Closed Bug 1565231 Opened 5 years ago Closed 5 years ago

Crash in [@ <webrender_bindings::moz2d_renderer::Moz2dBlobImageHandler as webrender_api::image::BlobImageHandler>::update] on whatsapp and other places

Categories

(Core :: Graphics: WebRender, defect, P1)

Unspecified
All
defect

Tracking

()

RESOLVED FIXED
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- unaffected
firefox68 --- unaffected
firefox69 --- unaffected
firefox70 --- fixed

People

(Reporter: emilio, Unassigned)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: crash, regression)

Crash Data

This bug is for crash report bp-6bc39f98-901a-4645-93b0-7e1020190711.

Top 10 frames of crashing thread:

0 libxul.so GeckoCrash toolkit/xre/nsAppRunner.cpp:5154
1 libxul.so gkrust_shared::panic_hook toolkit/library/rust/shared/lib.rs:246
2 libxul.so core::ops::function::Fn::call src/libcore/ops/function.rs:69
3 libxul.so std::panicking::rust_panic_with_hook src/libstd/panicking.rs:478
4 libxul.so std::panicking::continue_panic_fmt src/libstd/panicking.rs:381
5 libxul.so std::panicking::begin_panic_fmt src/libstd/panicking.rs:336
6 libxul.so <webrender_bindings::moz2d_renderer::Moz2dBlobImageHandler as webrender_api::image::BlobImageHandler>::update gfx/webrender_bindings/src/moz2d_renderer.rs
7 libxul.so webrender::resource_cache::ResourceCache::pre_scene_building_update gfx/wr/webrender/src/resource_cache.rs:955
8 libxul.so <core::iter::adapters::Map<I, F> as core::iter::traits::iterator::Iterator>::next src/libcore/iter/adapters/mod.rs:570
9 libxul.so webrender::render_backend::RenderBackend::process_api_msg src/liballoc/vec.rs:1819

assertion failed: `(left == right)`
  left: `TypedRect(98×16 at (0,0))`,
 right: `TypedRect(98×98 at (0,0))`

I can reproduce this pretty consistently tab-switching from a youtube tab to a whatsapp web tab a couple times using the keyboard. Both tabs are pinned fwiw.

I'll try to find some repro steps on a clean profile.

Jeff mentioned this is likely regressed by bug 1563775,

FWIW, I also filed bug 1565229 about the missing line number information for the assert.

Summary: Crash in [@ <webrender_bindings::moz2d_renderer::Moz2dBlobImageHandler as webrender_api::image::BlobImageHandler>::update] → Crash in [@ <webrender_bindings::moz2d_renderer::Moz2dBlobImageHandler as webrender_api::image::BlobImageHandler>::update] on whatsapp and other places

Yeah, on a clean profile, on Linux, with gfx.webrender.enabled=true, layers.gpu-process.enabled=false (just to detect the crash more easily).

I noticed this because I use Wayland, and the GPU process doesn't work on Wayland.

STR: Tab-switching to https://web.whatsapp.com insta-crashes.

(In reply to Emilio Cobos Álvarez (:emilio) from comment #3)

Yeah, on a clean profile, on Linux, with gfx.webrender.enabled=true, layers.gpu-process.enabled=false (just to detect the crash more easily).

I noticed this because I use Wayland, and the GPU process doesn't work on Wayland.

STR: Tab-switching to https://web.whatsapp.com insta-crashes.

Is this an unauthenticated https://web.whatsapp.com?

Flags: needinfo?(emilio)

Has to be logged in, apparently.

Flags: needinfo?(emilio)

I'm not able to reproduce locally yet. I wonder if there's some animated svg content that you see that I don't. Also what's your devicePixelRatio?

Flags: needinfo?(emilio)
Crash Signature: [@ <webrender_bindings::moz2d_renderer::Moz2dBlobImageHandler as webrender_api::image::BlobImageHandler>::update] → [@ <webrender_bindings::moz2d_renderer::Moz2dBlobImageHandler as webrender_api::image::BlobImageHandler>::update] [@ webrender_bindings::moz2d_renderer::{{impl}}::update ]
OS: Linux → All

I'm able to reproduce the bug by resizing the window with web.whatsapp.com loaded.

Flags: needinfo?(emilio)
Priority: -- → P1

Hi,
It also happens a lot on Twitter.

Regressed by: 1563770
No longer regressed by: 1563775
Crash Signature: [@ <webrender_bindings::moz2d_renderer::Moz2dBlobImageHandler as webrender_api::image::BlobImageHandler>::update] [@ webrender_bindings::moz2d_renderer::{{impl}}::update ] → [@ <webrender_bindings::moz2d_renderer::Moz2dBlobImageHandler as webrender_api::image::BlobImageHandler>::update] [@ webrender_bindings::moz2d_renderer::{{impl}}::update ] [@ @0x7f70f344825e]

I can reproduce this simply by scrolling on various websites.

Crash Signature: [@ <webrender_bindings::moz2d_renderer::Moz2dBlobImageHandler as webrender_api::image::BlobImageHandler>::update] [@ webrender_bindings::moz2d_renderer::{{impl}}::update ] [@ @0x7f70f344825e] → [@ <webrender_bindings::moz2d_renderer::Moz2dBlobImageHandler as webrender_api::image::BlobImageHandler>::update] [@ webrender_bindings::moz2d_renderer::{{impl}}::update ] [@ @0x7f70f344825e]

Looks like we can close this now as the regressing patch was backed out yesterday in bug 1563775.

Status: NEW → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Has Regression Range: --- → yes
You need to log in before you can comment on or make changes to this bug.