RunState&) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:2920:12
    #45 0x7f9bcfa1201e in MaybeEnterInterpreterTrampoline /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:394:10
    #46 0x7f9bcfa1201e in js::RunScript(JSContext*, js::RunState&) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:463:13
    #47 0x7f9bcfa132de in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:621:13
    #48 0x7f9bcfa14aaa in InternalCall /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:656:10
    #49 0x7f9bcfa14aaa in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) /home/mojo/firefox/mozilla-unified/js/src/vm/Interpreter.cpp:688:8
    #50 0x7f9bcfb3f731 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /home/mojo/firefox/mozilla-unified/js/src/vm/CallAndConstruct.cpp:55:10
    #51 0x7f9bc396d43a in nsXPCWrappedJS::CallMethod(unsigned short, nsXPTMethodInfo const*, nsXPTCMiniVariant*) /home/mojo/firefox/mozilla-unified/js/xpconnect/src/XPCWrappedJSClass.cpp:918:17
    #52 0x7f9bc1fbe341 in PrepareAndDispatch /home/mojo/firefox/mozilla-unified/xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_linux.cpp:115:37
    #53 0x7f9bc1fbd2aa in SharedStub xptcstubs_x86_64_linux.cpp
    #54 0x7f9bc1f0e028 in NS_CreateServicesFromCategory(char const*, nsISupports*, char const*, char16_t const*) /home/mojo/firefox/mozilla-unified/xpcom/components/nsCategoryManager.cpp:680:19
    #55 0x7f9bcf6bfa7d in nsXREDirProvider::DoStartup() /home/mojo/firefox/mozilla-unified/toolkit/xre/nsXREDirProvider.cpp:653:11
    #56 0x7f9bcf69d7a8 in XREMain::XRE_mainRun() /home/mojo/firefox/mozilla-unified/toolkit/xre/nsAppRunner.cpp:5666:18
    #57 0x7f9bcf69f303 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /home/mojo/firefox/mozilla-unified/toolkit/xre/nsAppRunner.cpp:6127:8
    #58 0x7f9bcf6a019b in XRE_main(int, char**, mozilla::BootstrapConfig const&) /home/mojo/firefox/mozilla-unified/toolkit/xre/nsAppRunner.cpp:6200:21
    #59 0x55f96bc8ff33 in do_main /home/mojo/firefox/mozilla-unified/browser/app/nsBrowserApp.cpp:232:22
    #60 0x55f96bc8ff33 in main /home/mojo/firefox/mozilla-unified/browser/app/nsBrowserApp.cpp:464:16
    #61 0x7f9bdcdb3082 in __libc_start_main /build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16

==190355==ABORTING
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Crash Annotation GraphicsCriticalError: |[C0][GFX1-]: CompositorBridgeChild receives IPC close with reason=AbnormalShutdown (t=6.61074) Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.

Actual results:

browser crash

Expected results:

browser not crash

pubmailaddr

Reporter

Comment 1

•

6 months ago

Sorry for my oversight, the operating system version is Ubuntu 20.04.6 LTS.

BugBot [:suhaib / :marco/ :calixte]

Comment 2

•

6 months ago

The Bugbug bot thinks this bug should belong to the 'Core::Graphics: CanvasWebGL' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Component: Untriaged → Graphics: CanvasWebGL

Product: Firefox → Core

Mayank Bansal

Comment 3

•

6 months ago

Can repro on my Win11x64 machine. You dont need an ASAN build, a simple Nightly is sufficient. Open the testcase and let it sit for 20 seconds or so.

