1529149 - MOZ_CRASH(assertion failed: child_index.0 >= parent_index.0) at gfx/wr/webrender/src/clip_scroll_tree.rs:166

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebRender, defect, P3)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c:
BuildID=20190219213951
SourceStamp=57c4b2afc95bfb3c444c732802d99c8522414a1b

Test case requires layout.css.individual-transform.enabled=true

Hit MOZ_CRASH(assertion failed: child_index.0 >= parent_index.0) at gfx/wr/webrender/src/clip_scroll_tree.rs:166

#0 MOZ_Crash(char const*, int, char const*) src/obj-firefox/dist/include/mozilla/Assertions.h:314:3
#1 GeckoCrash src/toolkit/xre/nsAppRunner.cpp:5202:3
#2 gkrust_shared::panic_hook::h113d2206896eaa5d src/toolkit/library/rust/shared/lib.rs:234:8
#3 core::ops::function::Fn::call::h919e7addd8640b46 /rustc/9fda7c2237db910e41d6a712e9a2139b352e558b/src/libcore/ops/function.rs:78:4
#4 std::panicking::rust_panic_with_hook::h8cbdfe43764887be /rustc/9fda7c2237db910e41d6a712e9a2139b352e558b/src/libstd/panicking.rs:495:16
#5 std::panicking::begin_panic::h62933bdf8159cfa7 /rustc/9fda7c2237db910e41d6a712e9a2139b352e558b/src/libstd/panicking.rs:425:4
#6 webrender::clip_scroll_tree::ClipScrollTree::get_relative_transform::h5c4af23098fffe82 src/gfx/wr/webrender/src/clip_scroll_tree.rs:166:8
#7 _$LT$webrender..prim_store..CoordinateSpaceMapping$LT$F$C$$u20$T$GT$$GT$::new::h4ca83f00fdabac33 src/gfx/wr/webrender/src/prim_store/mod.rs:156:12
#8 _$LT$webrender..prim_store..SpaceMapper$LT$F$C$$u20$T$GT$$GT$::set_target_spatial_node::h51baba827727e134 src/gfx/wr/webrender/src/prim_store/mod.rs:210
#9 webrender::picture::PicturePrimitive::post_update::hbed445f38f891b82 src/gfx/wr/webrender/src/picture.rs:2767:12
#10 webrender::picture::PictureUpdateState::update::hc49804d434c6a720 (.llvm.12219146962125215688) src/gfx/wr/webrender/src/picture.rs:1738
#11 webrender::picture::PictureUpdateState::update::hc49804d434c6a720 (.llvm.12219146962125215688) src/gfx/wr/webrender/src/picture.rs:1727:16
#12 webrender::picture::PictureUpdateState::update::hc49804d434c6a720 (.llvm.12219146962125215688) src/gfx/wr/webrender/src/picture.rs:1727:16
#13 webrender::picture::PictureUpdateState::update::hc49804d434c6a720 (.llvm.12219146962125215688) src/gfx/wr/webrender/src/picture.rs:1727:16
#14 webrender::picture::PictureUpdateState::update::hc49804d434c6a720 (.llvm.12219146962125215688) src/gfx/wr/webrender/src/picture.rs:1727:16
#15 webrender::picture::PictureUpdateState::update::hc49804d434c6a720 (.llvm.12219146962125215688) src/gfx/wr/webrender/src/picture.rs:1727:16
#16 webrender::picture::PictureUpdateState::update::hc49804d434c6a720 (.llvm.12219146962125215688) src/gfx/wr/webrender/src/picture.rs:1727:16
#17 webrender::picture::PictureUpdateState::update_all::h62475f961b618441 src/gfx/wr/webrender/src/picture.rs:1641:8
#18 webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::ha2fcec609007d548 src/gfx/wr/webrender/src/frame_builder.rs:367:8
#19 webrender::frame_builder::FrameBuilder::build::h2dddb212ef8f19c5 src/gfx/wr/webrender/src/frame_builder.rs:545
#20 webrender::render_backend::Document::build_frame::h3af581acc59b89e4 src/gfx/wr/webrender/src/render_backend.rs:515:24
#21 webrender::render_backend::RenderBackend::update_document::h92c8ede3c3293f2a src/gfx/wr/webrender/src/render_backend.rs:1374:40
#22 webrender::render_backend::RenderBackend::prepare_transaction::h68f64f5d0934f7ad src/gfx/wr/webrender/src/render_backend.rs:1250:12
#23 webrender::render_backend::RenderBackend::process_api_msg::h6b0f0f1cd62769bf src/gfx/wr/webrender/src/render_backend.rs:1178
#24 webrender::render_backend::RenderBackend::run::h84e45f4457b96d83 src/gfx/wr/webrender/src/render_backend.rs:936:20
#25 webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h42af659db9d22b36 src/gfx/wr/webrender/src/renderer.rs:1960:12
#26 std::sys_common::backtrace::__rust_begin_short_backtrace::h2cd728981c748206 /rustc/9fda7c2237db910e41d6a712e9a2139b352e558b/src/libstd/sys_common/backtrace.rs:136
#27 std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h2208ff1e366fa517 /rustc/9fda7c2237db910e41d6a712e9a2139b352e558b/src/libstd/thread/mod.rs:477:16
#28 _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::he5ba01428609c0af /rustc/9fda7c2237db910e41d6a712e9a2139b352e558b/src/libstd/panic.rs:319
#29 std::panicking::try::do_call::heee83db40d04dcfa (.llvm.1133406684134994044) /rustc/9fda7c2237db910e41d6a712e9a2139b352e558b/src/libstd/panicking.rs:310
#30 __rust_maybe_catch_panic /rustc/9fda7c2237db910e41d6a712e9a2139b352e558b/src/libpanic_abort/lib.rs:39:4

Comment 1

[Boris Chiou [:boris]]

Just tested this with

1. gfx.webrender.all=true and
2. layout.css.individual-transform.enabled=true,
   and I cannot reproduce this right now, at the tip today.

Maybe I missed some other prefs for webrender?

Tyson, could you please check this crash on gecko again? Thank you very much.

Comment 2

[Tyson Smith [:tsmith]]

(In reply to Boris Chiou [:boris] from comment #1)

Tyson, could you please check this crash on gecko again? Thank you very much.

Hey Boris, I retested with the attached testcase and I can no longer reproduce the issue.
It was last reported by a fuzzer two weeks ago running m-c 20190605-155a7e2117e5

Comment 3

[Hiroyuki Ikezoe (:hiro)]

let's close this bug as per comment 2.

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Should we land the testcase still?

Comment 5

[Hiroyuki Ikezoe (:hiro)]

Attachment: Bug 1529149 - A crash test by fuzzing. r?boris

Depends on D47565

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/48c9f6695b18
A crash test by fuzzing. r=boris

Comment 7

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/48c9f6695b18