SetAsGPUOutOfMemoryError() called but its OwningNonNull is left uninitialized
Categories
(Core :: Graphics: WebGPU, defect, P1)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr102 | --- | unaffected |
firefox-esr115 | --- | unaffected |
firefox114 | --- | unaffected |
firefox115 | --- | unaffected |
firefox116 | --- | fixed |
People
(Reporter: jgilbert, Assigned: jgilbert)
References
(Regression)
Details
(Keywords: regression)
Attachments
(1 file)
(deleted),
text/x-phabricator-request
|
Details |
Assignee | ||
Comment 1•1 year ago
|
||
From bug 1838703, here's the root cause analysis for the regression surfaced (though not introduced) by bug 1837557.
class OwningGPUOutOfMemoryErrorOrGPUValidationError : public AllOwningUnionBase
[...]
union Value
{
UnionMember<OwningNonNull<mozilla::webgpu::OutOfMemoryError> > mGPUOutOfMemoryError;
UnionMember<OwningNonNull<mozilla::webgpu::ValidationError> > mGPUValidationError;
};
TypeOrUninit mType;
Value mValue;
OwningNonNull<mozilla::webgpu::OutOfMemoryError>&
OwningGPUOutOfMemoryErrorOrGPUValidationError::SetAsGPUOutOfMemoryError()
{
if (mType == eGPUOutOfMemoryError) {
return mValue.mGPUOutOfMemoryError.Value();
}
Uninit();
mType = eGPUOutOfMemoryError;
return mValue.mGPUOutOfMemoryError.SetValue();
}
class UnionMember {
AlignedStorage2<T> mStorage;
[...]
template <typename... Args>
T& SetValue(Args&&... args) {
new (mStorage.addr()) T(std::forward<Args>(args)...);
return *mStorage.addr();
}
template <class T>
class MOZ_IS_SMARTPTR_TO_REFCOUNTED OwningNonNull {
public:
using element_type = T;
OwningNonNull() = default;
The problem is that SetValue() in-place constructs the union variant, and in this case the union variant isn't OutOfMemory (which has a deleted ctor), it's OwningNonNull<OutOfMemory>
, which does have a super dangerous default constructor!
Assignee | ||
Updated•1 year ago
|
Assignee | ||
Comment 2•1 year ago
|
||
Assignee | ||
Comment 3•1 year ago
|
||
The patch here is required for the patch in bug 1838703 to work, since bug 1838703 catches this issue.
Assignee | ||
Updated•1 year ago
|
Assignee | ||
Updated•1 year ago
|
Updated•1 year ago
|
Updated•1 year ago
|
Pushed by jgilbert@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/8599db8132f9 Initialize result of SetAsGPUOutOfMemoryError. r=webgpu-reviewers,nical
Comment 5•1 year ago
|
||
Set release status flags based on info from the regressing bug 1837557
Assignee | ||
Updated•1 year ago
|
Comment 6•1 year ago
|
||
Backed out for causing build bustages on OutOfMemoryError.h.
Failure log: https://treeherder.mozilla.org/logviewer?job_id=419505508&repo=autoland
Backout link: https://hg.mozilla.org/integration/autoland/rev/fa529bbf11c86465c2e1ecfd68b07ae27cbfcb87
Comment 7•1 year ago
|
||
I believe that :jgilbert has addressed the cause of the backout in D181161 already (added explicit
to the OutOfMemoryError
constructor), so I'm gonna try to land this.
Pushed by egubler@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/0ec4b06c796a Initialize result of SetAsGPUOutOfMemoryError. r=webgpu-reviewers,nical
Comment 9•1 year ago
|
||
Backed out for causing build bustages in OutOfMemoryError.h
- Backout link
- Push with failures
- Failure Log
- Failure line: builds/worker/workspace/obj-build/dist/include/mozilla/webgpu/OutOfMemoryError.h:24:12: error: missing return type for function 'sOutOfMemoryError'; did you mean the constructor name 'OutOfMemoryError'?
Comment 10•1 year ago
|
||
Pushed by jgilbert@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/1f0ecff11fae Initialize result of SetAsGPUOutOfMemoryError. r=webgpu-reviewers,nical
Assignee | ||
Updated•1 year ago
|
Comment 11•1 year ago
|
||
bugherder |
Comment 12•1 year ago
|
||
Set release status flags based on info from the regressing bug 1837557
Description
•