Crash: https://crash-stats.mozilla.org/report/index/c6a16b11-3bc7-403d-8215-520c20250417#tab-bugzilla

Status: UNCONFIRMED → NEW

Crash Signature: [@ mozilla::WebGLContext::DoBindFB ]

Ever confirmed: true

Comment 4

•

6 months ago

Bisection:
https://hg-edge.mozilla.org/mozilla-central/pushloghtml?fromchange=bf0897ec442e625c185407cc615a6adc0e40fa75&tochange=f8dd4015fa59fee3a1a74c00cd2393a9578e49f0

Suspect: Bug 1795296 / Bug 1855742

Keywords: regression

Regressed by: 1795296, 1855742

Lee Salzman [:lsalzman]

Assignee

Comment 5

•

6 months ago

Attached file Bug 1961191 - Check for null default FB in DoBindFB. r?aosmond — Details

Phabricator Automation

Updated

•

6 months ago

Assignee: nobody → lsalzman

Status: NEW → ASSIGNED

Pulsebot

Comment 6

•

6 months ago

Pushed by lsalzman@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/cb39c3c55fef Check for null default FB in DoBindFB. r=aosmond

Cosmin Sabou [:CosminS]

Comment 7

•

6 months ago

bugherder

https://hg.mozilla.org/mozilla-central/rev/cb39c3c55fef

Status: ASSIGNED → RESOLVED

Closed: 6 months ago

status-firefox139: --- → fixed

Resolution: --- → FIXED

Target Milestone: --- → 139 Branch

Ryan VanderMeulen [:RyanVM]

Updated

•

6 months ago

status-firefox137: --- → wontfix

status-firefox138: --- → fix-optional

status-firefox-esr115: --- → unaffected

status-firefox-esr128: --- → wontfix

BugBot [:suhaib / :marco/ :calixte]

Comment 8

•

6 months ago

The patch landed in nightly and beta is affected.
:lsalzman, is this bug important enough to require an uplift?

If yes, please nominate the patch for beta approval.
- See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
If no, please set status-firefox138 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(lsalzman)

Lee Salzman [:lsalzman]

Assignee

Comment 9

•

6 months ago

Comment on attachment 9479755 [details]
Bug 1961191 - Check for null default FB in DoBindFB. r?aosmond

Beta/Release Uplift Approval Request

User impact if declined/Reason for urgency: Potential crashes when using WebGL.
Is this code covered by automated tests?: Yes
Has the fix been verified in Nightly?: Yes
Needs manual test from QE?: No
If yes, steps to reproduce:
List of other uplifts needed: None
Risk to taking this patch: Low
Why is the change risky/not risky? (and alternatives if risky):
String changes made/needed:
Is Android affected?: Yes

Flags: needinfo?(lsalzman)

Attachment #9479755 - Flags: approval-mozilla-beta?

Dianna Smith [:diannaS]

Comment 10

•

6 months ago

Comment on attachment 9479755 [details]
Bug 1961191 - Check for null default FB in DoBindFB. r?aosmond

We are out of betas but moving to release in case of an RC2 re-spin or for the planned dot release.

Attachment #9479755 - Flags: approval-mozilla-beta? → approval-mozilla-release?

Mihai Boldan, Desktop QA [:mboldan]

Updated

•

6 months ago

QA Whiteboard: [qa-triage-done-c140/b139]

Dianna Smith [:diannaS]

Comment 11

•

6 months ago

Comment on attachment 9479755 [details]
Bug 1961191 - Check for null default FB in DoBindFB. r?aosmond

Approved for 138.0.3

Attachment #9479755 - Flags: approval-mozilla-release? → approval-mozilla-release+

Pulsebot

Comment 12

•

6 months ago

uplift

https://hg.mozilla.org/releases/mozilla-release/rev/504239d49977

Dianna Smith [:diannaS]

Updated

•

6 months ago

status-firefox138: fix-optional → fixed

Flags: in-testsuite+

Dianna Smith [:diannaS]

Updated

•

6 months ago

relnote-firefox: --- → 138+

2.html 6 months ago pubmailaddr 484 bytes, text/html		Details
Bug 1961191 - Check for null default FB in DoBindFB. r?aosmond 6 months ago Lee Salzman [:lsalzman] 48 bytes, text/x-phabricator-request	diannaS : approval-mozilla-release+	Details \| Review

Some WebGL-related code may cause the browser to crash."

Steps to reproduce the problem:

Some Additional Informarion

Settings

Asan Report

Beta/Release Uplift Approval Request