1586077 - Maximum number of clients reachedAssertion failure: aWindow (We're running on Wayland and but without valid nsWindow.), at /builds/worker/workspace/build/src/widget/gtk/GtkCompositorWidget.cpp:32

Status: RESOLVED WONTFIX

(Core :: Widget: Gtk, defect, P3)

Description

[Jason Kratzer [:jkratzer]]

Attachment: testcase.html

Testcase found while fuzzing mozilla-central rev 4a20e73bd624.

Maximum number of clients reachedAssertion failure: aWindow (We're running on Wayland and but without valid nsWindow.), at /builds/worker/workspace/build/src/widget/gtk/GtkCompositorWidget.cpp:32

rax = 0x00005634b2811340   rdx = 0x0000000000000000
rcx = 0x00007f36d3fe98d5   rbx = 0x00007f3471fa8be0
rsi = 0x00007f36df8948b0   rdi = 0x00007f36df893680
rbp = 0x00007f36c85fe5c0   rsp = 0x00007f36c85fe510
r8 = 0x00007f36df8948b0    r9 = 0x00007f36c85ff700
r10 = 0x0000000000000002   r11 = 0x0000000000000000
r12 = 0x0000000000000000   r13 = 0x00007f36c85fe710
r14 = 0x00007f3471fa8c30   r15 = 0x00007f3476244178
rip = 0x00007f36d045ddf2
OS|Linux|0.0.0 Linux 5.0.0-29-generic #31~18.04.1-Ubuntu SMP Thu Sep 12 18:29:21 UTC 2019 x86_64
CPU|amd64|family 6 model 94 stepping 3|1
GPU|||
Crash|SIGSEGV|0x0|2
2|0|libxul.so|mozilla::widget::GtkCompositorWidget::GtkCompositorWidget(mozilla::widget::GtkCompositorWidgetInitData const&, mozilla::layers::CompositorOptions const&, nsWindow*)|hg:hg.mozilla.org/mozilla-central:widget/gtk/GtkCompositorWidget.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|31|0x2e
2|1|libxul.so|mozilla::widget::CompositorWidgetParent::CompositorWidgetParent(mozilla::widget::CompositorWidgetInitData const&, mozilla::layers::CompositorOptions const&)|hg:hg.mozilla.org/mozilla-central:widget/gtk/CompositorWidgetParent.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|17|0x12
2|2|libxul.so|mozilla::layers::CompositorBridgeParent::AllocPCompositorWidgetParent(mozilla::widget::CompositorWidgetInitData const&)|hg:hg.mozilla.org/mozilla-central:gfx/layers/ipc/CompositorBridgeParent.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|2023|0x8
2|3|libxul.so|mozilla::layers::PCompositorBridgeParent::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:de4328119b14946407de803ce7430f203ca4d7739ddd97bbdee95656cfd766e5f815b653a571d02582ec1cd1fb51d90e56a56b1db7f1bc27485f36859c4dcc93/ipc/ipdl/PCompositorBridgeParent.cpp:|906|0xf
2|4|libxul.so|mozilla::layers::PCompositorManagerParent::OnMessageReceived(IPC::Message const&)|s3:gecko-generated-sources:630605becc71a25c915aa051997f57351f447e061193dbf6654bcd953c1d6168fca9019fbcf03c11642c75cd0c1986d0b5c946976452e29a48cd6607e4de1bb4/ipc/ipdl/PCompositorManagerParent.cpp:|197|0x15
2|5|libxul.so|mozilla::ipc::MessageChannel::DispatchAsyncMessage(mozilla::ipc::ActorLifecycleProxy*, IPC::Message const&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|2185|0x6
2|6|libxul.so|mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|2109|0xb
2|7|libxul.so|mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&)|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|1954|0xb
2|8|libxul.so|mozilla::ipc::MessageChannel::MessageTask::Run()|hg:hg.mozilla.org/mozilla-central:ipc/glue/MessageChannel.cpp:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|1985|0xc
2|9|libxul.so|MessageLoop::RunTask(already_AddRefed<nsIRunnable>)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|442|0x45
2|10|libxul.so|MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask&&)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|450|0x17
2|11|libxul.so|MessageLoop::DoWork()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|523|0x5
2|12|libxul.so|base::MessagePumpDefault::Run(base::MessagePump::Delegate*)|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_pump_default.cc:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|35|0x9
2|13|libxul.so|MessageLoop::RunInternal()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|315|0x17
2|14|libxul.so|MessageLoop::Run()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/message_loop.cc:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|290|0x8
2|15|libxul.so|base::Thread::ThreadMain()|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/thread.cc:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|192|0x8
2|16|libxul.so|ThreadFunc|hg:hg.mozilla.org/mozilla-central:ipc/chromium/src/base/platform_thread_posix.cc:4a20e73bd6243d88d056cb41c0d6a0d4a2bd11e5|40|0x3
2|17|libpthread-2.27.so||||0x76db
2|18|libc-2.27.so||||0x12188f

Comment 1

[Jason Kratzer [:jkratzer]]

Testcase bisects to the following build range:

Start: 404680ad41e4e7d08aa46081a70095486f14e15f (20190709153742)
End: 823177295f4c17856f7dacad1e1f3d4204d377ba (20190710094052)
Pushlog: https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=404680ad41e4e7d08aa46081a70095486f14e15f&tochange=823177295f4c17856f7dacad1e1f3d4204d377ba

Comment 2

[Jessie [:jbonisteel] pls NI]

Connor, does this look related to your work?

Comment 3

[Connor Brewster [:cbrewster]]

Hi Jessie, this looks unrelated to my work.

Comment 4

[Martin Stránský [:stransky] (ni? me)]

It's a clear assertion crash, nothing wrong here.