1360613 - webrender: crash on video fullscreen, on tab switching while video is playing, close multiple tabs popup

Status: VERIFIED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Darkspirit]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0
Build ID: 20170428100438

Steps to reproduce:

set gfx.webrender.enabled to true
open any youtube video (/watch?v=xxxxxxxxx)
click on the fullscreen button on the bottom right of the video
Firefox crashes, I hear the audio playing for the few seconds even the firefox window is already gone.
With webrender disabled, everything works as expected.


Actual results:

bp-557fcc19-1e3c-4275-aca1-c81660170428
bp-7775991e-1299-47e6-9183-d72230170428
bp-61677c2e-e248-40a5-aedb-cc5e80170428

Comment 1

[Darkspirit]

a random vimeo video, just clicked to make it fullscreen, crash bp-4bde089f-b2cf-46db-9302-6e9650170428
I am using Debian Testing 64 bit. And this profile is not older than a week.

Comment 2

[Darkspirit]

Playing a mp4 video from file:// is funny because the audio keeps playing until the video's end, even firefox crashed, is already restarted by the crash reporter with a restored session and the same video is playing in the only tab, but I can hear 2 audio streams (the one from the crashed firefox and the one from my visible tab)
bp-36bfc8ee-d359-4c18-85a2-913860170428 and bp-e2928312-5ef3-4d86-9dfd-33a4d0170428

Comment 3

[Darkspirit]

I have forgotten to mention that this behavior is very new: at maximum 2 days old.

Comment 4

[Darkspirit]

I started a HLS live stream[1] and opened another tab. Then I switched back to the tab with the live stream: Crash. This only happens with gfx.webrender.enabled=true.
bp-0d544422-cd94-41e1-9b52-b7fc90170428
bp-f3162da7-71dc-46d8-9161-429420170428
bp-930ba341-4bce-4c00-8912-cd62a0170428
bp-1d27a11a-9b76-44a6-880b-8a5320170428
bp-3015bc6f-5223-4552-bf66-025020170428

[1] https://www.zdf.de/live-tv

Comment 5

[Darkspirit]

The same webrender-only STR work on a fresh Nightly 64 bit on a fresh installed Windows 10, but the crash signature is different. And we have another webrender-only STR. I even had some tab-only crashes.

bp-84c7e653-0823-408e-88a1-d40710170429 [@ mozilla::layers::TextureClient::BorrowDrawTarget ]
the popup which wanted to ask if I want to close multiple tabs when closing firefox was black inside and firefox crashed.

bp-b0f1d029-4c3c-426b-a43a-a9c5e0170429 [@ mozilla::layers::TextureClient::BorrowDrawTarget ]

bp-37118111-2caf-4fa3-9dfa-96e4f0170429 [@ mozilla::layers::TextureClient::BorrowDrawTarget ] play vimeo video, open new tab, switch back. whole browser crash.

bp-5c6c4440-a02f-43e9-b8a2-5ea0c0170429 [@ mozilla::layers::TextureClient::BorrowDrawTarget ]

bp-614a7fc9-f1f3-4258-b02e-275e80170429 [@ mozilla::layers::TextureClient::BorrowDrawTarget ] vimeo video fullscreen. but only a tab crash, not the whole firefox. this is new.

bp-1ef465fa-0dba-4480-a9de-d880f0170429 [@ mozilla::layers::TextureClient::BorrowDrawTarget ] 

bp-c50ad632-c74d-41fd-8002-390420170429  [@ mozilla::layers::TextureClient::BorrowDrawTarget ] play a youtube video, open a new tab, switch back. crash

bp-72188398-739d-4cd2-bb7d-f0cba0170429 [@ mozilla::layers::TextureClient::BorrowDrawTarget ] 

bp-44769a76-c1dd-4a5a-848a-5d71c0170429 [@ mozilla::layers::TextureClient::BorrowDrawTarget ] youtube video fullscreen crash

bp-e0182adc-10a2-4c04-bfab-40f3c0170429  [@ mozilla::ipc::MessageChannel::AssertWorkerThread | mozilla::ipc::MessageChannel::Send | mozilla::layers::PWebRenderBridgeChild::SendDeleteImage ]

bp-4eb92366-7d3d-4116-856a-fe4040170429 [@ mozilla::ipc::MessageChannel::AssertWorkerThread | mozilla::ipc::MessageChannel::Send | mozilla::layers::PWebRenderBridgeChild::SendDeleteImage ]

bp-66847305-0a02-4786-bef9-f6c720170429 [@ mozilla::layers::TextureClient::BorrowDrawTarget ]

Comment 6

[Darkspirit]

On Windows and one of the crashes above: While a video automatically played on the top of the youtube home page (ad?), I clicked on a random link to a video from the suggestions below. Crash.

