Closed Bug 1588448 Opened 1 year ago Closed 1 year ago

Crash in [@ mozalloc_abort | abort | wl_array_copy | wl_proxy_marshal_array_constructor_versioned | wl_proxy_marshal_constructor | moz_container_get_wl_surface]

Categories

(Core :: Widget: Gtk, defect, P3)

Unspecified
Linux
defect

Tracking

()

RESOLVED FIXED
mozilla71
Tracking Status
firefox-esr60 --- unaffected
firefox-esr68 --- wontfix
firefox67 --- wontfix
firefox68 --- wontfix
firefox69 --- wontfix
firefox70 --- wontfix
firefox71 --- fixed

People

(Reporter: gsvelto, Assigned: stransky)

References

(Blocks 1 open bug)

Details

(Keywords: crash)

Crash Data

Attachments

(1 file)

This bug is for crash report bp-00dc5af0-af9f-4b1b-adfd-e04020191012.

Top 10 frames of crashing thread:

0 firefox-bin mozalloc_abort memory/mozalloc/mozalloc_abort.cpp:33
1 firefox-bin abort memory/mozalloc/mozalloc_abort.cpp:82
2 libwayland-client.so.0.3.0 wl_array_copy 
3 libwayland-client.so.0.3.0 wl_proxy_marshal_array_constructor_versioned 
4 libwayland-client.so.0.3.0 wl_proxy_marshal_constructor 
5 libxul.so moz_container_get_wl_surface widget/gtk/mozcontainer.cpp:587
6 libxul.so mozilla::widget::WindowSurfaceWayland::CommitWaylandBuffer widget/gtk/WindowSurfaceWayland.cpp:1011
7 libxul.so RunnableFunction<void  ipc/chromium/src/base/task.h:324
8 libxul.so MessageLoop::DoDelayedWork ipc/chromium/src/base/message_loop.cc:549
9 libxul.so base::MessagePumpDefault::Run ipc/chromium/src/base/message_pump_default.cc:39

Low-volume Wayland-specific crash, this seems to be happening across different Linux distros. The crash reason is a NULL-pointer dereference.

wl_subcompositor_get_subsurface() needs better error checking.

Assignee: nobody → stransky
Priority: -- → P3
Blocks: wayland
Duplicate of this bug: 1581480
Crash Signature: [@ mozalloc_abort | abort | wl_array_copy | wl_proxy_marshal_array_constructor_versioned | wl_proxy_marshal_constructor | moz_container_get_wl_surface] → [@ mozalloc_abort | abort | wl_array_copy | wl_proxy_marshal_array_constructor_versioned | wl_proxy_marshal_constructor | moz_container_get_wl_surface] [@ mozalloc_abort | abort | wl_array_copy]
Crash Signature: [@ mozalloc_abort | abort | wl_array_copy | wl_proxy_marshal_array_constructor_versioned | wl_proxy_marshal_constructor | moz_container_get_wl_surface] [@ mozalloc_abort | abort | wl_array_copy] → [@ mozalloc_abort | abort | wl_array_copy | wl_proxy_marshal_array_constructor_versioned | wl_proxy_marshal_constructor | moz_container_get_wl_surface] [@ mozalloc_abort | abort | wl_array_copy]
Keywords: checkin-needed

Pushed by dluca@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/af88ecdadcd4
[Wayland] Check mozcontainer wl_surface before we use it, r=jhorak

Keywords: checkin-needed
Status: NEW → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla71
Duplicate of this bug: 1543085
Crash Signature: [@ mozalloc_abort | abort | wl_array_copy | wl_proxy_marshal_array_constructor_versioned | wl_proxy_marshal_constructor | moz_container_get_wl_surface] [@ mozalloc_abort | abort | wl_array_copy] → [@ mozalloc_abort | abort | wl_array_copy | wl_proxy_marshal_array_constructor_versioned | wl_proxy_marshal_constructor | moz_container_get_wl_surface] [@ mozalloc_abort | abort | wl_array_copy] [@ wl_proxy_marshal_constructor]
You need to log in before you can comment on or make changes to this bug.