Hit MOZ_CRASH(assertion failed: child_index.0 >= parent_index.0) at gfx/wr/webrender/src/clip_scroll_tree.rs:260

#0 MOZ_Crash(char const*, int, char const*) src/obj-firefox/dist/include/mozilla/Assertions.h:332:3
#1 GeckoCrash src/toolkit/xre/nsAppRunner.cpp:5117:3
#2 gkrust_shared::panic_hook::h0562f7ec1f278e4c src/toolkit/library/rust/shared/lib.rs:249:8
#3 core::ops::function::Fn::call::h1bb63f18391eb075 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libcore/ops/function.rs:69:4
#4 std::panicking::rust_panic_with_hook::hffcefc09751839d1 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:481:16
#5 std::panicking::begin_panic::hc027073d19e121e1 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:411:4
#6 webrender::clip_scroll_tree::ClipScrollTree::get_relative_transform::h365328660ac3d220 src/gfx/wr/webrender/src/clip_scroll_tree.rs:260:8
#7 webrender::prim_store::SpaceMapper$LT$F$C$T$GT$::set_target_spatial_node::he19263d496e3348b src/gfx/wr/webrender/src/prim_store/mod.rs:275:28
#8 webrender::picture::PicturePrimitive::post_update::h62e597df6683983b src/gfx/wr/webrender/src/picture.rs:3679:12
#9 webrender::picture::PictureUpdateState::update::h45e9224c18953e60 (.llvm.12247027141564607933) src/gfx/wr/webrender/src/picture.rs:1909
#10 webrender::picture::PictureUpdateState::update::h45e9224c18953e60 (.llvm.12247027141564607933) src/gfx/wr/webrender/src/picture.rs:1897:24
#11 webrender::picture::PictureUpdateState::update::h45e9224c18953e60 (.llvm.12247027141564607933) src/gfx/wr/webrender/src/picture.rs:1897:24
#12 webrender::picture::PictureUpdateState::update_all::h7770e5973f1a6254 src/gfx/wr/webrender/src/picture.rs:1814:8
#13 webrender::frame_builder::FrameBuilder::build_layer_screen_rects_and_cull_layers::h4c117dc4463682c0 src/gfx/wr/webrender/src/frame_builder.rs:308:8
#14 webrender::frame_builder::FrameBuilder::build::hccbce9125db1fcbc src/gfx/wr/webrender/src/frame_builder.rs:484
#15 webrender::render_backend::Document::build_frame::h3d9138a4596afb9a src/gfx/wr/webrender/src/render_backend.rs:543:24
#16 webrender::render_backend::RenderBackend::update_document::h65eff78ea5d0bcc5 src/gfx/wr/webrender/src/render_backend.rs:1512:40
#17 webrender::render_backend::RenderBackend::prepare_transactions::ha02ad43f4a34154c src/gfx/wr/webrender/src/render_backend.rs:1339:16
#18 webrender::render_backend::RenderBackend::process_api_msg::h23f6f9ad81c9d2b4 src/gfx/wr/webrender/src/render_backend.rs:1231
#19 webrender::render_backend::RenderBackend::run::h678028524998e500 src/gfx/wr/webrender/src/render_backend.rs:967:20
#20 webrender::renderer::Renderer::new::_$u7b$$u7b$closure$u7d$$u7d$::h02c9145756008079 src/gfx/wr/webrender/src/renderer.rs:2292:12
#21 std::sys_common::backtrace::__rust_begin_short_backtrace::h40c9345aa390eb65 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/sys_common/backtrace.rs:77
#22 std::thread::Builder::spawn_unchecked::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::h68155fc775cdb8bb /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/thread/mod.rs:470:16
#23 _$LT$std..panic..AssertUnwindSafe$LT$F$GT$$u20$as$u20$core..ops..function..FnOnce$LT$$LP$$RP$$GT$$GT$::call_once::h4a2968d700f22916 /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panic.rs:315
#24 std::panicking::try::do_call::h9ed26225266ec5eb (.llvm.12247027141564607933) /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libstd/panicking.rs:296
#25 __rust_maybe_catch_panic /rustc/eae3437dfe991621e8afdc82734f4a172d7ddf9b/src/libpanic_abort/lib.rs:29:4

The priority flag is not set for this bug.
:jbonisteel, could you have a look please?

