Jason Kratzer [:jkratzer] Reporter
	Description • 6 years ago

Testcase found while fuzzing mozilla-central rev 9cd8e03d9e47.

rax = 0x0000000000000000   rdx = 0x0000000000000000
rcx = 0x00007f5004aca2dd   rbx = 0x00007f4fd996f000
rsi = 0x00007f5004d99770   rdi = 0x00007f5004d98540
rbp = 0x00007ffd77b7fc50   rsp = 0x00007ffd77b7fc30
r8 = 0x00007f5004d99770    r9 = 0x00007f5005e64740
r10 = 0x0000000000000039   r11 = 0x0000000000000000
r12 = 0x0000000000000502   r13 = 0x00007f4ff7b28ee0
r14 = 0x00007f4fd996f000   r15 = 0x00007ffd77b7fee8
rip = 0x00007f4ff41cd4f5
OS|Linux|0.0.0 Linux 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64
CPU|amd64|family 6 model 78 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|0
0|0|libxul.so|mozilla::gl::GLContext::AfterGLCall_Debug|hg:hg.mozilla.org/mozilla-central:gfx/gl/GLContext.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|3029|0x18
0|1|libxul.so|mozilla::WebGLContext::GetChannelBits|hg:hg.mozilla.org/mozilla-central:gfx/gl/GLContext.h:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|2041|0xf
0|2|libxul.so|mozilla::WebGLContext::GetParameter|hg:hg.mozilla.org/mozilla-central:dom/canvas/WebGLContextState.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|402|0x15
0|3|libxul.so|mozilla::WebGL2Context::GetParameter|hg:hg.mozilla.org/mozilla-central:dom/canvas/WebGL2ContextState.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|196|0xe
0|4|libxul.so|mozilla::WebGLContext::GetParameter|hg:hg.mozilla.org/mozilla-central:dom/canvas/WebGLContext.h:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|1020|0x9
0|5|libxul.so|mozilla::dom::WebGL2RenderingContextBinding::getParameter|s3:gecko-generated-sources:db33b7e35ade10b9e8ad0a63bae5aba14d7e355cc4b131daeaaf6ee456f43458cfeec1028f1e8a8961f0166e439abc3af54d5489ce6bf9590e00d03593bc2f49/dom/bindings/WebGL2RenderingContextBinding.cpp:|11551|0x1f
0|6|libxul.so|mozilla::dom::GenericBindingMethod|hg:hg.mozilla.org/mozilla-central:dom/bindings/BindingUtils.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|3031|0x9
0|7|libxul.so|js::CallJSNative|hg:hg.mozilla.org/mozilla-central:js/src/vm/JSContext-inl.h:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|290|0x6
0|8|libxul.so|js::InternalCallOrConstruct|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|467|0xf
0|9|libxul.so|InternalCall|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|516|0xd
0|10|libxul.so|Interpret|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|522|0xf
0|11|libxul.so|js::RunScript|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|417|0xb
0|12|libxul.so|js::ExecuteKernel|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|700|0x5
0|13|libxul.so|js::Execute|hg:hg.mozilla.org/mozilla-central:js/src/vm/Interpreter.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|733|0x5
0|14|libxul.so|ExecuteScript|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|4712|0x12
0|15|libxul.so|ExecuteScript|hg:hg.mozilla.org/mozilla-central:js/src/jsapi.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|4731|0x5
0|16|libxul.so|nsJSUtils::ExecutionContext::CompileAndExec|hg:hg.mozilla.org/mozilla-central:dom/base/nsJSUtils.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|266|0xc
0|17|libxul.so|mozilla::dom::ScriptLoader::EvaluateScript|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|2321|0x12
0|18|libxul.so|mozilla::dom::ScriptLoader::ProcessRequest|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|1950|0xb
0|19|libxul.so|mozilla::dom::ScriptLoader::ProcessInlineScript|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|1591|0xf
0|20|libxul.so|mozilla::dom::ScriptLoader::ProcessScriptElement|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptLoader.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|1310|0xb
0|21|libxul.so|mozilla::dom::ScriptElement::MaybeProcessScript|hg:hg.mozilla.org/mozilla-central:dom/script/ScriptElement.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|141|0x13
0|22|libxul.so|nsIScriptElement::AttemptToExecute|hg:hg.mozilla.org/mozilla-central:dom/script/nsIScriptElement.h:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|247|0x3
0|23|libxul.so|nsHtml5TreeOpExecutor::RunScript|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5TreeOpExecutor.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|736|0x10
0|24|libxul.so|nsHtml5TreeOpExecutor::RunFlushLoop|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5TreeOpExecutor.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|540|0x8
0|25|libxul.so|nsHtml5ExecutorFlusher::Run|hg:hg.mozilla.org/mozilla-central:parser/html/nsHtml5StreamParser.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|131|0x10
0|26|libxul.so|mozilla::SchedulerGroup::Runnable::Run|hg:hg.mozilla.org/mozilla-central:xpcom/threads/SchedulerGroup.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|413|0x1c
0|27|libxul.so|nsThread::ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThread.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|1096|0x15
0|28|libxul.so|NS_ProcessNextEvent|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|517|0x11
0|29|libxul.so|mozilla::ipc::MessagePump::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|97|0xa
0|30|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|326|0x17
0|31|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|319|0x8
0|32|libxul.so|nsBaseAppShell::Run|hg:hg.mozilla.org/mozilla-central:widget/nsBaseAppShell.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|157|0xd
0|33|libxul.so|XRE_RunAppShell|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|893|0x11
0|34|libxul.so|mozilla::ipc::MessagePumpForChildProcess::Run|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessagePump.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|269|0x5
0|35|libxul.so|MessageLoop::RunInternal|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|326|0x17
0|36|libxul.so|MessageLoop::Run|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|319|0x8
0|37|libxul.so|XRE_InitChildProcess|hg:hg.mozilla.org/mozilla-central:toolkit/xre/nsEmbedFunctions.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|719|0x8
0|38|firefox|content_process_main|hg:hg.mozilla.org/mozilla-central:ipc/contentproc/plugin-container.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|50|0x14
0|39|firefox|main|hg:hg.mozilla.org/mozilla-central:browser/app/nsBrowserApp.cpp:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|280|0x11
0|40|libc-2.23.so||||0x20830
0|41|firefox|MOZ_ReportAssertionFailure|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:9cd8e03d9e472f07041be3cd80cc95a8194f91a5|164|0x5

	Aria Beingessner [:Gankra]
	Comment 1 • 6 years ago

Confirmed instantly crashes the tab on my local Ubuntu machine. Works fine on macos.

	Kelsey Gilbert [:jgilbert] Assignee
	Comment 2 • 6 years ago

If you could run these through a DEBUG non-OPT build after finding they crashed, that'd be ideal. This crash stack is missing a frame or two. (which GL command is it?)

	Kelsey Gilbert [:jgilbert] Assignee
	Comment 4 • 6 years ago

For the record, I don't need you to look that up, since I can find it by running a debug build, but it's nice to be able to skip that step, if it can be automated. If it makes things too complicated, it doesn't really matter though. It would merely be a nice-to-have!

	Dzmitry Malyshau [:kvark]
	Comment 5 • 6 years ago
mozreview-review

Comment on attachment 8962585 [details]
Bug 1446412 - Forbid implicit construction of WebGLFBAttachPoint. -

https://reviewboard.mozilla.org/r/231394/#review237070

Looks fine by me, although I'm missing the context on why we are doing that.

	Pulsebot
	Comment 6 • 6 years ago

Pushed by jgilbert@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e3334509e606
Don't query GL for RED_BITS and friends queries. - r=kvark

	Stefan Hindli [:stefan_hindli]
	Comment 7 • 6 years ago

Backed out changeset e3334509e606 (bug 1446412) for gl failures in /builds/worker/workspace/build/src/dom/canvas/WebGLFramebuffer.cpp:44 on a CLOSED TREE

Problematic push: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=e3334509e606348f90f524a96adfb8e9dbcf8789&filter-resultStatus=testfailed&filter-resultStatus=busted&filter-resultStatus=exception&filter-classifiedState=unclassified
Failure: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&filter-resultStatus=testfailed&filter-resultStatus=busted&filter-resultStatus=exception&filter-classifiedState=unclassified&selectedJob=170647298
Backout: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=dc273da372bd8dcb4792000f724a7a523c2c071f&filter-resultStatus=testfailed&filter-resultStatus=busted&filter-resultStatus=exception&filter-classifiedState=unclassified
Log: https://treeherder.mozilla.org/logviewer.html#?job_id=170647298&repo=mozilla-inbound&lineNumber=3652

12:57:29     INFO - GECKO(760) | Assertion failure: !mTexturePtr, at /builds/worker/workspace/build/src/dom/canvas/WebGLFramebuffer.cpp:44
12:58:18     INFO - GECKO(760) | #01: mozilla::WebGLContext::GetParameter(JSContext*, unsigned int, mozilla::ErrorResult&) [dom/canvas/WebGLContextState.cpp:362]

	Pulsebot
	Comment 9 • 6 years ago

Pushed by jgilbert@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4ffac3c10aa5
Don't query GL for RED_BITS and friends queries. - r=kvark
https://hg.mozilla.org/integration/mozilla-inbound/rev/4a9e0098d23b
Forbid implicit construction of WebGLFBAttachPoint. - r=kvark

	Stefan Hindli [:stefan_hindli]
	Comment 10 • 6 years ago
bugherder

https://hg.mozilla.org/mozilla-central/rev/4ffac3c10aa5
https://hg.mozilla.org/mozilla-central/rev/4a9e0098d23b