Closed Bug 1749225 Opened 3 years ago Closed 3 years ago

src/program.h:72:5: runtime error: call to function cs_clip_rectangle_vert::set_uniform_1i(cs_clip_rectangle_vert*, int, int) through pointer to incorrect function type 'void (*)(glsl::VertexShaderImpl *, int, int)'

Categories

(Core :: Graphics: WebRender, defect)

defect

Tracking

()

RESOLVED FIXED
98 Branch
Tracking Status
firefox97 --- wontfix
firefox98 --- fixed

People

(Reporter: tsmith, Assigned: lsalzman)

References

(Blocks 1 open bug)

Details

(Keywords: csectype-undefined)

Attachments

(1 file, 1 obsolete file)

Found with m-c 20220108-4531cca1d7f9
This is periodically triggered on start up with an UBSan build. To enable this check add the following to your mozconfig:

ac_add_options --enable-undefined-sanitizer="function"

Note the build is blocked on bug 1747298 which has a pending fix.

src/program.h:72:5: runtime error: call to function cs_clip_rectangle_vert::set_uniform_1i(cs_clip_rectangle_vert*, int, int) through pointer to incorrect function type 'void (*)(glsl::VertexShaderImpl *, int, int)'
src/objdir-ff-ubsan/x86_64-unknown-linux-gnu/release/build/swgl-81e23a6b5b5d5a82/out/cs_clip_rectangle.h:523: note: cs_clip_rectangle_vert::set_uniform_1i(cs_clip_rectangle_vert*, int, int) defined here
    #0 0x7fa55feb49fa in set_uniform_1i src/gfx/wr/swgl/src/program.h:72:5
    #1 0x7fa55feb49fa in Uniform1i src/gfx/wr/swgl/src/gl.cc:2042:20
    #2 0x7fa55efa83be in webrender::device::gl::Device::bind_shader_samplers::h9bd54e785702a26a src/gfx/wr/webrender/src/device/gl.rs:2984:17
    #3 0x7fa55faed3e0 in webrender::renderer::shade::LazilyCompiledShader::get_internal::h8b90c0b086fcf3d0 src/gfx/wr/webrender/src/renderer/shade.rs
    #4 0x7fa55faec598 in webrender::renderer::shade::LazilyCompiledShader::bind::hd58153f3360f20ee src/gfx/wr/webrender/src/renderer/shade.rs:150:29
    #5 0x7fa55f1f34e4 in webrender::renderer::Renderer::draw_clip_batch_list::hda5fb94d123098c4 src/gfx/wr/webrender/src/renderer/mod.rs:3738:13
    #6 0x7fa55f1fdb5d in webrender::renderer::Renderer::draw_alpha_target::hc8f2f66a6e80148d src/gfx/wr/webrender/src/renderer/mod.rs:3970:13
    #7 0x7fa55f1fdb5d in webrender::renderer::Renderer::draw_frame::hd5decbfd2239f2cf src/gfx/wr/webrender/src/renderer/mod.rs:4745:17
    #8 0x7fa55f1df7aa in webrender::renderer::Renderer::render_impl::he0ece11432c9a6eb src/gfx/wr/webrender/src/renderer/mod.rs:2002:17
    #9 0x7fa55f1dc607 in webrender::renderer::Renderer::render::hee7ce0b8d1719409 src/gfx/wr/webrender/src/renderer/mod.rs:1724:30
    #10 0x7fa55ea49abd in wr_renderer_render src/gfx/webrender_bindings/src/bindings.rs:622:11
    #11 0x7fa54e5dd042 in mozilla::wr::RendererOGL::UpdateAndRender(mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, bool*, mozilla::wr::RendererStats*) src/gfx/webrender_bindings/RendererOGL.cpp:185:8
    #12 0x7fa54e5db4b4 in mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> const&, mozilla::TimeStamp const&, bool, mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, bool*) src/gfx/webrender_bindings/RenderThread.cpp:516:31
    #13 0x7fa54e5da1f3 in mozilla::wr::RenderThread::HandleFrameOneDoc(mozilla::wr::WrWindowId, bool) src/gfx/webrender_bindings/RenderThread.cpp:368:3
    #14 0x7fa54e605676 in apply<mozilla::wr::RenderThread, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, bool)> src/objdir-ff-ubsan/dist/include/nsThreadUtils.h:1153:12
    #15 0x7fa54e605676 in mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, bool), true, (mozilla::RunnableKind)0, mozilla::wr::WrWindowId, bool>::Run() src/objdir-ff-ubsan/dist/include/nsThreadUtils.h:1200:13
    #16 0x7fa54ac49434 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:1189:16
    #17 0x7fa54ac53a91 in NS_ProcessNextEvent(nsIThread*, bool) src/xpcom/threads/nsThreadUtils.cpp:467:10
    #18 0x7fa54c475ef4 in mozilla::ipc::MessagePumpForNonMainThreads::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:300:20
    #19 0x7fa54c274e82 in RunHandler src/ipc/chromium/src/base/message_loop.cc:324:3
    #20 0x7fa54c274e82 in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:306:3
    #21 0x7fa54ac4160e in nsThread::ThreadFunc(void*) src/xpcom/threads/nsThread.cpp:391:10
    #22 0x7fa57a9e56d3 in _pt_root src/nsprpub/pr/src/pthreads/ptthread.c:201:5
    #23 0x7fa57a62e6da in start_thread /build/glibc-S9d2JN/glibc-2.27/nptl/pthread_create.c:463
    #24 0x7fa57960c71e in __clone /build/glibc-S9d2JN/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
Severity: -- → S4

Due to the presence of multiple inheritance the implicit downcasting involved in
casting these function pointers may result in undesirable undefined behavior. Use
void pointer for now to avoid this and make the behavior a bit less undefined.

Assignee: nobody → lsalzman
Status: NEW → ASSIGNED

Due to the presence of multiple inheritance, casting between ShaderImpl and
derived types in function pointers may be classified as undefined behavior.
While the multiple inheritance chain tries to ensure that the ShaderImpl
is the first in the list of class parents, this might not be sufficiently
safe. Explicitly do the casting of individual parameters without casting the
function pointers to work around this.

Attachment #9260123 - Attachment is obsolete: true
Pushed by lsalzman@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/ba18c6833fd6
Avoid casting function pointers in glsl-to-cxx. r=aosmond
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → 98 Branch
You need to log in before you can comment on or make changes to this bug.