Closed Bug 1650990 Opened 4 years ago Closed 4 years ago

Hit MOZ_CRASH(assertion failed: layout_visible_range.end >= layout_visible_range.start) at gfx/wr/webrender_api/src/image_tiling.rs:354

Categories

(Core :: Graphics: WebRender, defect, P3)

defect

Tracking

()

VERIFIED FIXED
mozilla80
Tracking Status
firefox-esr68 --- unaffected
firefox-esr78 --- disabled
firefox77 --- unaffected
firefox78 --- wontfix
firefox79 --- wontfix
firefox80 --- verified

People

(Reporter: tsmith, Assigned: nical)

References

(Blocks 2 open bugs, Regression)

Details

(Keywords: assertion, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(4 files)

Attached file testcase.html

Hit MOZ_CRASH(assertion failed: layout_visible_range.end >= layout_visible_range.start) at gfx/wr/webrender_api/src/image_tiling.rs:354

13|0|libxul.so|RustMozCrash|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/wrappers.cpp:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|17|0x15
13|1|libxul.so|mozglue_static::panic_hook|hg:hg.mozilla.org/mozilla-central:mozglue/static/rust/lib.rs:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|89|0x9
13|2|libxul.so|core::ops::function::Fn::call|git:github.com/rust-lang/rust:src/libcore/ops/function.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|72|0xc
13|3|libxul.so|std::panicking::rust_panic_with_hook|git:github.com/rust-lang/rust:src/libstd/panicking.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|474|0x7
13|4|libxul.so|std::panicking::begin_panic|git:github.com/rust-lang/rust:src/libstd/panicking.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|397|0x27
13|5|libxul.so|webrender_api::image_tiling::tiles_1d|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender_api/src/image_tiling.rs:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|354|0x1f
13|6|libxul.so|webrender_api::image_tiling::tiles|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender_api/src/image_tiling.rs:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|322|0x8
13|7|libxul.so|webrender::clip::ClipStore::build_clip_chain_instance|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/clip.rs:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|588|0x29
13|8|libxul.so|webrender::visibility::update_primitive_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/visibility.rs:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|407|0x54
13|9|libxul.so|webrender::visibility::update_primitive_visibility|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/visibility.rs:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|302|0x2c
13|10|libxul.so|webrender::frame_builder::FrameBuilder::build|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/frame_builder.rs:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|364|0xf
13|11|libxul.so|webrender::render_backend::Document::build_frame|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|649|0x51
13|12|libxul.so|webrender::render_backend::RenderBackend::update_document|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|1609|0xd
13|13|libxul.so|webrender::render_backend::RenderBackend::process_api_msg|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|1389|0x199
13|14|libxul.so|webrender::resource_cache::ResourceCache::post_scene_building_update|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/resource_cache.rs:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|619|0x58
13|15|libxul.so|mozilla::layers::OpUpdateResource::AssertSanity() const|s3:gecko-generated-sources:14767795184cd2486e8046aa7e84606a44ba5b021ed3fb28684afbd09ab664ab6d0245f6c4b5d843024f6014734e21bf551b16e15ce6fab941a75b6cfd48cae8/ipc/ipdl/_ipdlheaders/mozilla/layers/WebRenderMessages.h:|3112|0xc
13|16|libxul.so|core::ptr::drop_in_place|git:github.com/rust-lang/rust:src/libcore/ptr/mod.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|177|0x31e
13|17|libxul.so|webrender::scene::SceneProperties::flush_pending_updates|git:github.com/rust-lang/rust:src/libcore/iter/adapters/zip.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|176|0xf
13|18|libxul.so|_fini|||0x1e0a10c
13|19|libxul.so|mozilla::layers::OpUpdateResource::AssertSanity() const|s3:gecko-generated-sources:14767795184cd2486e8046aa7e84606a44ba5b021ed3fb28684afbd09ab664ab6d0245f6c4b5d843024f6014734e21bf551b16e15ce6fab941a75b6cfd48cae8/ipc/ipdl/_ipdlheaders/mozilla/layers/WebRenderMessages.h:|3112|0xc
13|20|libxul.so|<name omitted>|git:github.com/rust-lang/rust:src/libcore/ptr/mod.rs:4fb7144ed159f94491249e86d5bbd033b5d60550|177|0x100
13|21|libxul.so|webrender::render_backend::RenderBackend::update_document|hg:hg.mozilla.org/mozilla-central:gfx/wr/webrender/src/render_backend.rs:6cedb9c51fd839f6de2812cac6b95c5b9f4c7716|1716|0x14
Flags: in-testsuite?
Attached file prefs.js
Whiteboard: [bugmon:bisected,confirmed]
Bugmon Analysis:
Verified bug as reproducible on mozilla-central 20200707034119-dd1766e040a2.
The bug appears to have been introduced in the following build range:
> Start: dfc2af02f1c57ff2fe70db56fdb033d52ec85b95 (20200511211718)
> End: b918fa03b3d9b1f14e0da9cee5f0fc152d60ebbb (20200511211751)
> Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=dfc2af02f1c57ff2fe70db56fdb033d52ec85b95&tochange=b918fa03b3d9b1f14e0da9cee5f0fc152d60ebbb

b918fa03b3d9b1f14e0da9cee5f0fc152d60ebbb Glenn Watson — Bug 1636320 - Part 3 - Remove Push/PopClipChain display items. r=Bert

I created a fresh profile, copied above prefs.js, removed the proxy prefs and was unable to reproduce the crash on Gnome X11, Nvidia GTX1060, Debian Testing. This crash does not seem to occur in the wild.

Has Regression Range: --- → yes
Flags: needinfo?(nical.bugzilla)

Looking at the code, I suspect we ended up with a NaN in tiles's visible rect.

It would be nice if Rect::intersection returned None in the presence of NaN but I just checked and it returns some rect with more NaNs.

Flags: needinfo?(nical.bugzilla)

Submitted a fix in euclid for the NaN case https://github.com/servo/euclid/pull/444

Assignee: nobody → nical.bugzilla
Severity: -- → S3
Priority: -- → P3

It contains a fix for some of the rect operations interacting poorly with NaNs.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla80
Status: RESOLVED → VERIFIED
Keywords: bugmon
Bugmon Analysis:
Verified bug as fixed on rev mozilla-central 20200717032756-f6127ce5c744.
Removing bugmon keyword as no further action possible.
Please review the bug and re-add the keyword for further analysis.

Can we land a test for this?

Flags: needinfo?(nical.bugzilla)

Can we land a test for this?

Yeah, thanks for reminding.

Flags: needinfo?(nical.bugzilla)
Pushed by nsilva@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/12ac6d0d07ab
Add the provided test case as a crashtest. r=kats
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: