Closed Bug 1516011 Opened Last year Closed 11 months ago

Google Slides: Crash in wr_moz2d_render_cb (ExternalSourceSurfaceCreation PLAY failure)


(Core :: Graphics: WebRender, defect, P3, critical)




Tracking Status
firefox-esr60 --- unaffected
firefox64 --- unaffected
firefox65 --- unaffected
firefox66 --- fixed


(Reporter: past, Assigned: aosmond)


(Blocks 2 open bugs)


(Keywords: crash)

Crash Data


(2 files)

This bug was filed from the Socorro interface and is
report bp-200a75db-d14f-4eb6-80a2-8fe600181221.

Top 10 frames of crashing thread:

0 XUL wr_moz2d_render_cb gfx/webrender_bindings/Moz2DImageRenderer.cpp:435
1 XUL webrender_bindings::moz2d_renderer::rasterize_blob gfx/webrender_bindings/src/
2 XUL <webrender_bindings::moz2d_renderer::Moz2dBlobRasterizer as webrender_api::image::AsyncBlobImageRasterizer>::rasterize libcore/ops/
3 XUL webrender::scene_builder::Transaction::rasterize_blobs gfx/wr/webrender/src/
4 XUL std::sys_common::backtrace::__rust_begin_short_backtrace gfx/wr/webrender/src/
5 XUL <F as alloc::boxed::FnBox<A>>::call_box libstd/thread/
6 XUL std::sys::unix::thread::Thread::new::thread_start src/liballoc/
7 libsystem_pthread.dylib libsystem_pthread.dylib@0x3304 
8 libsystem_pthread.dylib libsystem_pthread.dylib@0x626e 
9 libsystem_pthread.dylib libsystem_pthread.dylib@0x2414 


Other similar crashes:
Crash Signature: [@ wr_moz2d_render_cb] → [@ wr_moz2d_render_cb] [@ mozilla::wr::Moz2DRenderCallback ]
OS: Mac OS X → All
Priority: -- → P3
> GraphicsCriticalError 	|[0][GFX1-]: Replay failure: ExternalSourceSurfaceCreation PLAY (t=14976.7)

Because of the other signature with the same GraphicsCriticalError.

Flags: needinfo?(jan)

Thanks. It looks like this happens quite a bit on Google slides.

Summary: Crash in wr_moz2d_render_cb → Google Slides: Crash in wr_moz2d_render_cb
Summary: Google Slides: Crash in wr_moz2d_render_cb → Google Slides: Crash in wr_moz2d_render_cb (ExternalSourceSurfaceCreation PLAY failure)

I'm assigning to Andrew as this is his code. I expect this will be difficult to debug without a STR

Assignee: nobody → aosmond

It is hard to filter the signatures on the gfx logs, but I suspect recycling caused this. Animated image inside a blob might have some extra edge cases.

I can reproduce on in a local build by forcing images to go through fallback. I need to scroll around a lot to trigger though.

So if I fix this check:

to take into account recycled surfaces, it appears to fix the crashes. I'm a little worried about some state inconsistencies though, because recycling adds new races where the blob image might display the wrong data...

References to shared surfaces are already kept alive for the blob in the
content process, and it also ensures an image key is created to ensure
any release of the surface is delayed until the next epoch. Wrapped
shared surfaces (when used in an animation which is recycling its
surfaces) did not get an image key created which this patch corrects.
Given the crash resolved in part 1, it is possible for the blob
rasterizer in the compositor process to still be using surfaces after
the animation has advanced to the next frame. With recycling this can be
problematic as the recycled surface will be reused for a future frame.
In an ideal world, the blob recording would use the animation's image
key instead, but the rasterizer doesn't have easy access to the mapping
table. As such, for any frames used in a blob recording, we now
explicitly mark them as non-recyclable and we will be forced to allocate
a new frame instead.

Depends on D16191
Pushed by
Part 1. Ensure wrapped shared surfaces are retained for blob rasterization. r=jrmuizel
Part 2. Deny recycling for frames used in blob recordings. r=tnikkel
Flags: needinfo?(aosmond)
Pushed by
Part 1. Ensure wrapped shared surfaces are retained for blob rasterization. r=jrmuizel
Part 2. Deny recycling for frames used in blob recordings. r=tnikkel
Closed: 11 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla66

I see which includes my fix. I am now puzzled as to the root cause.

See Also: → 1524280
You need to log in before you can comment on or make changes to this bug.