1972259 - Crash in [@ webrender::resource_cache::ResourceCache::render_as_image] when detaching a tab with an active view transition.

Status: VERIFIED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Mayank Bansal]

Attachment: VT - crash on detaching tab.html

Crash report: https://crash-stats.mozilla.org/report/index/29437238-b87f-4a85-a1d0-c70830250616

MOZ_CRASH Reason:

called `Option::unwrap()` on a `None` value

Top 10 frames:

0  xul.dll  MOZ_Crash(char const*, int, char const*)  mfbt/Assertions.h:381
0  xul.dll  RustMozCrash(char const*, int, char const*)  mozglue/static/rust/wrappers.cpp:18
1  xul.dll  mozglue_static::panic_hook(std::panic::PanicHookInfo*)  mozglue/static/rust/lib.rs:99
2  xul.dll  core::ops::function::Fn::call<void (*)(ref$<std::panic::PanicHookInfo>), tupl...  /rustc/05f9846f893b09a1be1fc8560e33fc3c815cfecb/library/core/src/ops/function.rs:250
3  xul.dll  alloc::boxed::impl$30::call()  library/alloc/src/boxed.rs:1990
3  xul.dll  std::panicking::rust_panic_with_hook()  library/std/src/panicking.rs:839
4  xul.dll  std::panicking::begin_panic_handler::closure$0()  library/std/src/panicking.rs:697
5  xul.dll  std::sys::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_h...  library/std/src/sys/backtrace.rs:168
6  xul.dll  std::panicking::begin_panic_handler()  library/std/src/panicking.rs:695
7  xul.dll  core::panicking::panic_fmt()  library/core/src/panicking.rs:75

STR:
Open google.com in a tab and the testcase in another tab
Let the testcase run for 10-15 seconds
Now repeatedly and rapidly detach-and-reattach the tab with testcase

AR: Crash
ER: Not so

Disclaimer: testcase generated by chatgpt, but STR are mine.

Comment 1

[Mayank Bansal]

Attachment: about:support

Comment 2

[Mayank Bansal]

Bisection:
Bug 1953823 - When the root is snapshotted, snapshot the root contents but not top layer(s). r=view-transitions-reviewers,boris

For fallback snapshots, for now just snapshot the canvas frame.

Differential Revision: https://phabricator.services.mozilla.com/D242016

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1953823

:emilio, since you are the author of the regressor, bug 1953823, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Yeah, that patch just causes the snapshotting machinery to be used in that test-case. I can reproduce this. It's this unwrap here...

We're probably not dealing super well with the tab detach + attach scenario. I think we should just skip the view transition in that case just like viewport resizing does.

Simpler STR:

• Open https://wpt.live/css/css-view-transitions/content-with-clip.html
• Detach the tab.

Nical, ni?ing you in case you think it's worth making WR not crash in this situation. Without having dug into this, this is most likely because we're referencing images registered on the old window, so we should be able to prevent this from happening at the Gecko level.

Comment 5

[Emilio Cobos Álvarez (:emilio)]

See above, sorry :)

Comment 6

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1972259 - Skip view transition on page swap. r=nical

This fixes the crash, but it causes the commented out assertion to fire,
probably because the delete op is queued already with the wrong
pipeline, which I think means the snapshots leak.

Do you know what the right fix for that is? How does canvas/blobs deal
with it?

Comment 7

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1972259 - Don't remove margin between back / next buttons on Windows-style wizards. r=#theme

The only similar example in 1 has buttons uniformly spaced.

Comment 8

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1972259 - Simplify a bit wizard button layout. r=dao,Gijs

extra1/extra2 support is unused (we only have one wizard, and
comm-central doesn't use this feature either).

Comment 9

[Phabricator Automation]

Comment on attachment 9494875 [details]
Bug 1972259 - Don't remove margin between back / next buttons on Windows-style wizards. r=#theme

Revision D253798 was moved to bug 1971945. Setting attachment 9494875 [details] to obsolete.

Comment 10

[Phabricator Automation]

Comment on attachment 9494879 [details]
Bug 1972259 - Simplify a bit wizard button layout. r=dao,Gijs

Revision D253802 was moved to bug 1971945. Setting attachment 9494879 [details] to obsolete.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/34394572736c
https://hg.mozilla.org/integration/autoland/rev/d0a241d0c9b6
Skip view transition on page swap. r=nical

Comment 12

[Donal Meehan [:dmeehan]]

Looks like this is not needed in Fx140 release, its only with the assertion

Comment 13

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/d0a241d0c9b6

Comment 14

[Ciprian Georgiu, Desktop QA]

I was able to reproduce this crash using an affected Nightly build (2025-06-16) on Windows 11.

The issue is verified as fixed on the latest Beta 141.0b3 under Windows 11. Note that the dom.viewTransitions.enabled pref needs to be set to true, as it is not enabled by default.