Closed Bug 1648323 Opened 4 years ago Closed 4 years ago

backdrop-filter: Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at gfx/wr/webrender/src/clip.rs:569

Categories

(Core :: Graphics: WebRender, defect)

Product:
Core
Component:
Graphics: WebRender
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
mozilla80
Tracking Flags:
Tracking Status
firefox-esr68 --- unaffected
firefox-esr78 --- disabled
firefox77 --- disabled
firefox78 --- disabled
firefox79 --- disabled
firefox80 --- verified

People

(Reporter: tsmith, Assigned: nical)

References

(Blocks 2 open bugs, Regression)

Details

(4 keywords, Whiteboard: [bugmon:bisected,confirmed])

Crash Data

Attachments

(3 files)

testcase.html
205 bytes, text/html
Details
prefs.js
8.93 KB, application/x-javascript
Details
Bug 1648323 - Skip the primitive if its clip mask does not intersect it. r=gw
47 bytes, text/x-phabricator-request
Details | Review
Attached file testcase.html —

Hit MOZ_CRASH(called Option::unwrap() on a None value) at gfx/wr/webrender/src/clip.rs:569

39|0|libxul.so|RustMozCrash|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/wrappers.cpp:8fcf1cac56600d932240486ffe7a06d46a0c931c|17|0x15
39|1|libxul.so|mozglue_static::panic_hook|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/lib.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|89|0x9
39|2|libxul.so|core::ops::function::Fn::call|git:github.com/rust-lang/rust:src/libcore/ops/function.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|72|0xc
39|3|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|474|0x7
39|4|libxul.so|rust_begin_unwind|git:github.com/rust-lang/rust:src/libstd/panicking.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|378|0x2f
39|5|libxul.so|core::panicking::panic_fmt|git:github.com/rust-lang/rust:src/libcore/panicking.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|85|0x6
39|6|libxul.so|core::panicking::panic|git:github.com/rust-lang/rust:src/libcore/panicking.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|52|0x49
39|7|libxul.so|webrender::clip::ClipStore::build_clip_chain_instance|git:github.com/rust-lang/rust:src/libcore/macros/mod.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|10|0x19
39|8|libxul.so|webrender::visibility::update_primitive_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/visibility.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|403|0x57
39|9|libxul.so|webrender::visibility::update_primitive_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/visibility.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|299|0x2a
39|10|libxul.so|webrender::visibility::update_primitive_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/visibility.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|299|0x2a
39|11|libxul.so|webrender::visibility::update_primitive_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/visibility.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|299|0x2a
39|12|libxul.so|webrender::visibility::update_primitive_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/visibility.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|299|0x2a
39|13|libxul.so|webrender::frame_builder::FrameBuilder::build|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/frame_builder.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|387|0x29
39|14|libxul.so|webrender::render_backend::Document::build_frame|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|643|0x22
39|15|libxul.so|webrender::render_backend::RenderBackend::update_document|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|1552|0x1e
39|16|libxul.so|webrender::render_backend::RenderBackend::process_api_msg|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|1332|0x199
39|17|libnspr4.so|PR_GetCurrentThread|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/pthreads/ptthread.c:8fcf1cac56600d932240486ffe7a06d46a0c931c|640|0xb
39|18|libnspr4.so|PR_GetThreadPrivate|hg:hg.mozilla.org/mozilla-central:nsprpub/pr/src/threads/prtpd.c:8fcf1cac56600d932240486ffe7a06d46a0c931c|205|0x5
39|19|libxul.so|_fini|||0x10ea7
39|20|libxul.so|AssertActivityIsLegal()|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsTraceRefcnt.cpp:8fcf1cac56600d932240486ffe7a06d46a0c931c|198|0x10
39|21|libxul.so|mozilla::BlockingResourceBase::Release()|hg:hg.mozilla.org/mozilla-central:xpcom/threads/BlockingResourceBase.cpp:8fcf1cac56600d932240486ffe7a06d46a0c931c|284|0xc
39|22|libxul.so|NS_LogDtor|hg:hg.mozilla.org/mozilla-central:xpcom/base/nsTraceRefcnt.cpp:8fcf1cac56600d932240486ffe7a06d46a0c931c|1054|0x5
39|23|firefox-bin|mozilla::detail::MutexImpl::unlock()|hg:hg.mozilla.org/mozilla-central:mozglue/misc/Mutex_posix.cpp:8fcf1cac56600d932240486ffe7a06d46a0c931c|178|0x5
39|24|libxul.so|mozilla::layers::APZCTreeManager::SampleForWebRender(mozilla::wr::TransactionWrapper&, mozilla::TimeStamp const&, nsTArray<mozilla::wr::WrPipelineIdAndEpoch> const*)|hg:hg.mozilla.org/mozilla-central:gfx/layers/apz/src/APZCTreeManager.cpp:8fcf1cac56600d932240486ffe7a06d46a0c931c|893|0x60
39|25|libxul.so|webrender::resource_cache::ResourceCache::add_image_template|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/resource_cache.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|709|0x245
39|26|libxul.so|DumpHeap(JSContext*, unsigned int, JS::Value*)|hg:hg.mozilla.org/mozilla-central:js/src/builtin/TestingFunctions.cpp:8fcf1cac56600d932240486ffe7a06d46a0c931c|2736|0x12
39|27|libxul.so|webrender::resource_cache::ResourceCache::post_scene_building_update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/resource_cache.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|619|0x58
39|28|libxul.so|mozilla::layers::APZSampler::Release()|hg:hg.mozilla.org/mozilla-central:gfx/layers/apz/public/APZSampler.h:8fcf1cac56600d932240486ffe7a06d46a0c931c|41|0x12
39|29|libxul.so|core::ptr::drop_in_place|git:github.com/rust-lang/rust:src/libcore/ptr/mod.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|177|0x31e
39|30|libxul.so|hashbrown::raw::RawTable<T>::reserve_rehash|/cargo/registry/src/github.com-1ecc6299db9ec823/hashbrown-0.6.2/src/raw/mod.rs|932|0xf
39|31|libxul.so|_fini|||0x1e03e6d
39|32|libxul.so|webrender::scene::SceneProperties::flush_pending_updates|git:github.com/rust-lang/rust:src/libcore/iter/adapters/zip.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|176|0xf
39|33|libxul.so|_fini|||0x1e03e6c
39|34|libxul.so|webrender::render_backend::RenderBackend::update_document|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:8fcf1cac56600d932240486ffe7a06d46a0c931c|1658|0x14
Flags: in-testsuite?
Attached file prefs.js —
Keywords: bugmon

A Pernosco session is available here: https://pernos.co/debug/9tHfaJXm4z6ASyHXFxil9w/index.html

bp-1518e78e-e899-44a2-971f-1fe590200625

Blocks: wr-stability
Crash Signature: [@ webrender::clip::ClipStore::build_clip_chain_instance ]

Gnome Xwayland, Debian Testing, Macbook Pro
good: empty tab
bad: crash, firefox closes
mozregression --good 2020-03-15 --bad 2020-06-24 --pref gfx.webrender.all:true layers.gpu-process.enabled:false layout.css.backdrop-filter.enabled:true -a https://bugzilla.mozilla.org/attachment.cgi?id=9159130

9:00.82 INFO: Last good revision: eb5dd046d5c8a818855d4b0f0a0e6ad454239b2c
9:00.82 INFO: First bad revision: aff8eef07d078b20be9c4b7d6dfb689998fb11fa
9:00.82 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=eb5dd046d5c8a818855d4b0f0a0e6ad454239b2c&tochange=aff8eef07d078b20be9c4b7d6dfb689998fb11fa

aff8eef07d078b20be9c4b7d6dfb689998fb11fa Nicolas Silva — Bug 1587713 - Remove the late blob rasterization code. r=jrmuizel
100387beceed5894fa594a07845a149cbddfb1b8 Nicolas Silva — Bug 1630212 - Remove non-tiled blob images. r=jrmuizel

I assume it's bug 1630212?

Blocks: 1578503
status-firefox77: --- → disabled
status-firefox78: --- → disabled
status-firefox79: affected → disabled
status-firefox-esr68: --- → unaffected
status-firefox-esr78: --- → disabled
Flags: needinfo?(nical.bugzilla)
Keywords: regression
Regressed by: 1630212
See Also: → 1618013
Summary: Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at gfx/wr/webrender/src/clip.rs:569 → backdrop-filter: Hit MOZ_CRASH(called `Option::unwrap()` on a `None` value) at gfx/wr/webrender/src/clip.rs:569
Has Regression Range: --- → yes
Whiteboard: [bugmon:bisected,confirmed]
Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200625161839-324d5257f6f7.
The bug appears to have been introduced in the following build range:
> Start: eb5dd046d5c8a818855d4b0f0a0e6ad454239b2c (20200416200937)
> End: aff8eef07d078b20be9c4b7d6dfb689998fb11fa (20200416201406)
> Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=eb5dd046d5c8a818855d4b0f0a0e6ad454239b2c&tochange=aff8eef07d078b20be9c4b7d6dfb689998fb11fa
Severity: -- → S3
Assignee: nobody → nical.bugzilla
Status: NEW → ASSIGNED

It's unclear why the primitive's rect does not intersect the clip but I guess the most reasonable thing to do here is to default to the visible rect. it will cause the next few lines to generate zero repretitions and the primitive will be entirely clipped out.

Flags: needinfo?(nical.bugzilla)
Pushed by nsilva@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/5655e4fec81d
Skip the primitive if its clip mask does not intersect it. r=gw

https://hg.mozilla.org/mozilla-central/rev/5655e4fec81d

Status: ASSIGNED → RESOLVED
Closed: 4 years ago
status-firefox80: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla80
Status: RESOLVED → VERIFIED
status-firefox80: fixed → verified
Keywords: bugmon
Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20200702094606-6e29c02e7e5f.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: