2011700 - Crash in [@ webrender::render_task::render_task_sanity_check]

Status: RESOLVED FIXED

(Core :: Graphics: WebRender, defect)

Description

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

[Tracking Requested - why for this release]:

Since this landed on Jan 14, there have been ~1300 crashes from ~100 installs of Firefox 149.0a1

Crash report: https://crash-stats.mozilla.org/report/index/5bfb6534-c456-4c67-b43c-bd7cd0260121

MOZ_CRASH Reason:

explicit panic

Top 10 frames:

0  XUL  MOZ_CrashSequence(void*, long)  mfbt/Assertions.h:242
0  XUL  MOZ_Crash(char const*, int, char const*)  mfbt/Assertions.h:375
0  XUL  RustMozCrash  mozglue/static/rust/wrappers.cpp:18
1  XUL  mozglue_static::panic_hook  mozglue/static/rust/lib.rs:99
2  XUL  core::ops::function::Fn::call  /builds/worker/fetches/rustc/lib/rustlib/src/rust/library/core/src/ops/function.rs:80
3  XUL  <alloc::boxed::Box<F, A> as core::ops::function::Fn<Args>>::call  library/alloc/src/boxed.rs:1985
3  XUL  std::panicking::rust_panic_with_hook  library/std/src/panicking.rs:841
4  XUL  std::panicking::begin_panic::{{closure}}  library/std/src/panicking.rs:770
5  XUL  std::sys::backtrace::__rust_end_short_backtrace  library/std/src/sys/backtrace.rs:174
6  XUL  std::panicking::begin_panic  library/std/src/panicking.rs:769

Comment 1

[Timothy Nikkel (:tnikkel)]

Bug 2008381 hits a similar panic in this function.

Comment 2

[BugBot [:suhaib / :marco]]

The bug is linked to a topcrash signature, which matches the following criteria:

• Top 10 desktop browser crashes on nightly
• Top 10 AArch64 and ARM crashes on nightly

For more information, please visit BugBot documentation.

Comment 3

[BugBot [:suhaib / :marco]]

The bug is marked as tracked for firefox149 (nightly). However, the bug still isn't assigned.

:bhood, could you please find an assignee for this tracked bug? Given that it is a regression and we know the cause, we could also simply backout the regressor. If you disagree with the tracking decision, please talk with the release managers.

For more information, please visit BugBot documentation.

Comment 4

[Nicolas Silva [:nical]]

There is no way for bug 2009395 to have caused this regression.

It appears that we are failing to properly clip an indirect tile of a segmented quad primitive against the render target's bounds.

Comment 5

[Timothy Nikkel (:tnikkel)]

From crash stats there is basically zero volume until 20260114211245, and then there are hundreds a day. Pushlog for that is

https://hg-edge.mozilla.org/mozilla-central/pushloghtml?fromchange=39b21669cfe3cada4af31d53458e530dcd059d28&tochange=a6d1d264718a6cd72d47f19866492eb0a2456de0

Comment 6

[Pascal Chevrel (relman team) -> :pascalc|PTO until Sept 2]

Webrender patches that went into build 20260114211245

• Bug 2009392 - The size of a quad render task doesn't always match the size of the quad - https://bugzil.la/2009392
• Bug 2010036 - Avoid compiling default composite shader if not required - https://bugzil.la/2010036
• Bug 2009395 - Give GpuBuffer addresses more bits to work with - https://bugzil.la/2009395

There is also this linting fix:

• Bug 2009330 - Add missing header guards in gfx/ headers - https://bugzil.la/2009330

Comment 7

[Timothy Nikkel (:tnikkel)]

Is it possible that bug 2009392 caused this? The only one that seems possibly related.

Comment 8

[Nicolas Silva [:nical]]

I tried to run the test case from bug 2011815 but I can't reproduce the crash.

Is it possible that bug 2009392 caused this? The only one that seems possibly related.

The only difference I can find is that the code that was inlined from get_surface_rect does not have an empty rect check because I thought that it would be redundant with another check that happens a few lines below. Going though the code again I don't see how it could lead to this crash, but it's simple enough to restore the check and see if the crash volume changes.

