1391255 - Crash in webrender::resource_cache::ResourceCache::block_until_all_resources_added

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect, P3)

Description

[Marcia Knous [:marcia]]

This bug was filed from the Socorro interface and is 
report bp-f61d3500-8145-4221-bba1-042d70170817.
=============================================================

Higher volume webrender crash seen in nightly: http://bit.ly/2vGziUk

62 crashes/34 installs.

Comment 1

[Marcia Knous [:marcia]]

Perhaps a dupe of the bug Ting filed, Bug 1390422.

Comment 2

[Nicholas Nethercote [inactive]]

(In reply to Marcia Knous [:marcia - use ni] from comment #1)
> Perhaps a dupe of the bug Ting filed, Bug 1390422.

Looks like it isn't a dup of that bug -- that bug's signature has stopped appearing in the last two Nightly builds but this bug's signature is still occurring. E.g. in Nightly 20170820100343 this bug's signature is the #2 windows topcrash, with 176 occurrences so far.

kats, any ideas?

Comment 3

[Kartikaya Gupta (email:[e-mail])]

Huh, it's not clear to me from the backtrace which line is actually panicking here. Maybe once bug 1390488 is fixed and we get the panic message it will be more clear.

Comment 4

[Sotaro Ikeda [:sotaro]]

I could reproduce the crash on Windows when gfx.webrender.blob-images was true.

Comment 5

[Sotaro Ikeda [:sotaro]]

The following is the related log of debug build on windows.

[GFX2-]: Failed to get DWrite Factory.
[GFX2-]: Failed to get DWrite Factory.
[GFX2-]: Failed to get DWrite Factory.
[GFX2-]: Failed to get DWrite Factory.
thread 'RenderBackend' panicked at 'Vector image error Unknown error', C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\resource_cache.rs:645
[Parent 3280] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80070057: file c:/mozilla-qr-source/mozilla-central/netwerk/base/nsChannelClassifier.cpp, line 320
stack backtrace:
   0:     0x7ffb8bbb5bc4 - std::sys_common::backtrace::_print
                               at C:\projects\rust\src\libstd\sys_common\backtrace.rs:71
   1:     0x7ffb8bbcaf60 - std::panicking::default_hook::{{closure}}
                               at C:\projects\rust\src\libstd\panicking.rs:354
   2:     0x7ffb8bbca7c0 - std::panicking::default_hook
                               at C:\projects\rust\src\libstd\panicking.rs:371
   3:     0x7ffb8bbcb541 - std::panicking::rust_panic_with_hook
                               at C:\projects\rust\src\libstd\panicking.rs:549
   4:     0x7ffb8bbcb3d8 - std::panicking::begin_panic<collections::string::String>
                               at C:\projects\rust\src\libstd\panicking.rs:511
   5:     0x7ffb8bbcb2a1 - std::panicking::begin_panic_fmt
                               at C:\projects\rust\src\libstd\panicking.rs:495
   6:     0x7ffb8be5201c - webrender::resource_cache::ResourceCache::update_texture_cache
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\resource_cache.rs:645
   7:     0x7ffb8be51a1c - webrender::resource_cache::ResourceCache::block_until_all_resources_added
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\resource_cache.rs:610
   8:     0x7ffb8be35600 - webrender::frame_builder::FrameBuilder::build
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\frame_builder.rs:1595
   9:     0x7ffb8be23f3c - webrender::frame::{{impl}}::build_frame::{{closure}}
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\frame.rs:1183
  10:     0x7ffb8bd73b7f - core::option::Option<&mut webrender::frame_builder::FrameBuilder>::map<&mut webrender::frame_builder::FrameBuilder,webrender::tiling::Frame,closure>
                               at C:\projects\rust\src\libcore\option.rs:398
  11:     0x7ffb8be23cce - webrender::frame::Frame::build_frame
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\frame.rs:1182
  12:     0x7ffb8be23af4 - webrender::frame::Frame::build
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\frame.rs:1164
  13:     0x7ffb8bfdb3d7 - webrender::render_backend::Document::render
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\render_backend.rs:87
  14:     0x7ffb8bfdce27 - webrender::render_backend::RenderBackend::process_document
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\render_backend.rs:350
  15:     0x7ffb8bfddd1d - webrender::render_backend::RenderBackend::run
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\render_backend.rs:417
  16:     0x7ffb8c15327b - webrender::renderer::{{impl}}::new::{{closure}}
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\renderer.rs:1335
  17:     0x7ffb8c04b3fd - std::sys_common::backtrace::__rust_begin_short_backtrace<closure,()>
                               at C:\projects\rust\src\libstd\sys_common\backtrace.rs:136
  18:     0x7ffb8bf18355 - std::thread::{{impl}}::spawn::{{closure}}::{{closure}}<closure,()>
                               at C:\projects\rust\src\libstd\thread\mod.rs:364
  19:     0x7ffb8bfb2d9d - std::panic::{{impl}}::call_once<(),closure>
                               at C:\projects\rust\src\libstd\panic.rs:296
  20:     0x7ffb8bf19c71 - std::panicking::try::do_call<std::panic::AssertUnwindSafe<closure>,()>
                               at C:\projects\rust\src\libstd\panicking.rs:454
  21:     0x7ffb8d3b98b1 - panic_abort::__rust_maybe_catch_panic
                               at C:\projects\rust\src\libpanic_abort\lib.rs:40
  22:     0x7ffb8bf19218 - std::panicking::try<(),std::panic::AssertUnwindSafe<closure>>
                               at C:\projects\rust\src\libstd\panicking.rs:433
  23:     0x7ffb8bf1813a - std::panic::catch_unwind<std::panic::AssertUnwindSafe<closure>,()>
                               at C:\projects\rust\src\libstd\panic.rs:361
  24:     0x7ffb8c07f596 - std::thread::{{impl}}::spawn::{{closure}}<closure,()>
                               at C:\projects\rust\src\libstd\thread\mod.rs:363
  25:     0x7ffb8c0d563c - alloc::boxed::{{impl}}::call_box<(),closure>
                               at C:\projects\rust\src\liballoc\boxed.rs:648
  26:     0x7ffb8bbc899b - std::sys::imp::thread::{{impl}}::new::thread_start
                               at C:\projects\rust\src\libstd\sys\windows\thread.rs:50
  27:     0x7ffbe7c12773 - BaseThreadInitThunk

