Closed Bug 1749103 Opened 3 years ago Closed 3 years ago

Crash in [@ wr_moz2d_render_cb]

Categories

(Core :: Graphics: WebRender, defect)

Firefox 97
Unspecified
Windows
defect

Tracking

()

VERIFIED FIXED
98 Branch
Tracking Status
firefox-esr91 --- unaffected
firefox95 --- unaffected
firefox96 --- unaffected
firefox97 --- fixed
firefox98 --- fixed

People

(Reporter: lsalzman, Assigned: lsalzman)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Attachments

(1 file)

This bug addresses a regression from bug 1742896 that was pointed out in bug 1721278 comment 9, which would have only started as of version 97. Despite sharing the signature, this bug is distinct from the older issue underlying bug 1721278.

It seems like the cleanup in bug 1742896 potentially causes of ScaledFont instantiations when canvas and content are both in play at the same time, which may not interact well with blob image lifetimes on the WR side, such that a blob image is still playing back on the parent process while the content process communicates that a ScaledFont got deleted due to thrashing between canvas and content.

This is essentially a partial revert of a cleanup done in bug 1742896. If canvas and content
are using the same underlying gfxDWriteFont and simultaneously retrieving a ScaledFont, this
may cause the ScaledFont to get repeatedly destroyed and re-instantiated every time we switch
from one context to the other. If this destruction happens at an inopportune time while WR
is still using a blob image with the font, it can potentially trigger undesirable assertions.

For now, duplicate the part of Bas' original patch from bug 1730722 that separatedly cached
the GDI and non-GDI versions of the ScaledFont. This way, both will exist for the lifetime
of the underlying gfxDWriteFont and thus avoid the thrashing.

Pushed by lsalzman@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/4015e633df4e Avoid thrashing gfxDWriteFont's ScaledFonts between canvas and content. r=jfkthame
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → 98 Branch

Kasper, can you test if this is fixed in the latest nightly now?

Flags: needinfo?(kasper93)

Yes, it's fixed. Thanks.

Flags: needinfo?(kasper93)
Status: RESOLVED → VERIFIED

Comment on attachment 9258170 [details]
Bug 1749103 - Avoid thrashing gfxDWriteFont's ScaledFonts between canvas and content. r?jfkthame

Beta/Release Uplift Approval Request

  • User impact if declined: Potential crashing on Windows on any content that uses Canvas 2D.
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): This is just a partial revert of the cleanup patch in bug 1742896 that landed in 97. Doesn't add functionality so much as just undo some changes that seemed to have broken things. Verified by reporter.
  • String changes made/needed:
Attachment #9258170 - Flags: approval-mozilla-beta?

Comment on attachment 9258170 [details]
Bug 1749103 - Avoid thrashing gfxDWriteFont's ScaledFonts between canvas and content. r?jfkthame

Approved for 97.0b5. Thanks.

Attachment #9258170 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Flags: qe-verify+
QA Whiteboard: [qa-triaged]

Hey Kasper,
I've looked around for information on how to reproduce and verify this, but couldn't find anything clear. Could you please help us with a verification on Firefox 97 beta 5 as well? You can find and download the build here.

Flags: needinfo?(kasper93)
Has Regression Range: --- → yes

(In reply to Ralu from comment #9)

Hey Kasper,
I've looked around for information on how to reproduce and verify this, but couldn't find anything clear. Could you please help us with a verification on Firefox 97 beta 5 as well? You can find and download the build here.

Yes, this build also works ok. As for reproduce it was crashing on https://opnsense.org/ dashboard, probably due to network graph that is drawn there.

Flags: needinfo?(kasper93)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: