1470440 - thread '<unnamed>' panicked at 'assertion failed: `(left == right)` left: `2048×8192`, right: `2048×162568`', gfx/webrender/src/tiling.rs:226:9

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect, P2)

Description

[Jesse Schwartzentruber (:truber)]

Attachment: testcase.html

The attached testcase causes an assertion in m-c 20180622-6b6f3f6ecf14 with pref("gfx.webrender.all", true)

thread '<unnamed>' panicked at 'assertion failed: `(left == right)`   left: `2048×8192`,  right: `2048×162568`', gfx/webrender/src/tiling.rs:226:9
#0: mozalloc_abort
        at memory/mozalloc/mozalloc_abort.cpp:34
#1: abort
        at memory/mozalloc/mozalloc_abort.cpp:81
#2: panic_abort::__rust_start_panic
        at src/libpanic_abort/lib.rs:59
#3: std::panicking::rust_panic
        at src/libstd/panicking.rs:608
#4: std::panicking::rust_panic_with_hook
        at src/libstd/panicking.rs:593
#5: std::panicking::begin_panic
        at src/libstd/panicking.rs:538
#6: std::panicking::begin_panic_fmt
        at src/libstd/panicking.rs:522
#7: webrender::renderer::Renderer::draw_tile_frame
        at gfx/webrender/src/render_task.rs:0
#8: webrender::profiler::TimeProfileCounter::profile
        at gfx/webrender/src/renderer.rs:2339
#9: webrender::renderer::Renderer::render_impl
        at gfx/webrender/src/renderer.rs:2292
#10: webrender::renderer::Renderer::update
        at gfx/webrender/src/renderer.rs:1875
#11: mozilla::wr::RendererOGL::UpdateAndRender(bool)
        at gfx/webrender_bindings/RendererOGL.cpp:132
#12: mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, bool)
        at gfx/webrender_bindings/RenderThread.cpp:308
#13: mozilla::wr::RenderThread::NewFrameReady(mozilla::wr::WrWindowId)
        at gfx/webrender_bindings/RenderThread.cpp:223
#14: mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId), true, (mozilla::RunnableKind)0, mozilla::wr::WrWindowId>::Run()
        at xpcom/threads/nsThreadUtils.h:1165
#15: MessageLoop::RunTask(already_AddRefed<nsIRunnable>)
        at ipc/chromium/src/base/message_loop.cc:451
#16: MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&)
        at ipc/chromium/src/base/message_loop.cc:459
#17: MessageLoop::DoWork()
        at ipc/chromium/src/base/message_loop.cc:534
#18: base::MessagePumpDefault::Run(base::MessagePump::Delegate*)
        at ipc/chromium/src/base/message_pump_default.cc:38
#19: MessageLoop::RunInternal()
        at ipc/chromium/src/base/message_loop.cc:325
#20: MessageLoop::Run()
        at ipc/chromium/src/base/message_loop.cc:318
#21: base::Thread::ThreadMain()
        at ipc/chromium/src/base/thread.cc:181
#22: ThreadFunc
        at ipc/chromium/src/base/platform_thread_posix.cc:38

Comment 1

[Darkspirit]

This testcase is nearly identical to the one in bug 1470439.

bp-b5ecc69a-fc90-41bf-a663-29c400180622 (same crash signature as bug 1441392)

Comment 2

[Francois Guerraz]

Gets triggered by visiting https://en.wikipedia.org/wiki/Religion_in_Russia

Comment 3

[Francois Guerraz]

It looks like this bug has been fixed. I can't reproduce the issue any more

Comment 4

[Martin Giger [:freaktechnik]]

I'm apparently getting this from scrolling down the server list on discord (discordapp.com). At least according to what the crash reports are getting assigned with: https://crash-stats.mozilla.com/report/index/0c230c06-2a8b-46cb-8e80-d2b3a0180903#tab-bugzilla

Comment 5

[Maire Reavy [:mreavy]]

We can't release this to the field, but we can let this ride to beta.

Comment 6

[Josh Matthews [:jdm]]

It has been reported (https://github.com/servo/webrender/issues/2715#issuecomment-419948326) that scrolling on http://diana-adrianne.com/purecss-francine/ triggers this crash.

Comment 7

[Nicolas Silva [:nical]]

This currently ranks #1 in the list of crashes with webrender in the signature: https://crash-stats.mozilla.com/search/?signature=~webrender&date=%3E%3D2018-09-06T18%3A08%3A28.000Z&date=%3C2018-09-13T18%3A08%3A28.000Z&_sort=-date&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature

Interestingly, all of the reports I have seen so far have 

> |[0][GFX1-]: Attempting to allocate a texture of size 4294967293x2048 above the limit, trimming (t=102.156) 

in the gfxCriticalError log. 4294967293x2048 looks suspicious (FFFFFFFD).

Comment 8

[Nicolas Silva [:nical]]

This might get fixed by https://github.com/servo/webrender/pull/3049.

Comment 9

[Emilio Cobos Álvarez (:emilio)]

Was fixed by https://github.com/servo/webrender/pull/3067. Will land a crashtest.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/199eab3aaab1
Add a crashtest. r=me

Comment 11

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/199eab3aaab1