Closed Bug 1352092 Opened 7 years ago Closed 7 years ago

Crash in mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert

Categories

(Core :: Graphics: WebRender, defect)

55 Branch
x86_64
Linux
defect
Not set
critical

Tracking

()

VERIFIED FIXED
mozilla57
Tracking Status
firefox-esr52 --- unaffected
firefox55 --- disabled
firefox56 --- disabled
firefox57 --- fixed

People

(Reporter: 6lobe, Assigned: jerry)

References

(Blocks 1 open bug)

Details

(Keywords: crash, nightly-community)

Crash Data

Attachments

(5 files, 1 obsolete file)

Attached image screenshot.png
This bug was filed from the Socorro interface and is 
report bp-e9d46443-e460-4277-98e6-1c7562170330.
=============================================================

I can consistently reproduce this crash by opening the following page:

http://portableapps.com/apps/games/freeciv_portable

And clicking the image of the game in the Features section which you can see on the right in the attached screenshot.
Blocks: 1342450
Has STR: --- → yes
Version: 50 Branch → Trunk
(I removed the blocking relationship to 1342450 because you need to manually enable webrender to hit this bug, it's not an "unexpected regression" from building webrender)
Crash Signature: [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert] → [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert] [@ mozalloc_abort | abort | panic_abort::__rust_start_panic | webrender::texture_cache::TextureCache::insert]
Keywords: crash
I also hit this crash while clicking around on yahoo.com in a local Windows build with VS2015 attached. It hit the panic at the top of the TextureCache::insert function. No useful stack.
Blocks: 1367243
Status: UNCONFIRMED → NEW
Ever confirmed: true
Version: Trunk → 55 Branch
STR for me: Scrolling down a long friends list on a Facebook profile.
Meldungs-ID 	Sendedatum
bp-4a8f8874-5fad-494f-bd11-808010170606	06.06.17	12:36
bp-2eeb236d-a301-4e54-b5df-171ca0170606	06.06.17	12:36
bp-b32be9c9-62d4-4148-9080-f4dda0170606	06.06.17	12:36
bp-105bd01c-9b0b-40e1-8c63-b414c0170606	06.06.17	12:36
bp-a7f6167e-88f9-4595-ad3a-e1be20170606	06.06.17	12:35
bp-76c8dcf1-542b-4e4f-bee2-a87390170606	06.06.17	12:35
bp-7dbe6394-0c68-4cf8-a235-7baab0170606	06.06.17	12:35
bp-5dfab6f7-b72a-4083-8e78-64c520170606	06.06.17	12:35
bp-3f8f4bd4-bdc6-4237-a703-d05f90170606	06.06.17	12:35
bp-d6ac73aa-1bc3-4ae0-8d82-740840170606	06.06.17	12:35
bp-e5ae7392-fb85-410e-a1cb-1805d0170606	06.06.17	12:35
bp-b5110029-3fb1-4b14-ab40-2803a0170606	06.06.17	12:35
bp-819b4c7b-293e-42b1-9d7e-c01d40170606	06.06.17	12:35
bp-5fa8386a-5648-4246-8275-41f960170606	06.06.17	12:35
bp-d1e98efb-4932-43ce-8e74-7d3e40170606	06.06.17	12:35
bp-5bfe62af-d380-4406-9bc4-187150170606	06.06.17	12:35
bp-d9333bf9-a7c4-45c3-acf1-0a14e0170606	06.06.17	12:35
bp-50f32259-82fa-4df8-8965-651a80170606	06.06.17	12:35
bp-6a11ed1e-d527-4222-8624-d89f00170606	06.06.17	12:35
bp-f6d7c24d-9d02-42ea-8089-8e0950170606	06.06.17	12:35
bp-c4cf721d-677b-49e3-b000-15aae0170606	06.06.17	12:35
bp-1bb2be7a-6f95-4c58-ab26-612c20170606	06.06.17	12:35
bp-6950cccc-83d1-4233-bde7-329a90170606	06.06.17	12:35 [@ @0x405ab7 ]
bp-17ab0c36-ce42-401b-83b0-b30890170606	06.06.17	12:35
bp-ed80f929-d710-4fb4-9a73-df86c0170606	06.06.17	12:35
bp-f396f414-c562-4aa5-85e0-d04320170606	06.06.17	12:35
bp-a192468d-1baa-467e-ac4d-622540170606	06.06.17	12:35
bp-f56c1c8a-dde2-489d-a7f4-81a970170606	06.06.17	12:35
bp-de6e7c08-8dc6-4122-8b3c-77da10170606	06.06.17	12:32
No longer blocks: wr-stability
Depends on: wr-stability
See Also: → 1370649
#2 Linux crash for the June 7 Nightly, with 21% of all crashes. (#1 and about 40% of all crashes if you ignore shutdown hangs.)
I think that is Bug 1370839. We hit the limit of WR texture size. Then, the assertion occurs.
Depends on: 1370839
Build 20170618100241 @ Debian testing x64
1. Open https://gogs.io/docs/advanced/configuration_cheat_sheet (with webrender enabled, webrendest does not matter)
2. The whole window shows graphical nonsense.
bp-79da9d76-fbc5-43d9-9e67-f12d10170618	18.06.17	21:27
bp-4858fa1f-8f1b-43fc-9bfc-9f67e0170618	18.06.17	21:27
3. Ctrl+W, everything is fine now
Build 20170619100247 @ Debian testing x64

