1741124 - Playing certain Google Slides transitions causes crash

Status: VERIFIED FIXED

(Core :: Web Painting, defect)

Description

[karthin]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0

Steps to reproduce:

1. Create a new Google Slides presentation.
2. Click "Transitions" near the top, select "Flip", "Cube" or "Gallery".
3. Click "Play".

Actual results:

Sudden spike in memory usage before Firefox is killed.

Expected results:

Transition should have played.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Audio/Video: Playback' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Mayank Bansal]

can repro this

1. Create a new presentation on google slides - Choose any prebuilt templates
2. Select a slide->Slide->Transition
3. From the newly opened panel on the right, select cube.
4. Click on apply to all slides
5. Click on the Play button

ER: Normal transition
AR: OOM and browser crash

Comment 3

[Mayank Bansal]

https://docs.google.com/presentation/d/1rDhBeEPqsuzJsgZwDho8GzKjRdwHwyHqr775Yi3GO_U/edit?usp=sharing

Open the link
Click on View->slideshow OR press Ctrl+F5

Comment 4

[Mayank Bansal]

Attachment: about:support

Comment 5

[Timothy Nikkel (:tnikkel)]

https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=c7cb63e184710abd9c54d813504a2cffcd1bd12f&tochange=d8dea0ed3b970ae1ec4e07b9e21514bc00c8f2ba

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1716904

Comment 7

[Emilio Cobos Álvarez (:emilio)]

Attachment: Sorta standalone test-case.

Comment 8

[Emilio Cobos Álvarez (:emilio)]

Attachment: More reduced test-case.

Comment 9

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1741124 - Don't apply CSS perspective to non-CSS-transformed frames. r=miko,nical

Applying it to SVG-transformed frames is wrong, and causes us to
rasterize rather massive SVGs. This is consistent with the other CSS
3d transforms code, and our rendering of the test-case matches other
browsers.

Comment 10

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 9252320 [details]
Bug 1741124 - Don't apply CSS perspective to non-CSS-transformed frames. r=miko,nical

Beta/Release Uplift Approval Request

• User impact if declined: Crash on Google Slides. If the fix looks good to the reviewers I think we should consider uplifting.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: comment 3
• List of other uplifts needed: none
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Relatively simple tweak to CSS perspective handling so that it doesn't apply to SVG inner frames.
• String changes made/needed: none

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/936ee887c40c
Don't apply CSS perspective to non-CSS-transformed frames. r=miko

Comment 12

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/31733 for changes under testing/web-platform/tests

Comment 13

[Darkspirit]

https://chat.mozilla.org/#/room/#gfx:mozilla.org/$GoJozhQt6S1RReoifBiUxYkUYk7g09qhcryyH2V3dc0

context: It seems bug 1741124 is OOMing in the WebRender blob code

Comment 14

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/936ee887c40c

Comment 15

[Pascal Chevrel:pascalc]

Comment on attachment 9252320 [details]
Bug 1741124 - Don't apply CSS perspective to non-CSS-transformed frames. r=miko,nical

Approved for 95 beta 12, thanks.

Comment 16

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/0d548a8b193a

Comment 17

[Peter Magyari (Desktop QA)]

I have reproduced the issue using Firefox 94.0.2 and I've verified the fix using Firefox Nightly 96.0a1 (20211125043756) on MacOS 11, Ubuntu 20.04 and Windows 10.

Comment 18

[Peter Magyari (Desktop QA)]

I've also verified the fix on Firefox Beta 95.0b12 (20211125101315)

Comment 19

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot

Comment 20

[Brindusa Tot, Desktop QA]

this was verified on fixed versions