1588448 - Crash in [@ mozalloc_abort | abort | wl_array_copy | wl_proxy_marshal_array_constructor_versioned | wl_proxy_marshal_constructor | moz_container_get_wl_surface]

Status: RESOLVED FIXED

(Core :: Widget: Gtk, defect, P3)

Description

[Gabriele Svelto [:gsvelto]]

This bug is for crash report bp-00dc5af0-af9f-4b1b-adfd-e04020191012.

Top 10 frames of crashing thread:

0 firefox-bin mozalloc_abort memory/mozalloc/mozalloc_abort.cpp:33
1 firefox-bin abort memory/mozalloc/mozalloc_abort.cpp:82
2 libwayland-client.so.0.3.0 wl_array_copy 
3 libwayland-client.so.0.3.0 wl_proxy_marshal_array_constructor_versioned 
4 libwayland-client.so.0.3.0 wl_proxy_marshal_constructor 
5 libxul.so moz_container_get_wl_surface widget/gtk/mozcontainer.cpp:587
6 libxul.so mozilla::widget::WindowSurfaceWayland::CommitWaylandBuffer widget/gtk/WindowSurfaceWayland.cpp:1011
7 libxul.so RunnableFunction<void  ipc/chromium/src/base/task.h:324
8 libxul.so MessageLoop::DoDelayedWork ipc/chromium/src/base/message_loop.cc:549
9 libxul.so base::MessagePumpDefault::Run ipc/chromium/src/base/message_pump_default.cc:39

Low-volume Wayland-specific crash, this seems to be happening across different Linux distros. The crash reason is a NULL-pointer dereference.

Comment 1

[Martin Stránský [:stransky] (ni? me)]

wl_subcompositor_get_subsurface() needs better error checking.

Comment 2

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1588448 - [Wayland] Check mozcontainer wl_surface before we use it, r=jhorak

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/af88ecdadcd4
[Wayland] Check mozcontainer wl_surface before we use it, r=jhorak

Comment 5

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/af88ecdadcd4