My whole computer crashes if I use web.whatsapp.com for a longer time with gpu-process + webrender + webrendest enabled.

Meldungs-ID  Sendedatum
bp-cd6b7906-a32d-4c4e-babe-098490170619 19.06.17 10:58 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-2059fec2-da4d-4a56-8438-c930c0170619 19.06.17 10:58 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-8bf8c6c9-de29-4717-809b-7e8300170619 19.06.17 10:58 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-75da883f-8c9f-4833-aa80-10dc60170619 19.06.17 10:58 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-e1d2a292-9a78-46cb-8683-e27770170619 19.06.17 10:58 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-78513a1a-93dc-4e7b-be6e-e39d60170619 19.06.17 10:58 [@ mozilla::layers::CompositorManagerChild::Init ]
= seems new, no bug filled so far

bp-79da9d76-fbc5-43d9-9e67-f12d10170618 18.06.17 21:27 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-4858fa1f-8f1b-43fc-9bfc-9f67e0170618 18.06.17 21:27 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug

bp-847c339b-7231-4286-8b32-82e400170618 18.06.17 20:52 [@ @0x405b17 ]
= wtf
bp-c8593c0a-74e3-4856-9b8e-077980170618 18.06.17 20:52 [@ mozilla::layers::PWebRenderBridgeChild::SendCreate ]
= bug 1350408
bp-833bd85d-6797-4a9f-be1e-40c550170618 18.06.17 20:52 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-aef1b972-3f00-40b1-81be-c53870170618 18.06.17 20:52 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-686d4b17-c497-4ff1-9a2d-c425c0170618 18.06.17 20:52 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-0977faf6-99ff-4bdc-954d-1ae810170618 18.06.17 20:52 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-be8431ef-479d-4c38-a21b-58dc80170618 18.06.17 20:52 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-ed84dd87-6ac4-407b-a76b-1b4b50170618 18.06.17 20:52 [@ mozilla::layers::CrossProcessCompositorBridgeParent::AllocPWebRenderBridgeParent ]
= bug 1350404
bp-b277f9e2-b6e7-4488-bd46-a61ca0170618 18.06.17 20:52 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-ecab6aef-536c-4542-83e1-574ed0170618 18.06.17 20:52 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-c1085458-134c-4385-8ad4-ced440170618 18.06.17 20:52 [@ mozilla::layers::PWebRenderBridgeChild::SendCreate ]
= bug 1350408
bp-67e3a0f9-9f8e-42e1-9439-777fb0170618 18.06.17 20:52 [@ mozilla::layers::CompositorManagerChild::Init ]
= seems new, no bug filled so far
bp-cdbdbaba-ff58-4c3f-a997-238e30170618 18.06.17 20:52 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-bdf16eb5-8349-4582-a503-491550170618 18.06.17 20:52 [@ mozilla::layers::PWebRenderBridgeChild::SendCreate ]
= bug 1350408
bp-af48866b-3f5c-4fc7-a206-f41710170618 18.06.17 20:52 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-e6006a94-8c66-4040-9b31-e9a690170618 18.06.17 20:52 [@ mozilla::layers::PWebRenderBridgeChild::SendCreate ]
= bug 1350408
bp-7d09fa2a-cbf2-42b8-977e-910b90170618 18.06.17 20:52 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
(In reply to Darkspirit from comment #6)
> Crash on https://css-tricks.com/examples/ShapesOfCSS/

See also: bug 1372216 (This bug on Windows with a slightly different crash signature)
Assignee: nobody → hshih
Status: NEW → ASSIGNED
This is the #1 Linux topcrash in Nightly 20170623100152. Over the past 7 days there have been 97 crashes over 5 installations.
Nightly 56 build 20170630100234 @ Debisn testing x64 (Radeon RX480)

Opened https://twitter.com/lgarron/status/881168145800679428 with webrender enabled
Scrolled to the top, waited a moment, Twitter loaded some more answers, scrolled down. browser crashed.
Restarted. I have open some tabs now: session restore (nothing clicked), about:crashes and this tab.

Meldungs-ID 	Sendedatum
bp-01cb3cee-e271-487a-8132-d29840170701	01.07.17 19:16
bp-831bd1c5-4ac9-4a22-adf4-a5d510170701	01.07.17 19:16
bp-a7d7e2f8-b3cc-4688-adfa-8a3a70170701	01.07.17 19:16 all three are [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
= this bug
bp-ac5667c6-b518-47c7-9e1b-3b5b30170701	01.07.17 19:15 [@ @0x405ad1 ]
> bug 1377113: MOZ_CRASH Reason: assertion failed: requested_size.height <= self.max_texture_size

The last crash before these was...
bp-3d3b75f9-69e1-4eca-b308-82fa70170701	01.07.17 17:10 [@ sk_memset32 ]
...a test for another bug and I had my computer off for about an hour after this. So you can see the above crashes (19:15 - 19:16) are related to each other.

While filing this comment, I got a frozen desktop (bug 1377120). Had to press the reset button.
After the booting and starting Nightly, I accepted to restore the session and thankfully this comment was still in this textarea so I could finish it.
(In reply to Darkspirit from comment #11)
These are reliable STR for me!

Then, after the 7th browser crash and session restoration because of this, my desktop (and this time even the mouse) freezed (bug 1377120).

Gesendete Absturzberichte
Meldungs-ID 	Sendedatum
bp-3fdae3cd-f738-48ff-8362-f7e3d0170701	01.07.17 19:39
bp-d5c1dbf0-eb5b-4658-b787-38fff0170701	01.07.17 19:39
bp-c2c56651-e5c2-4eca-b907-94ccf0170701	01.07.17 19:38
bp-bebdbfb9-52a3-4687-909a-6ddf90170701	01.07.17 19:38
bp-5914515b-d21c-4ed7-8702-f65c30170701	01.07.17 19:37
bp-48bbc848-6228-4b30-aca9-d0eca0170701	01.07.17 19:37
bp-1a75f844-1d99-4f8c-a320-5fcf40170701	01.07.17 19:35
bp-3ba7e11e-f96b-4db6-8edd-f2a050170701	01.07.17 19:34
bp-b340fa72-c561-42e8-b317-d8f9b0170701	01.07.17 19:33 until here all are [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::insert ]
> this bug: MOZ_CRASH Reason: assertion failed: requested_size.height <= self.max_texture_size

bp-02838e3b-22fe-4be5-af9e-a4d840170701	01.07.17 19:33 [@ @0x405ad1 ]
> bug 1377113: assertion failed: requested_size.height <= self.max_texture_size

Below this crash are the crashes from comment 11.

