Closed Bug 1760847 Opened 5 months ago Closed 5 months ago

Crash in [@ malloc | mozilla::RetainedDisplayListBuilder::PreProcessDisplayList], [@ malloc | webrender_api::display_list::DisplayListBuilder::end]

Categories

(Core :: Graphics: WebRender, defect, P2)

Unspecified
Linux
defect

Tracking

()

RESOLVED FIXED
100 Branch
Tracking Status
firefox-esr91 --- unaffected
firefox98 --- unaffected
firefox99 --- fixed
firefox100 --- fixed

People

(Reporter: aryx, Assigned: mikokm)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

Started with Nightly 99, 14 crashes from 11 installations for Nightly 100.0a1, all with various Linux distros.

Crash report: https://crash-stats.mozilla.org/report/index/26f32a89-664b-4a74-9f1c-0fdbb0220322

MOZ_CRASH Reason: [unhandlable oom] Failed to mmap, likely no more mappings available /builds/worker/checkouts/gecko/memory/build/mozjemalloc.cpp : 1398

Top 10 frames of crashing thread:

0 firefox-bin malloc memory/build/malloc_decls.h:51
1 libxul.so webrender_api::display_list::DisplayListBuilder::end gfx/wr/webrender_api/src/display_list.rs:2179
2 libxul.so wr_api_end_builder gfx/webrender_bindings/src/bindings.rs:3878
3 libxul.so mozilla::wr::DisplayListBuilder::End gfx/webrender_bindings/WebRenderAPI.cpp:1014
4 libxul.so mozilla::layers::WebRenderLayerManager::EndTransactionWithoutLayer gfx/layers/wr/WebRenderLayerManager.cpp:446
5 libxul.so mozilla::nsDisplayList::PaintRoot layout/painting/nsDisplayList.cpp:2288
6 libxul.so nsLayoutUtils::PaintFrame layout/base/nsLayoutUtils.cpp:3446
7 libxul.so mozilla::PresShell::PaintInternal layout/base/PresShell.cpp:6362
8 libxul.so nsViewManager::ProcessPendingUpdatesPaint view/nsViewManager.cpp:440
9 libxul.so nsViewManager::ProcessPendingUpdatesForView view/nsViewManager.cpp:375

Please include these in the triage meeting.

Crash Signature: [@ malloc | webrender_api::display_list::DisplayListBuilder::end] → [@ malloc | mozilla::RetainedDisplayListBuilder::PreProcessDisplayList] [@ malloc | webrender_api::display_list::DisplayListBuilder::end]
Flags: needinfo?(bhood)
Summary: Crash in [@ malloc | webrender_api::display_list::DisplayListBuilder::end] → Linux Crash in [@ malloc | mozilla::RetainedDisplayListBuilder::PreProcessDisplayList], [@ malloc | webrender_api::display_list::DisplayListBuilder::end]

Miko, can you please check this? Looks like it's crashing in DisplayLists.

Blocks: gfx-triage
Flags: needinfo?(bhood) → needinfo?(mikokm)
Assignee: nobody → mikokm
Status: NEW → ASSIGNED
Flags: needinfo?(mikokm)
Priority: -- → P2

Comment on attachment 9268947 [details]
Bug 1760847 - Deallocate linked list nodes when RemoveBottom() is called r=emilio

Beta/Release Uplift Approval Request

  • User impact if declined: Possible OOM and crashes.
  • Is this code covered by automated tests?: No
  • Has the fix been verified in Nightly?: No
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): The bug is quite obvious and the fix is simple.
  • String changes made/needed:
Attachment #9268947 - Flags: approval-mozilla-beta?
Crash Signature: [@ malloc | mozilla::RetainedDisplayListBuilder::PreProcessDisplayList] [@ malloc | webrender_api::display_list::DisplayListBuilder::end] → [@ malloc | mozilla::RetainedDisplayListBuilder::PreProcessDisplayList] [@ malloc | webrender_api::display_list::DisplayListBuilder::end] [@ mozilla::RetainedDisplayListBuilder::PreProcessDisplayList]
Summary: Linux Crash in [@ malloc | mozilla::RetainedDisplayListBuilder::PreProcessDisplayList], [@ malloc | webrender_api::display_list::DisplayListBuilder::end] → Crash in [@ malloc | mozilla::RetainedDisplayListBuilder::PreProcessDisplayList], [@ malloc | webrender_api::display_list::DisplayListBuilder::end]
Pushed by mikokm@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/dffa8d716fa7
Deallocate linked list nodes when RemoveBottom() is called r=emilio
Status: ASSIGNED → RESOLVED
Closed: 5 months ago
Resolution: --- → FIXED
Target Milestone: --- → 100 Branch
Has Regression Range: --- → yes

Comment on attachment 9268947 [details]
Bug 1760847 - Deallocate linked list nodes when RemoveBottom() is called r=emilio

Approved for 99.0b8. Thanks.

Attachment #9268947 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Crash Signature: [@ malloc | mozilla::RetainedDisplayListBuilder::PreProcessDisplayList] [@ malloc | webrender_api::display_list::DisplayListBuilder::end] [@ mozilla::RetainedDisplayListBuilder::PreProcessDisplayList] → [@ malloc | mozilla::MergeState::AddNewNode ] [@ malloc | mozilla::RetainedDisplayListBuilder::PreProcessDisplayList] [@ malloc | webrender_api::display_list::DisplayListBuilder::end] [@ mozilla::RetainedDisplayListBuilder::PreProcessDisplayList]
See Also: → 1761967
Duplicate of this bug: 1761967
You need to log in before you can comment on or make changes to this bug.