Closed
Bug 1451458
Opened 7 years ago
Closed 7 years ago
blob-invalidation: Crash on telemetry.mozilla.org
Categories
(Core :: Graphics: WebRender, defect, P1)
Tracking
()
RESOLVED
FIXED
mozilla61
| Tracking | Status | |
|---|---|---|
| firefox-esr52 | --- | unaffected |
| firefox59 | --- | unaffected |
| firefox60 | --- | unaffected |
| firefox61 | --- | disabled |
People
(Reporter: jan, Assigned: jrmuizel)
References
(Blocks 1 open bug, )
Details
(Keywords: crash, nightly-community)
Crash Data
Attachments
(3 files)
Nightly 61 x64 20180404100127 de_DE ff0efa4132f0efd78af0910762aec7dcc1a8de66 @ Debian Testing (KDE, Radeon RX480, 2560x1440)
main profile: gpu process, gfx.webrender.all, gfx.webrender.blob.invalidation, etc.
I hovered the diagram on https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2018-04-02&keys=__none__!__none__!__none__&max_channel_version=nightly%252F61&measure=MIXED_CONTENT_PAGE_LOAD&min_channel_version=null&processType=*&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2018-03-12&table=0&trim=1&use_submission_date=0.
Meldungs-ID Sendedatum
bp-9a0dad1b-06de-4489-a073-157180180404 04.04.18 21:30 [@ mozilla::layers::DIGroup::ComputeGeometryChange ]
> MOZ_RELEASE_ASSERT(imageRect.IsEqualEdges(aData->mImageRect))
bp-1fc24168-1292-4482-862a-d8fc80180404 04.04.18 21:29 bug 1450162
> Unexpectedly empty result. This blob should just have been deleted
bp-f6456140-1bb8-4f7b-9cc6-43c510180404 04.04.18 21:29 bug 1450162
> Unexpectedly empty result. This blob should just have been deleted
bp-1a2d1e3c-0580-4c7a-b376-6ced50180404 04.04.18 21:28 bug 1450162
> Unexpectedly empty result. This blob should just have been deleted
bp-2731a239-94bf-417b-a2a9-37b560180404 04.04.18 21:28 [@ mozilla::layers::DIGroup::ComputeGeometryChange ]
> MOZ_RELEASE_ASSERT(imageRect.IsEqualEdges(aData->mImageRect))
|
Reporter | |
Comment 1•7 years ago
|
||
Move your mouse randomly over the diagram.
Nightly 61 x64 20180405220026 de_DE 2f5ffe4fa2153a798ed8b310a597ea92abd1b868 @ Debian Testing (KDE, Radeon RX480, 2560x1440)
main profile: gpu process, gfx.webrender.all, gfx.webrender.blob.invalidation, etc.
bp-aadd0211-75f1-47a8-a986-397e10180406 06.04.18 03:18
bp-32c08891-c51e-4e84-a4c3-3f84e0180406 06.04.18 03:18
bp-39be603e-41cd-4ba1-aa68-57cd60180406 06.04.18 03:18
bp-c8030146-da0c-44b1-a370-4f5530180406 06.04.18 03:18
bp-b80cbf11-38c5-4247-a7f5-43a580180406 06.04.18 03:18
> Unexpectedly empty result. This blob should just have been deleted
-----
fresh profile: gfx.webrender.all, gfx.webrender.blob.invalidation
bp-b24738e3-cea9-4b34-aa94-7d8a10180406 06.04.18 03:33
> MOZ_CRASH Reason MOZ_RELEASE_ASSERT(mGroupOffset == aData->mGroupOffset)
Does not happen without blob-invalidation.
