2025060 - Assertion failure: AllocationReporter::allocated >= mSize (Can't destroy more than allocated), at /builds/worker/checkouts/gecko/ipc/glue/SharedMemoryHandle.cpp:60

Status: VERIFIED FIXED

(Core :: Graphics: WebGPU, defect, P1)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260313-7bada6295526 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Marking as s-s as a precaution until this can be reviewed.

Assertion failure: AllocationReporter::allocated >= mSize (Can't destroy more than allocated), at /builds/worker/checkouts/gecko/ipc/glue/SharedMemoryHandle.cpp:60

#0 0x7fffe1a37638 in MOZ_CrashSequence /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:237:3
#1 0x7fffe1a37638 in mozilla::ipc::shared_memory::HandleBase::~HandleBase() /builds/worker/checkouts/gecko/ipc/glue/SharedMemoryHandle.cpp:59:5
#2 0x7fffe1a1cbb4 in ~Builder /builds/worker/workspace/obj-build/dist/include/mozilla/ipc/Shmem.h:78:9
#3 0x7fffe1a1cbb4 in mozilla::ipc::IToplevelProtocol::CreateSharedMemory(unsigned long, bool) /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:749:1
#4 0x7fffe1a1d105 in CreateSharedMemory /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:340:21
#5 0x7fffe1a1d105 in mozilla::ipc::IProtocol::AllocShmem(unsigned long, mozilla::ipc::Shmem*) /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:386:14
#6 0x7fffe4bb4e6f in mozilla::webgpu::WebGPUParent::GetFrontBufferSnapshot(mozilla::ipc::IProtocol*, mozilla::layers::RemoteTextureOwnerId const&, unsigned long const&, unsigned long const&, mozilla::Maybe<mozilla::ipc::Shmem>&, mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits>&, unsigned int&) /builds/worker/checkouts/gecko/dom/webgpu/ipc/WebGPUParent.cpp:1218:8
#7 0x7fffe2750d47 in mozilla::gfx::CanvasManagerParent::RecvGetSnapshot(unsigned int const&, long const&, mozilla::Maybe<mozilla::layers::RemoteTextureOwnerId> const&, mozilla::Maybe<unsigned long> const&, mozilla::Maybe<unsigned long> const&, mozilla::webgl::FrontBufferSnapshotIpc*) /builds/worker/checkouts/gecko/gfx/ipc/CanvasManagerParent.cpp:227:44
#8 0x7fffe277148c in mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>&) /builds/worker/workspace/obj-build/ipc/ipdl/PCanvasManagerParent.cpp:605:87
#9 0x7fffe1a06dde in mozilla::ipc::MessageChannel::DispatchSyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1774:25
#10 0x7fffe1a04841 in mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message, std::default_delete<IPC::Message>>) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1725:9
#11 0x7fffe1a05227 in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&) /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1516:3
#12 0x7fffe1a06209 in mozilla::ipc::MessageChannel::MessageTask::Run() /builds/worker/checkouts/gecko/ipc/glue/MessageChannel.cpp:1618:14
#13 0x7fffe0e24859 in nsThread::ProcessNextEvent(bool, bool*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:1175:16
#14 0x7fffe0e2a2ef in NS_ProcessNextEvent(nsIThread*, bool) /builds/worker/checkouts/gecko/xpcom/threads/nsThreadUtils.cpp:467:10
#15 0x7fffe1a0db59 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) /builds/worker/checkouts/gecko/ipc/glue/MessagePump.cpp:329:5
#16 0x7fffe19662a1 in RunHandler /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:366:3
#17 0x7fffe19662a1 in MessageLoop::Run() /builds/worker/checkouts/gecko/ipc/chromium/src/base/message_loop.cc:348:3
#18 0x7fffe0e2036e in nsThread::ThreadFunc(void*) /builds/worker/checkouts/gecko/xpcom/threads/nsThread.cpp:376:10

Comment 1

[Teodor Tanasoaia [:teoxoy]]

Sotaro, would you be able to look at this?

Comment 2

[Jim Blandy :jimb]

P1: Current

Comment 3

[Sotaro Ikeda [:sotaro]]

Attachment: (secure)

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/c18700ecc899
https://hg.mozilla.org/integration/autoland/rev/cc2f53a4ed20
Add size check r=webgpu-reviewers,gfx-reviewers,bradwerth

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/cc2f53a4ed20

Comment 6

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260325162532-02877f425f35.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.