Closed Bug 1496843 Opened 2 years ago Closed 1 year ago

Crash in <webrender_bindings::moz2d_renderer::Moz2dBlobImageHandler as webrender_api::image::BlobImageHandler>::update


(Core :: Graphics: WebRender, defect, P2, critical)




Tracking Status
firefox-esr60 --- unaffected
firefox63 --- disabled
firefox64 --- disabled
firefox65 --- fixed


(Reporter: mccr8, Assigned: jrmuizel)


(Blocks 2 open bugs)


(Keywords: crash)

Crash Data


(2 files, 2 obsolete files)

This bug was filed from the Socorro interface and is
report bp-c3cea662-176a-441e-876d-f12cb0181005.

Top 10 frames of crashing thread:

0 libmozglue.dylib mozalloc_abort memory/mozalloc/mozalloc_abort.cpp:35
1 libmozglue.dylib abort memory/mozalloc/mozalloc_abort.cpp:82
2 XUL panic_abort::__rust_start_panic::abort src/libpanic_abort/
3 XUL __rust_start_panic src/libpanic_abort/
4 XUL std::panicking::rust_panic_with_hook src/libstd/
5 XUL std::panicking::begin_panic src/libstd/
6 XUL <webrender_bindings::moz2d_renderer::Moz2dBlobImageHandler as webrender_api::image::BlobImageHandler>::update gfx/webrender_bindings/src/
7 XUL webrender::resource_cache::ResourceCache::pre_scene_building_update gfx/webrender/src/
8 XUL webrender::render_backend::RenderBackend::process_api_msg gfx/webrender/src/
9 XUL webrender::render_backend::RenderBackend::run gfx/webrender/src/


moz crash reason is:
assertion failed: old_reader.cache.is_empty()

Another crash signature with this crash reason is: webrender_bindings::moz2d_renderer::{{impl}}::update

An example of that signature is: bp-202d2e0c-acfb-40c2-af25-20c350181001

Not a high volume of crashes. I only see 15 in the last few weeks with this crash reason.
Bug 1460441 was the same assertion failure but with a different signature.
OS: Mac OS X → All
Priority: -- → P4
This has become very frequent today on the latest macOS for me:

Closing a tab seems to be the most sure fire way to cause it and twice the tab that was about to be displayed was the slide deck from the Wednesday cross-functional meeting, in case it's useful.
The first two of those crashes have a different assertion:
  assertion failed: old.bounds.contained_by(&dirty_rect)
This page seems to cause the "assertion failed: old_reader.cache.is_empty()"
Priority: P4 → P2
CCing Joe, who hit this on an internal google slide deck.
Assignee: nobody → a.beingessner
top non-hang crash on the Nov 7 OSX Nightly, with 13 crashes
I have had this crash occur while selecting text, while doing nothing but staring at my Gmail index, and by loading in a fresh tab.

Note that my hardware isn't shown properly by Socorro — Graphics Adapter 0x8086 0x5927 is Apple's custom Intel Iris Pro 560 chip (iMac 2017 21.5" Retina) and I believe all 4 crashes listed for that chip are me:
I get this consistently by navigating to (from

Firefox Nightly, Arch Linux, GNOME, GDK_SCALE=2 (HiDPI)
(In reply to Jan Alexander Steffens [:heftig] from comment #10)
> I get this consistently by navigating to
> (from
> Firefox Nightly, Arch Linux, GNOME, GDK_SCALE=2 (HiDPI)

can confirm crash on loading  with WR on Win10 (though the signature is different)
This doesn't seem to show up on beta for some reason.
the crash in comment 13 is also "assertion failed: old.bounds.contained_by(&dirty_rect)"
(In reply to Julien Cristau [:jcristau] from comment #12)
> This doesn't seem to show up on beta for some reason.

Probably because WR on beta is restricted to Windows, and these crashes seem to be on macOS/Linux. It's possible the Windows ones are under a different signature and bug somewhere else.
Spent the day debugging this, the issue is that when computing the dirty rect we intersect the old bounds of a changed item with mImageRect. This makes the bounds of that old item not-contained in the dirty rect, which during blob merging causes us to get confused, because deleted items are supposed to be contained inside the dirty rect.

log with `xxxx-` markers for relevant sections:
This has likely gotten worse because Bug 1456555 introduce more aggressive shrinking of mImageRect.
It looks like the problem here is caused by us not updating BlobItemData when the mImageRect change happens.
Attached patch Completely untested patch (obsolete) — Splinter Review
Here's an untested patch which I think should fix the problem.
Attachment #9024209 - Attachment is obsolete: true
Assignee: a.beingessner → jmuizelaar
Attached file Reduced test case
The relationship between this test case and the patch is left as an exercise for the reader.
Attachment #9024247 - Attachment is obsolete: true
Pushed by
Make sure we update mRect when mImageBounds changes. r=mattwoodrow
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla65
Depends on: 1506676
See Also: → 1507637
See Also: → 1533411
You need to log in before you can comment on or make changes to this bug.