2055976 - Hit MOZ_CRASH(attempt to shift right with overflow) at /builds/worker/checkouts/gecko/third_party/rust/wgpu-types/src/origin_extent.rs:180

Status: VERIFIED FIXED

(Core :: Graphics: WebGPU, defect, P1)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Found while fuzzing m-c 20260715-aa0263a64993 (--enable-debug --enable-fuzzing)

To reproduce via Grizzly Replay:

$ pip install fuzzfetch grizzly-framework --upgrade
$ python -m fuzzfetch -d --fuzzing -n firefox
$ python -m grizzly.replay.bugzilla ./firefox/firefox <bugid>

Hit MOZ_CRASH(attempt to shift right with overflow) at /builds/worker/checkouts/gecko/third_party/rust/wgpu-types/src/origin_extent.rs:180

31|0|xul.dll|RustMozCrash(char const*, int, char const*)|git:github.com/mozilla-firefox/firefox:mozglue/static/rust/wrappers.cpp:9822ee9dfe9be4851b0466ebf21646d66a5b7960|17|0x28
31|1|xul.dll|mozglue_static::panic_hook(std::panic::PanicHookInfo*)|git:github.com/mozilla-firefox/firefox:mozglue/static/rust/lib.rs:9822ee9dfe9be4851b0466ebf21646d66a5b7960|99|0xdf
31|2|xul.dll|core::ops::function::Fn::call<void (*)(ref$<std::panic::PanicHookInfo>),tuple$<ref$<std::panic::PanicHookInfo> > >(void (**)(std::panic::PanicHookInfo*), std::panic::PanicHookInfo*)|/builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs|79|0x11
31|3|xul.dll|std::panicking::panic_with_hook()|git:github.com/rust-lang/rust:library/std/src/panicking.rs:e408947bfd200af42db322daf0fadfe7e26d3bd1|833|0xdc
31|4|xul.dll|std::panicking::panic_handler::closure$0()|git:github.com/rust-lang/rust:library/std/src/panicking.rs:e408947bfd200af42db322daf0fadfe7e26d3bd1|691|0x88
31|5|xul.dll|std::sys::backtrace::__rust_end_short_backtrace<std::panicking::panic_handler::closure_env$0,never$>()|git:github.com/rust-lang/rust:library/std/src/sys/backtrace.rs:e408947bfd200af42db322daf0fadfe7e26d3bd1|182|0xe
31|6|xul.dll|std::panicking::panic_handler()|git:github.com/rust-lang/rust:library/std/src/panicking.rs:e408947bfd200af42db322daf0fadfe7e26d3bd1|689|0x1d
31|7|xul.dll|core::panicking::panic_fmt()|git:github.com/rust-lang/rust:library/core/src/panicking.rs:e408947bfd200af42db322daf0fadfe7e26d3bd1|80|0x2c
31|8|xul.dll|core::panicking::panic_const::panic_const_shr_overflow()|git:github.com/rust-lang/rust:library/core/src/panicking.rs:e408947bfd200af42db322daf0fadfe7e26d3bd1|175|0x1d
31|9|xul.dll|wgpu_types::origin_extent::Extent3d::mip_level_size(unsigned int, wgpu_types::texture::TextureDimension)|git:github.com/mozilla-firefox/firefox:third_party/rust/wgpu-types/src/origin_extent.rs:9822ee9dfe9be4851b0466ebf21646d66a5b7960|180|0x77
31|10|xul.dll|wgpu_core::device::queue::Queue::write_texture(wgpu_types::texture::TexelCopyTextureInfo<alloc::sync::Arc<wgpu_core::resource::Texture,alloc::alloc::Global> >, ref$<slice2$<u8> >, wgpu_types::texture::TexelCopyBufferLayout*, wgpu_types::origin_extent::Extent3d*)|git:github.com/mozilla-firefox/firefox:third_party/rust/wgpu-core/src/device/queue.rs:9822ee9dfe9be4851b0466ebf21646d66a5b7960|931|0x49c
31|11|xul.dll|wgpu_core::global::Global::queue_write_texture(wgpu_core::id::Id<enum2$<wgpu_core::id::markers::Queue> >, wgpu_types::texture::TexelCopyTextureInfo<wgpu_core::id::Id<enum2$<wgpu_core::id::markers::Texture> > >*, ref$<slice2$<u8> >, wgpu_types::texture::TexelCopyBufferLayout*, wgpu_types::origin_extent::Extent3d*)|git:github.com/mozilla-firefox/firefox:third_party/rust/wgpu-core/src/device/queue.rs:9822ee9dfe9be4851b0466ebf21646d66a5b7960|2026|0x1fd
31|12|xul.dll|wgpu_bindings::server::process_message(wgpu_bindings::server::Global*, ref$<slice2$<wgpu_bindings::ByteBuf> >, wgpu_bindings::FfiSlice<wgpu_bindings::FfiSlice<u8> >, enum2$<wgpu_bindings::Message>)|git:github.com/mozilla-firefox/firefox:gfx/wgpu_bindings/src/server.rs:9822ee9dfe9be4851b0466ebf21646d66a5b7960|2948|0x1b1d
31|13|xul.dll|wgpu_bindings::server::wgpu_server_messages(wgpu_bindings::server::Global*, unsigned int, wgpu_bindings::ByteBuf*, wgpu_bindings::FfiSlice<wgpu_bindings::ByteBuf>, wgpu_bindings::FfiSlice<wgpu_bindings::FfiSlice<u8> >)|git:github.com/mozilla-firefox/firefox:gfx/wgpu_bindings/src/server.rs:9822ee9dfe9be4851b0466ebf21646d66a5b7960|2674|0x67c
