1442718 - Crash in mozalloc_abort | abort | webrender::texture_cache::TextureCache::update (assertion failed: descriptor.width > 0 && descriptor.height > 0)

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect, P1)

Description

[Darkspirit]

Attachment: about:support.txt

Nightly 60 x64 20180302104326 de_DE @ Debian Testing (KDE, Radeon RX480)
main profile: webrender.all, gpu-process, omtp and others.

I clicked on "3 new tweets" (translated) on the top of my Twitter timeline. My whole browser UI turned white for about 2 seconds. There was a fallback to OpenGL compositing (although layers.acceleration.force-enabled is false).

bp-7eef7d60-2bde-4bac-a561-94a120180302 02.03.18 19:41 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update ]
> assertion failed: descriptor.width > 0 && descriptor.height > 0
> |[0]CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.05) |[1]CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.05) |[2]CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.05) |[3][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.05) |[4][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[5][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[6][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[7][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[8][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[9][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[10][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[11][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) 
bp-94c7affe-9dcf-4a42-b74b-d286d0180302 02.03.18 19:41 [@ @0x407d72 ]
> assertion failed: descriptor.width > 0 && descriptor.height > 0

bp-8a537fc0-8f1d-4b1b-a9ad-a036d0180302 02.03.18 19:01 [@ @0x407d72 ]
> assertion failed: descriptor.width > 0 && descriptor.height > 0
bp-1318670d-a28e-4db7-acca-2711c0180302 02.03.18 19:01 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update ]
> |[G0][GFX1-]: Incompatible CompositableHost at WebRenderBridgeParent. (t=0.371509) 
> assertion failed: descriptor.width > 0 && descriptor.height > 0

GPU_PROCESS	disabled by default: Disabled by default
		force_enabled by user: User force-enabled via pref
		failed by runtime: GPU process disabled after 2 attempts
WEBRENDER	
		opt-in by default: WebRender is an opt-in feature
		available by user: Enabled by pref
		unavailable by runtime: GPU Process is disabled <--- I am not on Windows, lol.
OMTP		disabled by default: Disabled by default
		available by user: Enabled via layers.omtp.enabled
Fehlerprotokoll
(#0) CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown
(#5) Error	Receive IPC close with reason=AbnormalShutdown
(#6) Error	Receive IPC close with reason=AbnormalShutdown
(#7) Error	Receive IPC close with reason=AbnormalShutdown
(#8) Error	Receive IPC close with reason=AbnormalShutdown
(#9) Error	Receive IPC close with reason=AbnormalShutdown
(#10) Error	Receive IPC close with reason=AbnormalShutdown
(#11) Error	Receive IPC close with reason=AbnormalShutdown
(#12) CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown
(#13) Error	Receive IPC close with reason=AbnormalShutdown
(#14) Error	GPU process disabled after 2 attempts
(#15) CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown
(#16) CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown
(#17) CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown
(#18) CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown
(#19) Error	Compositors might be mixed (5,2)

Comment 1

[Calixte Denizet (:calixte)]

There are 15 crashes (from 5 installations) in nightly 60 with buildid 20180302104326. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1440664.

[1] https://hg.mozilla.org/mozilla-central/rev?node=6f54af02c2e6

Comment 3

[Kartikaya Gupta (email:[e-mail])]

Any idea why this would have started with the last WR update?