For more information, please visit auto_nag documentation.

bp-e511d2ed-ad53-4f3d-96bc-ce0250191104

The priority flag is not set for this bug.
:jbonisteel, could you have a look please?

For more information, please visit auto_nag documentation.

This signature seems to be happening pretty consistently in 73 nightly.

Change the status for beta to have the same as nightly and release.
For more information, please visit auto_nag documentation.

The crash signature changed because of bug 1611948.

Tracking for 74 because the volume of crashes is significant for the nightly channel and we will want to make sure it doesn't explode in beta.

Jessie, could this bug be investigated given the current spike on Nightly? Thanks

Glenn, can you take a peak?

The attached test case doesn't crash for me - does it crash for anyone else?

Do we have any reliable repro URLs available in the crash stats for this?

The test case repros consistently for me with wr enabled on a debug build.

A Pernosco session is available here: https://pernos.co/debug/Fay67Vvbb1lh2N79JM5plA/index.html

Oh, my mistake.

I had incorrectly assumed that release mode rust asserts would be present in a normal build, but it seems they are only present in a full debug build.

That's somewhat concerning by itself, but I can repro locally in a debug build so should be able to fix this now, thanks for the test case!

On the last good frame before the crash, the glyph cluster maps to the following surface:

map cluster Rect(11.799988×15.75 at (639.2,0.0)) to SpatialNodeIndex(7) [SpatialNodeIndex(6)]

On the frame when the crash occurs, a new reference frame is introduced (ID 8 in the spatial tree debug log below) and the cluster is mapped to that surface:

map cluster Rect(11.799988×15.75 at (639.2,0.0)) to SpatialNodeIndex(7) [SpatialNodeIndex(8)]

However, spatial node 7 is not a child of spatial node 8, so we can't find a relative transform. This is expressing an invalid state - it's not clear yet whether the display list itself is invalid, or perhaps the scene building pass is incorrectly assigning primitives to invalid surface frames.

Spatial tree when crash occurs (the final reference frame only appears on the last frame):

┌ spatial tree
│  ├─ ReferenceFrame
│  │  ├─ kind: Transform
│  │  ├─ transform_style: Flat
│  │  ├─ source_transform: Value([I])
│  │  ├─ origin_in_parent_reference_frame: (0.0,0.0)
│  │  ├─ index: SpatialNodeIndex(0)
│  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  ├─ snapping_transform: Some(ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) })
│  │  ├─ coordinate_system_id: CoordinateSystemId(0)
│  │  ├─ ScrollFrame
│  │  │  ├─ viewport: Rect(675.0×506.0 at (0.0,0.0))
│  │  │  ├─ scrollable_size: 0.0×0.0
│  │  │  ├─ scroll offset: (0.0,0.0)
│  │  │  ├─ external_scroll_offset: (0.0,0.0)
│  │  │  ├─ kind: PipelineRoot
│  │  │  ├─ index: SpatialNodeIndex(1)
│  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  ├─ snapping_transform: Some(ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) })
│  │  │  ├─ coordinate_system_id: CoordinateSystemId(0)
│  │  │  ├─ ScrollFrame
│  │  │  │  ├─ viewport: Rect(305.0×43.0 at (205.5,58.0))
│  │  │  │  ├─ scrollable_size: 86.0×0.0
│  │  │  │  ├─ scroll offset: (0.0,0.0)
│  │  │  │  ├─ external_scroll_offset: (0.0,0.0)
│  │  │  │  ├─ kind: Explicit
│  │  │  │  ├─ index: SpatialNodeIndex(2)
│  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  ├─ snapping_transform: Some(ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) })
│  │  │  │  └─ coordinate_system_id: CoordinateSystemId(0)
│  │  │  ├─ ReferenceFrame
│  │  │  │  ├─ kind: Transform
│  │  │  │  ├─ transform_style: Flat
│  │  │  │  ├─ source_transform: Value([I])
│  │  │  │  ├─ origin_in_parent_reference_frame: (0.0,111.0)
│  │  │  │  ├─ index: SpatialNodeIndex(3)
│  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) }
│  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) }
│  │  │  │  ├─ snapping_transform: Some(ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) })
│  │  │  │  ├─ coordinate_system_id: CoordinateSystemId(0)
│  │  │  │  ├─ ScrollFrame
│  │  │  │  │  ├─ viewport: Rect(675.0×396.0 at (0.0,0.0))
│  │  │  │  │  ├─ scrollable_size: 0.0×0.0
│  │  │  │  │  ├─ scroll offset: (0.0,0.0)
│  │  │  │  │  ├─ external_scroll_offset: (0.0,0.0)
│  │  │  │  │  ├─ kind: PipelineRoot
│  │  │  │  │  ├─ index: SpatialNodeIndex(4)
│  │  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) }
│  │  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) }
│  │  │  │  │  ├─ snapping_transform: Some(ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) })
│  │  │  │  │  ├─ coordinate_system_id: CoordinateSystemId(0)
│  │  │  │  │  ├─ ScrollFrame
│  │  │  │  │  │  ├─ viewport: Rect(675.0×396.0 at (0.0,0.0))
│  │  │  │  │  │  ├─ scrollable_size: 0.0×0.0
│  │  │  │  │  │  ├─ scroll offset: (0.0,0.0)
│  │  │  │  │  │  ├─ external_scroll_offset: (0.0,0.0)
│  │  │  │  │  │  ├─ kind: Explicit
│  │  │  │  │  │  ├─ index: SpatialNodeIndex(5)
│  │  │  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) }
│  │  │  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) }
│  │  │  │  │  │  ├─ snapping_transform: Some(ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) })
│  │  │  │  │  │  ├─ coordinate_system_id: CoordinateSystemId(0)
│  │  │  │  │  │  ├─ ReferenceFrame
│  │  │  │  │  │  │  ├─ kind: Transform
│  │  │  │  │  │  │  ├─ transform_style: Flat
│  │  │  │  │  │  │  ├─ source_transform: Value([-0.15923242, -0.9872412, -0.0, -0.0, 0.9872412, -0.15923242, 0.0, 0.0, 0.0, 0.0, 1.0, 0.0, 55.99823, 369.88443, 0.0, 1.0])
│  │  │  │  │  │  │  ├─ origin_in_parent_reference_frame: (12.0,12.0)
│  │  │  │  │  │  │  ├─ index: SpatialNodeIndex(6)
│  │  │  │  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  │  │  │  ├─ snapping_transform: None
│  │  │  │  │  │  │  ├─ coordinate_system_id: CoordinateSystemId(1)
│  │  │  │  │  │  │  ├─ ScrollFrame
│  │  │  │  │  │  │  │  ├─ viewport: Rect(651.0×6.75 at (0.0,0.0))
│  │  │  │  │  │  │  │  ├─ scrollable_size: 0.0×9.0
│  │  │  │  │  │  │  │  ├─ scroll offset: (0.0,0.0)
│  │  │  │  │  │  │  │  ├─ external_scroll_offset: (0.0,0.0)
│  │  │  │  │  │  │  │  ├─ kind: Explicit
│  │  │  │  │  │  │  │  ├─ index: SpatialNodeIndex(7)
│  │  │  │  │  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  │  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  │  │  │  │  ├─ snapping_transform: None
│  │  │  │  │  │  │  │  └─ coordinate_system_id: CoordinateSystemId(1)
│  │  │  │  │  │  ├─ ReferenceFrame
│  │  │  │  │  │  │  ├─ kind: Transform
│  │  │  │  │  │  │  ├─ transform_style: Flat
│  │  │  │  │  │  │  ├─ source_transform: Value([-0.15923242, -0.9872412, -0.0, -0.0, 0.9872412, -0.15923242, 0.0, 0.0, 0.0, 0.0, 1.0, 0.0, 55.99823, 369.88443, 0.0, 1.0])
│  │  │  │  │  │  │  ├─ origin_in_parent_reference_frame: (12.0,12.0)
│  │  │  │  │  │  │  ├─ index: SpatialNodeIndex(8)
│  │  │  │  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  │  │  │  ├─ snapping_transform: None
│  │  │  │  │  │  │  └─ coordinate_system_id: CoordinateSystemId(2)

I think that this is a bug in the Gecko display list creation / conversion to WR. Posting my findings here so someone who knows more about this stuff can investigate further.