31|14|xul.dll|mozilla::webgpu::WebGPUParent::RecvMessages(unsigned int, mozilla::ipc::ByteBuf&&, nsTArray<mozilla::ipc::ByteBuf>&&, nsTArray<mozilla::ipc::shared_memory::Handle<0> >&&)|git:github.com/mozilla-firefox/firefox:dom/webgpu/ipc/WebGPUParent.cpp:9822ee9dfe9be4851b0466ebf21646d66a5b7960|1700|0x309
31|15|xul.dll|mozilla::webgpu::PWebGPUParent::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:e6528eacf6d5d6b1fa054dd520522b7283226b186bdb45c509097d619b922f2f73c7cf46c204a8d5f96c8f64707264087deeb2e98849a0cc2dfe813660bc766a/ipc/ipdl/PWebGPUParent.cpp:|322|0x3ac
31|16|xul.dll|mozilla::gfx::PCanvasManagerParent::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:4db1c935399938e54c4e8ac40060b1c95b54a7114c7ba9e1f03b259442b1e7224e296b397d2976c49ab5fa2a37dc6854de5e8d72bb339e36d0552f659ed389c3/ipc/ipdl/PCanvasManagerParent.cpp:|273|0x2d7
31|17|xul.dll|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessageChannel.cpp:9822ee9dfe9be4851b0466ebf21646d66a5b7960|1797|0x156
31|18|xul.dll|mozilla::ipc::MessageChannel::DispatchMessage(mozilla::ipc::ActorLifecycleProxy*, std::unique_ptr<IPC::Message,std::default_delete<IPC::Message> >)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessageChannel.cpp:9822ee9dfe9be4851b0466ebf21646d66a5b7960|1723|0x27e
31|19|xul.dll|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::ActorLifecycleProxy*, mozilla::ipc::MessageChannel::MessageTask&)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessageChannel.cpp:9822ee9dfe9be4851b0466ebf21646d66a5b7960|1512|0x181
31|20|xul.dll|mozilla::ipc::MessageChannel::MessageTask::Run()|git:github.com/mozilla-firefox/firefox:ipc/glue/MessageChannel.cpp:9822ee9dfe9be4851b0466ebf21646d66a5b7960|1614|0xdd
31|21|xul.dll|nsThread::ProcessNextEvent(bool, bool*)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThread.cpp:9822ee9dfe9be4851b0466ebf21646d66a5b7960|1174|0x8af
31|22|xul.dll|NS_ProcessNextEvent(nsIThread*, bool)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThreadUtils.cpp:9822ee9dfe9be4851b0466ebf21646d66a5b7960|471|0x70
31|23|xul.dll|mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*)|git:github.com/mozilla-firefox/firefox:ipc/glue/MessagePump.cpp:9822ee9dfe9be4851b0466ebf21646d66a5b7960|327|0x113
31|24|xul.dll|MessageLoop::RunHandler()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:9822ee9dfe9be4851b0466ebf21646d66a5b7960|364|0x3e
31|25|xul.dll|MessageLoop::Run()|git:github.com/mozilla-firefox/firefox:ipc/chromium/src/base/message_loop.cc:9822ee9dfe9be4851b0466ebf21646d66a5b7960|346|0x6e
31|26|xul.dll|nsThread::ThreadFunc(void*)|git:github.com/mozilla-firefox/firefox:xpcom/threads/nsThread.cpp:9822ee9dfe9be4851b0466ebf21646d66a5b7960|375|0x147
31|27|nss3.dll|_PR_NativeRunThread(void*)|git:github.com/mozilla-firefox/firefox:nsprpub/pr/src/threads/combined/pruthr.c:9822ee9dfe9be4851b0466ebf21646d66a5b7960|381|0x120
31|28|nss3.dll|pr_root(void*)|git:github.com/mozilla-firefox/firefox:nsprpub/pr/src/md/windows/w95thred.c:9822ee9dfe9be4851b0466ebf21646d66a5b7960|129|0x10

Comment 1

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20260717161234-1daac5fa8f14.
The bug appears to have been introduced in the following build range:

Start: f22c94882d3a8a408aa2cec7ebb8db9da0526923 (20260707132810)
End: cd01e00347b8c788bb3b09ccddcbf675e149e272 (20260707140006)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=f22c94882d3a8a408aa2cec7ebb8db9da0526923&tochange=cd01e00347b8c788bb3b09ccddcbf675e149e272

Comment 2

[BugBot [:suhaib / :marco]]

:teoxoy, since you are the author of the regressor, bug 2052109, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 3

[Andy Leiserson [:aleiserson]]

This was introduced by https://github.com/gfx-rs/wgpu/pull/9788. Since Teo is OoO, I will take it.

Comment 4

[Andy Leiserson [:aleiserson]]

Needs https://github.com/gfx-rs/wgpu/commit/c97d22fff4411228546f37bc7c532c158a61dc6e (2026-07-21).

Comment 5

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:jimb, could you have a look please?

For more information, please visit BugBot documentation.

Comment 6

[Andy Leiserson [:aleiserson]]

This should be fixed, but I have not verified (requires a debug build).

Comment 7

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20260810154837-1e704c6738f4.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.