1504230 - Crash in mozilla::wr::GetScaledFont

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect, P3)

Description

[Andrew Osmond [:aosmond] (he/him)]

This bug was filed from the Socorro interface and is
report bp-1b24382d-c951-4650-be26-9177a0181029.
=============================================================

Top 10 frames of crashing thread:

0 xul.dll CrashStatsLogForwarder::CrashAction gfx/thebes/gfxPlatform.cpp:420
1 xul.dll mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::Flush gfx/2d/Logging.h:285
2 xul.dll void mozilla::gfx::Log<1, mozilla::gfx::CriticalLogger>::~Log gfx/2d/Logging.h:277
3 xul.dll static class RefPtr<mozilla::gfx::ScaledFont> mozilla::wr::GetScaledFont gfx/webrender_bindings/Moz2DImageRenderer.cpp:296
4 xul.dll static bool mozilla::wr::Moz2DRenderCallback gfx/webrender_bindings/Moz2DImageRenderer.cpp:442
5 xul.dll wr_moz2d_render_cb gfx/webrender_bindings/Moz2DImageRenderer.cpp:487
6 xul.dll static struct  gfx/webrender_bindings/src/moz2d_renderer.rs:506
7 xul.dll static void rayon::iter::plumbing::bridge_producer_consumer::helper<rayon::vec::VecProducer<webrender_bindings::moz2d_renderer::Job>, rayon::iter::map::MapConsumer<rayon::iter::collect::consumer::CollectConsumer< third_party/rust/rayon/src/iter/plumbing/mod.rs:418
8 xul.dll static struct  third_party/rust/rayon-core/src/join/mod.rs:128
9 xul.dll static void rayon::iter::plumbing::bridge_producer_consumer::helper<rayon::vec::VecProducer<webrender_bindings::moz2d_renderer::Job>, rayon::iter::map::MapConsumer<rayon::iter::collect::consumer::CollectConsumer< third_party/rust/rayon/src/iter/plumbing/mod.rs:409

=============================================================

This won't crash in beta/release, only nightly, because it uses gfxDevCrash, although anything use the font won't show up I guess.

Comment 1

[Jeff Muizelaar [:jrmuizel]]

Doesn't happen often enough to block.

Comment 2

[Darkspirit]

Still happening on Nvidia/Win10.
From yesterday: bp-9b826250-0e79-4a92-888d-2cae10190131

MOZ_CRASH Reason (Sanitized) MOZ_CRASH(GFX_CRASH)
GraphicsCriticalError |[G0][GFX1-]: Incompatible CompositableHost at WebRenderBridgeParent. (t=0.837434) |[G1][GFX1 39]: Failed to get ScaledFont entry for FontInstanceKey 0 (t=6.21906) |[G2][GFX1-]: Incompatible CompositableHost at WebRenderBridgeParent. (t=6.7567)

Comment 3

[Lee Salzman [:lsalzman]]

Sotaro, any idea why we're seeing the "Incompatible CompositableHost" error? And any ideas why it might be related to a blob image's fonts having either been deleted or never added in the first place?

Comment 4

[Sotaro Ikeda [:sotaro]]

"Incompatible CompositableHost" seemed not directly related to this bug. It could happen like the following STR with all widgets in same process, I am going to work for it at Bug 1524168.
-[1] Open browser window with WebRender.
-[2] Non-WebRender window(dialog or popup) was opened when there was already WebRender window exists.
-[3] WebRender window start video playback.

Comment 5

[Sotaro Ikeda [:sotaro]]

All the crash logs seemed to have "Failed to get ScaledFont entry for FontInstanceKey 0". From it, I wonder if FontInstanceKey was null key.

Comment 6

[Sotaro Ikeda [:sotaro]]

(In reply to Jan Andre Ikenmeyer [:darkspirit] from comment #2)

Still happening on Nvidia/Win10.
From yesterday: bp-9b826250-0e79-4a92-888d-2cae10190131

MOZ_CRASH Reason (Sanitized) MOZ_CRASH(GFX_CRASH)
GraphicsCriticalError |[G0][GFX1-]: Incompatible CompositableHost at WebRenderBridgeParent. (t=0.837434) |[G1][GFX1 39]: Failed to get ScaledFont entry for FontInstanceKey 0 (t=6.21906) |[G2][GFX1-]: Incompatible CompositableHost at WebRenderBridgeParent. (t=6.7567)

:darkspirit, do you know the STR?

