1852741 - Crash at mozilla::wr::RendererOGL::UpdateAndRender() for WebGL scenes (Raw external data is not expected for deferred resolves!)

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Martin Stránský [:stransky] (ni? me)]

Firefox crashes in WebRender while WebGL scene is rendered on Linux.

It crashes in rust in:

panic!("Raw external data is not expected for deferred resolves!");

partial backtrace:

#15 0x00007f912b97d3fc in webrender::renderer::Renderer::update_deferred_resolves (self=0x7f90fb14e000, deferred_resolves=...) at gfx/wr/webrender/src/renderer/mod.rs:4291
#16 webrender::renderer::Renderer::prepare_gpu_cache (self=0x7f90fb14e000, deferred_resolves=...) at gfx/wr/webrender/src/renderer/gpu_cache.rs:494
#17 0x00007f912b98162c in webrender::renderer::Renderer::render_impl (self=0x7f90fb14e000, doc_id=..., active_doc=0x7f91110bacd0, device_size=..., buffer_age=2)
    at gfx/wr/webrender/src/renderer/mod.rs:1512
#18 0x00007f912b9808c9 in webrender::renderer::Renderer::render (self=0x7f90fb14e000, device_size=..., buffer_age=2) at gfx/wr/webrender/src/renderer/mod.rs:1240
#19 0x00007f912b7ca2f1 in webrender_bindings::bindings::wr_renderer_render (renderer=0x10c3, width=285975348, height=1, buffer_age=0, out_stats=0x7f91110bb7e0, out_dirty_rects=0x0)
    at gfx/webrender_bindings/src/bindings.rs:619
#20 0x00007f91268b004b in mozilla::wr::RendererOGL::UpdateAndRender(mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, bool*, mozilla::wr::RendererStats*)
    (this=0x7f90fc6c2b20, aReadbackSize=..., aReadbackFormat=..., aReadbackBuffer=..., aNeedsYFlip=0x0, aOutStats=aOutStats@entry=0x7f91110bb7e0)
    at /raid/src/gfx/webrender_bindings/RendererOGL.cpp:190
#21 0x00007f91268af620 in mozilla::wr::RenderThread::UpdateAndRender(mozilla::wr::WrWindowId, mozilla::layers::BaseTransactionId<mozilla::VsyncIdType> const&, mozilla::TimeStamp const&, bool, mozilla::Maybe<mozilla::gfx::IntSizeTyped<mozilla::gfx::UnknownUnits> > const&, mozilla::Maybe<mozilla::wr::ImageFormat> const&, mozilla::Maybe<mozilla::Range<unsigned char> > const&, bool*) (this=this@entry=0x7f910fe13c30, aWindowId=aWindowId@entry=..., aStartId=..., aStartTime=..., aRender=true, aReadbackSize=..., aReadbackFormat=..., aReadbackBuffer=..., aNeedsYFlip=0x0)
    at /raid/src/gfx/webrender_bindings/RenderThread.cpp:781
#22 0x00007f91268aeddf in mozilla::wr::RenderThread::HandleFrameOneDocInner(mozilla::wr::WrWindowId, bool, bool, mozilla::Maybe<mozilla::wr::FramePublishId>)
    (this=this@entry=0x7f910fe13c30, aWindowId=aWindowId@entry=..., aRender=true, aTrackedFrame=<optimized out>, aPublishId=...) at /raid/src/gfx/webrender_bindings/RenderThread.cpp:624
#23 0x00007f91268ae3f2 in mozilla::wr::RenderThread::HandleFrameOneDoc(mozilla::wr::WrWindowId, bool, bool, mozilla::Maybe<mozilla::wr::FramePublishId>)
    (this=0x7f910fe13c30, aWindowId=..., aRender=false, aTrackedFrame=true, aPublishId=...) at /raid/src/gfx/webrender_bindings/RenderThread.cpp:573
#24 mozilla::wr::RenderThread::WrNotifierEvent_HandleNewFrameReady(mozilla::wr::WrWindowId, bool, mozilla::wr::FramePublishId)
    (this=0x7f910fe13c30, aWindowId=..., aCompositeNeeded=false, aPublishId=...) at /raid/src/gfx/webrender_bindings/RenderThread.cpp:534

Reproduction steps:

1. Go to https://webglsamples.org
2. open all samples, each in new tab
3. Pres CTRL+PgDown which cycles between tabs
4. see Firefox freeze and crash

Comment 1

[Teodor Tanasoaia [:teoxoy]]

I can't reproduce this on Windows with Firefox stable 117. Is it only reproducible on Linux?

It seems we are violating an internal invariant (possibly due to cycling through pages faster than updating data?).
Can someone familiar with this code chime in?

Comment 2

[Jeff Muizelaar [:jrmuizel]]

Martin, is the a regression? Can you try to find a regression window?

Comment 3

[Glenn Watson [:gw]]

This is probably quite machine / environment dependent, can we get about:support too?

Comment 4

[Ashley Hale [:ahale]]

I made a brief attempt to repro this but failed, on nvidia proprietary driver 535 on Ubuntu 23.04 with Wayland, not sure if the data point is useful but thought I'd mention it.

Comment 5

[Sotaro Ikeda [:sotaro]]

The problem might be related to Bug 1851432.

Comment 6

[Martin Stránský [:stransky] (ni? me)]

Yes, I'll test that on Intel (I'm on AMD now) and try to find regression range although I think regression but may be the one where accelerated canvas was enabled.

Comment 7

[Martin Stránský [:stransky] (ni? me)]

But this is just a side effect of Bug 1850696 - the reproducer is there. If we're out of free file descriptors we fail to create next dmabuf surface. I'll create a patch with better error handling.

Comment 8

[Martin Stránský [:stransky] (ni? me)]

Core cause looks fixed by Bug 1851377 but we should better react to dmabuf import.

Comment 9

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1852741 [Linux] Delete DMABUFTextureHostOGL if dmabuf surface import fails r?sotaro

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0909e599f530
[Linux] Delete DMABUFTextureHostOGL if dmabuf surface import fails r=sotaro

Comment 11

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/0909e599f530