Comment 4

[Kartikaya Gupta (email:[e-mail])]

The regression range in WR is 8a19316a733a484bf9bafb8257e3008b1418bfe4..22b831c02479eea31821f49a0fac7dd699083557:

*   22b831c0 Auto merge of #2484 - staktrace:fixes, r=kvark
|\  
| * 280dae81 Fix missing break statement from b4e030dc
* |   6d8609b7 Auto merge of #2481 - mrobinson:frame-building-state, r=glennw
|\ \  
| * | 4cddeaa7 Rename FrameState and FrameContext
|/ /  
* |   f461a5b3 Auto merge of #2480 - asajeffrey:buffer-payloads-to-avoid-deadlock, r=glennw
|\ \  
| * | 8bed7713 Use a dedicated thread to buffer payloads, so avoiding deadlock caused by blocking ipc send
* | |   2beacccd Auto merge of #2477 - glennw:fix-clipped-blends, r=kvark
|\ \ \  
| |/ /  
|/| |   
| * | 69814e7c Correctly handle blend primitives, where the contents are clipped.
|/ /  
* |   d7735c7d Auto merge of #2473 - Eijebong:euclid, r=nical
|\ \  
| * | ab6aeaf0 Update euclid to 0.17
|  /  
* |   b53cf779 Auto merge of #2471 - glennw:box-shadow1, r=kvark
|\ \  
| * | 3b72e0f9 Remove some unused shaders and code paths.
| * | d5b9dfb4 Remove the single corner optimization for box-shadows.
* | |   b3c5013d Auto merge of #2472 - staktrace:assorted, r=glennw
|\ \ \  
| |/ /  
|/| |   
| * | c158e131 Miscellaneous tweaks found while reading the code
|/ /  
* |   4e374f0c Auto merge of #2468 - mrobinson:display-list-flattener, r=nical
|\ \  
| * | c402eeec Move all flattening code into DisplayListFlattener
| * | 559f8c33 Rename frame.rs and FlattenContext
* | |   af9b0c08 Auto merge of #2466 - glennw:drop-image, r=kvark
|\ \ \  
| |/ /  
|/| |   
| * | 84a7058c Port drop-shadow and blur filter to use brush_image.
|/ /  
* |   3505979a Auto merge of #2461 - nical:epoch-current-scene, r=glennw
|\ \  
| * | 4dfabd86 Track pipeline epochs in two places rather than three.
* | |   4b905a01 Auto merge of #2464 - kvark:wrench-win, r=mrobinson
|\ \ \  
| * | | a9b9e309 Fix for wrench hangs on windows
* | | |   681e181d Auto merge of #2460 - mrobinson:fixed-position-clipping, r=kvark
|\ \ \ \  
| * | | | 87cfc672 Properly clip fixed position children
|/ / / /  
* | | |   c4cd1c8b Auto merge of #2455 - mrobinson:custom-clip-chain-ancestors, r=glennw
|\ \ \ \  
| * | | | f32fb92e Properly handle optimized ClipChain in custom ClipChain nodes
| | |/ /  
| |/| |   
* | | |   44d26c91 Auto merge of #2463 - jdm:ipc-debugging, r=jrmuizel
|\ \ \ \  
| |_|/ /  
|/| | |   
| * | | 36755a33 Add explanatory comment.
| * | | 7a99bb5d Add debug output to identify the cause of frequent CI failures.
| |/ /  
* | |   1f8cdb4f Auto merge of #2462 - kvark:wrench-exit, r=mrobinson
|\ \ \  
| |/ /  
|/| |   
| * | dc7932e4 Properly free resources on wrench reftests
|/ /  
* |   8e2672e5 Auto merge of #2449 - mrobinson:linear-scroll-node-id, r=kvark
|\ \  
| * | b5480828 Store ClipScrollNodes in a vector
|/ /  
* |   0b711f2e Auto merge of #2457 - mrobinson:less-strict-2d-detection, r=glennw
|\ \  
| * | 4ee249f3 Be less strict when detecting 2D translations
| |/  
* |   a0575821 Auto merge of #2459 - kvark:texture-size, r=glennw
|\ \  
| * | 16cb2b19 Check for texture size
* | |   98048a3c Auto merge of #2456 - mrobinson:remove-frame-context, r=kvark
|\ \ \  
| |/ /  
|/| |   
| * | 38f75797 Eliminate FrameContext and merge it into Document
| |/  
* |   b308a67a Auto merge of #2443 - glennw:fix-pic-clip, r=kvark
|\ \  
| |/  
|/|   
| * f274acab Now that we draw pictures by using their local rect as a normal primitive, we also need to apply clip masks to them, when they are required.
* 992dbd3f Auto merge of #2362 - nical:async-scene, r=glennw
* 69939456 Split DocumentMsg into SceneMsg and FrameMsg.
* c3fb6561 Address review comments.
* 272d8dbd Apply frame messages after building the scene in the sync path.
* be67702b Move the scene builder to its own file.
* 392c62b2 Rename prefix/postfix messages into scene/frame messages.
* b09c8e45 Keep track of the pending and built scenes separately on the render backend.
* edf064a4 Move dynamic properties into Document.
* 61bb29a4 Address some review comments.
* e39e0e7c Don't use the scene builder thread by default (yet).
* 5df631e1 Refactor transactions and forward them to the scene builder thread.
* c8ee8586 Handle removed pipelines.
* 4bd50525 Handle the pipeline epoch map properly.
* a481a202 Wake the render backend up after building the scene.
* a89270ac Move window_size from frame context to frame builder and update the clip scroll tree.
* 111cc480 Use Arc instead of Rc for clip chain nodes to make the clip scroll tree sendable.
* b4e030dc Begin patching the necessary information to the scene builder thread.
* 5423ee16 Arc scene pipelines to get read access on both the render backend and scene builder threads.
* 42b9bc2d Add the plumbing for a scene building thread.

Comment 5

[Dzmitry Malyshau [:kvark]]

So, basically, the async scene building PR?
I scanned through the changes and didn't find anything obvious that would cause the issues. We need a good repro case.

Comment 6

[Marcia Knous [:marcia]]

Adding a Mac signature which maps to the same regression build ID. If it needs a separate bug, please let me know and I will file it.

Comment 7

[Darkspirit]

(In reply to Jan Andre Ikenmeyer [:darkspirit] from comment #0)
> I clicked on "3 new tweets" (translated) on the top of my Twitter timeline.

I think this is reproducible for me and for https://twitter.com/kneecaw/status/969790354638729216.

Comment 9

[Dirkjan Ochtman (:djc)]

I had this happen to me when starting a video on npo.nl.

Comment 10

[Glenn Watson [:gw]]

Nothing stands out as obvious to me since the last WR update that would cause. It does sound like it's reduced to the async scene building though? I'll see if I can reproduce locally today.

Comment 11

[:gerard-majax]

Reproduced three times in a few minutes on my laptop (ubuntu 17.10/intel gpu):
 - bp-f04c3f43-4305-4db0-8da0-69aae0180305
 - bp-4f8fc770-ffc5-446e-9857-72cdd0180305
 - bp-557d6f00-6cd4-487f-9aba-3143b0180305

Comment 12

[:gerard-majax]

(In reply to Alexandre LISSY :gerard-majax from comment #11)
> Reproduced three times in a few minutes on my laptop (ubuntu 17.10/intel
> gpu):
>  - bp-f04c3f43-4305-4db0-8da0-69aae0180305
>  - bp-4f8fc770-ffc5-446e-9857-72cdd0180305
>  - bp-557d6f00-6cd4-487f-9aba-3143b0180305

So far it happens in really unexpected ways: switching desktops, switching tabs.

Comment 13

[:gerard-majax]

100% repro on some interactions on Twitter, like "Load new tweets".

Comment 14

[Milan Sreckovic [:milan] (needinfo for best results)]

assertion failed: descriptor.width > 0 && descriptor.height > 0 is not a new assertion, but we're hitting it more now?

Comment 15

[:gerard-majax]

Attachment: RUST_BACKTRACE=full

Comment 16

[Darkspirit]

- Click on the drop-down button at the top right of a tweet and mousedown on an item.
- Mousedown (and hold) on logout.
I think it's the light-blue box-shadow transition, but I don't know.

Comment 17

[Darkspirit]

Attachment: testcase.html

Comment 18

[Kartikaya Gupta (email:[e-mail])]

(In reply to Glenn Watson [:gw] from comment #10)
> It does sound like it's reduced to the async scene building though?

I don't think that was ever confirmed.

Comment 19

[Kartikaya Gupta (email:[e-mail])]

It sounds like people can repro this reliably enough. Can you make a try build with extra logging? We can ask people to run the builds and report back the results, and therefore debug the issue "by proxy".

Comment 20

[Dzmitry Malyshau [:kvark]]

Kats, I can repro in the Nightly that I use for browsing. Building a fresh one from source now to produce a fix. I don't think we need extra logging/repros at this point.

Comment 21

[Kartikaya Gupta (email:[e-mail])]

Great, thanks!

Comment 22

[Dzmitry Malyshau [:kvark]]

Pending upstream fix - https://github.com/servo/webrender/pull/2490

Comment 23

[Darkspirit]

Click on "Crash me".

try builds from bug 1440664:
> WR @ 992dbd3f07b143f35581012082aa59fbda7c387e
mozregression --repo try --launch 4916bd1bb3e9470ea106ebf45859b68b2a1b474c --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 0b711f2e514107361deef4297c3c7da794d4835c
mozregression --repo try --launch 9cbf4580d196e5997b2ca7f8ce4fa26b49e47b0f --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 8e2672e52a5a80eba40030601653fe0c1ae223a1 with Martin's gecko-side build fix
mozregression --repo try --launch 317d1d2871553263a57c6928fdc10087a7a47542 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 1f8cdb4f3fb5de8bf40fc2d9c0d8c355476ccd86
mozregression --repo try --launch 41d4de115b4ef7f98a74e820422b6b12cc84a5f9 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ c4cd1c8bfa6b1904ba813d7c1ebd6df2e186f87e
mozregression --repo try --launch 846a8a65810a3e67818c9216beeef8f4af3c1e53 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 681e181d254e867efb07b91436daf5a6aea71d34
mozregression --repo try --launch 683c1393f6a3b351520532deb2cb6189a7de962e --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 4b905a0179c4ce43c8b4a536d249976b0df45963
mozregression --repo try --launch eef9473ccc0b04cab9372c9609f2aa320d8363df --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 3505979af2cfabb35729e6a73217405b638ac2f9
mozregression --repo try --launch bbcfaf58dd9510bf5c2883c5a4e24d89242ec826 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 4e374f0c5139ca81ee8de99afe2fc3bc53e3632e
mozregression --repo try --launch 3894fc62b9052a377b1e0a0287f44722751fbb4d --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ b53cf7799a0f5861dfa928ee0ccc66e8d0b78758
mozregression --repo try --launch d115c4c11850c1b1d0b1c847eefc3d959efe0b12 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
bad

> WR @ d7735c7da9844775d4a3e6ec8b6cea25fb0b0486
mozregression --repo try --launch b40a669299a09518cdbc422d2bf57fc9f5794d4f --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
bad

> WR @ f461a5b39fe2b35c542303d5f3128a7aff547806
mozregression --repo try --launch 186e548e48ffbfe68d3f21ac0b7c3223159f07e4 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
bad

> WR @ 6d8609b79048384465863c1cd13e294fb26cae0f
mozregression --repo try --launch d43989a894394b208494e5c888a5efe4ffb3c450 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
bad

> WR @ 22b831c02479eea31821f49a0fac7dd699083557
mozregression --repo try --launch 2e2f12e263c3482e5e0496e7a55ddd8be7d54550 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
bad

Regression range: https://github.com/servo/webrender/compare/4e374f0c5139ca81ee8de99afe2fc3bc53e3632e...b53cf7799a0f5861dfa928ee0ccc66e8d0b78758

-----

try build from servo/webrender#2490:
mozregression --repo try --launch 11b5d65d0e682c277992c1cea5d4048227184118 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good