Closed Bug 1666119 Opened 4 years ago Closed 4 years ago

sw-wr: Crash in [@ Composite]

Categories

(Core :: Graphics: WebRender, defect, P2)

x86
Windows 10
defect

Tracking

()

RESOLVED FIXED
83 Branch
Tracking Status
firefox-esr78 --- unaffected
firefox81 --- unaffected
firefox82 --- disabled
firefox83 --- fixed

People

(Reporter: cpeterson, Assigned: mattwoodrow)

References

(Blocks 1 open bug)

Details

(Keywords: crash)

Crash Data

Attachments

(2 files)

I'm dogfooding gfx.webrender.software with a Win32 Firefox build (on Win64 OS). I don't see the tab crash reporter, but I get periodic info bars popping up for "unsent crash reports". This suggests that background tabs are crashing (2-4 at a time).

I see multiple crash signatures that point to SW-WR code:

bp-c7b431d4-a640-4b46-82a5-875e90200920 [@ Composite]
bp-1c5ed48e-aa0f-44c3-b061-2fc960200920 [@ core::ops::function::Fn::call<T> | trunc]
bp-b9eb5222-663a-42ee-93db-e8bbf0200920 [@ memcpy | scale_blit]

Top 10 frames of crashing thread:

0 xul.dll Composite gfx/wr/swgl/src/composite.h:426
1 xul.dll webrender_bindings::swgl_bindings::SwCompositeThread::process_job gfx/webrender_bindings/src/swgl_bindings.rs:652
2 xul.dll std::sys_common::backtrace::__rust_begin_short_backtrace<closure-0,  ../4fb7144ed159f94491249e86d5bbd033b5d60550/src/libstd/sys_common/backtrace.rs:130
3 xul.dll core::ops::function::FnOnce::call_once<closure-0,  ../4fb7144ed159f94491249e86d5bbd033b5d60550/src/libcore/ops/function.rs:232
4 xul.dll alloc::boxed::{{impl}}::call_once< ../4fb7144ed159f94491249e86d5bbd033b5d60550/src/liballoc/boxed.rs:1017
5 xul.dll std::sys::windows::thread::{{impl}}::new::thread_start ../4fb7144ed159f94491249e86d5bbd033b5d60550//src/libstd/sys/windows/thread.rs:51
6 kernel32.dll BaseThreadInitThunk 
7 mozglue.dll patched_BaseThreadInitThunk mozglue/dllservices/WindowsDllBlocklist.cpp:592
8 ntdll.dll _RtlUserThreadStart 
9 ntdll.dll _RtlUserThreadStart 
Severity: -- → S3
Priority: -- → P3

I see this on Windows, it's the GPU process that's crashing, and then you get switched to Basic Layers (and no GPU process) after it's crashed 4 times.

Assignee: nobody → matt.woodrow
Pushed by mwoodrow@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/0ee0283c751a Clip the last band to the dest bounds. r=lsalzman
Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → 83 Branch

I'm still seeing this on a build that should have this fix.

Status: RESOLVED → REOPENED
Flags: needinfo?(matt.woodrow)
Resolution: FIXED → ---
Target Milestone: 83 Branch → ---
Blocks: sw-wr
No longer blocks: sw-wr-correctness
Severity: S3 → S1
Priority: P3 → P2

This is crashing on try pushes as well.

Pushed by mwoodrow@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/b9294db776bf Clip the last band to the dest bounds at remaining callsites. r=jrmuizel
Status: REOPENED → RESOLVED
Closed: 4 years ago4 years ago
Resolution: --- → FIXED
Target Milestone: --- → 83 Branch
Crash Signature: [@ Composite] [@ memcpy | scale_blit] [@ core::ops::function::Fn::call<T> | trunc] → [@ Composite] [@ memcpy | scale_blit] [@ core::ops::function::Fn::call<T> | trunc] [@ __memmove_avx_unaligned_erms | Composite]
Crash Signature: [@ Composite] [@ memcpy | scale_blit] [@ core::ops::function::Fn::call<T> | trunc] [@ __memmove_avx_unaligned_erms | Composite] → [@ Composite] [@ memcpy | scale_blit] [@ core::ops::function::Fn::call<T> | trunc] [@ __memmove_avx_unaligned_erms | Composite]
Flags: needinfo?(matt.woodrow)

Matt, I hit this sw-wr crash twice today with Nightly build 20201009041754, but this bug was resolved fixed on 2020-10-02. Might your fix have missed some corner case? Or perhaps this be a new regression?

[@ memcpy | scale_blit ] bp-7ad4fc66-e899-411f-9fd3-d47a60201009
[@ core::ops::function::Fn::call<T> | trunc ] bp-136c1fdc-f55c-470d-ac46-8b9b30201009

Flags: needinfo?(matt.woodrow)

The second of those seems unrelated (it's a crash elsewhere in WR), but the first looks like another variation of this bug.

Any idea what the STR might be to reproduce that?

Flags: needinfo?(matt.woodrow) → needinfo?(cpeterson)

(In reply to Matt Woodrow (:mattwoodrow) from comment #15)

The second of those seems unrelated (it's a crash elsewhere in WR), but the first looks like another variation of this bug.

OK. I'll remove the second signature from this bug. There is an existing bug 1606580 (filed ten months ago) with the second signature, but it looks unrelated because [@ RustMozCrash] is a very generic signature. I might file a new bug for this particular crash.

Any idea what the STR might be to reproduce that?

I don't know. I don't see content crash reporter for these crashes, so I don't know what I was doing when they happened. They're found by the unsubmitted crash report scan when I restart Nightly each morning. That suggests they're background tab or shutdown crashes.

If this crash happens again, I'll file a new bug (instead of reopening this one).

Crash Signature: [@ Composite] [@ memcpy | scale_blit] [@ core::ops::function::Fn::call<T> | trunc] [@ __memmove_avx_unaligned_erms | Composite] → [@ Composite] [@ memcpy | scale_blit] [@ __memmove_avx_unaligned_erms | Composite]
Flags: needinfo?(cpeterson)
Regressions: 1670793
No longer regressions: 1670793
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: