1757568 - SIGSEGV / SEGV_MAPERR in [@ moz_container_wayland_frame_callback_handler]

Status: RESOLVED FIXED

(Core :: Widget: Gtk, defect, P3)

Description

[q23456yuiop]

Maybe Fission related. (DOMFissionEnabled=1)

Crash report: https://crash-stats.mozilla.org/report/index/2b46ba87-3b33-4dae-9210-166e00220301

MOZ_CRASH Reason: MOZ_DIAGNOSTIC_ASSERT(wl_container->surface) (Should have surface if we're ready to draw)

Top 10 frames of crashing thread:

0 libxul.so moz_container_wayland_frame_callback_handler widget/gtk/MozContainerWayland.cpp:252
1 libxul.so RunnableFunction<void  ipc/chromium/src/base/task.h:324
2 libxul.so mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal xpcom/threads/TaskController.cpp:770
3 libxul.so NS_ProcessNextEvent xpcom/threads/nsThreadUtils.cpp:467
4 libxul.so mozilla::ipc::MessagePump::Run ipc/glue/MessagePump.cpp:85
5 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:306
6 libxul.so nsBaseAppShell::Run widget/nsBaseAppShell.cpp:137
7 libxul.so nsAppStartup::Run toolkit/components/startup/nsAppStartup.cpp:295
8 libxul.so XREMain::XRE_mainRun toolkit/xre/nsAppRunner.cpp:5731
9 libxul.so XREMain::XRE_main toolkit/xre/nsAppRunner.cpp:5916

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Widget: Gtk' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[q23456yuiop]

My environment is sway 1.7 with wlroots 0.15.1. Could this be somehow related?

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Martin, could you take a look at this? See also bug 1744800.

Comment 4

[Martin Stránský [:stransky] (ni? me)]

Do you know how that happens? If so, can you try to reproduce it with MOZ_LOG="Widget:5 WidgetPopup:5" env variable and attach the log here?
Thanks.

Comment 5

[q23456yuiop]

Attachment: fnightly.log

Comment 6

[q23456yuiop]

(In reply to Martin Stránský [:stransky] (ni? me) from comment #4)

Do you know how that happens? If so, can you try to reproduce it with MOZ_LOG="Widget:5 WidgetPopup:5" env variable and attach the log here?
Thanks.

I'm not sure how this happens but the log is attached.

Comment 7

[q23456yuiop]

Attachment: fnightly.log

See this instead as the old log wasn't one that ended with a crash.

Comment 8

[Martin Stránský [:stransky] (ni? me)]

Thanks, that explains it. Please run again with MOZ_LOG="Widget:5 WidgetPopup:5 WidgetWayland:5" and attach the log here when it crashes.
Thanks.

Comment 9

[q23456yuiop]

Attachment: fnightly_2.log

Comment 10

[Viktor Jägersküpper]

I had the same crash on KDE Wayland (5.24.3), so I guess this isn't specific to Sway. It happened when I closed a tab with a left-click on the X button, but I can't reproduce it. If anyone knows how to reproduce it, please post it here.

Comment 11

[Viktor Jägersküpper]

Version 100.0a1 for me, so adding this.

Comment 12

[:gerard-majax]

Just repro'd on Ubuntu 21.10 running GNOME3: https://crash-stats.mozilla.org/report/index/2f7aeb8d-b20a-4f7b-8367-617d10220314
Happened while I was switching tabs?

Comment 13

[:gerard-majax]

repro'd again, while I inadvertantly dragged a tab nowhere. I can't repro after restarting browser.

Martin, can we make that block wayland rather than wayland-sway? it's definitively NOT related to sway.

Comment 14

[Martin Stránský [:stransky] (ni? me)]

I think the sequence is:

1. moz_container_wayland_map_event -> moz_container_wayland_surface_create_locked() where wl_container->commit_to_parent is true
   so we call NS_DispatchToCurrentThread(moz_container_wayland_frame_callback_handler())

2. moz_container_wayland_unmap, wl_container->surface is set to null

3. moz_container_wayland_frame_callback_handler() is called from NS_DispatchToCurrentThread

Comment 15

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1757568 [Wayland] Don't crash when MozContainer is unmapped in moz_container_wayland_frame_callback_handler r?emilio

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/91156d5a1f00
[Wayland] Don't crash when MozContainer is unmapped in moz_container_wayland_frame_callback_handler r=emilio

Comment 17

[Emilio Cobos Álvarez [:emilio]]

ni? for the phab reply. No rush either way tho

Comment 18

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/91156d5a1f00

Comment 19

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1757568 [Wayland] Always clear wayland frame callback in moz_container_wayland_frame_callback_handler() r?emilio

Comment 20

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6889b3ebf318
[Wayland] Always clear wayland frame callback in moz_container_wayland_frame_callback_handler() r=emilio

Comment 21

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/6889b3ebf318