Comment 7

[Sotaro Ikeda [:sotaro]]

(In reply to Sotaro Ikeda [:sotaro] from comment #4)

"Incompatible CompositableHost" seemed not directly related to this bug. It could happen like the following STR with all widgets in same process, I am going to work for it at Bug 1524168.
-[1] Open browser window with WebRender.
-[2] Non-WebRender window(dialog or popup) was opened when there was already WebRender window exists.
-[3] WebRender window start video playback.

Another possibility is that MediaDecoder starts video decoding and rendering before calling ImageBridgeChild::IdentifyCompositorTextureHost().

Comment 8

[Darkspirit]

No, if I knew any STR I would have told you.
Graphics Critical Error messages from the last 7 days differ a bit:

bp-9b826250-0e79-4a92-888d-2cae10190131 x2

|[G0][GFX1-]: Incompatible CompositableHost at WebRenderBridgeParent. (t=0.837434) |[G1][GFX1 39]: Failed to get ScaledFont entry for FontInstanceKey 0 (t=6.21906) |[G2][GFX1-]: Incompatible CompositableHost at WebRenderBridgeParent. (t=6.7567)

"Incompatible CompositableHost at WebRenderBridgeParent" also occurs 2 times with [@ OOM | small ]: https://mzl.la/2G33G1C

bp-70bae848-82d7-451f-b89e-ef4fc0190131 x10

|[G0][GFX1 39]: Failed to get ScaledFont entry for FontInstanceKey 0 (t=1.40432)

bp-af4b9a07-571e-430d-97f6-09c2c0190130 x2

|[G0][GFX1-]: shader-cache: Timed out before finishing loads (t=1.94395) |[G1][GFX1-]: Updating unknown shared surface: 81604381962 (t=13330.3) |[G2][GFX1-]: Updating unknown shared surface: 30064808194 (t=15842.1) |[G3][GFX1-]: Updating unknown shared surface: 30064808965 (t=16614.8) |[G4][GFX1 39]: Failed to get ScaledFont entry for FontInstanceKey 0 (t=17334.9)

bp-6d368b1c-e48a-4698-9149-5b6600190130 x6

|[G0][GFX1-]: shader-cache: Timed out before finishing loads (t=1.87078) |[G1][GFX1 39]: Failed to get ScaledFont entry for FontInstanceKey 0 (t=20.6164)

bp-76f76912-6a76-4767-b947-4fa9f0190127

|[G0][GFX1-]: Updating unknown shared surface: 566935683201 (t=94178.5) |[G1][GFX1-]: Shared surface does not exist for extId:816043786247 (t=94515.2) |[G2][GFX1 39]: Failed to get ScaledFont entry for FontInstanceKey 0 (t=1.55707e+06)

Comment 9

[Sotaro Ikeda [:sotaro]]

(In reply to Lee Salzman [:lsalzman] from comment #3)

Sotaro, any idea why we're seeing the "Incompatible CompositableHost" error? And any ideas why it might be related to a blob image's fonts having either been deleted or never added in the first place?

I found one way to reproduce the problem. It happened when GPU process was crashed during video playback like the following STR.

• [1] Start firefox and start playback video.
• [2] Open new window by dragging new tab and start playback video.
• [3] Open new window by dragging new tab and open "about:support".
• [4] Close GPU process by pushing "Terminate GPU Process" button.
• [5] Check Tabs that were playing videos if video is rendered correctly.

During re-creating GPU process, there was a period that ImageBridgeChild was re-created, but ImageBridgeChild::UpdateTextureFactoryIdentifier() was not called yet. In the period, if ImageBridgeChild::CreateImageClient() is called, ImageBridgeParent creates incompatible ImageHost than WebRenderImageHost.

Comment 10

[Lee Salzman [:lsalzman]]

Attachment: check for failure in GetFontKeyForScaledFont when building blobs

Rather than baking invalid font keys into the blob which will simply crash the WR process on deserialization, this deals with the problem on the content side. GetFontKeyForScaledFont has been cleaned up to more clearly indicate failure, which is then checked before we actually complete building the blobs.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ce8c71866841
check for failure in GetFontKeyForScaledFont when building blobs. r=jrmuizel

Comment 12

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/ce8c71866841