1982820 - Assertion failure: mContext->mBoundDrawFramebuffer == this || mContext->mBoundReadFramebuffer == this, at /dom/canvas/WebGLFramebuffer.cpp:694

Status: NEW

(Core :: Graphics: CanvasWebGL, defect)

Description

[Jason Kratzer [:jkratzer]]

Testcase found while fuzzing mozilla-central rev 6c51cabb2e48 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch --build 6c51cabb2e48 --debug --fuzzing  -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Assertion failure: mContext->mBoundDrawFramebuffer == this || mContext->mBoundReadFramebuffer == this, at /dom/canvas/WebGLFramebuffer.cpp:694

    ==293618==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7266b532be31 bp 0x726686672250 sp 0x726686672200 T293740)
    ==293618==The signal is caused by a WRITE memory access.
    ==293618==Hint: address points to the zero page.
        #0 0x7266b532be31 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3
        #1 0x7266b532be31 in mozilla::WebGLFramebuffer::PrecheckFramebufferStatus(nsTString<char>*) const /dom/canvas/WebGLFramebuffer.cpp:693:3
        #2 0x7266b5306b50 in mozilla::WebGLFramebuffer::CheckFramebufferStatus() const /dom/canvas/WebGLFramebuffer.cpp:999:18
        #3 0x7266b52dc07b in IsCheckFramebufferStatusComplete /dom/canvas/WebGLFramebuffer.h:253:12
        #4 0x7266b52dc07b in mozilla::WebGLContext::CopyToSwapChain(mozilla::WebGLFramebuffer*, mozilla::layers::TextureType, mozilla::webgl::SwapChainOptions const&, mozilla::layers::RemoteTextureOwnerClient*) /dom/canvas/WebGLContext.cpp:1272:25
        #5 0x7266b5197559 in mozilla::gfx::DrawTargetWebgl::CopyToSwapChain(mozilla::layers::TextureType, mozilla::layers::RemoteTextureId, mozilla::layers::RemoteTextureOwnerId, mozilla::layers::RemoteTextureOwnerClient*) /dom/canvas/DrawTargetWebgl.cpp:5971:34
        #6 0x7266b31cb5d5 in mozilla::layers::CanvasTranslator::PresentTexture(mozilla::layers::RemoteTextureOwnerId, mozilla::layers::RemoteTextureId) /gfx/layers/ipc/CanvasTranslator.cpp:1371:16
        #7 0x7266b31c17fe in mozilla::layers::CanvasTranslator::TranslateRecording() /gfx/layers/ipc/CanvasTranslator.cpp:713:22
        #8 0x7266b31c28e8 in mozilla::layers::CanvasTranslator::SetDataSurfaceBuffer(mozilla::ipc::shared_memory::Handle<(mozilla::ipc::shared_memory::Type)0>&&) /gfx/layers/ipc/CanvasTranslator.cpp:350:10
        #9 0x7266b31c3685 in mozilla::layers::CanvasTranslator::HandleCanvasTranslatorEvents() /gfx/layers/ipc/CanvasTranslator.cpp:815:13
        #10 0x7266b31fe335 in operator()<> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1085:18
        #11 0x7266b31fe335 in __invoke_impl<void, (lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:60:14
        #12 0x7266b31fe335 in __invoke<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9)> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/bits/invoke.h:95:14
        #13 0x7266b31fe335 in __apply_impl<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1678:14
        #14 0x7266b31fe335 in apply<(lambda at /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1084:9), std::tuple<> &> /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/tuple:1687:14
        #15 0x7266b31fe335 in apply<mozilla::layers::CanvasTranslator, void (mozilla::layers::CanvasTranslator::*)()> /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1083:12
        #16 0x7266b31fe335 in mozilla::detail::RunnableMethodImpl<mozilla::layers::CanvasTranslator*, void (mozilla::layers::CanvasTranslator::*)(), true, (mozilla::RunnableKind)0>::Run() /builds/worker/workspace/obj-build/dist/include/nsThreadUtils.h:1134:13
        #17 0x7266b1dc145a in nsThread::ProcessNextEvent(bool, bool*) /xpcom/threads/nsThread.cpp:1153:16
        #18 0x7266b1dc79bf in NS_ProcessNextEvent(nsIThread*, bool) /xpcom/threads/nsThreadUtils.cpp:480:10
        #19 0x7266b2983770 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /ipc/glue/MessagePump.cpp:299:20
        #20 0x7266b28dcad1 in RunHandler /ipc/chromium/src/base/message_loop.cc:367:3
        #21 0x7266b28dcad1 in MessageLoop::Run() /ipc/chromium/src/base/message_loop.cc:349:3
        #22 0x7266b1dbcdce in nsThread::ThreadFunc(void*) /xpcom/threads/nsThread.cpp:366:10
        #23 0x7266c7554a1f in _pt_root /nsprpub/pr/src/pthreads/ptthread.c:191:3
        #24 0x7266c7e0faa3 in start_thread nptl/pthread_create.c:447:8
        #25 0x7266c7e9cc3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
    
    ==293618==Register values:
    rax = 0x0000000000000000  rbx = 0x00007266866722b8  rcx = 0x00000000000002b6  rdx = 0x00007266c7f77563  
    rdi = 0x00007266c7f78700  rsi = 0x0000000000000000  rbp = 0x0000726686672250  rsp = 0x0000726686672200  
     r8 = 0x0000000000000000   r9 = 0x0000000000000003  r10 = 0x0000000000000000  r11 = 0x0000000000000293  
    r12 = 0x00007265a8005b80  r13 = 0x0000000000000000  r14 = 0x00007265aa82f640  r15 = 0x00007265aa82f630  
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:248:3 in MOZ_CrashSequence
    ==293618==ABORTING

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: Testcase

Comment 2

[Erich Gubler [:ErichDonGubler] (he/him)]

This is a safe crash, so triaging severity seems mostly a question of consequence for applications we care about. Tentatively assigning S3.

NI'ing :ahale for diagnosis.

Comment 3

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250813091044-6c51cabb2e48.
The bug appears to have been introduced in the following build range:

Start: 45452b67fc9c83f030ddd1b2e2b8389e669d97cb (20250806001312)
End: 62b93e0936e577dc3983b93027e7212a88bb0d38 (20250806045044)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=45452b67fc9c83f030ddd1b2e2b8389e669d97cb&tochange=62b93e0936e577dc3983b93027e7212a88bb0d38

Comment 4

[BugBot [:suhaib / :marco]]

This bug has been marked as a regression. Setting status flag for Nightly to affected.

Comment 5

[Bugmon [:jkratzer for issues]]

Testcase crashes using the initial build (mozilla-central 20250813091044-6c51cabb2e48) but not with tip (mozilla-central 20250823091702-a17fc8d3e4b5.)

The bug appears to have been fixed in the following build range:

Start: dd9c335571f31066a55612b89703fcda4e13ef47 (20250820144754)
End: de7e823c99b304efce4cf7cbe6a4b2c46b93ee0f (20250820162451)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=dd9c335571f31066a55612b89703fcda4e13ef47&tochange=de7e823c99b304efce4cf7cbe6a4b2c46b93ee0f

jkratzer, can you confirm that the above bisection range is responsible for fixing this issue?
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.

Comment 6

[Jason Kratzer [:jkratzer]]

This appears to be intermittent. I can still reproduce the bug locally. I'm going to leave bugmon disabled for now.