1441392 - Crash [@ swrast_dri.so+0x790f29 | webrender::device::Device::clear_target]

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebRender, defect, P2)

Description

[Jesse Schwartzentruber (:truber)]

Attachment: testcase.html

The attached testcase crashes in m-c 20180226-580d833df9c4 in Xvfb.

=================================================================
==6600==ERROR: AddressSanitizer: SEGV on unknown address 0x7fd6c3db9008 (pc 0x7fd72a5faf2a bp 0x6310007be780 sp 0x7fd6d0590670 T38)
==6600==The signal is caused by a READ memory access.
    #0 0x7fd72a5faf29 in begin_binning (/usr/lib/dri/swrast_dri.so+0x790f29)
    #1 0x7fd72a5fb3a5 in set_scene_state.isra.7 (/usr/lib/dri/swrast_dri.so+0x7913a5)
    #2 0x7fd72a5fbec2 in lp_setup_bind_framebuffer (/usr/lib/dri/swrast_dri.so+0x791ec2)
    #3 0x7fd72a60d5a2 in llvmpipe_set_framebuffer_state (/usr/lib/dri/swrast_dri.so+0x7a35a2)
    #4 0x7fd72a0adabb in st_update_framebuffer_state (/usr/lib/dri/swrast_dri.so+0x243abb)
    #5 0x7fd72a0ac538 in st_validate_state (/usr/lib/dri/swrast_dri.so+0x242538)
    #6 0x7fd72a0b47b3 in st_Clear (/usr/lib/dri/swrast_dri.so+0x24a7b3)
    #7 0x7fd73e80cb5a in webrender::device::Device::clear_target::h48bee34b9da1e8bc /builds/worker/workspace/build/src/gfx/webrender/src/device.rs:1928
    #8 0x7fd73e8f9e39 in webrender::renderer::Renderer::draw_alpha_target::h09013a711479cb55 /builds/worker/workspace/build/src/gfx/webrender/src/renderer.rs:3937
    #9 0x7fd73e8f9e39 in webrender::renderer::Renderer::draw_tile_frame::hf244c05f00232032 /builds/worker/workspace/build/src/gfx/webrender/src/renderer.rs:4427
    #10 0x7fd73e8ec3ee in webrender::renderer::Renderer::render_impl::_$u7b$$u7b$closure$u7d$$u7d$::h13f5531cbda2b29d /builds/worker/workspace/build/src/gfx/webrender/src/renderer.rs:2880
    #11 0x7fd73e8ec3ee in webrender::profiler::TimeProfileCounter::profile::h4a84da955fa713a4 /builds/worker/workspace/build/src/gfx/webrender/src/profiler.rs:190
    #12 0x7fd73e8ec3ee in webrender::renderer::Renderer::render_impl::hfea42b1748348b19 /builds/worker/workspace/build/src/gfx/webrender/src/renderer.rs:2833
    #13 0x7fd73e7d764d in webrender::renderer::Renderer::render::hb5fb0e293cab898c /builds/worker/workspace/build/src/gfx/webrender/src/renderer.rs:2779
    #14 0x7fd73e7d764d in wr_renderer_render /builds/worker/workspace/build/src/gfx/webrender_bindings/src/bindings.rs:525
    #15 0x7fd7332d966e in mozilla::wr::RendererOGL::UpdateAndRender(bool) /builds/worker/workspace/build/src/gfx/webrender_bindings/RendererOGL.cpp:136:8
    #16 0x7fd7332d816c in mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, bool) /builds/worker/workspace/build/src/gfx/webrender_bindings/RenderThread.cpp:256:24
    #17 0x7fd7332d7d4c in mozilla::wr::RenderThread::NewFrameReady(mozilla::wr::WrWindowId) /builds/worker/workspace/build/src/gfx/webrender_bindings/RenderThread.cpp:174:3
    #18 0x7fd7332e59c0 in applyImpl<mozilla::wr::RenderThread, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId), StoreCopyPassByConstLRef<mozilla::wr::WrWindowId> , 0> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1149:12
    #19 0x7fd7332e59c0 in apply<mozilla::wr::RenderThread, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId)> /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1155
    #20 0x7fd7332e59c0 in mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId), true, (mozilla::RunnableKind)0, mozilla::wr::WrWindowId>::Run() /builds/worker/workspace/build/src/obj-firefox/dist/include/nsThreadUtils.h:1200
    #21 0x7fd7314a43b3 in RunTask /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:452:9
    #22 0x7fd7314a43b3 in DeferOrRunPendingTask /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:460
    #23 0x7fd7314a43b3 in MessageLoop::DoWork() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:535
    #24 0x7fd7314a6328 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) /builds/worker/workspace/build/src/ipc/chromium/src/base/message_pump_default.cc:36:31
    #25 0x7fd7314a1799 in RunInternal /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:326:10
    #26 0x7fd7314a1799 in RunHandler /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:319
    #27 0x7fd7314a1799 in MessageLoop::Run() /builds/worker/workspace/build/src/ipc/chromium/src/base/message_loop.cc:299
    #28 0x7fd7314c0d3f in base::Thread::ThreadMain() /builds/worker/workspace/build/src/ipc/chromium/src/base/thread.cc:181:16
    #29 0x7fd7314b27ac in ThreadFunc(void*) /builds/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:38:13
    #30 0x7fd7505d408b in start_thread (/usr/lib/libpthread.so.0+0x708b)
    #31 0x7fd74f615e7e in __GI___clone (/usr/lib/libc.so.6+0xf5e7e)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/usr/lib/dri/swrast_dri.so+0x790f29) in begin_binning
Thread T38 (Renderer) created by T0 here:
    #0 0x4b065d in __interceptor_pthread_create /builds/worker/workspace/moz-toolchain/src/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:204:3
    #1 0x7fd7314b010f in CreateThread /builds/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:135:14
    #2 0x7fd7314b010f in PlatformThread::Create(unsigned long, PlatformThread::Delegate*, unsigned long*) /builds/worker/workspace/build/src/ipc/chromium/src/base/platform_thread_posix.cc:146
    #3 0x7fd7314c06df in base::Thread::StartWithOptions(base::Thread::Options const&) /builds/worker/workspace/build/src/ipc/chromium/src/base/thread.cc:99:8
    #4 0x7fd7332d6b26 in mozilla::wr::RenderThread::Start() /builds/worker/workspace/build/src/gfx/webrender_bindings/RenderThread.cpp:57:16
    #5 0x7fd73308b928 in gfxPlatform::InitLayersIPC() /builds/worker/workspace/build/src/gfx/thebes/gfxPlatform.cpp:1031:7
    #6 0x7fd733086ad3 in gfxPlatform::Init() /builds/worker/workspace/build/src/gfx/thebes/gfxPlatform.cpp:779:5
    #7 0x7fd7330840fb in gfxPlatform::GetPlatform() /builds/worker/workspace/build/src/gfx/thebes/gfxPlatform.cpp:538:9
    #8 0x7fd737ebe6d9 in mozilla::widget::GfxInfoBase::GetContentBackend(nsTSubstring<char16_t>&) /builds/worker/workspace/build/src/widget/GfxInfoBase.cpp:1527:25
    #9 0x7fd7306a4161 in NS_InvokeByIndex /builds/worker/workspace/build/src/xpcom/reflect/xptcall/md/unix/xptcinvoke_asm_x86_64_unix.S:106
    #10 0x7fd73216cb30 in Invoke /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1948:12
    #11 0x7fd73216cb30 in Call /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1267
    #12 0x7fd73216cb30 in XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNative.cpp:1234
    #13 0x7fd732173ba9 in GetAttribute /builds/worker/workspace/build/src/js/xpconnect/src/xpcprivate.h:1671:17
    #14 0x7fd732173ba9 in XPC_WN_GetterSetter(JSContext*, unsigned int, JS::Value*) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedNativeJSOps.cpp:965
    #15 0x7fd73c8d518e in CallJSNative /builds/worker/workspace/build/src/js/src/vm/JSContext-inl.h:290:15
    #16 0x7fd73c8d518e in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:467
    #17 0x7fd73c8d6ee2 in InternalCall /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:516:12
    #18 0x7fd73c8d6ee2 in Call /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535
    #19 0x7fd73c8d6ee2 in js::CallGetter(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:650
    #20 0x7fd73da375ae in CallGetter /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2155:16
    #21 0x7fd73da375ae in GetExistingProperty<js::AllowGC::CanGC> /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2208
    #22 0x7fd73da375ae in NativeGetPropertyInline<js::AllowGC::CanGC> /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2411
    #23 0x7fd73da375ae in js::NativeGetProperty(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::Value>, JS::Handle<jsid>, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/NativeObject.cpp:2447
    #24 0x7fd73c8bf97d in GetProperty /builds/worker/workspace/build/src/js/src/vm/NativeObject.h:1629:12
    #25 0x7fd73c8bf97d in GetObjectElementOperation /builds/worker/workspace/build/src/js/src/vm/Interpreter-inl.h:520
    #26 0x7fd73c8bf97d in GetElementOperation /builds/worker/workspace/build/src/js/src/vm/Interpreter-inl.h:626
    #27 0x7fd73c8bf97d in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:2930
    #28 0x7fd73c89f6e4 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12
    #29 0x7fd73c8d4f87 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15
    #30 0x7fd73c8bcb6b in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:12
    #31 0x7fd73c8bcb6b in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3092
    #32 0x7fd73c89f6e4 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12
    #33 0x7fd73c8d4f87 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15
    #34 0x7fd73c8bcb6b in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:12
    #35 0x7fd73c8bcb6b in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3092
    #36 0x7fd73c89f6e4 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12
    #37 0x7fd73c8d4f87 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15
    #38 0x7fd73c8bcb6b in CallFromStack /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:522:12
    #39 0x7fd73c8bcb6b in Interpret(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:3092
    #40 0x7fd73c89f6e4 in js::RunScript(JSContext*, js::RunState&) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:417:12
    #41 0x7fd73c8d4f87 in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:489:15
    #42 0x7fd73c8d5cf3 in js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/vm/Interpreter.cpp:535:10
    #43 0x7fd73d4d7ec5 in JS_CallFunctionValue(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::HandleValueArray const&, JS::MutableHandle<JS::Value>) /builds/worker/workspace/build/src/js/src/jsapi.cpp:2969:12
    #44 0x7fd732153b42 in nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS*, unsigned short, XPTMethodDescriptor const*, nsXPTCMiniVariant*) /builds/worker/workspace/build/src/js/xpconnect/src/XPCWrappedJSClass.cpp:1307:23
    #45 0x7fd7306a573f in PrepareAndDispatch /builds/worker/workspace/build/src/xpcom/reflect/xptcall/md/unix/xptcstubs_x86_64_linux.cpp:120:28
    #46 0x7fd7306a46ea in SharedStub (/home/truber/builds/m-c-1519683613-fuzzing-asan-opt/libxul.so+0x224e6ea)
    #47 0x7fd73061e91d in NS_CreateServicesFromCategory(char const*, nsISupports*, char const*, char16_t const*) /builds/worker/workspace/build/src/xpcom/components/nsCategoryManager.cpp:810:19
    #48 0x7fd73c5e846c in nsXREDirProvider::DoStartup() /builds/worker/workspace/build/src/toolkit/xre/nsXREDirProvider.cpp:1022:11
    #49 0x7fd73c5c4f68 in XREMain::XRE_mainRun() /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4516:16
    #50 0x7fd73c5c851c in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4814:8
    #51 0x7fd73c5c9964 in XRE_main(int, char**, mozilla::BootstrapConfig const&) /builds/worker/workspace/build/src/toolkit/xre/nsAppRunner.cpp:4906:21
    #52 0x4f6d45 in do_main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:231:22
    #53 0x4f6d45 in main /builds/worker/workspace/build/src/browser/app/nsBrowserApp.cpp:304
    #54 0x7fd74f540f49 in __libc_start_main (/usr/lib/libc.so.6+0x20f49)

