1440088 - blob-images: Crash on http://www.adfc-tourenportal.de/viewtrackobject.php?trackObjectID=23944

Status: RESOLVED DUPLICATE of bug 1454187

(Core :: Graphics: WebRender, defect, P1)

Description

[Tobias (:Tobbi) Markus]

Steps to reproduce:

1. Go to http://www.adfc-tourenportal.de/viewtrackobject.php?trackObjectID=23944
2. Scroll in and out of the map. (The resulting rendering issue has been reported as bug 1440087).

3. I got a crash while doing so repeatedly in a short period of time.

Crash report:

https://crash-stats.mozilla.com/report/index/007e7c63-6f18-414b-8772-24f850180221

Comment 2

[Darkspirit]

Attachment: Crash.mp4

bp-5e7875ff-8e57-43a7-9d9d-2179b0180306 06.03.18 13:58

Comment 3

[Darkspirit]

Attachment: Memory Leak.mp4

Comment 4

[Darkspirit]

It looks like bug 1391255 could have multiple causes. This one is easy to reproduce for me.

Comment 5

[Darkspirit]

> Memory Leak.mp4
OBS was dying. In reality, zooming stutters only at the end.

Comment 6

[Milan Sreckovic [:milan] (needinfo for best results)]

Failed to allocate a surface due to invalid size (DTD) Size(12290,12290) preceding the assert/panic.

Comment 7

[Darkspirit]

Try completely zooming out and then zooming into the center of Moscow. I had no luck with other cities like London. (lol)

Comment 8

[Darkspirit]

(In reply to Jan Andre Ikenmeyer [:darkspirit] from comment #7)
> Try completely zooming out and then zooming into the center of Moscow.

mozregression --launch 9cd8e03d9e472f07041be3cd80cc95a8194f91a5 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://www.adfc-tourenportal.de/map.php?&minimap=1&maptypecontrol=1&largenavigation=1&poi=1&viewbox=50.5964,6.08269,54.8396,10.0339&selectId=16782716385aac1ef0225d2&sid=tjr78raeoc0j55vunekjr60gd2&TrackobjectId=23944" -B debug
> 0:43.72 INFO: [Child 3475, ImageIO] WARNING: Appending an extra chunk for SourceBuffer: file /builds/worker/workspace/build/src/image/SourceBuffer.cpp, line 148
> 0:43.72 INFO: [Child 3475, ImageIO] WARNING: Appending an extra chunk for SourceBuffer: file /builds/worker/workspace/build/src/image/SourceBuffer.cpp, line 148
> 0:43.79 INFO: [Child 3475, ImageIO] WARNING: Appending an extra chunk for SourceBuffer: file /builds/worker/workspace/build
> [...]
> 0:56.11 INFO: [GFX3-]: Surface size too large (exceeds allocation limit)!
> 0:56.11 INFO: [GFX3-]: Surface size too large (exceeds extent limit)!
> 0:56.11 INFO: [GFX1-]: Failed to allocate a surface due to invalid size (DTD) Size(13122,9863)
> 0:56.11 INFO: thread 'WRWorker#1' panicked at 'Moz2D replay problem', gfx/webrender_bindings/src/moz2d_renderer.rs:187:21

Behavior is the same: Sometimes Nightly just freezes with a broken UI and uses more and more memory (until my desktop freezes) or I get a crash report like this one:
bp-7e13d0b5-775f-487a-bdd1-4478f0180316 [@ mozalloc_abort | abort | rayon_core::job::{{impl}}::execute<T> ]

Comment 9

[Darkspirit]

Nightly 61 x64 20180403100105 de_DE 4a3275936ddf871103b53e00608e2b8d5aee7e69 @ Debian Testing, KDE, Radeon RX480, 2560x1440
fresh profile

[@ mozalloc_abort | abort | libxul.so@0x3d69b08 | libxul.so@0x3d69af8 | libxul.so@0x3d59650 | rayon_core::job::{{impl}}::execute<T> ]
bp-5af27b2a-6477-4fc0-83e3-d88680180403 03.04.18 21:35 gfx.webrender.all + gfx.webrender.blob.invalidation
bp-ff9fa5c0-7a23-455d-8256-74d0e0180403 03.04.18 21:34 gfx.webrender.all
> MOZ_CRASH Reason 	Moz2D replay problem
> GraphicsCriticalError |[0][GFX1-]: Failed to allocate a surface due to invalid size (DTD) Size(15170,9507) (t=31.865) 

fastly zooming in: memory leak
zooming in not too fast, but also not too slow: crash

Slightly different crash signature, otherwise unchanged.

Comment 10

[Darkspirit]

> Try completely zooming out and then zooming into the center of Moscow.
> https://www.adfc-tourenportal.de/map.php?&minimap=1&maptypecontrol=1&largenavigation=1&poi=1&viewbox=50.5964,6.08269,54.8396,10.0339&selectId=16782716385aac1ef0225d2&sid=tjr78raeoc0j55vunekjr60gd2&TrackobjectId=23944
> zooming in not too fast, but also not too slow: crash

bp-0719b3a8-f84e-487f-ac4c-335be0180407 07.04.18 02:10

Comment 11

[Darkspirit]

bp-9f183072-24c6-4cd7-b322-849220180414 14.04.18 21:07

Comment 12

[Darkspirit]

gfx.webrender.all + gfx.webrender.async-scene-build;2 = bug 1455743     bp-775d7165-52dc-4fab-9288-b6def0180424
gfx.webrender.all + gfx.webrender.async-scene-build;0 = same as before. bp-c1322c32-f3d3-4142-8254-fd6000180424

Comment 13

[Darkspirit]

Debian Testing, KDE, Radeon RX480

bad = a crash. This issue behaves the same in the past.

mozregression --good 2018-01-15 --bad 2018-03-06 --pref layers.acceleration.force-enabled:true gfx.webrender.enabled:true image.mem.shared:false gfx.webrender.blob-images:true gfx.webrender.hit-test:true gfx.webrender.async-scene-build:0 gfx.webrender.blob.invalidation:false startup.homepage_welcome_url:'https://www.adfc-tourenportal.de/map.php?&minimap=1&maptypecontrol=1&largenavigation=1&poi=1&viewbox=50.5964,6.08269,54.8396,10.0339&selectId=16782716385aac1ef0225d2&sid=tjr78raeoc0j55vunekjr60gd2&TrackobjectId=23944'
> 25:40.50 INFO: Last good revision: 0561afeb9ca153847505cb3857ebda9d380205a2
> 25:40.50 INFO: First bad revision: b2804c6bec4c61bffd17cd1526877db79508f454
> 25:40.50 INFO: Pushlog:
> https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=0561afeb9ca153847505cb3857ebda9d380205a2&tochange=b2804c6bec4c61bffd17cd1526877db79508f454

2018-02-06
> b2804c6bec4c	Alexis Beingessner — Bug 1362115 - turn on blob-images by default with webrender. r=kats
> cae458b810a8	Alexis Beingessner — Bug 1362115 - properly handle empty slices in FFI bindings. r=kats
> 87b04696a381	Alexis Beingessner — Bug 1362115 - don't emit a blob-image for contentless videos. r=kats

(Note that mozregression always had gfx.webrender.blob-images:true.)

-----

mozregression --repo autoland --launch b2804c6bec4c61bffd17cd1526877db79508f454 -B debug --pref layers.acceleration.force-enabled:true gfx.webrender.enabled:true image.mem.shared:false gfx.webrender.blob-images:true gfx.webrender.hit-test:true gfx.webrender.async-scene-build:0 gfx.webrender.blob.invalidation:false startup.homepage_welcome_url:'https://www.adfc-tourenportal.de/map.php?&minimap=1&maptypecontrol=1&largenavigation=1&poi=1&viewbox=50.5964,6.08269,54.8396,10.0339&selectId=16782716385aac1ef0225d2&sid=tjr78raeoc0j55vunekjr60gd2&TrackobjectId=23944'
> 0:51.62 INFO: [GFX3-]: Surface size too large (exceeds allocation limit)!
> 0:51.62 INFO: [GFX3-]: Surface size too large (exceeds extent limit)!
> 0:51.62 INFO: [GFX1-]: Failed to allocate a surface due to invalid size (DTD) Size(13330,11452)
> 0:51.62 INFO: thread 'WRRenderBackend#1' panicked at 'Vector image error Unknown error', /builds/worker/workspace/build/src/gfx/webrender/src/resource_cache.rs:868:28

is the same reason reason as bp-5e7875ff-8e57-43a7-9d9d-2179b0180306 from comment 2. (Same with gfx.webrender.hit-test:false.)

Please don't slap me. xD

Comment 14

[Darkspirit]

*crash reason

Comment 15

[Darkspirit]

First bad:
RUST_BACKTRACE=1 mozregression --repo autoland --launch b2804c6bec4c61bffd17cd1526877db79508f454 -B debug --pref layers.acceleration.force-enabled:true gfx.webrender.enabled:true image.mem.shared:false gfx.webrender.blob-images:true gfx.webrender.hit-test:false gfx.webrender.async-scene-build:0 gfx.webrender.blob.invalidation:false startup.homepage_welcome_url:'https://www.adfc-tourenportal.de/map.php?&minimap=1&maptypecontrol=1&largenavigation=1&poi=1&viewbox=50.5964,6.08269,54.8396,10.0339&selectId=16782716385aac1ef0225d2&sid=tjr78raeoc0j55vunekjr60gd2&TrackobjectId=23944'
> 0:50.79 INFO: [GFX3-]: Surface size too large (exceeds allocation limit)!
> 0:50.79 INFO: [GFX3-]: Surface size too large (exceeds extent limit)!
> 0:50.79 INFO: [GFX1-]: Failed to allocate a surface due to invalid size (DTD) Size(14210,8906)
> 0:50.79 INFO: thread 'WRRenderBackend#1' panicked at 'Vector image error Unknown error', /builds/worker/workspace/build/src/gfx/webrender/src/resource_cache.rs:868:28
> 0:51.51 INFO: --DOMWINDOW == 15 (0x7f3a1db29c00) [pid = 15564] [serial = 2] [outer = (nil)] [url = about:blank]
> 0:51.51 INFO: --DOMWINDOW == 14 (0x7f3a07b7d800) [pid = 15564] [serial = 12] [outer = (nil)] [url = about:blank]
> 0:51.51 INFO: --DOMWINDOW == 13 (0x7f3a1af0a800) [pid = 15564] [serial = 11] [outer = (nil)] [url = about:blank]
> 0:51.51 INFO: --DOMWINDOW == 12 (0x7f3a07b82800) [pid = 15564] [serial = 15] [outer = (nil)] [url = about:blank]
> 0:52.46 INFO: stack backtrace:
> 0:52.46 INFO:    0: std::sys::imp::backtrace::tracing::imp::unwind_backtrace
> 0:52.46 INFO:    1: std::sys_common::backtrace::_print
> 0:52.46 INFO:    2: std::panicking::default_hook::{{closure}}
> 0:52.46 INFO:    3: std::panicking::default_hook
> 0:52.46 INFO:    4: std::panicking::rust_panic_with_hook
> 0:52.46 INFO:    5: std::panicking::begin_panic
> 0:52.46 INFO:    6: std::panicking::begin_panic_fmt
> 0:52.46 INFO:    7: <unknown>
> 0:52.46 INFO: Redirecting call to abort() to mozalloc_abort
> 0:52.46 INFO: 
> 0:52.46 INFO: Hit MOZ_CRASH() at /builds/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:33

Although this has the same crash reason as bp-5e7875ff-8e57-43a7-9d9d-2179b0180306, the crash stack looks different.

Today:
RUST_BACKTRACE=1 mozregression --launch 2018-04-23 -B debug --pref layers.acceleration.force-enabled:true gfx.webrender.enabled:true image.mem.shared:false gfx.webrender.blob-images:true gfx.webrender.hit-test:true gfx.webrender.async-scene-build:0 gfx.webrender.blob.invalidation:false startup.homepage_welcome_url:'https://www.adfc-tourenportal.de/map.php?&minimap=1&maptypecontrol=1&largenavigation=1&poi=1&viewbox=50.5964,6.08269,54.8396,10.0339&selectId=16782716385aac1ef0225d2&sid=tjr78raeoc0j55vunekjr60gd2&TrackobjectId=23944'
> 1:01.92 INFO: [GFX3-]: Surface size too large (exceeds allocation limit)!
> 1:01.92 INFO: [GFX3-]: Surface size too large (exceeds extent limit)!
> 1:01.92 INFO: [GFX1-]: Failed to allocate a surface due to invalid size (DTD) Size(15554,9749)
> 1:01.92 INFO: thread 'WRWorker#5' panicked at 'Moz2D replay problem', gfx/webrender_bindings/src/moz2d_renderer.rs:454:21
> 1:02.91 INFO: --DOMWINDOW == 6 (0x7fdff4d11400) [pid = 15161] [serial = 3] [outer = (nil)] [url = about:blank]
> 1:03.30 INFO: stack backtrace:
> 1:03.30 INFO:    0: std::sys::unix::backtrace::tracing::imp::unwind_backtrace
> 1:03.30 INFO:    1: std::sys_common::backtrace::_print
> 1:03.30 INFO:    2: std::panicking::default_hook::{{closure}}
> 1:03.30 INFO:    3: std::panicking::default_hook
> 1:03.30 INFO:    4: std::panicking::rust_panic_with_hook
> 1:03.30 INFO:    5: <unknown>
> 1:03.30 INFO: Redirecting call to abort() to mozalloc_abort
> 1:03.30 INFO: 
> 1:03.30 INFO: Hit MOZ_CRASH() at /builds/worker/workspace/build/src/memory/mozalloc/mozalloc_abort.cpp:34

Comment 16

[Darkspirit]

> https://web.archive.org/web/20171021231331/https://www.adfc-tourenportal.de/map.php
bp-12124d5c-0bf7-49b7-a0d3-357cd0180605 GTX 1060, proprietary driver, on Debian Testing