Closed Bug 1391255 Opened 3 years ago Closed 3 years ago

Crash in webrender::resource_cache::ResourceCache::block_until_all_resources_added

Categories

(Core :: Graphics: WebRender, defect, P3)

defect

Tracking

()

RESOLVED FIXED
mozilla61
Tracking Status
firefox-esr52 --- unaffected
firefox56 --- unaffected
firefox57 --- unaffected
firefox59 --- unaffected
firefox60 --- disabled
firefox61 --- fixed

People

(Reporter: marcia, Assigned: jrmuizel)

References

(Blocks 2 open bugs)

Details

(Keywords: crash, Whiteboard: [wr-reserve] [gfx-noted])

Crash Data

Attachments

(3 files)

This bug was filed from the Socorro interface and is 
report bp-f61d3500-8145-4221-bba1-042d70170817.
=============================================================

Higher volume webrender crash seen in nightly: http://bit.ly/2vGziUk

62 crashes/34 installs.
Perhaps a dupe of the bug Ting filed, Bug 1390422.
(In reply to Marcia Knous [:marcia - use ni] from comment #1)
> Perhaps a dupe of the bug Ting filed, Bug 1390422.

Looks like it isn't a dup of that bug -- that bug's signature has stopped appearing in the last two Nightly builds but this bug's signature is still occurring. E.g. in Nightly 20170820100343 this bug's signature is the #2 windows topcrash, with 176 occurrences so far.

kats, any ideas?
Flags: needinfo?(bugmail)
Huh, it's not clear to me from the backtrace which line is actually panicking here. Maybe once bug 1390488 is fixed and we get the panic message it will be more clear.
Depends on: 1390488
Flags: needinfo?(bugmail)
I could reproduce the crash on Windows when gfx.webrender.blob-images was true.
The following is the related log of debug build on windows.

[GFX2-]: Failed to get DWrite Factory.
[GFX2-]: Failed to get DWrite Factory.
[GFX2-]: Failed to get DWrite Factory.
[GFX2-]: Failed to get DWrite Factory.
thread 'RenderBackend' panicked at 'Vector image error Unknown error', C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\resource_cache.rs:645
[Parent 3280] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80070057: file c:/mozilla-qr-source/mozilla-central/netwerk/base/nsChannelClassifier.cpp, line 320
stack backtrace:
   0:     0x7ffb8bbb5bc4 - std::sys_common::backtrace::_print
                               at C:\projects\rust\src\libstd\sys_common\backtrace.rs:71
   1:     0x7ffb8bbcaf60 - std::panicking::default_hook::{{closure}}
                               at C:\projects\rust\src\libstd\panicking.rs:354
   2:     0x7ffb8bbca7c0 - std::panicking::default_hook
                               at C:\projects\rust\src\libstd\panicking.rs:371
   3:     0x7ffb8bbcb541 - std::panicking::rust_panic_with_hook
                               at C:\projects\rust\src\libstd\panicking.rs:549
   4:     0x7ffb8bbcb3d8 - std::panicking::begin_panic<collections::string::String>
                               at C:\projects\rust\src\libstd\panicking.rs:511
   5:     0x7ffb8bbcb2a1 - std::panicking::begin_panic_fmt
                               at C:\projects\rust\src\libstd\panicking.rs:495
   6:     0x7ffb8be5201c - webrender::resource_cache::ResourceCache::update_texture_cache
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\resource_cache.rs:645
   7:     0x7ffb8be51a1c - webrender::resource_cache::ResourceCache::block_until_all_resources_added
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\resource_cache.rs:610
   8:     0x7ffb8be35600 - webrender::frame_builder::FrameBuilder::build
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\frame_builder.rs:1595
   9:     0x7ffb8be23f3c - webrender::frame::{{impl}}::build_frame::{{closure}}
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\frame.rs:1183
  10:     0x7ffb8bd73b7f - core::option::Option<&mut webrender::frame_builder::FrameBuilder>::map<&mut webrender::frame_builder::FrameBuilder,webrender::tiling::Frame,closure>
                               at C:\projects\rust\src\libcore\option.rs:398
  11:     0x7ffb8be23cce - webrender::frame::Frame::build_frame
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\frame.rs:1182
  12:     0x7ffb8be23af4 - webrender::frame::Frame::build
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\frame.rs:1164
  13:     0x7ffb8bfdb3d7 - webrender::render_backend::Document::render
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\render_backend.rs:87
  14:     0x7ffb8bfdce27 - webrender::render_backend::RenderBackend::process_document
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\render_backend.rs:350
  15:     0x7ffb8bfddd1d - webrender::render_backend::RenderBackend::run
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\render_backend.rs:417
  16:     0x7ffb8c15327b - webrender::renderer::{{impl}}::new::{{closure}}
                               at C:\mozilla-qr-source\mozilla-central\gfx\webrender\src\renderer.rs:1335
  17:     0x7ffb8c04b3fd - std::sys_common::backtrace::__rust_begin_short_backtrace<closure,()>
                               at C:\projects\rust\src\libstd\sys_common\backtrace.rs:136
  18:     0x7ffb8bf18355 - std::thread::{{impl}}::spawn::{{closure}}::{{closure}}<closure,()>
                               at C:\projects\rust\src\libstd\thread\mod.rs:364
  19:     0x7ffb8bfb2d9d - std::panic::{{impl}}::call_once<(),closure>
                               at C:\projects\rust\src\libstd\panic.rs:296
  20:     0x7ffb8bf19c71 - std::panicking::try::do_call<std::panic::AssertUnwindSafe<closure>,()>
                               at C:\projects\rust\src\libstd\panicking.rs:454
  21:     0x7ffb8d3b98b1 - panic_abort::__rust_maybe_catch_panic
                               at C:\projects\rust\src\libpanic_abort\lib.rs:40
  22:     0x7ffb8bf19218 - std::panicking::try<(),std::panic::AssertUnwindSafe<closure>>
                               at C:\projects\rust\src\libstd\panicking.rs:433
  23:     0x7ffb8bf1813a - std::panic::catch_unwind<std::panic::AssertUnwindSafe<closure>,()>
                               at C:\projects\rust\src\libstd\panic.rs:361
  24:     0x7ffb8c07f596 - std::thread::{{impl}}::spawn::{{closure}}<closure,()>
                               at C:\projects\rust\src\libstd\thread\mod.rs:363
  25:     0x7ffb8c0d563c - alloc::boxed::{{impl}}::call_box<(),closure>
                               at C:\projects\rust\src\liballoc\boxed.rs:648
  26:     0x7ffb8bbc899b - std::sys::imp::thread::{{impl}}::new::thread_start
                               at C:\projects\rust\src\libstd\sys\windows\thread.rs:50
  27:     0x7ffbe7c12773 - BaseThreadInitThunk
Depends on: 1392556
Priority: P3 → P2
Whiteboard: [wr-mvp]
Whiteboard: [wr-mvp] → [wr-mvp][gfx-noted]
This stopped after the 20170905220108 buildid.
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → WORKSFORME
Priority: P2 → --
Whiteboard: [wr-mvp][gfx-noted] → [gfx-noted]
(In reply to Kartikaya Gupta (email:kats@mozilla.com) from comment #6)
> This stopped after the 20170905220108 buildid.
(2017-09-05) - but there are even a few at 2017-09-25

Really WFM?
Last seen
on Windows: 20171001100335 (2017-10-01)
on Mac: 20171002223859 (2017-10-02)
on Android(?!): 20170924100523 (2017-09-24)
Crash Signature: [@ webrender::resource_cache::ResourceCache::block_until_all_resources_added] → [@ webrender::resource_cache::ResourceCache::block_until_all_resources_added] [@ mozalloc_abort | abort | webrender::resource_cache::{{impl}}::block_until_all_resources_added ]
OS: Windows 7 → All
Hardware: x86 → All
Indeed, it looks like it came back a few days after I closed this bug.
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
There are 11 crash of this signature in FF 58. From GraphicsCriticalError, it seems that the problem is not like FF 57 of the same signature. In FF58, the GraphicsCriticalError contains 

[G0][GFX1-]: Failed to allocate a surface due to invalid size (DTD) Size(14307,14026)
Crash Signature: [@ webrender::resource_cache::ResourceCache::block_until_all_resources_added] [@ mozalloc_abort | abort | webrender::resource_cache::{{impl}}::block_until_all_resources_added ] → [@ webrender::resource_cache::ResourceCache::block_until_all_resources_added] [@ mozalloc_abort | abort | webrender::resource_cache::{{impl}}::block_until_all_resources_added ] [@ mozalloc_abort | abort | webrender::resource_cache::ResourceCache::block_…
Nightly 58 x64 20171012105833 de_DE @ Debian Testing (KDE, Radeon RX480)
fresh profile: layers force accel + webrender + webrendest + blob-images

1. open https://www.mozilla.org/en-US/firefox/56.0.1/firstrun/
2. click on the blue "Skip this step" button
3. immediately start resizing Firefox and keep doing it
4. if you have luck, you get a crash, otherwise you should get redirected to about:home

> [GFX1-]: Failed to allocate a surface due to invalid size (DTD) Size(13129,13376)
> thread 'RenderBackend' panicked at 'Vector image error Unknown error', /builds/worker/workspace/build/src/gfx/webrender/src/resource_cache.rs:773
> stack backtrace:
>   0:     0x7f3250f31e33 - std::sys::imp::backtrace::tracing::imp::unwind_backtrace::hcab99e0793da62c7
>   1:     0x7f3250f2edf9 - std::panicking::default_hook::{{closure}}::h9ba2c6973907a2be
>   2:     0x7f3250f2e220 - std::panicking::default_hook::he4d55e2dd21c3cca
>   3:     0x7f3250f2dd84 - std::panicking::rust_panic_with_hook::ha138c05cd33ad44d
>   4:     0x7f3250f2dc5f - std::panicking::begin_panic::hcdbfa35c94142fa2
>   5:     0x7f3250f2dbc9 - std::panicking::begin_panic_fmt::hc09fe500d9b7be81
>   6:     0x7f3250bdcfc4 - webrender::resource_cache::ResourceCache::block_until_all_resources_added::h1ebfafc121eae346
>   7:     0x7f3250bc8906 - webrender::frame_builder::FrameBuilder::build::h68460f3392ae55c7
>   8:     0x7f3250bbff14 - webrender::render_backend::Document::render::h8476b546b908d7ef
>   9:     0x7f3250bb491c - webrender::render_backend::RenderBackend::process_document::h3833fe14afa489c2
>  10:     0x7f3250ba7305 - webrender::render_backend::RenderBackend::run::h1efa2d0d361dc081
>  11:     0x7f3250ba5858 - std::sys_common::backtrace::__rust_begin_short_backtrace::ha6e91b0d2607dd75
>  12:     0x7f3250ba4f26 - <F as alloc::boxed::FnBox<A>>::call_box::hcbdcaf377ac29db0
>  13:     0x7f3250f39b43 - std::sys::imp::thread::Thread::new::thread_start::h227b2afaa9316a8d
>  14:     0x7f325e5a2493 - start_thread
>  15:     0x7f325d633abe - __clone
>  16:                0x0 - <unknown>
> Redirecting call to abort() to mozalloc_abort

bp-162f00f3-da22-4216-9c36-ca92d0171012	12.10.17 21:36
bp-34ba689e-77e8-4746-918e-1b7d50171012	12.10.17 21:32
bp-76f415f6-fbc8-41f7-aae9-802b90171012	12.10.17 21:31
bp-7e774fc6-4b4b-46a6-ab34-0fac80171012	12.10.17 21:31
bp-29e9dde5-3bd8-468f-ae98-5ba670171012	12.10.17 21:31
FWIW I was getting this crash reproducibly visiting http://www.nationalrail.co.uk/ with WebRender enabled in Ubuntu e.g. https://crash-stats.mozilla.com/report/index/d19189b2-2726-4f28-88dc-bdd690171016
Attachment #8919597 - Attachment mime type: text/x-emacs-lisp → text/plain
Whiteboard: [gfx-noted] → [wr-mvp] [triage] [gfx-noted]
Status: REOPENED → NEW
Priority: -- → P2
Whiteboard: [wr-mvp] [triage] [gfx-noted] → [wr-mvp] [gfx-noted]
See Also: → 1415000
Assignee: nobody → kechen
Status: NEW → ASSIGNED
Priority: P2 → P1
Deprioritized to P3 during triage - moving to Reserve Backlog.
Assignee: kechen → nobody
Status: ASSIGNED → NEW
Priority: P1 → P3
Whiteboard: [wr-mvp] [gfx-noted] → [wr-reserve] [gfx-noted]
I just hit this when opening https://travis-ci.org/servo/servo/builds/341119960?utm_source=github_status&utm_medium=notification from https://github.com/servo/servo/pull/19934, but it hasn't happened again when I attempted to reproduce it.
Is there any chance that the reader constructed after https://searchfox.org/mozilla-central/source/gfx/webrender_bindings/Moz2DImageRenderer.cpp#232 could have a zero length, leading to returning an uninitialized value from that function?
^
Flags: needinfo?(jmuizelaar)
#1 non-hang top crash on the 2-14 Nightly.
Crash Signature: webrender::resource_cache::ResourceCache::block_until_all_resources_added ] → webrender::resource_cache::ResourceCache::block_until_all_resources_added ] [@ mozalloc_abort | abort | webrender::resource_cache::ResourceCache::block_until_all_resources_added::h37f200fba556c4c6]
I can still reproduce comment 10.
> CP+[GFX1-]: Failed to allocate a surface due to invalid size (DTD) Size(15598,8765)
> Vector image error Unknown error
bp-f5f933e7-7f30-421b-b348-39db60180221
Duplicate of this bug: 1440088
This is the #1 non-hang topcrash in the 20180222154733 nightly.
I got several instances while zooming a lot on aircasting.org maps (Google Maps based). Example: https://crash-stats.mozilla.com/report/index/cf1ec2b0-5c0b-46a9-aa02-1bd320180227
Duplicate of this bug: 1440483
Crash Signature: webrender::resource_cache::ResourceCache::block_until_all_resources_added ] [@ mozalloc_abort | abort | webrender::resource_cache::ResourceCache::block_until_all_resources_added::h37f200fba556c4c6] → webrender::resource_cache::ResourceCache::block_until_all_resources_added ] [@ mozalloc_abort | abort | webrender::resource_cache::ResourceCache::block_until_all_resources_added::h37f200fba556c4c6] [@ mozalloc_abort | abort | webrender::resource_cache:…
I had a tab with a youtube video opened. Every time the video would start playing it would crash with this sig. Using past tense cause I closed said tab.

Terminal contains :
[ludo@Oulanl ~]$ bin/firefox/firefox
WebRender - OpenGL version new 4.5 (Core Profile) Mesa 17.3.5
WebRender - OpenGL version new 4.5 (Core Profile) Mesa 17.3.5
thread 'WRRenderBackend#1' panicked at 'Vector image error Unknown error', gfx/webrender/src/resource_cache.rs:854:29
note: Run with `RUST_BACKTRACE=1` for a backtrace.
Redirecting call to abort() to mozalloc_abort

