Closed Bug 1442718 Opened 2 years ago Closed 2 years ago

Crash in mozalloc_abort | abort | webrender::texture_cache::TextureCache::update (assertion failed: descriptor.width > 0 && descriptor.height > 0)

Categories

(Core :: Graphics: WebRender, defect, P1, critical)

x86_64
All
defect

Tracking

()

RESOLVED FIXED
mozilla60
Tracking Status
firefox-esr52 --- unaffected
firefox58 --- unaffected
firefox59 --- unaffected
firefox60 --- fixed

People

(Reporter: darkspirit, Assigned: kvark)

References

(Blocks 2 open bugs, )

Details

(Keywords: crash, nightly-community, regression)

Crash Data

Attachments

(3 files)

Attached file about:support.txt
Nightly 60 x64 20180302104326 de_DE @ Debian Testing (KDE, Radeon RX480)
main profile: webrender.all, gpu-process, omtp and others.

I clicked on "3 new tweets" (translated) on the top of my Twitter timeline. My whole browser UI turned white for about 2 seconds. There was a fallback to OpenGL compositing (although layers.acceleration.force-enabled is false).

bp-7eef7d60-2bde-4bac-a561-94a120180302 02.03.18 19:41 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update ]
> assertion failed: descriptor.width > 0 && descriptor.height > 0
> |[0]CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.05) |[1]CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.05) |[2]CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.05) |[3][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.05) |[4][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[5][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[6][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[7][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[8][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[9][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[10][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) |[11][GFX1-]: Receive IPC close with reason=AbnormalShutdown (t=2958.3) 
bp-94c7affe-9dcf-4a42-b74b-d286d0180302 02.03.18 19:41 [@ @0x407d72 ]
> assertion failed: descriptor.width > 0 && descriptor.height > 0

bp-8a537fc0-8f1d-4b1b-a9ad-a036d0180302 02.03.18 19:01 [@ @0x407d72 ]
> assertion failed: descriptor.width > 0 && descriptor.height > 0
bp-1318670d-a28e-4db7-acca-2711c0180302 02.03.18 19:01 [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update ]
> |[G0][GFX1-]: Incompatible CompositableHost at WebRenderBridgeParent. (t=0.371509) 
> assertion failed: descriptor.width > 0 && descriptor.height > 0

GPU_PROCESS	disabled by default: Disabled by default
		force_enabled by user: User force-enabled via pref
		failed by runtime: GPU process disabled after 2 attempts
WEBRENDER	
		opt-in by default: WebRender is an opt-in feature
		available by user: Enabled by pref
		unavailable by runtime: GPU Process is disabled <--- I am not on Windows, lol.
OMTP		disabled by default: Disabled by default
		available by user: Enabled via layers.omtp.enabled
Fehlerprotokoll
(#0) CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown
(#5) Error	Receive IPC close with reason=AbnormalShutdown
(#6) Error	Receive IPC close with reason=AbnormalShutdown
(#7) Error	Receive IPC close with reason=AbnormalShutdown
(#8) Error	Receive IPC close with reason=AbnormalShutdown
(#9) Error	Receive IPC close with reason=AbnormalShutdown
(#10) Error	Receive IPC close with reason=AbnormalShutdown
(#11) Error	Receive IPC close with reason=AbnormalShutdown
(#12) CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown
(#13) Error	Receive IPC close with reason=AbnormalShutdown
(#14) Error	GPU process disabled after 2 attempts
(#15) CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown
(#16) CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown
(#17) CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown
(#18) CP+[GFX1-]: Receive IPC close with reason=AbnormalShutdown
(#19) Error	Compositors might be mixed (5,2)
There are 15 crashes (from 5 installations) in nightly 60 with buildid 20180302104326. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1440664.

