1797613 - Crash in [@ webrender::profiler::TransactionProfile::merge]

Status: NEW

(Core :: Graphics: WebRender, defect)

Description

[Taegeon Lee]

Crash report: https://crash-stats.mozilla.org/report/index/abbced8f-9b95-4ead-a076-9e7fd0221026

Reason: EXCEPTION_ACCESS_VIOLATION_READTop 10 frames of crashing thread:

0  xul.dll  webrender::profiler::TransactionProfile::merge  gfx/wr/webrender/src/profiler.rs:1668
0  xul.dll  webrender::renderer::Renderer::update  gfx/wr/webrender/src/renderer/mod.rs:977
1  xul.dll  webrender_bindings::bindings::wr_renderer_update  gfx/webrender_bindings/src/bindings.rs:607
1  xul.dll  mozilla::wr::RendererOGL::UpdateAndRender  gfx/webrender_bindings/RendererOGL.cpp:173
1  xul.dll  mozilla::wr::RenderThread::UpdateAndRender  gfx/webrender_bindings/RenderThread.cpp:565
2  xul.dll  mozilla::wr::RenderThread::HandleFrameOneDoc  gfx/webrender_bindings/RenderThread.cpp:411
3  xul.dll  mozilla::detail::RunnableMethodArguments<mozilla::wr::WrWindowId, bool>::applyImpl  xpcom/threads/nsThreadUtils.h:1147
3  xul.dll  mozilla::detail::RunnableMethodArguments<mozilla::wr::WrWindowId, bool>::apply  xpcom/threads/nsThreadUtils.h:1153
3  xul.dll  mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void   xpcom/threads/nsThreadUtils.h:1200
4  xul.dll  nsThread::ProcessNextEvent  xpcom/threads/nsThread.cpp:1198

Comment 1

[Jamie Nicol [:jnicol] (on leave until 21st October)]

Does this make any sense to you Nical? self.events and other.events should presumably always be both allocated and the same length?

Comment 2

[Nicolas Silva [:nical]]

Odd. For some of the crashes It doesn't even look like we hit a rust assertion which would have happened if we somehow missed to allocate one the events vectors with the proper size. Although for some crashes it is the assertion

There aren't many crashes in this signature, and it's a mix of AMD and intel CPUs https://crash-stats.mozilla.org/signature/?product=Firefox&signature=webrender%3A%3Aprofiler%3A%3ATransactionProfile%3A%3Amerge&date=%3E%3D2022-04-28T13%3A57%3A00.000Z&date=%3C2022-10-28T13%3A57%3A00.000Z&_columns=date&_columns=product&_columns=version&_columns=build_id&_columns=platform&_columns=reason&_columns=address&_columns=cpu_info&_columns=moz_crash_reason&_sort=-date&page=1

Another interesting oddity is that some of the crashes report weird lengths like 87 in firefox 101 for the events vectors which should always be allocated with size of the constant NUM_PROFILER_EVENTS. Which was already 100 a year ago and has only gotten larger since.