Closed Bug 1470440 Opened 2 years ago Closed 2 years ago

thread '<unnamed>' panicked at 'assertion failed: `(left == right)` left: `2048×8192`, right: `2048×162568`', gfx/webrender/src/tiling.rs:226:9

Categories

(Core :: Graphics: WebRender, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla64
Tracking Status
firefox-esr60 --- unaffected
firefox62 --- disabled
firefox63 --- disabled
firefox64 --- fixed

People

(Reporter: truber, Assigned: emilio)

References

(Blocks 4 open bugs)

Details

(Keywords: assertion, testcase)

Crash Data

Attachments

(1 file)

Attached file testcase.html
The attached testcase causes an assertion in m-c 20180622-6b6f3f6ecf14 with pref("gfx.webrender.all", true)

thread '<unnamed>' panicked at 'assertion failed: `(left == right)`   left: `2048×8192`,  right: `2048×162568`', gfx/webrender/src/tiling.rs:226:9
#0: mozalloc_abort
        at memory/mozalloc/mozalloc_abort.cpp:34
#1: abort
        at memory/mozalloc/mozalloc_abort.cpp:81
#2: panic_abort::__rust_start_panic
        at src/libpanic_abort/lib.rs:59
#3: std::panicking::rust_panic
        at src/libstd/panicking.rs:608
#4: std::panicking::rust_panic_with_hook
        at src/libstd/panicking.rs:593
#5: std::panicking::begin_panic
        at src/libstd/panicking.rs:538
#6: std::panicking::begin_panic_fmt
        at src/libstd/panicking.rs:522
#7: webrender::renderer::Renderer::draw_tile_frame
        at gfx/webrender/src/render_task.rs:0
#8: webrender::profiler::TimeProfileCounter::profile
        at gfx/webrender/src/renderer.rs:2339
#9: webrender::renderer::Renderer::render_impl
        at gfx/webrender/src/renderer.rs:2292
#10: webrender::renderer::Renderer::update
        at gfx/webrender/src/renderer.rs:1875
#11: mozilla::wr::RendererOGL::UpdateAndRender(bool)
        at gfx/webrender_bindings/RendererOGL.cpp:132
#12: mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, bool)
        at gfx/webrender_bindings/RenderThread.cpp:308
#13: mozilla::wr::RenderThread::NewFrameReady(mozilla::wr::WrWindowId)
        at gfx/webrender_bindings/RenderThread.cpp:223
#14: mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId), true, (mozilla::RunnableKind)0, mozilla::wr::WrWindowId>::Run()
        at xpcom/threads/nsThreadUtils.h:1165
#15: MessageLoop::RunTask(already_AddRefed<nsIRunnable>)
        at ipc/chromium/src/base/message_loop.cc:451
#16: MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&)
        at ipc/chromium/src/base/message_loop.cc:459
#17: MessageLoop::DoWork()
        at ipc/chromium/src/base/message_loop.cc:534
#18: base::MessagePumpDefault::Run(base::MessagePump::Delegate*)
        at ipc/chromium/src/base/message_pump_default.cc:38
#19: MessageLoop::RunInternal()
        at ipc/chromium/src/base/message_loop.cc:325
#20: MessageLoop::Run()
        at ipc/chromium/src/base/message_loop.cc:318
#21: base::Thread::ThreadMain()
        at ipc/chromium/src/base/thread.cc:181
#22: ThreadFunc
        at ipc/chromium/src/base/platform_thread_posix.cc:38
Flags: in-testsuite?
Priority: -- → P1
This testcase is nearly identical to the one in bug 1470439.

bp-b5ecc69a-fc90-41bf-a663-29c400180622 (same crash signature as bug 1441392)
Crash Signature: [@ webrender::renderer::Renderer::draw_tile_frame ]
It looks like this bug has been fixed. I can't reproduce the issue any more
I'm apparently getting this from scrolling down the server list on discord (discordapp.com). At least according to what the crash reports are getting assigned with: https://crash-stats.mozilla.com/report/index/0c230c06-2a8b-46cb-8e80-d2b3a0180903#tab-bugzilla
We can't release this to the field, but we can let this ride to beta.
Priority: P1 → P2
Blocks: wr-fuzz
This currently ranks #1 in the list of crashes with webrender in the signature: https://crash-stats.mozilla.com/search/?signature=~webrender&date=%3E%3D2018-09-06T18%3A08%3A28.000Z&date=%3C2018-09-13T18%3A08%3A28.000Z&_sort=-date&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

Interestingly, all of the reports I have seen so far have 

> |[0][GFX1-]: Attempting to allocate a texture of size 4294967293x2048 above the limit, trimming (t=102.156) 

in the gfxCriticalError log. 4294967293x2048 looks suspicious (FFFFFFFD).
Was fixed by https://github.com/servo/webrender/pull/3067. Will land a crashtest.
Assignee: nobody → emilio
https://hg.mozilla.org/mozilla-central/rev/199eab3aaab1
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla64
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.