You see, this bug and bug 1377113 have the same crash reason.
Reproduced comment 11 with
Nightly 56 x64 20170701100236 @ Debian Testing (Linux 4.9.0-3-amd64, Radeon RX480)
and got a new crash signature between this: bug 1375058 [@ @0x405b17 ]

bp-6084139b-e49a-4500-84e1-25e000170702	02.07.17 16:29 TextureCache::insert
bp-67b89445-3e6f-44db-8be2-3e92c0170702	02.07.17 16:28 TextureCache::insert
bp-c1be35bd-b0e0-4030-a615-4ff3a0170702	02.07.17 16:28 TextureCache::insert
bp-87be357d-9f27-4b3d-b309-d4ae40170702	02.07.17 16:28 TextureCache::insert
bp-46ddff24-8e90-450a-8b36-bcb840170702	02.07.17 16:28 TextureCache::insert
bp-587d8770-6f8d-419c-9c45-ff7c70170702	02.07.17 16:27 TextureCache::insert
bp-61b1961d-07d8-4ee9-b6da-096750170702	02.07.17 16:24 [@ @0x405b17 ]
> bug 1375058: assertion failed: requested_size.height <= self.max_texture_size
bp-c1ca4a36-4860-47fd-be1a-3029c0170702	02.07.17 16:23 TextureCache::insert
> all crashes with this signature have: assertion failed: requested_size.height <= self.max_texture_size

bug 1375058 ([@ @0x405b17 ]) only had
> bp-d05f4fc0-613e-4289-b9b4-8634e0170621	
> Process Type: gpu (web)
> MOZ_CRASH Reason: MOZ_CRASH()
> Crash Reason: SIGSEGV
in the past when I had the gpu-process enabled,
but now has that precise and well-known crash reason you can see above.
Is it possible that this problem can go away over time with those "Update webrender to <random>" bugs?
I had a painful data loss when my desktop freezed, so I had to disable WebRender roughly 2 weeks ago and had no problems anymore.
(In reply to Darkspirit from comment #14)
> Is it possible that this problem can go away over time with those "Update
> webrender to <random>" bugs?

It's possible, yes. If you're up for it, it might be worth re-enabling WR after those update bugs land to see if it has fixed the problem or not.
Attached image IMG_1323.JPG
(In reply to Kartikaya Gupta (email:kats@mozilla.com) from comment #15)
> (In reply to Darkspirit from comment #14)
> > Is it possible that this problem can go away over time with those "Update
> > webrender to <random>" bugs?
> 
> It's possible, yes. 
Then I will try again and again
> If you're up for it,
WebRender is cool and important and thank you for working on it! As this bug is a blocker for me and I couldn't find any other bug I am helping out in bug 1375906 to find Stylo bugs. But I want permanently reenable WebRender as soon as possible. ;)
> it might be worth re-enabling WR after those update bugs land to see if it has fixed the problem or not.

I could reproduce with STR from comment 11 in
Nightly 56 x64 20170714100217 @ Debian Testing (Linux 4.11.0-1-amd64, Radeon RX480)
with a fresh profile and webrender enabled. The attached image is a photo of my freezed screen where Nightly just crashed and wanted to close its main window to show the crash reporter. The freeze happened after the ~12th crash or so, bp-b3778ba0-5dcc-4e7b-a06a-e543c0170714 was the last on about:crashes for example. Would a RUST_LOG=debug log help? I was asked for such one in bug 1378064 comment 10 and it seemed to help a bit.
I will try to handle the big size image problem this week.
See Also: → 1385588
See Also: → 1383731
I'm working on this bug this week.
After some testing and talking with @nical, the "external image buffer" could use tiling. But if we use mask, there will be no tiling. And WR doesn't support tiling for yuv image.

Here is a test page for mask:
https://github.com/JerryShih/test_page/tree/gh-pages

The gecko still does the clipping for painted layer, so I can't get a large size of mask image(8865x5288 in this case) with this test page. So, I set the maximum texture size into 2048[1]. Then, I could hit the texture size assertion. The WR could have tiling for external image buffer(the bufferTextureHost in gecko), but no tiling for mask.

I still don't know why we have an assertion like[2]. I think gecko will not pass a big size of mask image. Anyway, we will have the crash problem if we play a big video.

[1]
https://hg.mozilla.org/mozilla-central/annotate/7ce557b85b61/gfx/webrender/src/texture_cache.rs#l693
[2]
https://crash-stats.mozilla.com/report/index/da5b5deb-e838-488f-920a-b76380170723
And I try to avoid the assertion in WR.
https://github.com/servo/webrender/issues/1405
In https://github.com/servo/webrender/pull/1564, WR will use a dummy texture to avoid the big size texture. That could prevent the crash problem, but the screen result will be incorrect.

Thanks to :sotaro. Here is a test url[1] to reproduce the crash. In [1], we will have a big mask layer for the border-radius property. Before we remove the mask layer, I'm going to skip the mask layer creation if the mask layer is to large.

[1]
http://www.mmo-champion.com/content/6669-Interview-Darkmoon-Faire-Class-Mounts-Power-Ascended-Raid-Testing-Armory-Update
TextureCache::max_texture_size and device's max texture size could be different. The TextureCache::max_texture_size was limited to SQRT_MAX_RGBA_PIXELS_PER_TEXTURE(8192) by the following.
https://github.com/servo/webrender/blob/master/webrender/src/texture_cache.rs#L565

gecko side just use device_max_size(16384) to create Mask Layer, therefore there could be a case that exceed TextureCache::max_texture_size(8192).

gecko limits MaskImage's max size with ContainerState::CreateMaskLayer()
https://dxr.mozilla.org/mozilla-central/source/layout/painting/FrameLayerBuilder.cpp#6423

It uses device_max_size(16384) not TextureCache::max_texture_size(8192), then it could hit the assert. If ContainerState::CreateMaskLayer() limits the max size to TextureCache::max_texture_size(8192), [1] in Comment 23 does not hit the assert.
MozReview-Commit-ID: 9SKUFytsyxw
MozReview-Commit-ID: LyCAVXDi9jZ
The gecko side just queries the max texture size from gl context[1]. We
should query that size from WR.

[1]
https://dxr.mozilla.org/mozilla-central/rev/4c5fbf49376351679dcc49f4cff26c3c2e055ccc/gfx/webrender_bindings/WebRenderAPI.cpp#72

MozReview-Commit-ID: 6RQ8ZW9mWSE
Attachment #8895732 - Flags: review?(nical.bugzilla)
Attachment #8895732 - Flags: review?(nical.bugzilla) → review+
Attachment #8895732 - Attachment is obsolete: true
Pushed by hshih@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/71407855e9a6
Get the max texture size from WR. r=nical
https://hg.mozilla.org/mozilla-central/rev/71407855e9a6
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
(In reply to Jan Andre Ikenmeyer [:darkspirit] from comment #11)
> Nightly 56 build 20170630100234 @ Debian testing x64 (Radeon RX480)
> 
> Opened https://twitter.com/lgarron/status/881168145800679428 with webrender enabled
> Scrolled to the top, waited a moment, Twitter loaded some more answers, scrolled down. browser crashed.

Nightly 57 x64 20170813100233 @ Debian Testing.
Can't reproduce my old STR anymore! :)
And nothing scary in the console anymore.
> WebRender - OpenGL version new 4.3 (Core Profile) Mesa 13.0.6                                                                              
> WebGL(0x7f472d858800)::ForceLoseContext                                                                                                    
> WebGL(0x7f472d859800)::ForceLoseContext

All the last crashes were from my last test in comment 17 with 20170714100217.
Status: RESOLVED → VERIFIED
See Also: 1372216
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: