1955346 - crash in get_relative_transform_with_face with WebRender snapshots.

Status: ASSIGNED

(Core :: Graphics: WebRender, task, P2)

Description

[Nicolas Silva [:nical]]

This happens on testing/web-platform/tests/css/css-view-transitions/empty-render-target-crash.html when applying the patches from bug 1955005, bug 1954803 and bug 1953823 with the various view-transition prefs turned on.

Backtrace:

#9  0x00007ffff094f542 in std::panicking::begin_panic<&str> () at library/std/src/panicking.rs:764
#10 0x00007fffecfe32c2 in webrender::spatial_tree::SpatialTree::get_relative_transform_with_face
    (self=0x7fff96147688, child_index=..., parent_index=..., visible_face=...)
    at gfx/wr/webrender/src/spatial_tree.rs:1038
#11 0x00007fffecfe31db in webrender::spatial_tree::SpatialTree::get_relative_transform
    (self=0x7fff96147688, child_index=..., parent_index=...) at gfx/wr/webrender/src/spatial_tree.rs:1014
#12 0x00007fffed41d7f0 in webrender::picture::PicturePrimitive::assign_surface
    (self=0x7fff9e1c3c08, frame_context=0x7fff95ceae78, parent_surface_index=..., tile_caches=0x7fff95cfab60, surfaces=0x7fff96147238) at gfx/wr/webrender/src/picture.rs:6814
#13 0x00007fffecfd6ed5 in webrender::picture_graph::PictureGraph::assign_surfaces
    (self=0x7fff961471d8, pictures=..., surfaces=0x7fff96147238, tile_caches=0x7fff95cfab60, frame_context=0x7fff95ceae78) at gfx/wr/webrender/src/picture_graph.rs:111
#14 0x00007fffed058d81 in webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers
    (self=0x7fff96147320, scene=0x7fff96147048, present=true, global_screen_world_rect=..., resource_cache=0x7fff95cfa0b0, gpu_cache=0x7fff95cfa938, rg_builder=0x7fff96147380, global_device_pixel_scale=..., scene_properties=0x7fff96147400, transform_palette=0x7fff95cec1d0, data_stores=0x7fff961474f0, scratch=0x7fff961476d8, debug_flags=..., composite_state=0x7fff95cec270, tile_caches=0x7fff95cfab60, spatial_tree=0x7fff96147688, cmd_buffers=0x7fff95cec418, frame_gpu_data=0x7fff95cec430, frame_memory=0x7fff95cec1b0, profile=0x7fff96147a48)
    at gfx/wr/webrender/src/frame_builder.rs:331
#15 0x00007fffed05b9d1 in webrender::frame_builder::FrameBuilder::build
    (self=0x7fff96147320, scene=0x7fff96147048, present=true, resource_cache=0x7fff95cfa0b0, gpu_cache=0x7fff95cfa938, rg_builder=0x7fff96147380, stamp=..., device_origin=..., scene_properties=0x7fff96147400, data_stores=0x7fff961474f0, scratch=0x7fff961476d8, debug_flags=..., tile_caches=0x7fff95cfab60, spatial_tree=0x7fff96147688, dirty_rects_are_valid=true, profile=0x7fff96147a48, minimap_data=..., frame_memory=...) at gfx/wr/webrender/src/frame_builder.rs:697
#16 0x00007fffed427a9a in webrender::render_backend::Document::build_frame
    (self=0x7fff96147048, resource_cache=0x7fff95cfa0b0, gpu_cache=0x7fff95cfa938, debug_flags=..., tile_caches=0x7fff95cfab60, frame_stats=..., present=true, render_reasons=..., frame_memory=...)
    at gfx/wr/webrender/src/render_backend.rs:531
#17 0x00007fffed42c36b in webrender::render_backend::RenderBackend::update_document

Comment 1

[Nicolas Silva [:nical]]

Attachment: The serialized WR display list (.ron format)

Comment 2

[Nicolas Silva [:nical]]

We are running into a WR display list that has this unusual arrangement:

                          +------> [SpatialNode 2] (root)
                          |               |
                          |        [SpatialNode 3] (Scroll frame)
                          |               |
Parent SC           -------------> [SpatialNode 4] (Complex transform)
|                         |
+--> Child SC (snapshot)--+

A child stacking context is attached to a spatial node that is closer to the root (it looks like it actually is the root) than its parent. WR does not like that. I wonder if this is by accident or intentional.

Comment 3

[Nicolas Silva [:nical]]

Attachment: Spatial tree dump

```

```