1538719 - Hit MOZ_CRASH(Caught GL error 505 at tex_storage_3d) at gfx/wr/webrender/src/device/gl.rs:1124

Status: RESOLVED WORKSFORME

(Core :: Graphics: WebRender, defect, P3)

Description

Testcase found while fuzzing mozilla-central rev 880331515823.

Hit MOZ_CRASH(Caught GL error 505 at tex_storage_3d) at gfx/wr/webrender/src/device/gl.rs:1124

rax = 0x000055cb1e998e40   rdx = 0x0000000000000000
rcx = 0x0000000000000b40   rbx = 0x00007f128806061a
rsi = 0x00007f12aecb38b0   rdi = 0x00007f12aecb2680
rbp = 0x00007f1288060600   rsp = 0x00007f12880605f0
r8 = 0x00007f12aecb38b0    r9 = 0x00007f1288062700
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x0000000000000464   r13 = 0x0000000000000021
r14 = 0x00007f1272cd3a00   r15 = 0x0000000000000025
rip = 0x00007f12a13494bd
OS|Linux|0.0.0 Linux 4.18.0-16-generic #17~18.04.1-Ubuntu SMP Tue Feb 12 13:35:51 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV /SEGV_MAPERR|0x0|35
35|0|libxul.so|GeckoCrash|hg:hg.mozilla.org/mozilla-central:mfbt/Assertions.h:8803315158232628b5a63ad1e2dc84b28da805eb|314|0x0
35|1|libxul.so|gkrust_shared::panic_hook|hg:hg.mozilla.org/mozilla-central:toolkit/library/rust/shared/lib.rs:8803315158232628b5a63ad1e2dc84b28da805eb|234|0x9
35|2|libxul.so|core::ops::function::Fn::call|git:github.com/rust-lang/rust:src/libcore/ops/function.rs:9fda7c2237db910e41d6a712e9a2139b352e558b|78|0x5
35|3|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:9fda7c2237db910e41d6a712e9a2139b352e558b|495|0x6
35|4|libxul.so|std::panicking::continue_panic_fmt|git:github.com/rust-lang/rust:src/libstd/panicking.rs:9fda7c2237db910e41d6a712e9a2139b352e558b|398|0x18
35|5|libxul.so|std::panicking::begin_panic_fmt|git:github.com/rust-lang/rust:src/libstd/panicking.rs:9fda7c2237db910e41d6a712e9a2139b352e558b|353|0x5
35|6|libxul.so|webrender::device::gl::Device::new::{{closure}}|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/device/gl.rs:8803315158232628b5a63ad1e2dc84b28da805eb|1124|0x12
35|7|libxul.so|<gleam::gl::ErrorReactingGl<F> as gleam::gl::Gl>::tex_storage_3d|hg:hg.mozilla.org/mozilla-central:third_party/rust/gleam/src/gl.rs:8803315158232628b5a63ad1e2dc84b28da805eb|97|0x1a
35|8|libxul.so|webrender::device::gl::Device::create_texture|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/device/gl.rs:8803315158232628b5a63ad1e2dc84b28da805eb|1773|0x10
35|9|libxul.so|webrender::renderer::Renderer::draw_tile_frame|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/renderer.rs:8803315158232628b5a63ad1e2dc84b28da805eb|4225|0x21
35|10|libxul.so|webrender::profiler::TimeProfileCounter::profile|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/renderer.rs:8803315158232628b5a63ad1e2dc84b28da805eb|2738|0x28
35|11|libxul.so|webrender::renderer::Renderer::render_impl|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/renderer.rs:8803315158232628b5a63ad1e2dc84b28da805eb|2688|0x8
35|12|libxul.so|webrender::renderer::Renderer::render|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/renderer.rs:8803315158232628b5a63ad1e2dc84b28da805eb|2613|0x5
35|13|libxul.so|wr_renderer_render|hg:hg.mozilla.org/mozilla-central:gfx/webrender_bindings/src/bindings.rs:8803315158232628b5a63ad1e2dc84b28da805eb|644|0x9
35|14|libxul.so|mozilla::wr::RendererOGL::UpdateAndRender(mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, bool, mozilla::wr::RendererStats*)|hg:hg.mozilla.org/mozilla-central:gfx/webrender_bindings/RendererOGL.cpp:8803315158232628b5a63ad1e2dc84b28da805eb|121|0x1b
35|15|libxul.so|mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> const&, mozilla::TimeStamp const&, bool, mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, bool)|hg:hg.mozilla.org/mozilla-central:gfx/webrender_bindings/RenderThread.cpp:8803315158232628b5a63ad1e2dc84b28da805eb|370|0x15
35|16|libxul.so|mozilla::wr::RenderThread::HandleFrame(mozilla::wr::WrWindowId, bool)|hg:hg.mozilla.org/mozilla-central:gfx/webrender_bindings/RenderThread.cpp:8803315158232628b5a63ad1e2dc84b28da805eb|264|0x5
35|17|libxul.so|mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void (mozilla::wr::RenderThread::*)(mozilla::wr::WrWindowId, bool), true, (mozilla::RunnableKind)0, mozilla::wr::WrWindowId, bool>::Run()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/nsThreadUtils.h:8803315158232628b5a63ad1e2dc84b28da805eb|1122|0x1c
35|18|libxul.so|MessageLoop::RunTask(already_AddRefed<nsIRunnable>)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8803315158232628b5a63ad1e2dc84b28da805eb|442|0x6
35|19|libxul.so|MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8803315158232628b5a63ad1e2dc84b28da805eb|450|0x17
35|20|libxul.so|MessageLoop::DoWork()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8803315158232628b5a63ad1e2dc84b28da805eb|523|0x5
35|21|libxul.so|base::MessagePumpDefault::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_pump_default.cc:8803315158232628b5a63ad1e2dc84b28da805eb|35|0x9
35|22|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8803315158232628b5a63ad1e2dc84b28da805eb|315|0x17
35|23|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:8803315158232628b5a63ad1e2dc84b28da805eb|308|0x8
35|24|libxul.so|base::Thread::ThreadMain()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/thread.cc:8803315158232628b5a63ad1e2dc84b28da805eb|192|0x8
35|25|libxul.so|ThreadFunc|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/platform_thread_posix.cc:8803315158232628b5a63ad1e2dc84b28da805eb|40|0x3
35|26|libpthread-2.27.so||||0x76db
35|27|libc-2.27.so||||0x12188f

Comment 1

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Comment 2

[Mayank Bansal]

This testcase doesnt crash for me, but it uses 1.2GB RAM, which increases to 4GB+ if I try to scroll the page.

Comment 3

[Jason Kratzer [:jkratzer]]

Attachment: prefs.js

I can reliably reproduce this issue using a debug build with these prefs.

Comment 4

[Mayank Bansal]

Attachment: memory-report.json.gz

Comment 5

[Mayank Bansal]

Attachment: memory-report.json.gz

Comment 6

[Mayank Bansal]

With the latest Nightly, if I open the testcase, and scroll a bit, the memory use increases. If I scroll some more, the browser sort of "turns white". After i click on the browser a few times, it is "restored", but with an anomaly.
The memory use is still 4.5GB-5GB, but the memory doesnt reduce at all. All the extra memory is in the GPU process. Even after i repeatedly minimize memory, the GPU process still keeps on holding that much RAM.
Only option is to restart the browser. I recently updated to Win10 V1903

Comment 7

[Mayank Bansal]

Attachment: about:support

Comment 8

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/qb34HASnbHcibKgvyhWu-A/index.html

Comment 9

[Tyson Smith [:tsmith]]

The attached test case no longer triggers the issue. This was last reported by fuzzers running m-c 20201213-6567bdeb3c1e.