1598434 - About:support crashing when scrolling down on Fenix

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect, P2)

Description

[Kris Taeleman (:ktaeleman)]

Repro steps

• open about:support
• scroll down to ~mid-page

Expected result:

• page shows correctly

Actual result:

• Browser crashes

Reproduced on device: Pixel 2 XL, Android 10.

Extra info

Crash occurs here due to failing assert:
https://searchfox.org/mozilla-central/rev/652014ca1183c56bc5f04daf01af180d4e50a91c/gfx/wr/webrender/src/picture.rs#3681

It looks like the tile.world_rect.origin has a fraction, causing the assert to fail.

Another thing I've noticed is that when opening the page, the content first loads at normal zoom and zooms out once the page is fully loaded. This zoom might contribute to the fraction.

Comment 1

[Kris Taeleman (:ktaeleman)]

@Glenn: Any idea why this would occur on about:support page and nowhere else (as far as we know)?

Comment 2

[Glenn Watson [:gw]]

The display lists for about:support and related pages come from the parent process, instead of the content process. That doesn't sound likely to be a factor here. The zoom you mentioned sounds likely to be related, although I'm not sure what would cause it. Some log outputs of those values and how they change over time might be relevant.

Comment 3

[Jamie Nicol [:jnicol]]

I think I've hit this before when zoomed on a regular page. I think when investigating bug 1589669. So it likely would be due to about:support being zoomed, rather than specific to that page.

Comment 4

[Kris Taeleman (:ktaeleman)]

This seems to be related to zoom values being smaller than 1.

When disabling the assert mentioned in my original comment, we still crash when changing the zoom due to:
https://searchfox.org/mozilla-central/rev/3483fb259b4edbe4594cfcc3911db97d5441b67d/gfx/wr/webrender/src/picture.rs#3169
This will crash due to rust panicking on the bitshift on negative values resulting from the log2 operation with reason: "attempt to shift left with overflow".

@Glenn: I'm not 100% sure what the output of this function should be in the case of 0.0 < zoom < 1.0.

Comment 5

[Glenn Watson [:gw]]

Looks like that piece of code is related to some changes Jamie made related to zooming, so he might be better able to answer your question above.

Comment 6

[Jamie Nicol [:jnicol]]

Oh, whoops, of course that won't work if scale < 0.5!

I suppose we want to write let rounded_up = 2.0f32.powf(scale.log2().ceil()).

Comment 7

[Kris Taeleman (:ktaeleman)]

This should have been fixed by:
https://bugzilla.mozilla.org/show_bug.cgi?id=1589669