1618939 - Hit MOZ_CRASH(explicit panic) at gfx/wr/webrender/src/render_task.rs:37

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Tyson Smith [:tsmith]]

Attachment: testcase.html

Reduced with m-c: 20200228-fc9d28ae4655 (--enable-debug)

Hit MOZ_CRASH(explicit panic) at gfx/wr/webrender/src/render_task.rs:37

26|0|libxul.so|RustMozCrash|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/wrappers.cpp:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|17|0x15
26|1|libxul.so|mozglue_static::panic_hook|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/lib.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|89|0x9
26|2|libxul.so|core::ops::function::Fn::call|git:github.com/rust-lang/rust:src/libcore/ops/function.rs:f3e1a954d2ead4e2fc197c7da7d71e6c61bad196|72|0xc
26|3|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:f3e1a954d2ead4e2fc197c7da7d71e6c61bad196|475|0x6
26|4|libxul.so|std::panicking::begin_panic|git:github.com/rust-lang/rust:src/libstd/panicking.rs:f3e1a954d2ead4e2fc197c7da7d71e6c61bad196|404|0x8
26|5|libxul.so|webrender::render_task_cache::RenderTaskCache::request_render_task|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_task.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|37|0x18
26|6|libxul.so|webrender::prim_store::PrimitiveStore::prepare_prim_for_render|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/resource_cache.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|595|0xb
26|7|libxul.so|webrender::prim_store::PrimitiveStore::prepare_primitives|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|2866|0x23
26|8|libxul.so|webrender::prim_store::PrimitiveStore::prepare_prim_for_render|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|2755|0x2e
26|9|libxul.so|webrender::prim_store::PrimitiveStore::prepare_primitives|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/prim_store/mod.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|2866|0x23
26|10|libxul.so|webrender::frame_builder::FrameBuilder::build|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/frame_builder.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|465|0x3c
26|11|libxul.so|webrender::render_backend::Document::build_frame|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|559|0x21
26|12|libxul.so|webrender::render_backend::RenderBackend::update_document|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|1585|0x1d
26|13|libxul.so|webrender::render_backend::RenderBackend::process_api_msg|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|1304|0x339
26|14|libxul.so|webrender::render_backend::RenderBackend::process_api_msg|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|1304|0x2a
26|15|libxul.so|alloc::raw_vec::RawVec<T,A>::reserve|git:github.com/rust-lang/rust:src/liballoc/raw_vec.rs:f3e1a954d2ead4e2fc197c7da7d71e6c61bad196|520|0xe
26|16|libxul.so|webrender::hit_test::HitTester::new|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/hit_test.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|231|0x10
26|17|firefox-bin|RedBlackTree<arena_chunk_map_t, ArenaRunTreeTrait>::TreeNode::IsRed()|hg:hg.mozilla.org/mozilla-central:memory/build/rb.h:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|177|0xc
26|18|firefox-bin|RedBlackTree<arena_chunk_map_t, ArenaRunTreeTrait>::Insert(RedBlackTree<arena_chunk_map_t, ArenaRunTreeTrait>::TreeNode)|hg:hg.mozilla.org/mozilla-central:memory/build/rb.h:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|377|0xa
26|19|firefox-bin|arena_t::DallocSmall(arena_chunk_t*, void*, arena_chunk_map_t*)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|3329|0xb
26|20|firefox-bin|AutoLock<Mutex>::~AutoLock()|hg:hg.mozilla.org/mozilla-central:memory/build/Mutex.h:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|121|0x12
26|21|firefox-bin|arena_dalloc|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|3366|0x8
26|22|firefox-bin|arena_t::MallocSmall(unsigned long, bool)|hg:hg.mozilla.org/mozilla-central:memory/build/mozjemalloc.cpp:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|2865|0xb
26|23|firefox-bin|Allocator<MozJemallocBase>::free(void*)|hg:hg.mozilla.org/mozilla-central:memory/build/malloc_decls.h:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|54|0x2b
26|24|firefox-bin|PageFree|hg:hg.mozilla.org/mozilla-central:memory/replace/phc/PHC.cpp:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|1122|0x8
26|25|firefox-bin|replace_free|hg:hg.mozilla.org/mozilla-central:memory/replace/phc/PHC.cpp:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|1155|0x33
26|26|firefox-bin|replace_free|hg:hg.mozilla.org/mozilla-central:memory/replace/phc/PHC.cpp:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|1155|0x33
26|27|libxul.so|webrender::render_backend::RenderBackend::update_document|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:fc9d28ae4655254a6ef8a57ac6577545b2a42ca7|1669|0x91

Comment 1

[Tyson Smith [:tsmith]]

Attachment: prefs.js

Comment 2

[Tyson Smith [:tsmith]]

A Pernosco session is available here: https://pernos.co/debug/UQJ1s66scMhbWwFed1iWQA/index.html

Comment 3

[Jason Kratzer [:jkratzer]]

BugMon: Verified bug as reproducible on fc9d28ae4655254a6ef8a57ac6577545b2a42ca7

Comment 4

[Jason Kratzer [:jkratzer]]

BugMon: Reduced build range to...
> Start: 7d9a2196d3132f3716652666a945cb1831dfda36 (20190814215752)
> End: 144fbfb409b72b5849ace2a1e3c199c259f7c1d3 (20190815094430)
> Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7d9a2196d3132f3716652666a945cb1831dfda36&tochange=144fbfb409b72b5849ace2a1e3c199c259f7c1d3

Comment 5

[Jessie [:jbonisteel] pls NI]

Jeff does this look like something we should fix?

Comment 6

[Jessie [:jbonisteel] pls NI]

Glenn, can you take a look?

Comment 7

[Jessie [:jbonisteel] pls NI]

Bert - want to take a stab at fixing this?

Comment 8

[Bert Peers [:bpeers]]

[GFX1-]: Attempting to create a render task of size 28796x11520

Comment 9

[Bert Peers [:bpeers]]

Attachment: Bug 1618939 - Hit MOZ_CRASH(explicit panic) at gfx/wr/webrender/src/render_task.rs:37

Adding a repro-case reftest that asks for a 19996x5000 RenderTask (at
-p1), then fix it in analogy with the clamping to reasonable values that
happens for NormalBorder.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/14caf2826f00
Hit MOZ_CRASH(explicit panic) at gfx/wr/webrender/src/render_task.rs:37 r=gw

Comment 11

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/14caf2826f00

Comment 12

[Marco Castelluccio [:marco]]

(In reply to Jason Kratzer [:jkratzer] from comment #4)

BugMon: Reduced build range to...

Start: 7d9a2196d3132f3716652666a945cb1831dfda36 (20190814215752)
End: 144fbfb409b72b5849ace2a1e3c199c259f7c1d3 (20190815094430)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=7d9a2196d3132f3716652666a945cb1831dfda36&tochange=144fbfb409b72b5849ace2a1e3c199c259f7c1d3

Did we identify the cause between these changesets? Can we set the 'regressed by' field if so?

Comment 13

[Glenn Watson [:gw]]

I don't know of the exact cause, no. https://hg.mozilla.org/mozilla-central/rev/71b7ef6e0ed8b224e2715f894887587b1a80b34e is one candidate.