1627870 - Headless WebRender passes bogus source rectangle to Device::blit_render_target

Status: NEW

(Core :: Graphics: WebRender, defect, P3)

Description

[Jim Blandy :jimb]

Attachment: src-rect-assertions.patch

The following command, run from gfx/wr/wrench, causes WebRender to pass Device::blit_render_target a source rectangle that is not contained within the source ReadTarget:

./script/headless.py reftest reftests/text/raster_root_C_8192.yaml

This can be seen by adding the following assertions above the call to Device::blit_render_target in Renderer::handle_readback_composite (patch attached):

        assert!(DeviceIntRect::from_size(draw_target.dimensions())
                .contains_rect(&src));
        assert!(DeviceIntRect::from_size(cache_draw_target.dimensions())
                .contains_rect(&dest));

Comment 1

[Jim Blandy :jimb]

With the assertion added, the following gfx/wr/wrench/reftest tests crash:

reftests/text/raster_root_C_8192.yaml
reftests/transforms/raster_root_A_8192.yaml

All other reftests continue to pass.

Comment 2

[Glenn Watson [:gw]]

This might be related to the recent local scale work?

Comment 3

[Bert Peers [:bpeers]]

This is legal behavior: https://www.khronos.org/registry/OpenGL-Refpages/gl4/html/glBlitFramebuffer.xhtml

The actual region taken from the read framebuffer is limited to the intersection of the source buffers being transferred, which may include the color buffer selected by the read buffer, the depth buffer, and/or the stencil buffer depending on mask.

If the backend has compatibility issues then the more robust solution is to fix the backend, not massage the data to no longer trigger its bugs? :P

I mean we could add a src = src.intersection(&src_texture.get_dimensions().into()) similar to this anywhere up the callstack, but then I'm not sure how that's better than BlitFrameBuffer doing it?

Comment 4

[Jim Blandy :jimb]

That covers the GL_LINEAR case (which SWGL handles) but not GL_NEAREST. In bug 1627718, we made SWWR just clamp the source region, since that's fastest.

In practice, different drivers behave differently. nVidia leaves the corresponding part of the destination unwritten. Mesa writes garbage. Everyone else does something like CLAMP_TO_EDGE.

Since WR can't count on the area being culled out of the blit entirely, it's at the very least doing unnecessary overdraw.

But from what I know of WR display lists at the moment, it doesn't seem like any display list should even ask for such a blit, so it seems like a WR bug.

Comment 5

[Firefox Bug Husbandry Bot]

Because this bug's Severity has not been changed from the default since it was filed, and it's Priority is P3 (Backlog,) indicating it has been triaged, the bug's Severity is being updated to S3 (normal.)