Closed Bug 1782044 Opened 2 years ago Closed 2 years ago

Hit MOZ_CRASH(assertion failed: info.ignore_missing_pipeline) at gfx/wr/webrender/src/scene_building.rs:1078

Categories

(Core :: Graphics: WebRender, defect)

Product:
Core
Component:
Graphics: WebRender
Platform:
x86_64
Linux
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
105 Branch
Tracking Flags:
Tracking Status
firefox-esr91 --- unaffected
firefox-esr102 --- unaffected
firefox103 --- unaffected
firefox104 --- unaffected
firefox105 --- verified

People

(Reporter: jkratzer, Assigned: sotaro)

References

(Blocks 1 open bug, Regression)

Details

(Keywords: perf-alert, regression, testcase, Whiteboard: [bugmon:bisected,confirmed])

Attachments

(2 files)

Testcase
523 bytes, text/plain
Details
Bug 1782044 - Force sync image pipeline in WebRenderCanvasRendererAsync
48 bytes, text/x-phabricator-request
Details | Review

Testcase found while fuzzing mozilla-central rev 7a144cb09b52 (built with: --enable-debug --enable-fuzzing).

Testcase can be reproduced using the following commands:

$ pip install fuzzfetch grizzly-framework
$ python -m fuzzfetch --build 7a144cb09b52 --debug --fuzzing -n firefox
$ python -m grizzly.replay ./firefox/firefox testcase.html

Hit MOZ_CRASH(assertion failed: info.ignore_missing_pipeline) at gfx/wr/webrender/src/scene_building.rs:1078

    ==2922329==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f968cb32775 bp 0x7f95767f8210 sp 0x7f95767f8200 T2922510)
    ==2922329==The signal is caused by a WRITE memory access.
    ==2922329==Hint: address points to the zero page.
        #0 0x7f968cb32775 in MOZ_Crash /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3
        #1 0x7f968cb32775 in RustMozCrash /mozglue/static/rust/wrappers.cpp:18:3
        #2 0x7f968cb326f8 in mozglue_static::panic_hook::hc73c6ec992377969 /mozglue/static/rust/lib.rs:91:9
        #3 0x7f968cb3217b in core::ops::function::Fn::call::h3d3ab1c02c30d6c6 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/core/src/ops/function.rs:77:5
        #4 0x7f968daf8bd5 in std::panicking::rust_panic_with_hook::hc82286af2030e925 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/panicking.rs:702:17
        #5 0x7f968daf8998 in std::panicking::begin_panic_handler::_$u7b$$u7b$closure$u7d$$u7d$::h1c15057c2f09081f /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/panicking.rs:586:13
        #6 0x7f968daf5b93 in std::sys_common::backtrace::__rust_end_short_backtrace::h65de906a5330f8da /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/sys_common/backtrace.rs:138:18
        #7 0x7f968daf8708 in rust_begin_unwind /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/panicking.rs:584:5
        #8 0x7f96832578a2 in core::panicking::panic_fmt::h741cfbfc95bc6112 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/core/src/panicking.rs:142:14
        #9 0x7f968325776c in core::panicking::panic::hab046c3856b52f65 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/core/src/panicking.rs:48:5
        #10 0x7f968c77bf75 in webrender::scene_building::SceneBuilder::push_iframe::hdfb6d3a2204fd734 /gfx/wr/webrender/src/scene_building.rs:1078:17
        #11 0x7f968c77bf75 in webrender::scene_building::SceneBuilder::build_all::h2fa32a9dd7d50d11 /gfx/wr/webrender/src/scene_building.rs:867:50
        #12 0x7f968c76ff6b in webrender::scene_building::SceneBuilder::build::hd29e96230e7216bd /gfx/wr/webrender/src/scene_building.rs:590:9
        #13 0x7f968c76ff6b in webrender::scene_builder_thread::SceneBuilderThread::process_transaction::h1fa9e91fc19c016d /gfx/wr/webrender/src/scene_builder_thread.rs:596:25
        #14 0x7f968c760b4a in webrender::scene_builder_thread::SceneBuilderThread::run::_$u7b$$u7b$closure$u7d$$u7d$::h9b19692bcf0493e5 /gfx/wr/webrender/src/scene_builder_thread.rs:313:36
        #15 0x7f968c760b4a in core::iter::adapters::map::map_try_fold::_$u7b$$u7b$closure$u7d$$u7d$::h098c45d00de1f45b /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/core/src/iter/adapters/map.rs:91:28
        #16 0x7f968c760b4a in core::iter::traits::iterator::Iterator::try_fold::h3531a31c12cc8f26 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/core/src/iter/traits/iterator.rs:2190:21
        #17 0x7f968c760b4a in _$LT$core..iter..adapters..map..Map$LT$I$C$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::try_fold::h43ec0497a535e910 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/core/src/iter/adapters/map.rs:117:9
        #18 0x7f968c760b4a in _$LT$I$u20$as$u20$alloc..vec..in_place_collect..SpecInPlaceCollect$LT$T$C$I$GT$$GT$::collect_in_place::h448404f4bcb5aa57 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/alloc/src/vec/in_place_collect.rs:251:13
        #19 0x7f968c760b4a in alloc::vec::in_place_collect::_$LT$impl$u20$alloc..vec..spec_from_iter..SpecFromIter$LT$T$C$I$GT$$u20$for$u20$alloc..vec..Vec$LT$T$GT$$GT$::from_iter::h31e30868bc3e43fa /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/alloc/src/vec/in_place_collect.rs:178:19
        #20 0x7f968c760b4a in _$LT$alloc..vec..Vec$LT$T$GT$$u20$as$u20$core..iter..traits..collect..FromIterator$LT$T$GT$$GT$::from_iter::h53039e3c80fe067c /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/alloc/src/vec/mod.rs:2612:9
        #21 0x7f968c760b4a in core::iter::traits::iterator::Iterator::collect::h9c81463211e26b96 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/core/src/iter/traits/iterator.rs:1788:9
        #22 0x7f968c760b4a in webrender::scene_builder_thread::SceneBuilderThread::run::h90c2bcbde9c4ab83 /gfx/wr/webrender/src/scene_builder_thread.rs:312:67
        #23 0x7f968c4a9d2b in webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h1dcc82480b2b50e0 /gfx/wr/webrender/src/renderer/mod.rs:1249:13
        #24 0x7f968c4a9d2b in std::sys_common::backtrace::__rust_begin_short_backtrace::h632758c0056c0c67 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/sys_common/backtrace.rs:122:18
        #25 0x7f968c4c98ce in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h8ad6858cb390048a /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/thread/mod.rs:501:17
        #26 0x7f968c4c98ce in _$LT$core..panic..unwind_safe..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h197a2159720a1328 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/core/src/panic/unwind_safe.rs:271:9
        #27 0x7f968c4c98ce in std::panicking::try::do_call::h2c5a526964602bff /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/panicking.rs:492:40
        #28 0x7f968c4c98ce in std::panicking::try::h8acd169cabfb9801 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/panicking.rs:456:19
        #29 0x7f968c4c98ce in std::panic::catch_unwind::he4072416f0ae7186 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/panic.rs:137:14
        #30 0x7f968c4c98ce in std::thread::Builder::spawn_unchecked_::_$u7b$$u7b$closure$u7d$$u7d$::h7224727f864a873e /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/thread/mod.rs:500:30
        #31 0x7f968c4c98ce in core::ops::function::FnOnce::call_once$u7b$$u7b$vtable.shim$u7d$$u7d$::hde45ab2ede9971eb /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/core/src/ops/function.rs:248:5
        #32 0x7f968db02b02 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::hcbca3baf872b7fe4 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/alloc/src/boxed.rs:1872:9
        #33 0x7f968db02b02 in _$LT$alloc..boxed..Box$LT$F$C$A$GT$$u20$as$u20$core..ops..function..FnOnce$LT$Args$GT$$GT$::call_once::h18790338ce1743e2 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/alloc/src/boxed.rs:1872:9
        #34 0x7f968db02b02 in std::sys::unix::thread::Thread::new::thread_start::hb1067183bad48893 /rustc/a8314ef7d0ec7b75c336af2c9857bfaf43002bfc/library/std/src/sys/unix/thread.rs:108:17
        #35 0x7f969a29d608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477:8
        #36 0x7f9699e64132 in __clone /build/glibc-SzIz7B/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    UndefinedBehaviorSanitizer can not provide additional info.
    SUMMARY: UndefinedBehaviorSanitizer: SEGV /builds/worker/workspace/obj-build/dist/include/mozilla/Assertions.h:261:3 in MOZ_Crash
    ==2922329==ABORTING
Attached file Testcase — 

    
    

    
  
Can reproduce with the testcase on a normal linux debug build. Mozregression points to bug 1779681. Any ideas Lee?


Severity: -- → S3
Flags: needinfo?(lsalzman)
Regressed by: 1779681

    
    

    
  
Set release status flags based on info from the regressing bug 1779681



          status-firefox103:
          --- → unaffected

          status-firefox104:
          --- → unaffected

          status-firefox105:
          --- → affected

          status-firefox-esr102:
          --- → unaffected

          status-firefox-esr91:
          --- → unaffected

    
    

    
  
Bugmon Analysis

Verified bug as reproducible on mozilla-central 20220728093233-7a144cb09b52.

The bug appears to have been introduced in the following build range:




Start: f089ee647e811f3c3e4e6346e92001e93ea6bbf5 (20220726195158)

End: e3ea81c6d654db2ac7bbcae3dfc4912339da9997 (20220726140355)

Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=f089ee647e811f3c3e4e6346e92001e93ea6bbf5&tochange=e3ea81c6d654db2ac7bbcae3dfc4912339da9997




Keywords: regression
Whiteboard: [bugmon:confirm] → [bugmon:bisected,confirmed]

    
    

    
  
The testcase doesn't seem to reproduce for me at all, neither with my own build nor with the fuzzing build.


Flags: needinfo?(lsalzman)

    
    

    
  
I've uploaded a pernosco session for this bug here.



    
    

    
  
Sotaro, any idea what might be going on here? This seems like it is related to our async present change in principle?


Flags: needinfo?(sotaro.ikeda.g)

    
    

    
  
I confirmed the crash locally. I am going to look into it.



    
    

    
  
With the test case, the problem happened like the following.


At first, ShareableCanvasRenderer::UpdateCompositableClient() created async image pipeline by EnsurePipeline(/* aIsAsync / true).

Second ShareableCanvasRenderer::UpdateCompositableClient()  was called in empty transaction. It triggered to re-create image pipeline as sync by EnsurePipeline(/ aIsAsync */ false). The WebRenderCanvasRendererAsync::EnsurePipeline() destroyed old async image pipeline and created a sync pipeline.


Empty transaction does not update display list. Then display list still referenced the destroyed async image pipeline.


It happened because, first  DrawTargetWebgl::GetFrontBuffer() returned SurfaceDescriptorRemoteTexture.

Second DrawTargetWebgl::GetFrontBuffer() returned Nothing().


DrawTargetWebgl::FlushFromSkia() returned false by DrawTargetWebgl::DrawRect() failure.



    
    

    
  
DrawTargetWebgl::SharedContext::SupportsPattern() was failed by surfacePattern's Surface was too big. The size was (300, 11102).



    
  
Assignee: nobody → sotaro.ikeda.g
Flags: needinfo?(sotaro.ikeda.g)

        Attachment #9288453 -
        Attachment description: Bug 1782044 - Force sync image pipeline → Bug 1782044 - Force sync image pipeline in WebRenderCanvasRendererAsync

    
    

    
  
Pushed by sikeda.birchill@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/d2ecdff379d2
Force sync image pipeline in WebRenderCanvasRendererAsync r=gfx-reviewers,lsalzman

    
    

    
  
https://hg.mozilla.org/mozilla-central/rev/d2ecdff379d2


Status: NEW → RESOLVED
Closed: 2 years ago

          status-firefox105:
          affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 105 Branch

    
    

    
  
Bugmon Analysis

Verified bug as fixed on rev mozilla-central 20220805092851-ee74de02b663.

Removing bugmon keyword as no further action possible.  Please review the bug and re-add the keyword for further analysis.


Status: RESOLVED → VERIFIED

          status-firefox105:
          fixed → verified
Keywords: bugmon

    
    

    
  
(In reply to Pulsebot from comment #12)




Pushed by sikeda.birchill@mozilla.com:

https://hg.mozilla.org/integration/autoland/rev/d2ecdff379d2

Force sync image pipeline in WebRenderCanvasRendererAsync

r=gfx-reviewers,lsalzman




== Change summary for alert #35044 (as of Mon, 08 Aug 2022 09:16:27 GMT) ==


Improvements:






Ratio
Test
Platform
Options
Absolute values (old vs new)






4%
google-docs ContentfulSpeedIndex
linux1804-64-shippable-qr
cold fission webrender
1,590.71 -> 1,529.92




2%
wikia ContentfulSpeedIndex
linux1804-64-shippable-qr
fission warm webrender
838.58 -> 818.00






For up to date results, see: https://treeherder.mozilla.org/perfherder/alerts?id=35044



          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: