Closed Bug 1405814 Opened 4 years ago Closed 3 years ago

Crash in mozilla::layers::ScrollMetadata::ScrollMetadata


(Core :: Graphics: WebRender, defect, P2)

58 Branch



Tracking Status
firefox-esr52 --- unaffected
firefox-esr60 --- disabled
firefox56 --- unaffected
firefox57 --- unaffected
firefox58 --- unaffected
firefox63 --- disabled
firefox64 --- fixed
firefox65 --- fixed


(Reporter: philipp, Assigned: aosmond)


(Blocks 2 open bugs)


(Keywords: crash, regression, Whiteboard: [wr-reserve])

Crash Data


(1 file)

This bug was filed from the Socorro interface and is 
report bp-74138075-a3db-4b31-9a5c-068f00170927.
Crashing Thread (0)
Frame 	Module 	Signature 	Source
0 	XUL 	mozilla::layers::ScrollMetadata::ScrollMetadata(mozilla::layers::ScrollMetadata const&) 	xpcom/ds/nsTArray.h:398
1 	XUL 	mozilla::layers::WebRenderScrollData::AddMetadata(mozilla::layers::ScrollMetadata const&) 	gfx/layers/FrameMetrics.h:778
2 	XUL 	mozilla::layers::WebRenderLayerScrollData::Initialize(mozilla::layers::WebRenderScrollData&, nsDisplayItem*, int, mozilla::ActiveScrolledRoot const*) 	gfx/layers/wr/WebRenderScrollData.cpp:89
3 	XUL 	mozilla::layers::WebRenderLayerManager::CreateWebRenderCommandsFromDisplayList(nsDisplayList*, nsDisplayListBuilder*, mozilla::layers::StackingContextHelper const&, mozilla::wr::DisplayListBuilder&, mozilla::wr::IpcResourceUpdateQueue&) 	gfx/layers/wr/WebRenderLayerManager.cpp:361
4 	XUL 	mozilla::layers::WebRenderLayerManager::EndTransactionInternal(void (*)(mozilla::layers::PaintedLayer*, gfxContext*, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, mozilla::layers::DrawRegionClip, mozilla::gfx::IntRegionTyped<mozilla::gfx::UnknownUnits> const&, void*), void*, mozilla::layers::LayerManager::EndTransactionFlags, nsDisplayList*, nsDisplayListBuilder*) 	gfx/layers/wr/WebRenderLayerManager.cpp:784
5 	XUL 	nsDisplayList::PaintRoot(nsDisplayListBuilder*, gfxContext*, unsigned int) 	layout/painting/nsDisplayList.cpp:2173
6 	XUL 	nsLayoutUtils::PaintFrame(gfxContext*, nsIFrame*, nsRegion const&, unsigned int, nsDisplayListBuilderMode, nsLayoutUtils::PaintFrameFlags) 	layout/base/nsLayoutUtils.cpp:3823
7 	XUL 	mozilla::PresShell::Paint(nsView*, nsRegion const&, unsigned int) 	layout/base/PresShell.cpp:6454
8 	XUL 	nsViewManager::ProcessPendingUpdatesPaint(nsIWidget*) 	view/nsViewManager.cpp:480
9 	XUL 	nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) 	view/nsViewManager.cpp:412
10 	XUL 	nsViewManager::ProcessPendingUpdates() 	view/nsViewManager.cpp:1102
11 	XUL 	nsRefreshDriver::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:2082
12 	XUL 	mozilla::RefreshDriverTimer::TickRefreshDrivers(long long, mozilla::TimeStamp, nsTArray<RefPtr<nsRefreshDriver> >&) 	layout/base/nsRefreshDriver.cpp:337
13 	XUL 	mozilla::RefreshDriverTimer::Tick(long long, mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:329
14 	XUL 	mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::TickRefreshDriver(mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:770
15 	XUL 	mozilla::VsyncRefreshDriverTimer::RefreshDriverVsyncObserver::NotifyVsync(mozilla::TimeStamp) 	layout/base/nsRefreshDriver.cpp:584
16 	XUL 	mozilla::layout::VsyncChild::RecvNotify(mozilla::TimeStamp const&) 	layout/ipc/VsyncChild.cpp:67
17 	XUL 	mozilla::layout::PVsyncChild::OnMessageReceived(IPC::Message const&) 	ipc/ipdl/PVsyncChild.cpp:155
18 	XUL 	mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) 	ipc/glue/MessageChannel.cpp:2119
19 	XUL 	mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) 	ipc/glue/MessageChannel.cpp:2049
20 	XUL 	mozilla::ipc::MessageChannel::MessageTask::Run() 	ipc/glue/MessageChannel.cpp:1928
21 	XUL 	nsThread::ProcessNextEvent(bool, bool*) 	xpcom/threads/nsThread.cpp:1039
22 	XUL 	NS_ProcessPendingEvents(nsIThread*, unsigned int) 	xpcom/threads/nsThreadUtils.cpp:466
23 	XUL 	nsBaseAppShell::NativeEventCallback() 	widget/nsBaseAppShell.cpp:99
24 	XUL 	nsAppShell::ProcessGeckoEvents(void*) 	widget/cocoa/

reports with this signature seem to get more common with webrender - primarily on macos and fennec. is this related to bug 1384181?
Flags: needinfo?(bugmail)
Whiteboard: [wr-mvp] [triage]
(In reply to [:philipp] from comment #0)
> reports with this signature seem to get more common with webrender -
> primarily on macos and fennec. is this related to bug 1384181?

I don't see any reports of this on Fennec. That should be impossible since webrender is not (and now cannot be) enabled on fennec. But yes, I see crashes on all three desktop platforms. It's not obvious to me from looking at the stack what the problem is, but it's something we'll need to fix.
Flags: needinfo?(bugmail)
Priority: -- → P2
Whiteboard: [wr-mvp] [triage] → [wr-mvp]
Priority: P2 → P3
Whiteboard: [wr-mvp] → [wr-reserve]
I don't see any more crashes in crash-stats that match this.
Closed: 3 years ago
Resolution: --- → WORKSFORME
Blocks: stage-wr-trains
No longer blocks: stage-wr-nightly
We are failing to copy construct this array:

ScrollMetadata::mSnapInfo::mScrollSnapCoordinates::mHdr seems to point to an invalid location in the source data that we want to copy. This ScrollMetadata structure actually lives on the stack, a little further up the call stack:

The Maybe<ScrollMetadata> is probably Nothing, just like in the ClipManager crash in bug 1471671.
Assignee: nobody → aosmond
Priority: P3 → P2
See Also: → 1471671
Similar to bug 1471671, we are seeing missing scroll metadata in cases
we do not expect that, and have been observing low volume crashes in the
wild as a result. It appears that in the non-WR path, it skips such items,
so we should probably do the same thing with WebRender. If it is a real
problem, we will hopefully get a reproducible test case from a user if
scrolling fails for them.
Pushed by
Avoid crash with WebRender when the scroll metadata is unavailable. r=kats
Closed: 3 years ago3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla65
I'm confused - this bug predates WebRender and we see crashes with this signature without WR on the stack:

Is there a bug tracking these original crashes somewhere still?
Flags: needinfo?(aosmond)
Huh, nevermind. I guess this bug always *was* for the WR crash. Andrew, can you please nominate this for Beta approval since the volume there seems non-negligible?
Crash Signature: [@ mozilla::layers::ScrollMetadata::ScrollMetadata] → [@ mozilla::layers::ScrollMetadata::ScrollMetadata] [@ nsTArray_Impl<T>::AppendElements<T> | mozilla::layers::ScrollMetadata::ScrollMetadata]
Comment on attachment 9020096 [details]
Bug 1405814 - Avoid crash with WebRender when the scroll metadata is unavailable.

[Beta/Release Uplift Approval Request]

Feature/Bug causing the regression: None

User impact if declined: May experience crashes while using WebRender.

Is this code covered by automated tests?: Yes

Has the fix been verified in Nightly?: Yes

Needs manual test from QE?: No

If yes, steps to reproduce: 

List of other uplifts needed: None

Risk to taking this patch: Low

Why is the change risky/not risky? (and alternatives if risky): The change is not risky. The worst case scrolling is would not work as the user expects, versus today where it crashes mid scroll.

String changes made/needed: N/A
Flags: needinfo?(aosmond)
Attachment #9020096 - Flags: approval-mozilla-beta?
Comment on attachment 9020096 [details]
Bug 1405814 - Avoid crash with WebRender when the scroll metadata is unavailable.

[Triage Comment]
Fixes a crash for users opted into the WebRender experiments on Beta. Approved for 64.0b7.
Attachment #9020096 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.