Below is a a debug dump of the WR spatial tree at the time of the crash occurring [1]. A new reference frame (index 8) has been introduced. The relevant part of the tree structure is:

ScrollFrame (index 5)
  ReferenceFrame (index 6)
    ScrollFrame (index 7)
  ReferenceFrame (index 8)

A partial dump of the display list processed during scene building before the crashing frame:

-- SceneBuilder::build --
push_stacking_context SpatialNodeIndex(0) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
  push_stacking_context SpatialNodeIndex(1) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
    push_stacking_context SpatialNodeIndex(1) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
        add_text SpatialNodeIndex(1)
    pop_stacking_context
    push_stacking_context SpatialNodeIndex(1) CompositeOps { filters: [Opacity(Value(0.4), 0.4)], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
    pop_stacking_context
    push_stacking_context SpatialNodeIndex(1) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
        add_text SpatialNodeIndex(2)
    pop_stacking_context
    push_stacking_context SpatialNodeIndex(4) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
      push_stacking_context SpatialNodeIndex(6) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
        push_stacking_context SpatialNodeIndex(6) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
            add_text SpatialNodeIndex(7)
        pop_stacking_context
      pop_stacking_context
    pop_stacking_context
    push_stacking_context SpatialNodeIndex(1) CompositeOps { filters: [Opacity(Value(0.4), 0.4)], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
    pop_stacking_context
    push_stacking_context SpatialNodeIndex(1) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
        add_text SpatialNodeIndex(1)
    pop_stacking_context
  pop_stacking_context
pop_stacking_context
map cluster Rect(11.799988×15.75 at (639.2,0.0)) to SpatialNodeIndex(7) [SpatialNodeIndex(6)]

The same partial dump of the display list processed during scene building on the crashing frame:

-- SceneBuilder::build --
push_stacking_context SpatialNodeIndex(0) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
  push_stacking_context SpatialNodeIndex(1) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
    push_stacking_context SpatialNodeIndex(1) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
        add_text SpatialNodeIndex(1)
    pop_stacking_context
    push_stacking_context SpatialNodeIndex(1) CompositeOps { filters: [Opacity(Value(0.4), 0.4)], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
    pop_stacking_context
    push_stacking_context SpatialNodeIndex(1) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
        add_text SpatialNodeIndex(2)
    pop_stacking_context
    push_stacking_context SpatialNodeIndex(4) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
      push_stacking_context SpatialNodeIndex(4) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
        push_stacking_context SpatialNodeIndex(6) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
        pop_stacking_context
        push_stacking_context SpatialNodeIndex(5) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: Some(ColorBurn) }
            add_text SpatialNodeIndex(5)
        pop_stacking_context
      pop_stacking_context
      push_stacking_context SpatialNodeIndex(8) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
        push_stacking_context SpatialNodeIndex(8) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
            add_text SpatialNodeIndex(7)
        pop_stacking_context
      pop_stacking_context
    pop_stacking_context
    push_stacking_context SpatialNodeIndex(1) CompositeOps { filters: [Opacity(Value(0.4), 0.4)], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
    pop_stacking_context
    push_stacking_context SpatialNodeIndex(1) CompositeOps { filters: [], filter_datas: [], filter_primitives: [], mix_blend_mode: None }
        add_text SpatialNodeIndex(1)
    pop_stacking_context
  pop_stacking_context
pop_stacking_context
map cluster Rect(11.799988×15.75 at (639.2,0.0)) to SpatialNodeIndex(7) [SpatialNodeIndex(8)]

In the second display list dump, notice that:
(1) There is an extra text run added (5 text runs vs. 4).
(2) The second last text run is positioned by spatial node 7, but is part of parent stacking context positioned by spatial node 8.

I'm unsure whether (1) is a bug or expected. However, (2) seems wrong to me - I think any element that is a child of a stacking context should be positioned by a spatial node that is a child of the stacking context positioning node.

[1]