Comment 9

[Nicolas Silva [:nical]]

Attachment: Bug 2011700 - Restore an empty rect check in prepare_quad. r=#gfx-reviewers

Comment 10

[Nicolas Silva [:nical]]

Marking leave-open to keep an eye on this after landing as we don't know for sure that the patch will fix anything.

Comment 11

[Jake Archibald [:jakea]]

Attachment: Demo & steps

I can reproduce this on Firefox Android, starting on https://bengalspice.app4food.co.uk/.

Video demo with steps attached.

Comment 12

[David Lawrence [:dkl]]

The content of attachment 9540052 [details] has been deleted for the following reason:

Deleted at request of author

Comment 13

[Jake Archibald [:jakea]]

Attachment: Demo

I can reproduce this on Firefox Android, starting on https://bengalspice.app4food.co.uk/.

Video demo with steps attached.

Comment 14

[Andrew McCreight [:mccr8]]

Why was this hidden? Is it a security issue? Can we remove the moco confidential and security groups now that the attachment has been deleted?

Comment 15

[Jake Archibald [:jakea]]

The flags can be removed. I don't have the ability to remove the security one.

Comment 16

[Timothy Nikkel (:tnikkel)]

I'm able to reproduce pretty consistently with https://www.kaufland.cz/product/500757760/

https://hg-edge.mozilla.org/integration/autoland/pushloghtml?fromchange=887c704514f5a8b741780cef570e0e27c6353aa7&tochange=be54f74c729c3ae004fec93a3738e75b33d85c0d

I think it might be the accept cookies dialog that causes it, so if it doesn't reproduce try a fresh profile so you get that dialog again.

Comment 17

[Timothy Nikkel (:tnikkel)]

Verified by local backout it was bug 2009392.

Comment 18

[Timothy Nikkel (:tnikkel)]

The patch attached to this bug does not fix the issue for me.

Comment 19

[Timothy Nikkel (:tnikkel)]

These also seem to reproduce consistently
https://filiale.kaufland.de/
https://cariere.kaufland.ro/

Comment 20

[Nicolas Silva [:nical]]

Attachment: Bug 2011700 - Fix missing clip prepare_quad_impl. r=#gfx-reviewers

The regressing patch had missed applying the surface's clipping rect in the case where the surface is in raster space.

Comment 21

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/4b8501e80ba3
https://hg.mozilla.org/integration/autoland/rev/7b83cf4f0f25
Fix missing clip prepare_quad_impl. r=gfx-reviewers,jnicol

Comment 22

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/773911cb863b
https://hg.mozilla.org/integration/autoland/rev/b41eb98a45de
Revert "Bug 2011700 - Fix missing clip prepare_quad_impl. r=gfx-reviewers,jnicol" for causing wrench bustages

Comment 23

[amarc]

Backed out for causing wrench bustages

• Backout link
• Push with failures
• Failure Log

Comment 24

[Chris Peterson [:cpeterson]]

I can reproduce on Windows by clicking the "Login" button on https://macstadium.com/

Comment 25

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/f82b6cac6363
https://hg.mozilla.org/integration/autoland/rev/3c2b8f4035fe
Fix missing clip prepare_quad_impl. r=gfx-reviewers,jnicol

Comment 26

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/3c2b8f4035fe

Comment 27

[Jim Mathies [:jimm]]

https://crash-stats.mozilla.org/report/index/82dc85f2-17c1-4564-a684-393950260226

Just experienced this on a redash dashboard I clicked 'edit' on.

Comment 28

[Dianna Smith [:diannaS]]

:nical should we reopen this? or file a new bug?

Comment 29

[Nicolas Silva [:nical]]

:nical should we reopen this? or file a new bug?

The stack is similar but we are hitting the opposite problem (a render task is too large instead of being zero-sized). I filed bug 2019940.

Edit: actually I confused this bug with bug 2017031 so they may be more similar than I let on, but let's still do this in another bug.