1769963 - Crash in [@ webrender::spatial_tree::SpatialTree::get_relative_transform_with_face] by clicking "Open Model" on https://codepen.io/islamghany/full/BaajZXW

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Gregory Pappas [:gregp]]

Crash report: https://crash-stats.mozilla.org/report/index/fc138aa9-5df6-47f6-9ce1-073cb0220518

MOZ_CRASH Reason: bug: this is an unexpected case - please open a bug and talk to #gfx team!

Top 10 frames of crashing thread:

0 libxul.so RustMozCrash mozglue/static/rust/wrappers.cpp:18
1 libxul.so mozglue_static::panic_hook mozglue/static/rust/lib.rs:91
2 libxul.so core::ops::function::Fn::call library/core/src/ops/function.rs:70
3 libxul.so std::panicking::rust_panic_with_hook library/std/src/panicking.rs:702
4 libxul.so std::panicking::begin_panic::{{closure}} library/std/src/panicking.rs:617
5 libxul.so std::sys_common::backtrace::__rust_end_short_backtrace library/std/src/sys_common/backtrace.rs:138
6 libxul.so std::panicking::begin_panic library/std/src/panicking.rs:616
7 libxul.so webrender::spatial_tree::SpatialTree::get_relative_transform_with_face gfx/wr/webrender/src/spatial_tree.rs:973
8 libxul.so webrender::picture::PicturePrimitive::assign_surface gfx/wr/webrender/src/picture.rs:5882
9 libxul.so webrender::picture_graph::PictureGraph::assign_surfaces gfx/wr/webrender/src/picture_graph.rs:108

Steps to reproduce:

1. Set layout.css.backdrop-filter.enabled to true in about:config
2. Navigate to https://codepen.io/islamghany/full/BaajZXW
3. Click "Open Model"

Actual results: Firefox crashes
Expected result: Firefox does not crash

Comment 1

[Glenn Watson [:gw]]

A somewhat reduced repro appears to have a nested backdrop-filter within an opacity filter:

Roughly speaking:

backdrop-filter: blur(9,9)
    filter: opacity([animated binding])
        backdrop-filter: blur(9, 9)

They're attached to different spatial nodes, including the wrapping stacking context for the opacity.

Comment 2

[Glenn Watson [:gw]]

A minimal wrench test case:

---
root:
  items:
    - type: rect
      color: [100, 0, 0, 1]
      bounds: 0 0 200 200
    - type: stacking-context
      transform: rotate(45)
      filters: opacity(0.5)
      wraps-backdrop-filter: true
      items:
        - type: backdrop-filter
          bounds: 0 0 100 100
          filters: invert(1)

Comment 3

[Glenn Watson [:gw]]

Attachment: Bug 1769963 - Fix backdrop-filter inside complex transform with CSS filter chain

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/827ff7c5f5f4
Fix backdrop-filter inside complex transform with CSS filter chain r=gfx-reviewers,lsalzman

Comment 5

[Marian-Vasile Laza]

Backed out changeset 827ff7c5f5f4 (Bug 1769963) as requested by the dev.
Backout link

Comment 6

[Glenn Watson [:gw]]

Fixed and updated the patch, will do a try run then push again.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c912923296d1
Fix backdrop-filter inside complex transform with CSS filter chain r=gfx-reviewers,lsalzman

Comment 8

[Marian-Vasile Laza]

Backed out changeset c912923296d1 (Bug 1769963) for causing mochitest failures on test_aboutmemory5.xhtml.
Backout link
Push with failures <--> c2 <--> bc1 <--> c3 <--> bc7
Failure Log
bc1 Failure Log
c3 Failure Log
bc7 Failure Log

Comment 9

[Glenn Watson [:gw]]

Fixed up an ffi binding issue, will re-land after a new try.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ea22ccce0c4d
Fix backdrop-filter inside complex transform with CSS filter chain r=gfx-reviewers,lsalzman

Comment 11

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/ea22ccce0c4d