Comment 7

[Kartikaya Gupta (email:[e-mail])]

Bug 1361111 should help with some of these crashes.

Comment 8

[Kartikaya Gupta (email:[e-mail])]

Jerry, do you know what might be causing the BorrowDrawTarget crashes? I also saw similar crashes just starting the latest nightly win64 build with WR enabled on a fresh profile.

https://crash-stats.mozilla.com/report/index/fe9877eb-b2d8-40b9-8aef-04dbf0170501

Comment 9

[Jerry Shih[:jerry] (UTC+8) (inactive)]

I don't know why we hit the assertion of IsValid() checking here.
But I will try to reproduce this crash with my xps15 later.

Comment 10

[Kartikaya Gupta (email:[e-mail])]

I see the same assertion in a try push for windows with webrender force-enabled. https://treeherder.mozilla.org/logviewer.html#?job_id=95961278&repo=try&lineNumber=2738

From the backtrace I'm guessing that UpdateImageHelper has a null mTexture, and so when we call GetDrawTarget on it, it barfs.

Comment 11

[Kartikaya Gupta (email:[e-mail])]

Attachment: Bug 1360613 - Don't call BorrowDrawTarget on a null texture.

Review commit: https://reviewboard.mozilla.org/r/135680/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/135680/

Comment 12

[Kartikaya Gupta (email:[e-mail])]

^ This patch should fix the BorrowDrawTarget signature, although the crash will probably just manifest in some other way.

Comment 13

[Ethan Lin[:ethlin]]

Comment on attachment 8863957 [details]
Bug 1360613 - Don't call BorrowDrawTarget on a null texture.

https://reviewboard.mozilla.org/r/135680/#review138722

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/737d2954faeb
Don't call BorrowDrawTarget on a null texture. r=ethlin

Comment 15

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/737d2954faeb

Comment 16

[Darkspirit]

That push to mozilla-central wasn't in today's 20170505100657, so I built my own to test.
> hg clone http://hg.mozilla.org/mozilla-central/ && cd mozilla-central && ./mach build

Same STR as bug 1360613 comment 0
> set gfx.webrender.enabled to true
> open any youtube video (/watch?v=xxxxxxxxx)
> click on the fullscreen button on the bottom right of the video
> Firefox crashes, I hear the audio playing for the few seconds even the firefox window is already gone.
> With webrender disabled, everything works as expected.
Yep, no crash, if webrender is disabled.

built from mozilla-central. this bug (those STRs) seems not to be fixed.
My custom build id: 20170505162722
New Crash signature: [@ firefox@0x6361 ]
https://crash-stats.mozilla.com/report/index/a5b62689-cddf-4871-8767-5dd341170505
https://crash-stats.mozilla.com/report/index/9d335312-c563-4f0b-9df0-5de810170505 watch video, new tab, switch back. crash.
https://crash-stats.mozilla.com/report/index/9a2d620c-1741-4a50-9b55-ac0801170505

Comment 17

[Kartikaya Gupta (email:[e-mail])]

Not surprising, as I mentioned in comment 12, the underlying root cause is still there. Once there is a new nightly build with that push, please use that to get a new crash report and file a new bug from that. The crash reports you listed in comment 16 don't have symbols (probably because it's a local build) and so we can't really do much with that.

Comment 18

[Darkspirit]

(In reply to Kartikaya Gupta (email:[e-mail]) from comment #17)
> Not surprising, as I mentioned in comment 12, the underlying root cause is
> still there. Once there is a new nightly build with that push, please use
> that to get a new crash report and file a new bug from that.

Reopened because of the new bug 1363347 which has the same STR and blocks this bug. (I hope this is the right thing to do)

Comment 19

[Kartikaya Gupta (email:[e-mail])]

No, we will leave this one closed. Otherwise it becomes hard to track which bugs have patches that landed and which ones still need to land their patches. We will use the new bug to track the remaining issues.

Comment 20

[Darkspirit]

no more crashes on this STR. Build: 20170520182312 (Linux x64)