Closed Bug 1451458 Opened 3 years ago Closed 3 years ago

blob-invalidation: Crash on telemetry.mozilla.org

Categories

(Core :: Graphics: WebRender, defect, P1)

x86_64
All
defect

Tracking

()

RESOLVED FIXED
mozilla61
Tracking Status
firefox-esr52 --- unaffected
firefox59 --- unaffected
firefox60 --- unaffected
firefox61 --- disabled

People

(Reporter: jan, Assigned: jrmuizel)

References

(Blocks 1 open bug, )

Details

(Keywords: crash, nightly-community)

Crash Data

Attachments

(3 files)

Nightly 61 x64 20180404100127 de_DE ff0efa4132f0efd78af0910762aec7dcc1a8de66 @ Debian Testing (KDE, Radeon RX480, 2560x1440)
main profile: gpu process, gfx.webrender.all, gfx.webrender.blob.invalidation, etc.

I hovered the diagram on https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2018-04-02&keys=__none__!__none__!__none__&max_channel_version=nightly%252F61&measure=MIXED_CONTENT_PAGE_LOAD&min_channel_version=null&processType=*&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2018-03-12&table=0&trim=1&use_submission_date=0.

Meldungs-ID 	Sendedatum
bp-9a0dad1b-06de-4489-a073-157180180404 04.04.18 21:30 [@ mozilla::layers::DIGroup::ComputeGeometryChange ]
> MOZ_RELEASE_ASSERT(imageRect.IsEqualEdges(aData->mImageRect))
bp-1fc24168-1292-4482-862a-d8fc80180404 04.04.18 21:29 bug 1450162
> Unexpectedly empty result. This blob should just have been deleted
bp-f6456140-1bb8-4f7b-9cc6-43c510180404 04.04.18 21:29 bug 1450162
> Unexpectedly empty result. This blob should just have been deleted
bp-1a2d1e3c-0580-4c7a-b376-6ced50180404 04.04.18 21:28 bug 1450162
> Unexpectedly empty result. This blob should just have been deleted
bp-2731a239-94bf-417b-a2a9-37b560180404 04.04.18 21:28 [@ mozilla::layers::DIGroup::ComputeGeometryChange ]
> MOZ_RELEASE_ASSERT(imageRect.IsEqualEdges(aData->mImageRect))
Move your mouse randomly over the diagram.

Nightly 61 x64 20180405220026 de_DE 2f5ffe4fa2153a798ed8b310a597ea92abd1b868 @ Debian Testing (KDE, Radeon RX480, 2560x1440)
main profile: gpu process, gfx.webrender.all, gfx.webrender.blob.invalidation, etc.

bp-aadd0211-75f1-47a8-a986-397e10180406 06.04.18 03:18
bp-32c08891-c51e-4e84-a4c3-3f84e0180406 06.04.18 03:18
bp-39be603e-41cd-4ba1-aa68-57cd60180406 06.04.18 03:18
bp-c8030146-da0c-44b1-a370-4f5530180406 06.04.18 03:18
bp-b80cbf11-38c5-4247-a7f5-43a580180406 06.04.18 03:18
> Unexpectedly empty result. This blob should just have been deleted

-----

fresh profile: gfx.webrender.all, gfx.webrender.blob.invalidation
bp-b24738e3-cea9-4b34-aa94-7d8a10180406 06.04.18 03:33
> MOZ_CRASH Reason 	MOZ_RELEASE_ASSERT(mGroupOffset == aData->mGroupOffset)

Does not happen without blob-invalidation.
Blocks: 1388842
Crash Signature: [@ mozilla::layers::DIGroup::ComputeGeometryChange ] → [@ mozilla::layers::DIGroup::ComputeGeometryChange ] [@ mozalloc_abort | abort | libxul.so@0x3d67ac8 | libxul.so@0x3d67ab8 | libxul.so@0x3d57610 | webrender_bindings::moz2d_renderer::{{impl}}::update ] [@ mozalloc_abort | abort | libxul.so@0x3d67498 | l…
Summary: Crash in mozilla::layers::DIGroup::ComputeGeometryChange → blob-invalidation: Crash on telemetry.mozilla.org
Crash Signature: libxul.so@0x3d67488 | libxul.so@0x3d56fe0 | webrender_bindings::moz2d_renderer::{{impl}}::update ] → libxul.so@0x3d67488 | libxul.so@0x3d56fe0 | webrender_bindings::moz2d_renderer::{{impl}}::update ] [@ mozalloc_abort | abort | libxul.so@0x3d6b258 | libxul.so@0x3d6b248 | libxul.so@0x3d5ada0 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
If I'm not wrong:

layout.display-list.retain;false:
* Only tab crashes of [@ mozilla::layers::DIGroup::ComputeGeometryChange ]

layout.display-list.retain;true:
* tab crashes of [@ mozilla::layers::DIGroup::ComputeGeometryChange ]
* browser crashes of [@ mozalloc_abort | abort | libxul.so@0x3d28d48 | libxul.so@0x3d28d38 | libxul.so@0x3d18890 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
Crash Signature: libxul.so@0x3d67488 | libxul.so@0x3d56fe0 | webrender_bindings::moz2d_renderer::{{impl}}::update ] [@ mozalloc_abort | abort | libxul.so@0x3d6b258 | libxul.so@0x3d6b248 | libxul.so@0x3d5ada0 | webrender_bindings::moz2d_renderer::{{impl}}::update ] → libxul.so@0x3d67488 | libxul.so@0x3d56fe0 | webrender_bindings::moz2d_renderer::{{impl}}::update ] [@ mozalloc_abort | abort | libxul.so@0x3d6b258 | libxul.so@0x3d6b248 | libxul.so@0x3d5ada0 | webrender_bindings::moz2d_renderer::{{impl}}::update ] [@ m…
I'll take a look at this next week. Hopefully it's easy to fix.
Assignee: nobody → jmuizelaar
Win10, Radeon RX480, fresh profile: gfx.webrender.all, gfx.webrender.blob.invalidation
bp-a9cf71cc-a32e-4d29-b66b-ee7690180409 09.04.2018 16:43 [@ mozilla::layers::DIGroup::ComputeGeometryChange ]
bp-a17ab0f1-0c63-41ef-81e3-815b60180409 09.04.2018 16:35 [@ static void std::panicking::rust_panic_with_hook ]
Crash Signature: mozalloc_abort | abort | libxul.so@0x3d28d48 | libxul.so@0x3d28d38 | libxul.so@0x3d18890 | webrender_bindings::moz2d_renderer::{{impl}}::update ] → mozalloc_abort | abort | libxul.so@0x3d28d48 | libxul.so@0x3d28d38 | libxul.so@0x3d18890 | webrender_bindings::moz2d_renderer::{{impl}}::update ] [@ mozalloc_abort | abort | libxul.so@0x3d4b7d8 | libxul.so@0x3d4b7c8 | libxul.so@0x3d3b320 | webrender_bin…
OS: Linux → All
Comment on attachment 8967089 [details]
Bug 1451458. Make sure we always clear items on size change.

https://reviewboard.mozilla.org/r/235744/#review241530

::: gfx/layers/wr/WebRenderCommandBuilder.cpp:933
(Diff revision 1)
> -          GP("Inner group size change\n");
> +        GP("Inner group size change\n");
> -          aCommandBuilder->mManager->AddImageKeyForDiscard(groupData->mFollowingGroup.mKey.value());
> -          groupData->mFollowingGroup.mKey = Nothing();
> -          groupData->mFollowingGroup.ClearItems();
> +        groupData->mFollowingGroup.ClearItems();
> -
> +        if (groupData->mFollowingGroup.mKey) {
>            IntSize size = currentGroup->mGroupBounds.Size().ScaleToNearestPixels(currentGroup->mScale.width, currentGroup->mScale.height, mAppUnitsPerDevPixel);

I think this size computation also needs to be fixed at some point to use RoundedOut.
Attachment #8967089 - Flags: review?(mstange) → review+
Pushed by jmuizelaar@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/131a63a3ce79
Make sure we always clear items on size change. r=mstange
Pushed by jmuizelaar@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6f973e2cc44d
Make sure we always clear items on size change. r=mstange
Oh. I guess I double landed... Hopefully that works out ok.
https://hg.mozilla.org/mozilla-central/rev/131a63a3ce79
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
mozregression --find-fix --bad 2018-04-11 --good 2018-04-12 --pref gfx.webrender.all:true gfx.webrender.blob.invalidation:true startup.homepage_welcome_url:'https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2018-04-02&keys=__none__!__none__!__none__&max_channel_version=nightly%252F61&measure=MIXED_CONTENT_PAGE_LOAD&min_channel_version=null&processType=*&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2018-03-12&table=0&trim=1&use_submission_date=0'
> 4:52.83 INFO: First good revision: 6f973e2cc44db9ff26a3c7754e4d54c2cfef7012
> 4:52.83 INFO: Last bad revision: c4e17dd680658e18f7f9260503676d74dc94e300
> 4:52.83 INFO: Pushlog:
> https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c4e17dd680658e18f7f9260503676d74dc94e300&tochange=6f973e2cc44db9ff26a3c7754e4d54c2cfef7012

