1477716 - OOM on http://www.makeitmagic.ru/

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebRender, defect, P2)

Description

[Darkspirit]

(get_logan from bug 1450015 comment 4)
> Bug 1450015 is a regression that induces:
> 
> Bug 1468020 (instant tab crash on http://myphoneandme.vodafone.com.tr/ with webrender enabled)
> Bug 1473014 (crash occurs when trying to scroll down on http://www.makeitmagic.ru/ with webrender enabled)

Win10, GTX 1060 3GB
gfx.webrender.blob.invalidation;false doesn't help,
but gfx.webrender.blob-images;false helps.

I don't get an OOM crash, but Debian froze without return and Win10 went up to my memory limit and made everything just incredible slow.

Comment 1

[get_logan]

beta 62.0b10
bp-4eb64c50-747b-41c9-826c-6dfa00180723

beta62.0b10-memory-report.json.gz
attachment 8994178 [details]

nightly 20180722220044
bp-5e440243-dd5c-4987-97df-1a6340180723

nightly20180722220044-memory-report.json.gz
attachment 8994179 [details]

Comment 2

[get_logan]

Core i7 6700K, 32GB ram, GTX 1080 ti, Windows 10 64-bit

Comment 4

[Kartikaya Gupta (email:[e-mail])]

(In reply to get_logan from comment #1)
> beta 62.0b10
> bp-4eb64c50-747b-41c9-826c-6dfa00180723

This must be something else, webrender is not enabled in this one. (And generally shouldn't be enabled on beta)

Comment 5

[get_logan]

(In reply to Kartikaya Gupta (email:[e-mail]) from comment #4)
> (In reply to get_logan from comment #1)
> > beta 62.0b10
> > bp-4eb64c50-747b-41c9-826c-6dfa00180723
> 
> This must be something else, webrender is not enabled in this one. (And
> generally shouldn't be enabled on beta)

I forced it on. Apparently it is now possible to enable in beta.
https://www.reddit.com/r/firefox/comments/8uaoj2/how_to_enable_webrender_in_firefox_62_beta/
https://bugzilla.mozilla.org/show_bug.cgi?id=1432515

Comment 6

[Kartikaya Gupta (email:[e-mail])]

Ugh. It's possible, yes. But I was kind of hoping people wouldn't do it. I'll post on the reddit thread.

Comment 7

[get_logan]

(In reply to Kartikaya Gupta (email:[e-mail]) from comment #6)
> Ugh. It's possible, yes. But I was kind of hoping people wouldn't do it.
> I'll post on the reddit thread.

When I test beta I don't normally enable webrender because it still has old graphical glitches that are no longer present in the nightlies. I normally test nightly anyway, with webrender on. So when I saw that bug in nightly, I wondered if it existed in beta too. That was the only reason.

Comment 8

[Kartikaya Gupta (email:[e-mail])]

Makes sense, thanks.

Comment 9

[Pascal Chevrel:pascalc]

Nicolas, could you give us your opinion on this bug? Thanks

Comment 10

[Kartikaya Gupta (email:[e-mail])]

I started looking at this by running DMD in live mode on a Linux build where I was reproducing the problem. The output showed this:

Live {
  281 blocks in heap block record 1 of 6,723
  707,747,840 bytes (707,700,946 requested / 46,894 slop)
  Individual block sizes: 60,956,672; 49,942,528; 48,943,104; 45,445,120; 40,259,584; 33,542,144; 32,157,696; 30,162,944; 14,434,304; 13,451,264; 11,116,544; 9,523,200; 8,142,848; 8,052,736; 8,032,256; 6,041,600; 4,657,152; 4,562,944; 4,472,832; 3,334,144; 1,933,312; 1,802,240; 1,048,576 x 254; 405,504; 12,288 x 2; 8,192; 4,096
  85.39% of the heap (85.39% cumulative)
  Allocated at {
    #01: replace_calloc(unsigned long, unsigned long) (/home/kats/zspace/mozilla-fennec/memory/replace/dmd/DMD.cpp:1281 (discriminator 1))
    #02: __rdl_alloc_zeroed (/checkout/src/libstd/alloc.rs:76)
    #03: _$LT$alloc..alloc..Global$u20$as$u20$core..alloc..Alloc$GT$::alloc_zeroed::h4559403b0adf5b99 (/checkout/src/liballoc/alloc.rs:132)
  }
}

This shows an allocation of 60 megs (!) and other large multi-megabyte sizes coming from somewhere in rust code. Unfortunately the stack is not complete, I filed bug 1478415 for that.

Comment 11

[Kartikaya Gupta (email:[e-mail])]

Attachment: Allocation stack

Added a crash for allocations over 50 MB and was able get a stack from gdb.

Comment 12

[Kartikaya Gupta (email:[e-mail])]

https://searchfox.org/mozilla-central/rev/bdfd20ef30d521b57d5b6feeda71325e8b4cad66/gfx/webrender_bindings/src/moz2d_renderer.rs#372 is where it's coming from. Presumably bug 1456555 will help here.

Comment 13

[Liz Henry (:lizzard) (privacy/fingerprinting team)]

If this depends on bug 1456555 it doesn't sound like this is going to be fixed for 63.

Comment 14

[Jeff Muizelaar [:jrmuizel]]

:darkspirit do you still see problems here?

Comment 15

[Darkspirit]

short: No, it looks fine.

long:
Memory explosion also seen with variation fonts disabled:
mozregression --launch 2018-09-10 --pref gfx.webrender.all:true layout.css.font-variations.enabled:false -a http://www.makeitmagic.ru/

bad=memory explosion, good=crash & fallback to Basic
mozregression --find-fix --bad 2018-07-23 --good 2018-09-16 --pref gfx.webrender.all:true -a http://www.makeitmagic.ru/
> https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=e414fcdabb7209d3ac6a0052f4c0c8c8c89ab35d&tochange=5bfe272aa1a2e80b562e245b48346e9c5aa4acee
2018-09-11
> 5bfe272aa1a2	Jeff Muizelaar — Bug 1490242. Adjust reftests for 3d transfrom changes
> 8c80d5351916	Jeff Muizelaar — Bug 1490242. Update webrender to 04d63e7d73b9661d9eb934a0933c8f9751a9a3db
= https://github.com/servo/webrender/pull/3030


Crash was fixed by:
mozregression --find-fix --repo autoland --bad 2018-09-19 --good 2018-09-20 --pref gfx.webrender.all:true -a http://www.makeitmagic.ru/
> https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=96059b4f6d8a1590c97ffc47ca7f73530dd51cb5&tochange=76d218ea875ec431df790c097847b4f1cf0d2bc0
2018-09-19
> 76d218ea875e	Matt Woodrow — Bug 1489337 - Don't set preserve-3d to true when creating WebRender commands for nsDisplayPerspective since it's not needed. r=jrmuize

No problems observed after this. That crash might be unrelated and the real problem might have been fixed between 2018-09-11 and 2018-09-19, I don't know.