1507323 - Crash with "index out of bounds: the len is 2 but the index is 5" in webrender::clip_scroll_tree::ClipScrollTree::get_relative_transform

Status: VERIFIED FIXED

(Core :: Graphics: WebRender, defect, P2)

Description

[David Burns :automatedtester]

When loading Google Drive I regularly get a crash that takes out the entire browser.

This bug was filed from the Socorro interface and is
report bp-8f7efd1a-4fef-444f-a778-ad7a90181114.
=============================================================

Top 10 frames of crashing thread:

0 libmozglue.dylib mozalloc_abort memory/mozalloc/mozalloc_abort.cpp:35
1 libmozglue.dylib abort memory/mozalloc/mozalloc_abort.cpp:82
2 XUL panic_abort::__rust_start_panic::abort /rustc/da5f414c2c0bfe5198934493f04c676e2b23ff2e/src/libpanic_abort/lib.rs:63
3 XUL __rust_start_panic /rustc/da5f414c2c0bfe5198934493f04c676e2b23ff2e/src/libpanic_abort/lib.rs:58
4 XUL std::panicking::rust_panic_with_hook /rustc/da5f414c2c0bfe5198934493f04c676e2b23ff2e/src/libstd/panicking.rs:525
5 XUL std::panicking::continue_panic_fmt /rustc/da5f414c2c0bfe5198934493f04c676e2b23ff2e/src/libstd/panicking.rs:391
6 XUL rust_begin_unwind /rustc/da5f414c2c0bfe5198934493f04c676e2b23ff2e/src/libstd/panicking.rs:326
7 XUL core::panicking::panic_fmt /rustc/da5f414c2c0bfe5198934493f04c676e2b23ff2e/src/libcore/panicking.rs:77
8 XUL core::panicking::panic_bounds_check /rustc/da5f414c2c0bfe5198934493f04c676e2b23ff2e/src/libcore/panicking.rs:59
9 XUL webrender::clip_scroll_tree::ClipScrollTree::get_relative_transform libcore/slice/mod.rs:2046

=============================================================

Comment 2

[Kartikaya Gupta (email:[e-mail])]

Per https://bugzilla.mozilla.org/show_bug.cgi?id=1502717#c24

Comment 3

[Liz Henry (:lizzard) (relman/hg->git project)]

Tracking this for 65 and adding a couple of crash signatures from the duplicate bugs.

Comment 4

[Kartikaya Gupta (email:[e-mail])]

The MOZ_CrashOOL garbage signatures should stop appearing now that bug 1505954 is deployed, although the existing crashes from the nov 15-nov 19 timeframe will remain unless they are reprocessed. Also note that while the majority of those crashes (with the Moz_CrashOOL signature) are for this bug, not all of them are - the rest seem to be for bug 1507017. And the signature changes per buildid. I'm not sure if it's worth tracking those signatures on this bug but we can leave it for now since the majority of those crashes are for this bug.

I verified that I can no longer repro the crash from my STR in bug 1502717 comment 7, so that fix did fix *something*. But I guess there are other root causes that are still in play here.

Glenn/Andrew, :automatedtester seems to be able to hit this frequently, maybe he can try to provide STR or run with some logging to track this down?

Comment 5

[Kartikaya Gupta (email:[e-mail])]

This is looking like our #1 QR topcrash over the last three days

Comment 6

[Glenn Watson [:gw]]

The fix for this is https://github.com/servo/webrender/pull/3331.

Comment 7

[:gerard-majax]

Now that bug 1508766 landed, it seems I don't reproduce anymore the crash :)

Comment 8

[David Burns :automatedtester]

This is no longer happening to me. Thanks for the fix!