[1] https://hg.mozilla.org/mozilla-central/rev?node=6f54af02c2e6
Blocks: clouseau, 1440664
Flags: needinfo?(bugmail)
Crash Signature: [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update ] [@ @0x407d72 ] → [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update ] [@ @0x407d72 ] [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update::h1d76aa66f4f6d22d ]
OS: Linux → All
Duplicate of this bug: 1442691
Any idea why this would have started with the last WR update?
Flags: needinfo?(kvark)
Flags: needinfo?(gwatson)
The regression range in WR is 8a19316a733a484bf9bafb8257e3008b1418bfe4..22b831c02479eea31821f49a0fac7dd699083557:

*   22b831c0 Auto merge of #2484 - staktrace:fixes, r=kvark
|\  
| * 280dae81 Fix missing break statement from b4e030dc
* |   6d8609b7 Auto merge of #2481 - mrobinson:frame-building-state, r=glennw
|\ \  
| * | 4cddeaa7 Rename FrameState and FrameContext
|/ /  
* |   f461a5b3 Auto merge of #2480 - asajeffrey:buffer-payloads-to-avoid-deadlock, r=glennw
|\ \  
| * | 8bed7713 Use a dedicated thread to buffer payloads, so avoiding deadlock caused by blocking ipc send
* | |   2beacccd Auto merge of #2477 - glennw:fix-clipped-blends, r=kvark
|\ \ \  
| |/ /  
|/| |   
| * | 69814e7c Correctly handle blend primitives, where the contents are clipped.
|/ /  
* |   d7735c7d Auto merge of #2473 - Eijebong:euclid, r=nical
|\ \  
| * | ab6aeaf0 Update euclid to 0.17
|  /  
* |   b53cf779 Auto merge of #2471 - glennw:box-shadow1, r=kvark
|\ \  
| * | 3b72e0f9 Remove some unused shaders and code paths.
| * | d5b9dfb4 Remove the single corner optimization for box-shadows.
* | |   b3c5013d Auto merge of #2472 - staktrace:assorted, r=glennw
|\ \ \  
| |/ /  
|/| |   
| * | c158e131 Miscellaneous tweaks found while reading the code
|/ /  
* |   4e374f0c Auto merge of #2468 - mrobinson:display-list-flattener, r=nical
|\ \  
| * | c402eeec Move all flattening code into DisplayListFlattener
| * | 559f8c33 Rename frame.rs and FlattenContext
* | |   af9b0c08 Auto merge of #2466 - glennw:drop-image, r=kvark
|\ \ \  
| |/ /  
|/| |   
| * | 84a7058c Port drop-shadow and blur filter to use brush_image.
|/ /  
* |   3505979a Auto merge of #2461 - nical:epoch-current-scene, r=glennw
|\ \  
| * | 4dfabd86 Track pipeline epochs in two places rather than three.
* | |   4b905a01 Auto merge of #2464 - kvark:wrench-win, r=mrobinson
|\ \ \  
| * | | a9b9e309 Fix for wrench hangs on windows
* | | |   681e181d Auto merge of #2460 - mrobinson:fixed-position-clipping, r=kvark
|\ \ \ \  
| * | | | 87cfc672 Properly clip fixed position children
|/ / / /  
* | | |   c4cd1c8b Auto merge of #2455 - mrobinson:custom-clip-chain-ancestors, r=glennw
|\ \ \ \  
| * | | | f32fb92e Properly handle optimized ClipChain in custom ClipChain nodes
| | |/ /  
| |/| |   
* | | |   44d26c91 Auto merge of #2463 - jdm:ipc-debugging, r=jrmuizel
|\ \ \ \  
| |_|/ /  
|/| | |   
| * | | 36755a33 Add explanatory comment.
| * | | 7a99bb5d Add debug output to identify the cause of frequent CI failures.
| |/ /  
* | |   1f8cdb4f Auto merge of #2462 - kvark:wrench-exit, r=mrobinson
|\ \ \  
| |/ /  
|/| |   
| * | dc7932e4 Properly free resources on wrench reftests
|/ /  
* |   8e2672e5 Auto merge of #2449 - mrobinson:linear-scroll-node-id, r=kvark
|\ \  
| * | b5480828 Store ClipScrollNodes in a vector
|/ /  
* |   0b711f2e Auto merge of #2457 - mrobinson:less-strict-2d-detection, r=glennw
|\ \  
| * | 4ee249f3 Be less strict when detecting 2D translations
| |/  
* |   a0575821 Auto merge of #2459 - kvark:texture-size, r=glennw
|\ \  
| * | 16cb2b19 Check for texture size
* | |   98048a3c Auto merge of #2456 - mrobinson:remove-frame-context, r=kvark
|\ \ \  
| |/ /  
|/| |   
| * | 38f75797 Eliminate FrameContext and merge it into Document
| |/  
* |   b308a67a Auto merge of #2443 - glennw:fix-pic-clip, r=kvark
|\ \  
| |/  
|/|   
| * f274acab Now that we draw pictures by using their local rect as a normal primitive, we also need to apply clip masks to them, when they are required.
* 992dbd3f Auto merge of #2362 - nical:async-scene, r=glennw
* 69939456 Split DocumentMsg into SceneMsg and FrameMsg.
* c3fb6561 Address review comments.
* 272d8dbd Apply frame messages after building the scene in the sync path.
* be67702b Move the scene builder to its own file.
* 392c62b2 Rename prefix/postfix messages into scene/frame messages.
* b09c8e45 Keep track of the pending and built scenes separately on the render backend.
* edf064a4 Move dynamic properties into Document.
* 61bb29a4 Address some review comments.
* e39e0e7c Don't use the scene builder thread by default (yet).
* 5df631e1 Refactor transactions and forward them to the scene builder thread.
* c8ee8586 Handle removed pipelines.
* 4bd50525 Handle the pipeline epoch map properly.
* a481a202 Wake the render backend up after building the scene.
* a89270ac Move window_size from frame context to frame builder and update the clip scroll tree.
* 111cc480 Use Arc instead of Rc for clip chain nodes to make the clip scroll tree sendable.
* b4e030dc Begin patching the necessary information to the scene builder thread.
* 5423ee16 Arc scene pipelines to get read access on both the render backend and scene builder threads.
* 42b9bc2d Add the plumbing for a scene building thread.
So, basically, the async scene building PR?
I scanned through the changes and didn't find anything obvious that would cause the issues. We need a good repro case.
Flags: needinfo?(kvark)
Adding a Mac signature which maps to the same regression build ID. If it needs a separate bug, please let me know and I will file it.
(In reply to Jan Andre Ikenmeyer [:darkspirit] from comment #0)
> I clicked on "3 new tweets" (translated) on the top of my Twitter timeline.