Comment 6

[Kartikaya Gupta (email:[e-mail])]

This stopped after the 20170905220108 buildid.

Comment 7

[Darkspirit]

(In reply to Kartikaya Gupta (email:[e-mail]) from comment #6)
> This stopped after the 20170905220108 buildid.
(2017-09-05) - but there are even a few at 2017-09-25

Really WFM?
Last seen
on Windows: 20171001100335 (2017-10-01)
on Mac: 20171002223859 (2017-10-02)
on Android(?!): 20170924100523 (2017-09-24)

Comment 8

[Kartikaya Gupta (email:[e-mail])]

Indeed, it looks like it came back a few days after I closed this bug.

Comment 9

[Vincent Liu[:vliu]]

There are 11 crash of this signature in FF 58. From GraphicsCriticalError, it seems that the problem is not like FF 57 of the same signature. In FF58, the GraphicsCriticalError contains 

[G0][GFX1-]: Failed to allocate a surface due to invalid size (DTD) Size(14307,14026)

Comment 10

[Darkspirit]

Nightly 58 x64 20171012105833 de_DE @ Debian Testing (KDE, Radeon RX480)
fresh profile: layers force accel + webrender + webrendest + blob-images

1. open https://www.mozilla.org/en-US/firefox/56.0.1/firstrun/
2. click on the blue "Skip this step" button
3. immediately start resizing Firefox and keep doing it
4. if you have luck, you get a crash, otherwise you should get redirected to about:home

> [GFX1-]: Failed to allocate a surface due to invalid size (DTD) Size(13129,13376)
> thread 'RenderBackend' panicked at 'Vector image error Unknown error', /builds/worker/workspace/build/src/gfx/webrender/src/resource_cache.rs:773
> stack backtrace:
>   0:     0x7f3250f31e33 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::hcab99e0793da62c7
>   1:     0x7f3250f2edf9 - std::panicking::default_hook::{{closure}}::h9ba2c6973907a2be
>   2:     0x7f3250f2e220 - std::panicking::default_hook::he4d55e2dd21c3cca
>   3:     0x7f3250f2dd84 - std::panicking::rust_panic_with_hook::ha138c05cd33ad44d
>   4:     0x7f3250f2dc5f - std::panicking::begin_panic::hcdbfa35c94142fa2
>   5:     0x7f3250f2dbc9 - std::panicking::begin_panic_fmt::hc09fe500d9b7be81
>   6:     0x7f3250bdcfc4 - webrender::resource_cache::ResourceCache::block_until_all_resources_added::h1ebfafc121eae346
>   7:     0x7f3250bc8906 - webrender::frame_builder::FrameBuilder::build::h68460f3392ae55c7
>   8:     0x7f3250bbff14 - webrender::render_backend::Document::render::h8476b546b908d7ef
>   9:     0x7f3250bb491c - webrender::render_backend::RenderBackend::process_document::h3833fe14afa489c2
>  10:     0x7f3250ba7305 - webrender::render_backend::RenderBackend::run::h1efa2d0d361dc081
>  11:     0x7f3250ba5858 - std::sys_common::backtrace::__rust_begin_short_backtrace::ha6e91b0d2607dd75
>  12:     0x7f3250ba4f26 - <F as alloc::boxed::FnBox<A>>::call_box::hcbdcaf377ac29db0
>  13:     0x7f3250f39b43 - std::sys::imp::thread::Thread::new::thread_start::h227b2afaa9316a8d
>  14:     0x7f325e5a2493 - start_thread
>  15:     0x7f325d633abe - __clone
>  16:                0x0 - <unknown>
> Redirecting call to abort() to mozalloc_abort

bp-162f00f3-da22-4216-9c36-ca92d0171012	12.10.17 21:36
bp-34ba689e-77e8-4746-918e-1b7d50171012	12.10.17 21:32
bp-76f415f6-fbc8-41f7-aae9-802b90171012	12.10.17 21:31
bp-7e774fc6-4b4b-46a6-ab34-0fac80171012	12.10.17 21:31
bp-29e9dde5-3bd8-468f-ae98-5ba670171012	12.10.17 21:31

Comment 11

[James Graham [:jgraham]]

FWIW I was getting this crash reproducibly visiting http://www.nationalrail.co.uk/ with WebRender enabled in Ubuntu e.g. https://crash-stats.mozilla.com/report/index/d19189b2-2726-4f28-88dc-bdd690171016

Comment 12

[Sotaro Ikeda [:sotaro]]

Attachment: Callstack of client side when a problem of Comment 10 happned

Comment 13

[Sotaro Ikeda [:sotaro]]

Attachment: Callstack of webrender side when a problem of Comment 10 happned

Comment 15

[Marco Mucci [:MarcoM]]

Deprioritized to P3 during triage - moving to Reserve Backlog.

Comment 16

[Josh Matthews [:jdm]]

I hit this today loading slack: https://crash-stats.mozilla.com/report/index/53ac514b-1e44-4eac-ac44-9f2a80180209#tab-details

Comment 17

[Dirkjan Ochtman (:djc)]

I also hit this today loading Slack: https://crash-stats.mozilla.com/report/index/a7593c56-47d4-4a6e-8bfb-8ce8c0180214

Comment 18

[Josh Matthews [:jdm]]

I just hit this when opening https://travis-ci.org/servo/servo/builds/341119960?utm_source=github_status&utm_medium=notification from https://github.com/servo/servo/pull/19934, but it hasn't happened again when I attempted to reproduce it.

Comment 19

[Josh Matthews [:jdm]]

The "Unknown error" blob error is coming from https://searchfox.org/mozilla-central/rev/d03ad8843e3bf2e856126bc53b0475c595e5183b/gfx/webrender_bindings/src/moz2d_renderer.rs#187, and the panic when encountering the error is https://hg.mozilla.org/mozilla-central/annotate/38b3c1d03a594664c6b32c35533734283c258f43/gfx/webrender/src/resource_cache.rs#l854 .

Comment 20

[Josh Matthews [:jdm]]

Is there any chance that the reader constructed after https://searchfox.org/mozilla-central/source/gfx/webrender_bindings/Moz2DImageRenderer.cpp#232 could have a zero length, leading to returning an uninitialized value from that function?

Comment 21

[Kartikaya Gupta (email:[e-mail])]

^

Comment 22

[Andrew McCreight [:mccr8]]

#1 non-hang top crash on the 2-14 Nightly.

Comment 23

[Darkspirit]

I can still reproduce comment 10.
> CP+[GFX1-]: Failed to allocate a surface due to invalid size (DTD) Size(15598,8765)
> Vector image error Unknown error
bp-f5f933e7-7f30-421b-b348-39db60180221

Comment 25

[Julian Seward [:jseward]]

This is the #1 non-hang topcrash in the 20180222154733 nightly.

Comment 26

[:gerard-majax]

I got several instances while zooming a lot on aircasting.org maps (Google Maps based). Example: https://crash-stats.mozilla.com/report/index/cf1ec2b0-5c0b-46a9-aa02-1bd320180227

Comment 28

[Ludovic Hirlimann [:Usul]]

I had a tab with a youtube video opened. Every time the video would start playing it would crash with this sig. Using past tense cause I closed said tab.

Terminal contains :
[ludo@Oulanl ~]$ bin/firefox/firefox
WebRender - OpenGL version new 4.5 (Core Profile) Mesa 17.3.5
WebRender - OpenGL version new 4.5 (Core Profile) Mesa 17.3.5
thread 'WRRenderBackend#1' panicked at 'Vector image error Unknown error', gfx/webrender/src/resource_cache.rs:854:29
note: Run with `RUST_BACKTRACE=1` for a backtrace.
Redirecting call to abort() to mozalloc_abort

