Open Bug 1645677 Opened 7 months ago Updated 20 days ago

[Wayland] Crash when opening toolbar panel

Categories

(Core :: Graphics, defect)

x86_64
Linux
defect

Tracking

()

Tracking Status
firefox79 --- disabled
firefox80 --- disabled
firefox81 --- disabled

People

(Reporter: jan, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: crash, nightly-community)

Crash Data

Gnome Wayland, Debian Testing
Main process crash. I clicked to open the panel of enhanced-h264ify. It doesn't seem to be reproducible.
gfx.webrender.max-partial-present-rects is 0 (default),
but I have manually set gfx.webrender.panic-on-gl-error to true.

This bug is for crash report bp-9d065196-d957-4144-9e88-9ee940200614.

Top 10 frames of crashing thread:

0 libEGL_mesa.so.0 dri2_wl_swap_buffers_with_damage ./build/../src/egl/drivers/dri2/platform_wayland.c:1107
1 libEGL_mesa.so.0 dri2_swap_buffers_with_damage ./build/../src/egl/drivers/dri2/egl_dri2.c:1956
2 libEGL_mesa.so.0 _eglSwapBuffersWithDamageCommon ./build/../src/egl/main/eglapi.c:1376
3 libxul.so mozilla::gl::GLContextEGL::SwapBuffers gfx/gl/GLContextProviderEGL.cpp:536
4 libxul.so mozilla::wr::RenderCompositorEGL::EndFrame gfx/webrender_bindings/RenderCompositorEGL.cpp:113
5 libxul.so mozilla::wr::RendererOGL::UpdateAndRender gfx/webrender_bindings/RendererOGL.cpp:176
6 libxul.so mozilla::wr::RenderThread::UpdateAndRender gfx/webrender_bindings/RenderThread.cpp:478
7 libxul.so mozilla::wr::RenderThread::HandleFrameOneDoc gfx/webrender_bindings/RenderThread.cpp:356
8 libxul.so mozilla::detail::RunnableMethodImpl<mozilla::wr::RenderThread*, void  xpcom/threads/nsThreadUtils.h:1237
9 libxul.so base::MessagePumpDefault::Run ipc/chromium/src/base/message_pump_default.cc:35
Blocks: wr-linux
Severity: -- → S3

I clicked to open the panel of enhanced-h264ify.

When clicking on it after startup (while restored app tabs are still loading) I can reproduce a fallback to OpenGL (no crash report):

(#0) Error window is null
(#1) Error Failed to create EGLSurface
(#2) Error We don't have EGLSurface to draw into. Called too early?
(#3) Error We don't have EGLSurface to draw into. Called too early?
(#4) Error Compositors might be mixed (5,2)

I assume it could have the same underlying problem as the autoscroll icon.

See Also: → 1638084
Duplicate of this bug: 1648700
Crash Signature: [@ dri2_wl_swap_buffers_with_damage] → [@ dri2_wl_swap_buffers_with_damage] [@ libEGL_mesa.so.0@0x28a81]
Depends on: 1650583
See Also: → 1655120
Crash Signature: [@ dri2_wl_swap_buffers_with_damage] [@ libEGL_mesa.so.0@0x28a81] → [@ dri2_wl_swap_buffers_with_damage] [@ libEGL_mesa.so.0@0x28a81] [@ wl_proxy_create_wrapper | libEGL_mesa.so.0@0x236b9 ]

Interesting! I wouldn't be surprised if this was related to bug 1650246 - i.e. maybe something about the first buffer swap is wrong for popups. Thanks for the hint with gfx.webrender.panic-on-gl-error, will try that.

See Also: 1655120
Duplicate of this bug: 1655120
Duplicate of this bug: 1656415
Summary: [Wayland] Crash in [@ dri2_wl_swap_buffers_with_damage] → [Wayland] Crash when opening toolbar panel
Crash Signature: [@ dri2_wl_swap_buffers_with_damage] [@ libEGL_mesa.so.0@0x28a81] [@ wl_proxy_create_wrapper | libEGL_mesa.so.0@0x236b9 ] → [@ dri2_wl_swap_buffers_with_damage] [@ libEGL_mesa.so.0@0x28a81] [@ wl_proxy_create_wrapper | libEGL_mesa.so.0@0x236b9 ] [@ <name omitted> | <name omitted> | dri2_allocate_textures]
Crash Signature: [@ dri2_wl_swap_buffers_with_damage] [@ libEGL_mesa.so.0@0x28a81] [@ wl_proxy_create_wrapper | libEGL_mesa.so.0@0x236b9 ] [@ <name omitted> | <name omitted> | dri2_allocate_textures] → [@ dri2_wl_swap_buffers_with_damage] [@ libEGL_mesa.so.0@0x28a81] [@ wl_proxy_create_wrapper | libEGL_mesa.so.0@0x236b9 ] [@ <name omitted> | <name omitted> | dri2_allocate_textures] [@ wl_proxy_create_wrapper | libEGL_mesa.so.0@0x255c8]
Duplicate of this bug: 1650531

(Matt Fagnani from bug 1656415 comment #3)

Firefox Nightly 81.0a1 (2020-8-5) on Wayland with Webrender enabled in Plasma 5.19.4 in Fedora Rawhide crashed when clicking to disable Tracking protection in the Tracking protection popup. A segmentation fault occurred in wl_proxy_create_wrapper at src/wayland-client.c:2237 in libwayland-client-1.18.0-2.fc33.x86_64 in the Renderer thread as in crash I originally reported here. The crash address was 0x0. A null pointer dereference might've happened. https://crash-stats.mozilla.org/report/index/23ad0563-e71b-4986-b183-cff7f0200805

The functions in frames 1 and 2 were similar to those in the original crash.
1 dri2_wl_create_window_surface in ../src/egl/drivers/dri2/platform_wayland.c:377 in mesa-libEGL-20.1.4-2.fc33.x86_64
2 _eglCreateWindowSurfaceCommon in ../src/egl/main/eglapi.c:971 in mesa-libEGL-20.1.4-2.fc33.x86_64

Crash Signature: [@ dri2_wl_swap_buffers_with_damage] [@ libEGL_mesa.so.0@0x28a81] [@ wl_proxy_create_wrapper | libEGL_mesa.so.0@0x236b9 ] [@ <name omitted> | <name omitted> | dri2_allocate_textures] [@ wl_proxy_create_wrapper | libEGL_mesa.so.0@0x255c8] → [@ dri2_wl_swap_buffers_with_damage] [@ libEGL_mesa.so.0@0x28a81] [@ wl_proxy_create_wrapper | libEGL_mesa.so.0@0x236b9 ] [@ <name omitted> | <name omitted> | dri2_allocate_textures] [@ wl_proxy_create_wrapper | libEGL_mesa.so.0@0x255c8] [@ <name omi…
Duplicate of this bug: 1657630
Crash Signature: omitted> | <name omitted> | <name omitted> | mozilla::gl::CreateSurfaceFromNativeWindow ] → omitted> | <name omitted> | <name omitted> | mozilla::gl::CreateSurfaceFromNativeWindow ] [@ wl_proxy_create_wrapper | dri2_wl_create_window_surface]
No longer depends on: 1650583

I saw a segmentation fault in dri2_wl_swap_buffers_with_damage at ../src/egl/drivers/dri2/platform_wayland.c:1111 in mesa-libEGL-20.2.0~rc4-1.fc33.x86_64 in Nightly 82.0a1 (2020-9-12) on Wayland with Webrender enabled in Plasma 5.19.5 in Fedora 33. I clicked on Bookmarks in the menu bar then Bookmark This Page when the crash happened. https://crash-stats.mozilla.org/report/index/f484f315-0319-42cb-89a1-7c4590200912

platform_wayland.c:1111 was dri2_surf->wl_win->attached_width = dri2_surf->base.Width;
The crash might've involved a race condition in which dri2_surf or dri2_surf->wl_win was occasionally freed or corrupted before it was used. The crashes in update_buffers in mesa-libEGL at https://bugzilla.mozilla.org/show_bug.cgi?id=1655120 involved dri2_surf or dri2_surf->wl_win being an invalid pointer and using the bookmarks menu or toolbar buttons. The crashes in wl_proxy_create_wrapper at https://bugzilla.mozilla.org/show_bug.cgi?id=1656415 happened when the Wayland proxy was an invalid pointer and using the bookmarks menu or toolbar buttons.

firefox 82.0.2 the bug persists and is very annoying

See Also: → 1681107, 1680961

The fallback to gl/basic appears to be fixed by bug 1681107 - (try: https://treeherder.mozilla.org/jobs?repo=try&revision=9f07ace949c2dfd903d1fa002d74e3016f42214a). Jan (or somebody else affected), can you confirm this?

As for the crash in dri2_wl_swap_buffers_with_damage, I think it can still happen under very unfortunate circumstances - and that we could avoid it by locking the wl_surface while swapping buffers, see bug 1680961

You need to log in before you can comment on or make changes to this bug.