I think this is reproducible for me and for https://twitter.com/kneecaw/status/969790354638729216.
Crash Signature: [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update ] [@ @0x407d72 ] [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update::h1d76aa66f4f6d22d ] → [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update ] [@ @0x407d72 ] [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update::h1d76aa66f4f6d22d ] [@ webrender::texture_cache::TextureCache::update ]
See Also: → 1442921
Duplicate of this bug: 1443005
Crash Signature: [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update ] [@ @0x407d72 ] [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update::h1d76aa66f4f6d22d ] [@ webrender::texture_cache::TextureCache::update ] → [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update ] [@ @0x407d72 ] [@ mozalloc_abort | abort | webrender::texture_cache::TextureCache::update::h1d76aa66f4f6d22d ] [@ webrender::texture_cache::TextureCache::update ] [@ mozalloc…
I had this happen to me when starting a video on npo.nl.
Nothing stands out as obvious to me since the last WR update that would cause. It does sound like it's reduced to the async scene building though? I'll see if I can reproduce locally today.
Flags: needinfo?(gwatson)
Reproduced three times in a few minutes on my laptop (ubuntu 17.10/intel gpu):
 - bp-f04c3f43-4305-4db0-8da0-69aae0180305
 - bp-4f8fc770-ffc5-446e-9857-72cdd0180305
 - bp-557d6f00-6cd4-487f-9aba-3143b0180305
(In reply to Alexandre LISSY :gerard-majax from comment #11)
> Reproduced three times in a few minutes on my laptop (ubuntu 17.10/intel
> gpu):
>  - bp-f04c3f43-4305-4db0-8da0-69aae0180305
>  - bp-4f8fc770-ffc5-446e-9857-72cdd0180305
>  - bp-557d6f00-6cd4-487f-9aba-3143b0180305

So far it happens in really unexpected ways: switching desktops, switching tabs.
100% repro on some interactions on Twitter, like "Load new tweets".
assertion failed: descriptor.width > 0 && descriptor.height > 0 is not a new assertion, but we're hitting it more now?
Assignee: nobody → gwatson
Priority: -- → P1
- Click on the drop-down button at the top right of a tweet and mousedown on an item.
- Mousedown (and hold) on logout.
I think it's the light-blue box-shadow transition, but I don't know.
Attached file testcase.html
(In reply to Glenn Watson [:gw] from comment #10)
> It does sound like it's reduced to the async scene building though?