ExceptionHandler::WaitForContinueSignal waiting for continue signal...
ExceptionHandler::GenerateDump cloned child 4660
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
[Child 4219, MediaPlayback #2] WARNING: Decoder=7f2cccb02980 Decode error: NS_ERROR_OUT_OF_MEMORY (0x8007000e) - virtual mozilla::MediaResult mozilla::FFmpegVideoDecoder<46465650>::DoDecode(mozilla::MediaRawData*, uint8_t*, int, bool*, mozilla::MediaDataDecoder::DecodedData&): image allocation error: file /builds/worker/workspace/build/src/dom/media/MediaDecoderStateMachine.cpp, line 3445
[ludo@Oulanl ~]$ Failed to open curl lib from binary, use libcurl.so instead
WebRender - OpenGL version new 4.5 (Core Profile) Mesa 17.3.5
ExceptionHandler::GenerateDump cloned child 4861
ExceptionHandler::WaitForContinueSignal waiting for continue signal...
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
[Parent 4687, Gecko_IOThread] WARNING: waitpid failed pid:4830 errno:10: file /builds/worker/workspace/build/src/ipc/chromium/src/base/process_util_posix.cc, line 265

Comment 29

[Ludovic Hirlimann [:Usul]]

With RUST_BACKTRACE=full I get :
[ludo@Oulanl ~]$ bin/firefox/firefox
WebRender - OpenGL version new 4.5 (Core Profile) Mesa 17.3.5
thread 'WRRenderBackend#1' panicked at 'Vector image error Unknown error', gfx/webrender/src/resource_cache.rs:854:29
stack backtrace:
   0:     0x7f8d5732e623 - std::sys::unix::backtrace::tracing::imp::unwind_backtrace::hb98fbe643b37b8bb
   1:     0x7f8d57328fcc - std::panicking::default_hook::{{closure}}::h83c090f00cd2917d
   2:     0x7f8d5732895d - std::panicking::default_hook::hf9722061a353cd29
   3:     0x7f8d5732851c - std::panicking::rust_panic_with_hook::h574be4fada9826dc
   4:     0x7f8d5732a405 - std::panicking::begin_panic::h87949d2c83be3718
   5:     0x7f8d5732a399 - std::panicking::begin_panic_fmt::h351d9e48d73bd160
   6:     0x7f8d57272f49 - webrender::resource_cache::ResourceCache::block_until_all_resources_added::h2d9da5c4a13ffbc5
   7:     0x7f8d572603bb - webrender::frame_builder::FrameBuilder::build::h10d02cd4b012dac1
   8:     0x7f8d5723d97b - webrender::render_backend::Document::render::h1d1178e65a7d46fa
   9:     0x7f8d5721bc71 - webrender::render_backend::RenderBackend::update_document::he0fea0574177986c
  10:     0x7f8d5721f133 - webrender::render_backend::RenderBackend::process_api_msg::h03851f6525fb8e27
  11:     0x7f8d57211856 - std::sys_common::backtrace::__rust_begin_short_backtrace::h2e01641e2d4d376d
  12:     0x7f8d5720d098 - <F as alloc::boxed::FnBox<A>>::call_box::hd6b6d904d7a44b93
  13:     0x7f8d5732a933 - std::sys::unix::thread::Thread::new::thread_start::hd71cb092e75e9bed
  14:     0x7f8d6480161a - start_thread
  15:     0x7f8d6382f98e - __GI___clone
  16:                0x0 - <unknown>
Redirecting call to abort() to mozalloc_abort

ExceptionHandler::GenerateDump cloned child 6865
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
ExceptionHandler::WaitForContinueSignal waiting for continue signal...

Offending URL is https://www.youtube.com/watch?v=4N0OS2f4xVg and I reproduce constantly on this. Running up to date Fedora 27.

Comment 30

[:gerard-majax]

Reproducing as well, when zooming / dragging the map of AirCasting.org (Google Maps), but not 100% repro for me.

Comment 31

[Jeff Muizelaar [:jrmuizel]]

Attachment: Bug 1391255. Crash earlier if recording playback fails.

This should help us narrow down what's going wrong a bit.

Review commit: https://reviewboard.mozilla.org/r/227784/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/227784/

Comment 32

[Kartikaya Gupta (email:[e-mail])]

Comment on attachment 8958916 [details]
Bug 1391255. Crash earlier if recording playback fails.

https://reviewboard.mozilla.org/r/227784/#review233540

Comment 33

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7dad306cf8fe
Crash earlier if recording playback fails. r=kats

Comment 35

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/7dad306cf8fe

Comment 36

[Jeff Muizelaar [:jrmuizel]]

The landed patch will just move the crash signature to another place. If those who can reproduce this can try with a recent Nightly we'll see where it moved to.

Comment 37

[Jeff Muizelaar [:jrmuizel]]

Looks like that's bug 1446286.

Comment 38

[Darkspirit]

(In reply to Jeff Muizelaar [:jrmuizel] from comment #37)
> Looks like that's bug 1446286.

Confirmed in bug 1440088 comment 8.