Blocks: 1388842
Crash Signature: [@ mozilla::layers::DIGroup::ComputeGeometryChange ] → [@ mozilla::layers::DIGroup::ComputeGeometryChange ]
[@ mozalloc_abort | abort | libxul.so@0x3d67ac8 | libxul.so@0x3d67ab8 | libxul.so@0x3d57610 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
[@ mozalloc_abort | abort | libxul.so@0x3d67498 | l…
status-firefox59:
--- → unaffected
status-firefox60:
--- → unaffected
status-firefox-esr52:
--- → unaffected
Summary: Crash in mozilla::layers::DIGroup::ComputeGeometryChange → blob-invalidation: Crash on telemetry.mozilla.org
|
|
Reporter | |
Updated•7 years ago
|
Crash Signature: libxul.so@0x3d67488 | libxul.so@0x3d56fe0 | webrender_bindings::moz2d_renderer::{{impl}}::update ] → libxul.so@0x3d67488 | libxul.so@0x3d56fe0 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
[@ mozalloc_abort | abort | libxul.so@0x3d6b258 | libxul.so@0x3d6b248 | libxul.so@0x3d5ada0 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
|
||
Updated•7 years ago
|
Blocks: stage-wr-nightly
Priority: -- → P1
|
|
Reporter | |
Comment 2•7 years ago
|
||
If I'm not wrong:
layout.display-list.retain;false:
* Only tab crashes of [@ mozilla::layers::DIGroup::ComputeGeometryChange ]
layout.display-list.retain;true:
* tab crashes of [@ mozilla::layers::DIGroup::ComputeGeometryChange ]
* browser crashes of [@ mozalloc_abort | abort | libxul.so@0x3d28d48 | libxul.so@0x3d28d38 | libxul.so@0x3d18890 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
Crash Signature: libxul.so@0x3d67488 | libxul.so@0x3d56fe0 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
[@ mozalloc_abort | abort | libxul.so@0x3d6b258 | libxul.so@0x3d6b248 | libxul.so@0x3d5ada0 | webrender_bindings::moz2d_renderer::{{impl}}::update ] → libxul.so@0x3d67488 | libxul.so@0x3d56fe0 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
[@ mozalloc_abort | abort | libxul.so@0x3d6b258 | libxul.so@0x3d6b248 | libxul.so@0x3d5ada0 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
[@ m…
|
Assignee | |
Comment 3•7 years ago
|
||
I'll take a look at this next week. Hopefully it's easy to fix.
Assignee: nobody → jmuizelaar
|
|
Reporter | |
Comment 4•7 years ago
|
||
Win10, Radeon RX480, fresh profile: gfx.webrender.all, gfx.webrender.blob.invalidation
bp-a9cf71cc-a32e-4d29-b66b-ee7690180409 09.04.2018 16:43 [@ mozilla::layers::DIGroup::ComputeGeometryChange ]
bp-a17ab0f1-0c63-41ef-81e3-815b60180409 09.04.2018 16:35 [@ static void std::panicking::rust_panic_with_hook ]
Crash Signature: mozalloc_abort | abort | libxul.so@0x3d28d48 | libxul.so@0x3d28d38 | libxul.so@0x3d18890 | webrender_bindings::moz2d_renderer::{{impl}}::update ] → mozalloc_abort | abort | libxul.so@0x3d28d48 | libxul.so@0x3d28d38 | libxul.so@0x3d18890 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
[@ mozalloc_abort | abort | libxul.so@0x3d4b7d8 | libxul.so@0x3d4b7c8 | libxul.so@0x3d3b320 | webrender_bin…
OS: Linux → All
| Comment hidden (mozreview-request) |
|
||
Comment 6•7 years ago
|
||
| mozreview-review | ||
Comment on attachment 8967089 [details]
Bug 1451458. Make sure we always clear items on size change.
https://reviewboard.mozilla.org/r/235744/#review241530
::: gfx/layers/wr/WebRenderCommandBuilder.cpp:933
(Diff revision 1)
> - GP("Inner group size change\n");
> + GP("Inner group size change\n");
> - aCommandBuilder->mManager->AddImageKeyForDiscard(groupData->mFollowingGroup.mKey.value());
> - groupData->mFollowingGroup.mKey = Nothing();
> - groupData->mFollowingGroup.ClearItems();
> + groupData->mFollowingGroup.ClearItems();
> -
> + if (groupData->mFollowingGroup.mKey) {
> IntSize size = currentGroup->mGroupBounds.Size().ScaleToNearestPixels(currentGroup->mScale.width, currentGroup->mScale.height, mAppUnitsPerDevPixel);
I think this size computation also needs to be fixed at some point to use RoundedOut.
Attachment #8967089 -
Flags: review?(mstange) → review+
Pushed by jmuizelaar@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/131a63a3ce79
Make sure we always clear items on size change. r=mstange
Pushed by jmuizelaar@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6f973e2cc44d
Make sure we always clear items on size change. r=mstange
|
|
Assignee | |
Comment 9•7 years ago
|
||
Oh. I guess I double landed... Hopefully that works out ok.
|
||
Comment 10•7 years ago
|
||
| bugherder | ||
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
|
|
||
Comment 11•7 years ago
|
||
| bugherder | ||
|
|
Reporter | |
Comment 12•7 years ago
|
||
mozregression --find-fix --bad 2018-04-11 --good 2018-04-12 --pref gfx.webrender.all:true gfx.webrender.blob.invalidation:true startup.homepage_welcome_url:'https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2018-04-02&keys=__none__!__none__!__none__&max_channel_version=nightly%252F61&measure=MIXED_CONTENT_PAGE_LOAD&min_channel_version=null&processType=*&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2018-03-12&table=0&trim=1&use_submission_date=0'
> 4:52.83 INFO: First good revision: 6f973e2cc44db9ff26a3c7754e4d54c2cfef7012
> 4:52.83 INFO: Last bad revision: c4e17dd680658e18f7f9260503676d74dc94e300
> 4:52.83 INFO: Pushlog:
> https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=c4e17dd680658e18f7f9260503676d74dc94e300&tochange=6f973e2cc44db9ff26a3c7754e4d54c2cfef7012
> 6f973e2cc44d Jeff Muizelaar — Bug 1451458. Make sure we always clear items on size change. r=mstange
Status: RESOLVED → VERIFIED
|
|
Reporter | |
Comment 13•7 years ago
|
||
Oh, no, now I managed to reproduce the browser crash. :-/
bp-a639aae7-f316-4627-93b4-a52990180412 [...] webrender_bindings::moz2d_renderer::{{impl}}::update
Even with the first good build from comment 12 (comment 8) after hovering, zooming and scrolling like hell:
mozregression --repo mozilla-inbound --launch 6f973e2cc44db9ff26a3c7754e4d54c2cfef7012 --pref gfx.webrender.all:true gfx.webrender.blob.invalidation:true startup.homepage_welcome_url:'https://telemetry.mozilla.org/new-pipeline/dist.html#!cumulative=0&end_date=2018-04-02&keys=__none__!__none__!__none__&max_channel_version=nightly%252F61&measure=MIXED_CONTENT_PAGE_LOAD&min_channel_version=null&processType=*&product=Firefox&sanitize=1&sort_keys=submissions&start_date=2018-03-12&table=0&trim=1&use_submission_date=0'
Status: VERIFIED → REOPENED
Crash Signature: _$LT$webrender_bindings..moz2d_renderer..Moz2dImageRenderer$u20$as$u20$webrender_api..image..BlobImageRenderer$GT$::update::h2aff647f... ]
[@ static void std::panicking::rust_panic_with_hook ] → _$LT$webrender_bindings..moz2d_renderer..Moz2dImageRenderer$u20$as$u20$webrender_api..image..BlobImageRenderer$GT$::update::h2aff647f... ]
[@ static void std::panicking::rust_panic_with_hook ]
[@ mozalloc_abort | abort | libxul.so@0x3d147d8 | libxul.so…
Resolution: FIXED → ---
|
|
Assignee | |
Comment 14•7 years ago
|
||
Ok, that's probably a different issue. It would be good to see if we can get some better STR.
|
|
Reporter | |
Comment 15•7 years ago
|
||
(In reply to Jeff Muizelaar [:jrmuizel] from comment #14)
> Ok, that's probably a different issue. It would be good to see if we can get some better STR.
fresh profile: gfx.webrender.all, gfx.webrender.blob.invalidation
1. Load the website.
2. Scroll up, if you can scroll up.
3. Hover the first bar.
4. Doubleclick on the second line of the label to mark the text.
5. Move your mouse away.
6. Move your mouse back over the bar and click on the second line of the label.
7. bp-21231740-9c14-4d6e-9e4d-ac55f0180413
|
|
Reporter | |
Updated•7 years ago
|
Crash Signature: libxul.so@0x3d147c8 | libxul.so@0x3d04320 | webrender_bindings::moz2d_renderer::{{impl}}::update ] → libxul.so@0x3d147c8 | libxul.so@0x3d04320 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
[@ mozalloc_abort | abort | libxul.so@0x3d28b88 | libxul.so@0x3d28b78 | libxul.so@0x3d186d0 | webrender_bindings::moz2d_renderer::{{impl}}::update ]
|
|
Assignee | |
Comment 16•7 years ago
|
||
I have a crash like this in rr. Let's see if it's debuggable.
|
|
Assignee | |
Comment 17•7 years ago
|
||
I have a rough idea what's going on here. I'm going to try to make a reduced test case.
|
|
Assignee | |
Comment 18•7 years ago
|
||
A crash test courtesy of mstange.
|
|
Reporter | |
Comment 19•7 years ago
|
||
> A crash test courtesy of mstange.
Thank you! :)
Crash Signature: _$LT$webrender_bindings..moz2d_renderer..Moz2dImageRenderer$u20$as$u20$webrender_api..image..BlobImageRenderer$GT$::update::h2aff647f... ]
[@ static void std::panicking::rust_panic_with_hook ]
[@ mozalloc_abort | abort | libxul.so@0x3d147d8 | libxul.so… → _$LT$webrender_bindings..moz2d_renderer..Moz2dImageRenderer$u20$as$u20$webrender_api..image..BlobImageRenderer$GT$::update::h2aff647f... ]
[@ mozalloc_abort | abort | panic_abort::__rust_start_panic::abort::h091e61b1e9ef8f82 | panic_abort::__rust_start_…
|
|
Reporter | |
Updated•7 years ago
|
|
|
Reporter | |
Comment 20•7 years ago
|
||
This crash signature is gone and bug 1454659 fixes the rest. Thanks!
Status: REOPENED → RESOLVED
Closed: 7 years ago → 7 years ago
Resolution: --- → FIXED
|
|
Reporter | |
Updated•7 years ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•