I don't think that was ever confirmed.
It sounds like people can repro this reliably enough. Can you make a try build with extra logging? We can ask people to run the builds and report back the results, and therefore debug the issue "by proxy".
Flags: needinfo?(kvark)
Kats, I can repro in the Nightly that I use for browsing. Building a fresh one from source now to produce a fix. I don't think we need extra logging/repros at this point.
Flags: needinfo?(kvark)
Great, thanks!
Assignee: gwatson → kvark
Click on "Crash me".

try builds from bug 1440664:
> WR @ 992dbd3f07b143f35581012082aa59fbda7c387e
mozregression --repo try --launch 4916bd1bb3e9470ea106ebf45859b68b2a1b474c --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 0b711f2e514107361deef4297c3c7da794d4835c
mozregression --repo try --launch 9cbf4580d196e5997b2ca7f8ce4fa26b49e47b0f --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 8e2672e52a5a80eba40030601653fe0c1ae223a1 with Martin's gecko-side build fix
mozregression --repo try --launch 317d1d2871553263a57c6928fdc10087a7a47542 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 1f8cdb4f3fb5de8bf40fc2d9c0d8c355476ccd86
mozregression --repo try --launch 41d4de115b4ef7f98a74e820422b6b12cc84a5f9 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ c4cd1c8bfa6b1904ba813d7c1ebd6df2e186f87e
mozregression --repo try --launch 846a8a65810a3e67818c9216beeef8f4af3c1e53 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 681e181d254e867efb07b91436daf5a6aea71d34
mozregression --repo try --launch 683c1393f6a3b351520532deb2cb6189a7de962e --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 4b905a0179c4ce43c8b4a536d249976b0df45963
mozregression --repo try --launch eef9473ccc0b04cab9372c9609f2aa320d8363df --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 3505979af2cfabb35729e6a73217405b638ac2f9
mozregression --repo try --launch bbcfaf58dd9510bf5c2883c5a4e24d89242ec826 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ 4e374f0c5139ca81ee8de99afe2fc3bc53e3632e
mozregression --repo try --launch 3894fc62b9052a377b1e0a0287f44722751fbb4d --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good

> WR @ b53cf7799a0f5861dfa928ee0ccc66e8d0b78758
mozregression --repo try --launch d115c4c11850c1b1d0b1c847eefc3d959efe0b12 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
bad

> WR @ d7735c7da9844775d4a3e6ec8b6cea25fb0b0486
mozregression --repo try --launch b40a669299a09518cdbc422d2bf57fc9f5794d4f --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
bad

> WR @ f461a5b39fe2b35c542303d5f3128a7aff547806
mozregression --repo try --launch 186e548e48ffbfe68d3f21ac0b7c3223159f07e4 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
bad

> WR @ 6d8609b79048384465863c1cd13e294fb26cae0f
mozregression --repo try --launch d43989a894394b208494e5c888a5efe4ffb3c450 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
bad

> WR @ 22b831c02479eea31821f49a0fac7dd699083557
mozregression --repo try --launch 2e2f12e263c3482e5e0496e7a55ddd8be7d54550 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
bad

Regression range: https://github.com/servo/webrender/compare/4e374f0c5139ca81ee8de99afe2fc3bc53e3632e...b53cf7799a0f5861dfa928ee0ccc66e8d0b78758

-----

try build from servo/webrender#2490:
mozregression --repo try --launch 11b5d65d0e682c277992c1cea5d4048227184118 --pref gfx.webrender.all:true startup.homepage_welcome_url:"https://bug1442718.bmoattachments.org/attachment.cgi?id=8956064"
good
Has Regression Range: --- → yes
Has STR: --- → yes
Depends on: 1442422
Keywords: regression
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla60
Duplicate of this bug: 1444238
You need to log in before you can comment on or make changes to this bug.