1431963 - Crash in mozalloc_abort | abort | webrender::renderer::{{impl}}::render_impl::{{closure}}

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect, P1)

Description

[Asif Youssuff]

This bug was filed from the Socorro interface and is
report bp-a111931e-ccd0-4d70-b81a-e5bf70180121.
=============================================================

Top 10 frames of crashing thread:

0 libmozglue.dylib mozalloc_abort memory/mozalloc/mozalloc_abort.cpp:33
1 libmozglue.dylib abort memory/mozalloc/mozalloc_abort.cpp:80
2 XUL std::panicking::rust_panic src/libpanic_abort/lib.rs:59
3 XUL std::panicking::rust_panic_with_hook src/libstd/panicking.rs:593
4 XUL std::panicking::begin_panic<alloc::string::String> src/libstd/panicking.rs:538
5 XUL std::panicking::begin_panic_fmt src/libstd/panicking.rs:522
6 XUL core::panicking::panic_fmt src/libstd/panicking.rs:498
7 XUL core::panicking::panic_bounds_check src/libcore/panicking.rs:58
8 XUL webrender::renderer::{{impl}}::render_impl::{{closure}} src/liballoc/vec.rs:1552
9 XUL webrender::renderer::{{impl}}::render_impl gfx/webrender/src/profiler.rs:190

=============================================================

I ran into this issue repeatedly when attempting to load https://www.youtube.com/watch?v=63GiUMI1f7I

See also: 

https://crash-stats.mozilla.com/report/index/255f9d54-6099-4cac-9c94-375b70180121
https://crash-stats.mozilla.com/report/index/00947bac-eb0b-40da-b6ee-85f480180121

Comment 1

[Darkspirit]

There is "webrender_bindings" mentioned.

> MOZ_CRASH Reason 	index out of bounds: the len is 0 but the index is 0
appeared in bug 1431448

Comment 2

[Calixte Denizet (:calixte)]

The regression may have been introduced by patch [1] to fix bug 1430829.
:kats, could you investigate please ?

[1] https://hg.mozilla.org/mozilla-central/rev/d1a22efb9e43

Comment 3

[Kartikaya Gupta (email:[e-mail])]

It looks like one of the profile() callbacks in render_impl is causing this crash. There are three of them; two of them were touched in the WR update in bug 1430829. Those changes came from servo/webrender#2313 and servo/webrender#2318. Not sure if it was one of those to blame, or some other change, but that's probably a good place to start looking.

Comment 4

[Glenn Watson [:gw]]

I'm unable to reproduce this with the youtube URL provided above. Do we have any other repro steps for this crash?

Comment 5

[Milan Sreckovic [:milan] (needinfo for best results)]

"index out of bounds: the len is 0 but the index is 0" doesn't help?

Comment 6

[Asif Youssuff]

Unfortunately, that page now loads up for me without issues. :/

Comment 7

[Glenn Watson [:gw]]

index out of bounds means an array was accessed incorrectly, but doesn't identify how or which one.

Comment 8

[Glenn Watson [:gw]]

I still haven't been able to reproduce this locally with the steps above, but I did reproduce a crash in Servo that seems to match this one. I suspect when https://github.com/servo/webrender/pull/2353 lands in WR and Gecko, this bug will be fixed by that patch.

Comment 9

[Darkspirit]

I made a video on twitter multiple times fullscreen and back to normal and got a crash. bp-f7fd29ba-36fd-44a5-8e56-d89590180130
Socorro's logo is away and some text (ID/Signature on the top + App Notes) is just displayed with ☐☐☐☐☐☐ characters. If I copy them into a text editor, they are real text. If I open a new tab with https://www.google.de it's just blank.

Comment 10

[Glenn Watson [:gw]]

Do we know if this has been seen since https://github.com/servo/webrender/pull/2353 made its way into a Gecko/WR update? After that fix I haven't been able to reproduce it again.

Comment 11

[Darkspirit]

https://github.com/servo/webrender/compare/1d8157c71f88d5c673f5d084f02515ab74263814...b6e69a8efbcd8dc3e0c0a8a9925e6a9355635de3
landed with bug 1433567 comment 13 on 2018-01-30 21:59.
The two last crashes happened with build 20180130102929, so briefly before the fix landed. One was me. I can't reproduce my STR from comment 9 anymore.

Comment 12

[Kartikaya Gupta (email:[e-mail])]

Based on comment 11 and given the frequency with which this was happening before I think we can call it fixed.

Comment 13

[Milan Sreckovic [:milan] (needinfo for best results)]

This being fixed with a PR - is there a Gecko side reftest that we can add that catches this problem?