┌ spatial tree
│  ├─ ReferenceFrame
│  │  ├─ kind: Transform
│  │  ├─ transform_style: Flat
│  │  ├─ source_transform: Value([I])
│  │  ├─ origin_in_parent_reference_frame: (0.0,0.0)
│  │  ├─ index: SpatialNodeIndex(0)
│  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  ├─ snapping_transform: Some(ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) })
│  │  ├─ coordinate_system_id: CoordinateSystemId(0)
│  │  ├─ ScrollFrame
│  │  │  ├─ viewport: Rect(675.0×528.0 at (0.0,0.0))
│  │  │  ├─ scrollable_size: 0.0×0.0
│  │  │  ├─ scroll offset: (0.0,0.0)
│  │  │  ├─ external_scroll_offset: (0.0,0.0)
│  │  │  ├─ kind: PipelineRoot
│  │  │  ├─ index: SpatialNodeIndex(1)
│  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  ├─ snapping_transform: Some(ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) })
│  │  │  ├─ coordinate_system_id: CoordinateSystemId(0)
│  │  │  ├─ ScrollFrame
│  │  │  │  ├─ viewport: Rect(305.0×43.0 at (205.5,58.0))
│  │  │  │  ├─ scrollable_size: 86.0×0.0
│  │  │  │  ├─ scroll offset: (0.0,0.0)
│  │  │  │  ├─ external_scroll_offset: (0.0,0.0)
│  │  │  │  ├─ kind: Explicit
│  │  │  │  ├─ index: SpatialNodeIndex(2)
│  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  ├─ snapping_transform: Some(ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) })
│  │  │  │  └─ coordinate_system_id: CoordinateSystemId(0)
│  │  │  ├─ ReferenceFrame
│  │  │  │  ├─ kind: Transform
│  │  │  │  ├─ transform_style: Flat
│  │  │  │  ├─ source_transform: Value([I])
│  │  │  │  ├─ origin_in_parent_reference_frame: (0.0,111.0)
│  │  │  │  ├─ index: SpatialNodeIndex(3)
│  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) }
│  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) }
│  │  │  │  ├─ snapping_transform: Some(ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) })
│  │  │  │  ├─ coordinate_system_id: CoordinateSystemId(0)
│  │  │  │  ├─ ScrollFrame
│  │  │  │  │  ├─ viewport: Rect(675.0×418.0 at (0.0,0.0))
│  │  │  │  │  ├─ scrollable_size: 0.0×0.0
│  │  │  │  │  ├─ scroll offset: (0.0,0.0)
│  │  │  │  │  ├─ external_scroll_offset: (0.0,0.0)
│  │  │  │  │  ├─ kind: PipelineRoot
│  │  │  │  │  ├─ index: SpatialNodeIndex(4)
│  │  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) }
│  │  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) }
│  │  │  │  │  ├─ snapping_transform: Some(ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) })
│  │  │  │  │  ├─ coordinate_system_id: CoordinateSystemId(0)
│  │  │  │  │  ├─ ScrollFrame
│  │  │  │  │  │  ├─ viewport: Rect(675.0×418.0 at (0.0,0.0))
│  │  │  │  │  │  ├─ scrollable_size: 0.0×0.0
│  │  │  │  │  │  ├─ scroll offset: (0.0,0.0)
│  │  │  │  │  │  ├─ external_scroll_offset: (0.0,0.0)
│  │  │  │  │  │  ├─ kind: Explicit
│  │  │  │  │  │  ├─ index: SpatialNodeIndex(5)
│  │  │  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) }
│  │  │  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) }
│  │  │  │  │  │  ├─ snapping_transform: Some(ScaleOffset { scale: (1.0,1.0), offset: (0.0,111.0) })
│  │  │  │  │  │  ├─ coordinate_system_id: CoordinateSystemId(0)
│  │  │  │  │  │  ├─ ReferenceFrame
│  │  │  │  │  │  │  ├─ kind: Transform
│  │  │  │  │  │  │  ├─ transform_style: Flat
│  │  │  │  │  │  │  ├─ source_transform: Value([-0.15923242, -0.9872412, -0.0, -0.0, 0.9872412, -0.15923242, 0.0, 0.0, 0.0, 0.0, 1.0, 0.0, 55.99823, 369.88443, 0.0, 1.0])
│  │  │  │  │  │  │  ├─ origin_in_parent_reference_frame: (12.0,12.0)
│  │  │  │  │  │  │  ├─ index: SpatialNodeIndex(6)
│  │  │  │  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  │  │  │  ├─ snapping_transform: None
│  │  │  │  │  │  │  ├─ coordinate_system_id: CoordinateSystemId(1)
│  │  │  │  │  │  │  ├─ ScrollFrame
│  │  │  │  │  │  │  │  ├─ viewport: Rect(651.0×6.75 at (0.0,0.0))
│  │  │  │  │  │  │  │  ├─ scrollable_size: 0.0×9.0
│  │  │  │  │  │  │  │  ├─ scroll offset: (0.0,0.0)
│  │  │  │  │  │  │  │  ├─ external_scroll_offset: (0.0,0.0)
│  │  │  │  │  │  │  │  ├─ kind: Explicit
│  │  │  │  │  │  │  │  ├─ index: SpatialNodeIndex(7)
│  │  │  │  │  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  │  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  │  │  │  │  ├─ snapping_transform: None
│  │  │  │  │  │  │  │  └─ coordinate_system_id: CoordinateSystemId(1)
│  │  │  │  │  │  ├─ ReferenceFrame
│  │  │  │  │  │  │  ├─ kind: Transform
│  │  │  │  │  │  │  ├─ transform_style: Flat
│  │  │  │  │  │  │  ├─ source_transform: Value([-0.15923242, -0.9872412, -0.0, -0.0, 0.9872412, -0.15923242, 0.0, 0.0, 0.0, 0.0, 1.0, 0.0, 55.99823, 369.88443, 0.0, 1.0])
│  │  │  │  │  │  │  ├─ origin_in_parent_reference_frame: (12.0,12.0)
│  │  │  │  │  │  │  ├─ index: SpatialNodeIndex(8)
│  │  │  │  │  │  │  ├─ content_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  │  │  │  ├─ viewport_transform: ScaleOffset { scale: (1.0,1.0), offset: (0.0,0.0) }
│  │  │  │  │  │  │  ├─ snapping_transform: None
│  │  │  │  │  │  │  └─ coordinate_system_id: CoordinateSystemId(2)

Jeff, Jessie, any ideas on who might know the Gecko / WR conversion code well enough to investigate further from https://bugzilla.mozilla.org/show_bug.cgi?id=1589800#c14 ?

Maybe Alexis?

Changing the priority to p1 as the bug is tracked by a release manager for the current beta.
See What Do You Triage for more information

Is it possible to get any known URLs for those crash reports? There is an attached test case, but it's quite a complex edge case, and it may be easier to resolve what's happening if we have some other repro steps.

(In reply to Glenn Watson [:gw] from comment #18)

Is it possible to get any known URLs for those crash reports? There is an attached test case, but it's quite a complex edge case, and it may be easier to resolve what's happening if we have some other repro steps.

Yes, I sent you a list by email.

miko briefly peeked at this and saw that this test case crashes debug builds of firefox even without webrender, so this is definitely a corruption up in gecko that WR only notices later:

With non-WR, it triggers an assertion:

[Child 167660, Main Thread] ###!!! ASSERTION: Bounds computation mismatch: 'mContainerBounds.IsEqualInterior(mAccumulatedChildBounds)',
file /home/miko/Code/mozilla-unified/layout/painting/FrameLayerBuilder.cpp, line 5953

Usually these have been cases where something is clipped incorrectly

reaffirming my grip on reality (and how rust asserts work in firefox), the test does in fact cause reliable crashes for me on nightly on windows today

It looks like retained display lists are causing the issue. If I disable layout.display-list.retain the bug goes away. If I enable layout.display-list.retain.verify, the bug goes away. Stopping here for the evening.

notes:

text gets pushed with invalid spatial id (4, but only 0,1,2,5 exist)
spatial id set by SpaceAndClipChainHelper
spatial id acquired by ClipManager::SwitchItem
wr::DisplayListBuilder->mScrollIds contains this mapping 
    from the text item's ASR's mViewId (3) to the invalid spatial id (4)
    mScrollIds is append only, so it isn't too surprising to find "dead" spaces in there
    but presumably we shouldn't ever use ASRs with that id once out of scope?
the only thing else in the parent WrapList are a bunch of HitTestInfos
    1 with a good ASR, and then 3 others with the bad ASR (and then the text)

seems like a bug in RetainedDisplayListMerging..?

I'm not confident in my ability to debug and fix retained display lists before beta, perhaps Miko should be put back on this? Like I'm willing to try, just being honest that I don't think I can meet the ~2 week deadline for this.

If no one can figure this out, we do also have the nuclear option to disable RDL, but it's likely that would cause worse bugs, due to lack of test coverage of that configuration.

Miko or Timothy, can either of you take a look at what Alexis has discovered and see if you can figure out what is going on?

I'll take a look.

The high volume of crashes remains restricted to nightly so we don't need to track it for 74.

https://hg.mozilla.org/mozilla-central/rev/5002852a9b56