==6600==ABORTING

Comment 1

[Sotaro Ikeda [:sotaro]]

Bug 1442921 seems to be similar bug. attachment 8954253 [details] caused similar crash like Bug 1442921 on my ubuntu pc.

Comment 2

[Glenn Watson [:gw]]

I believe this is fixed by https://github.com/servo/webrender/pull/2524, which is now in m-c. Jesse, are you able to confirm?

Comment 3

[Jesse Schwartzentruber (:truber)]

I get the following error now in m-c rev 20180411-cfe6399e142c:

ERROR 2018-04-11T17:25:21Z: webrender::render_backend: ERROR: Invalid window dimensions 32767x1335. Please call api.set_window_size()
firefox: ../mesa-18.0.0/src/gallium/drivers/llvmpipe/lp_state_surface.c:57: llvmpipe_set_framebuffer_state: Assertion `fb->width <= LP_MAX_WIDTH' failed.

Exit code: -6

No backtrace, only ASan traces from IPC shutdown.

Comment 4

[Darkspirit]

I opened https://bug1441392.bmoattachments.org/attachment.cgi?id=8954253 and allowed the popup.
bp-18eb2a53-dd34-47a3-8630-7548f0180516

Comment 5

[Darkspirit]

I couldn't reproduce on Win10 1803 (GeForce GTX 1060) so far.

Comment 6

[Glenn Watson [:gw]]

I'm fairly confident this is resolved now - we explicitly handle framebuffer dimensions being larger than supported by the hardware or OSMesa now. Has anyone seen this recently?

Comment 7

[Darkspirit]

(In reply to Glenn Watson [:gw] from comment #6)
> I'm fairly confident this is resolved now - we explicitly handle framebuffer dimensions being larger than supported by the hardware or OSMesa now. Has anyone seen this recently?

Same steps: bp-79cf4e1a-d774-491f-9ca2-ed6fa0180601 build 2018-05-31_220139 Linux.