ExceptionHandler::WaitForContinueSignal waiting for continue signal...
ExceptionHandler::GenerateDump cloned child 4660
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
[Child 4219, MediaPlayback #2] WARNING: Decoder=7f2cccb02980 Decode error: NS_ERROR_OUT_OF_MEMORY (0x8007000e) - virtual mozilla::MediaResult mozilla::FFmpegVideoDecoder<46465650>::DoDecode(mozilla::MediaRawData*, uint8_t*, int, bool*, mozilla::MediaDataDecoder::DecodedData&): image allocation error: file /builds/worker/workspace/build/src/dom/media/MediaDecoderStateMachine.cpp, line 3445
[ludo@Oulanl ~]$ Failed to open curl lib from binary, use libcurl.so instead
WebRender - OpenGL version new 4.5 (Core Profile) Mesa 17.3.5
ExceptionHandler::GenerateDump cloned child 4861
ExceptionHandler::WaitForContinueSignal waiting for continue signal...
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
[Parent 4687, Gecko_IOThread] WARNING: waitpid failed pid:4830 errno:10: file /builds/worker/workspace/build/src/ipc/chromium/src/base/process_util_posix.cc, line 265
With RUST_BACKTRACE=full I get :
[ludo@Oulanl ~]$ bin/firefox/firefox
WebRender - OpenGL version new 4.5 (Core Profile) Mesa 17.3.5
thread 'WRRenderBackend#1' panicked at 'Vector image error Unknown error', gfx/webrender/src/resource_cache.rs:854:29
stack backtrace:
   0:     0x7f8d5732e623 - std::sys::unix::backtrace::tracing::imp::unwind_backtrace::hb98fbe643b37b8bb
   1:     0x7f8d57328fcc - std::panicking::default_hook::{{closure}}::h83c090f00cd2917d
   2:     0x7f8d5732895d - std::panicking::default_hook::hf9722061a353cd29
   3:     0x7f8d5732851c - std::panicking::rust_panic_with_hook::h574be4fada9826dc
   4:     0x7f8d5732a405 - std::panicking::begin_panic::h87949d2c83be3718
   5:     0x7f8d5732a399 - std::panicking::begin_panic_fmt::h351d9e48d73bd160
   6:     0x7f8d57272f49 - webrender::resource_cache::ResourceCache::block_until_all_resources_added::h2d9da5c4a13ffbc5
   7:     0x7f8d572603bb - webrender::frame_builder::FrameBuilder::build::h10d02cd4b012dac1
   8:     0x7f8d5723d97b - webrender::render_backend::Document::render::h1d1178e65a7d46fa
   9:     0x7f8d5721bc71 - webrender::render_backend::RenderBackend::update_document::he0fea0574177986c
  10:     0x7f8d5721f133 - webrender::render_backend::RenderBackend::process_api_msg::h03851f6525fb8e27
  11:     0x7f8d57211856 - std::sys_common::backtrace::__rust_begin_short_backtrace::h2e01641e2d4d376d
  12:     0x7f8d5720d098 - <F as alloc::boxed::FnBox<A>>::call_box::hd6b6d904d7a44b93
  13:     0x7f8d5732a933 - std::sys::unix::thread::Thread::new::thread_start::hd71cb092e75e9bed
  14:     0x7f8d6480161a - start_thread
  15:     0x7f8d6382f98e - __GI___clone
  16:                0x0 - <unknown>
Redirecting call to abort() to mozalloc_abort

ExceptionHandler::GenerateDump cloned child 6865
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
ExceptionHandler::WaitForContinueSignal waiting for continue signal...

Offending URL is https://www.youtube.com/watch?v=4N0OS2f4xVg and I reproduce constantly on this. Running up to date Fedora 27.
Depends on: 1440088
Reproducing as well, when zooming / dragging the map of AirCasting.org (Google Maps), but not 100% repro for me.
Crash Signature: webrender::resource_cache::ResourceCache::block_until_all_resources_added::h021c5ee598cd252c ] → webrender::resource_cache::ResourceCache::block_until_all_resources_added::h021c5ee598cd252c ] [@ mozalloc_abort | abort | webrender::resource_cache::ResourceCache::block_until_all_resources_added::h4ccac4a9da81f318 ] [@ mozalloc_abort | abort | webren…
Comment on attachment 8958916 [details]
Bug 1391255. Crash earlier if recording playback fails.

https://reviewboard.mozilla.org/r/227784/#review233540
Attachment #8958916 - Flags: review?(bugmail) → review+
Pushed by jmuizelaar@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/7dad306cf8fe
Crash earlier if recording playback fails. r=kats
Crash Signature: webrender::resource_cache::ResourceCache::block_until_all_resources_added::h9f3077ab7598bd25 ] → webrender::resource_cache::ResourceCache::block_until_all_resources_added::h9f3077ab7598bd25 ] [@ mozalloc_abort | abort | webrender::resource_cache::ResourceCache::block_until_all_resources_added::h800626b0c861501a ]
Duplicate of this bug: 1445720
https://hg.mozilla.org/mozilla-central/rev/7dad306cf8fe
Status: NEW → RESOLVED
Closed: 3 years ago3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
The landed patch will just move the crash signature to another place. If those who can reproduce this can try with a recent Nightly we'll see where it moved to.
Flags: needinfo?(jmuizelaar)
Looks like that's bug 1446286.
(In reply to Jeff Muizelaar [:jrmuizel] from comment #37)
> Looks like that's bug 1446286.

Confirmed in bug 1440088 comment 8.
See Also: → 1446286
Depends on: 1466613
You need to log in before you can comment on or make changes to this bug.