1477571 - Crash in static void webrender_bindings::moz2d_renderer::{{impl}}::update

Status: RESOLVED DUPLICATE of bug 1494062

(Core :: Graphics: WebRender, defect, P3)

Description

[Calixte Denizet (:calixte)]

This bug was filed from the Socorro interface and is
report bp-3af19a5a-186e-4ca7-928d-f545e0180722.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll static void std::panicking::rust_panic_with_hook src/libstd/panicking.rs:521
1 xul.dll static <NoType> std::panicking::begin_panic<str*> src/libstd/panicking.rs:445
2 xul.dll static void webrender_bindings::moz2d_renderer::{{impl}}::update gfx/webrender_bindings/src/moz2d_renderer.rs:416
3 xul.dll static void webrender::resource_cache::ResourceCache::pre_scene_building_update gfx/webrender/src/resource_cache.rs:515
4 xul.dll static bool webrender::render_backend::RenderBackend::process_api_msg gfx/webrender/src/render_backend.rs:983
5 xul.dll static void webrender::render_backend::RenderBackend::run gfx/webrender/src/render_backend.rs:798
6 xul.dll static void std::sys_common::backtrace::__rust_begin_short_backtrace<closure,  src/libstd/sys_common/backtrace.rs:136
7 xul.dll static void alloc::boxed::{{impl}}::call_box< src/liballoc/boxed.rs:640
8 xul.dll static void std::sys::windows::thread::{{impl}}::new::thread_start src/libstd/sys/windows/thread.rs:55
9 kernel32.dll BaseThreadInitThunk 

=============================================================

There is 1 crash in nightly 63 with buildid 20180722100230. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1476636.

[1] https://hg.mozilla.org/mozilla-central/rev?node=5fdc7f00aba1

Comment 1

[Darkspirit]

Win10, GTX 1060
1. Fresh WR profile
2. Open and play https://www.youtube.com/watch?v=Scxs7L0vhZ4
3. Open about:support
4. Move the YouTube tab out of the window [if needed: then move it back, move it out again etc.]
5. bp-5c080be5-39d2-4905-a273-21db80180731, bp-f94d7503-b82b-4a2d-8b8b-d545c0180731

Comment 2

[Darkspirit]

Same with STR from bug 1452513 comment 19:
https://bug1470855.bmoattachments.org/attachment.cgi?id=8987464
https://www.gatsbyjs.org/
= bp-8160125b-2805-4db4-9524-321300180731

Comment 3

[Nicolas Silva [:nical]]

This is in fact the same as the signatures: that previously had "Attempt to update non-existent image" in the moz crash reason.

https://crash-stats.mozilla.com/search/?moz_crash_reason=Attempt%20to%20update%20non-existent%20image&product=Firefox&date=%3E%3D2018-02-01T15%3A49%3A41.000Z&date=%3C2018-08-01T16%3A49%3A41.000Z&_sort=-date&_facets=signature&_columns=date&_columns=signature&_columns=product&_columns=version&_columns=build_id&_columns=platform#facet-signature which moved to a different assertion checking the same thing in the async blob pull request.

I suspect that we have some frame throttling code that can drop transactions and these transactions could contain AddImage operations which we should never drop lest risking to hit this assertion. I'll keep looking in that direction.

Comment 5

[Sotaro Ikeda [:sotaro]]

The crash seems to be tracked by Bug 1494062 now.