Comment 8

[Darkspirit]

> WR @ 5e4f257d9f3cdb5691ac62f3affe2e9189d66447 (bug 1465058 comment 6)

RUST_BACKTRACE=1 mozregression --repo try --launch 119a1f4d7e743df417cdb8f008569dda7c0cc18f -B debug --pref gfx.webrender.all:true startup.homepage_welcome_url:'https://bug1441392.bmoattachments.org/attachment.cgi?id=8954253'
> 0:42.96 INFO: [GFX1-]: Attempting to allocate a texture of size 32688x2048 above the limit, trimming
> 0:42.96 INFO: ERROR 2018-06-01T16:22:05Z: webrender::device: Attempting to allocate a texture of size 32688x2048 above the limit, trimming
> 0:42.96 INFO: thread '<unnamed>' panicked at 'assertion failed: `(left == right)`
> 0:42.96 INFO:   left: `16384×2048`,
> 0:42.96 INFO:  right: `32688×2048`', gfx/webrender/src/tiling.rs:227:9
> 0:44.26 INFO: stack backtrace:
> 0:44.26 INFO:    0: std::sys::unix::backtrace::tracing::imp::unwind_backtrace
> 0:44.26 INFO:    1: std::sys_common::backtrace::print
> 0:44.26 INFO:    2: std::panicking::default_hook::{{closure}}
> 0:44.26 INFO:    3: std::panicking::default_hook
> 0:44.26 INFO:    4: std::panicking::rust_panic_with_hook
> 0:44.26 INFO:    5: std::panicking::begin_panic
> 0:44.26 INFO:    6: std::panicking::begin_panic_fmt
> 0:44.26 INFO:    7: <unknown>
> 0:44.26 INFO: Redirecting call to abort() to mozalloc_abort

https://github.com/servo/webrender/blob/5e4f257d9f3cdb5691ac62f3affe2e9189d66447/webrender/src/tiling.rs#L227

Comment 9

[Darkspirit]

comment 8 = Radeon RX480 on Debian Testing.

This doesn't crash with proprietary Nvidia.
> Gerätekennung	GeForce GTX 1060 3GB/PCIe/SSE2
> Treiber-Version	4.6.0 NVIDIA 390.48
https://packages.debian.org/buster/nvidia-driver

Comment 10

[Glenn Watson [:gw]]

The problem here appears to be that the check at https://github.com/servo/webrender/blob/952521658aaf331e7b7382fb18ca1d8b7bfc9dc8/webrender/src/render_backend.rs#L182 is no longer enough to avoid trying to render to a very large window.

I think this is because of the way the scene building is forwarded to the scene builder thread avoids this code path.

I tried to add a check to has_pixels() but that doesn't seem to be sufficient - it looks like the scene still gets built with a window size that is larger than the maximum texture size.

kats, any suggestions on the best way to resolve this? Or do you feel like taking this bug? :)

Comment 11

[Kartikaya Gupta (email:[e-mail])]

(In reply to Glenn Watson [:gw] from comment #10)
> The problem here appears to be that the check at
> https://github.com/servo/webrender/blob/
> 952521658aaf331e7b7382fb18ca1d8b7bfc9dc8/webrender/src/render_backend.
> rs#L182 is no longer enough to avoid trying to render to a very large window.
> 
> I think this is because of the way the scene building is forwarded to the
> scene builder thread avoids this code path.

I had kind of wondered about that inconsistency when I made the has_pixels() check. What is the expected behaviour in this case, if the window size is too large? If it skips doing the scene build isn't that going to just show a blank window instead of crashing?

> I tried to add a check to has_pixels() but that doesn't seem to be
> sufficient - it looks like the scene still gets built with a window size
> that is larger than the maximum texture size.
> 
> kats, any suggestions on the best way to resolve this? Or do you feel like
> taking this bug? :)

The has_pixels() check happens after scene build but before rendering. So yeah, it would still do the scene build if you put the check in has_pixels(). We probably want to add the check somewhere near the start of the forward_transaction_to_scene_builder function. But what exactly to do that in case depends on what the expected behaviour is for this scenario. I'm happy to implement the fix if you can answer the above questions.

Comment 12

[Kartikaya Gupta (email:[e-mail])]

For comment 11

Comment 13

[Glenn Watson [:gw]]

I think the expected behavior, for now at least, can just be to draw nothing. This generally only occurs for one frame, since Gecko then clamps the layout to the actual window size and sends a new display list. In any case, that is an improvement on a crash.

We could perhaps consider a better solution as a later follow up where we clamp to the maximum window size, but I'm not sure if that would be simple or perhaps cause issues elsewhere.

Comment 14

[Josh Matthews [:jdm]]

To reproduce the RenderTask::new_mask crash, all I have to do is scroll down https://www.magicleap.com/creator.

Comment 15

[Jeff Muizelaar [:jrmuizel]]

I've filed the magicleap crash as bug 1505934. I think this crash is actually fixed now. If someone disagrees please re-open.