> 6f973e2cc44d	Jeff Muizelaar — Bug 1451458. Make sure we always clear items on size change. r=mstange
Status: RESOLVED → VERIFIED
Oh, no, now I managed to reproduce the browser crash. :-/
bp-a639aae7-f316-4627-93b4-a52990180412 [...] webrender_bindings::moz2d_renderer::{{impl}}::update

Even with the first good build from comment 12 (comment 8) after hovering, zooming and scrolling like hell:
mozregression --repo mozilla-inbound --launch 6f973e2cc44db9ff26a3c7754e4d54c2cfef7012 --pref gfx.webrender.all:true gfx.webrender.blob.invalidation:true startup.homepage_welcome_url:'https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2018-04-02&keys=__none__!__none__!__none__&max_channel_version=nightly%252F61&measure=MIXED_CONTENT_PAGE_LOAD&min_channel_version=null&processType=*&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2018-03-12&table=0&trim=1&use_submission_date=0'
Status: VERIFIED → REOPENED
Crash Signature: _$LT$webrender_bindings..moz2d_renderer..Moz2dImageRenderer$u20$as$u20$webrender_api..image..BlobImageRenderer$GT$::update::h2aff647f... ] [@ static void std::panicking::rust_panic_with_hook ] → _$LT$webrender_bindings..moz2d_renderer..Moz2dImageRenderer$u20$as$u20$webrender_api..image..BlobImageRenderer$GT$::update::h2aff647f... ] [@ static void std::panicking::rust_panic_with_hook ] [@ mozalloc_abort | abort | libxul.so@0x3d147d8 | libxul.so…
Resolution: FIXED → ---
Ok, that's probably a different issue. It would be good to see if we can get some better STR.
Attached video 2018-04-13_13-24-15.mp4
(In reply to Jeff Muizelaar [:jrmuizel] from comment #14)
> Ok, that's probably a different issue. It would be good to see if we can get some better STR.

fresh profile: gfx.webrender.all, gfx.webrender.blob.invalidation
1. Load the website.
2. Scroll up, if you can scroll up.
3. Hover the first bar.
4. Doubleclick on the second line of the label to mark the text.
5. Move your mouse away.
6. Move your mouse back over the bar and click on the second line of the label.
7. bp-21231740-9c14-4d6e-9e4d-ac55f0180413
Crash Signature: libxul.so@0x3d147c8 | libxul.so@0x3d04320 | webrender_bindings::moz2d_renderer::{{impl}}::update ] → libxul.so@0x3d147c8 | libxul.so@0x3d04320 | webrender_bindings::moz2d_renderer::{{impl}}::update ] [@ mozalloc_abort | abort | libxul.so@0x3d28b88 | libxul.so@0x3d28b78 | libxul.so@0x3d186d0 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
I have a crash like this in rr. Let's see if it's debuggable.
I have a rough idea what's going on here. I'm going to try to make a reduced test case.
Attached patch crash-test.htmlSplinter Review
A crash test courtesy of mstange.
> A crash test courtesy of mstange.
Thank you! :)
Crash Signature: _$LT$webrender_bindings..moz2d_renderer..Moz2dImageRenderer$u20$as$u20$webrender_api..image..BlobImageRenderer$GT$::update::h2aff647f... ] [@ static void std::panicking::rust_panic_with_hook ] [@ mozalloc_abort | abort | libxul.so@0x3d147d8 | libxul.so… → _$LT$webrender_bindings..moz2d_renderer..Moz2dImageRenderer$u20$as$u20$webrender_api..image..BlobImageRenderer$GT$::update::h2aff647f... ] [@ mozalloc_abort | abort | panic_abort::__rust_start_panic::abort::h091e61b1e9ef8f82 | panic_abort::__rust_start_…
Depends on: 1454507
See Also: → 1454659
This crash signature is gone and bug 1454659 fixes the rest. Thanks!
Status: REOPENED → RESOLVED
Closed: 3 years ago3 years ago
Resolution: --- → FIXED
See Also: → 1455488
You need to log in before you can comment on or make changes to this bug.