Closed Bug 1655120 Opened 1 year ago Closed 1 year ago

Crash in [@ <name omitted> | <name omitted> | dri2_allocate_textures]


(Core :: Widget: Gtk, defect)

80 Branch



Tracking Status
firefox80 --- disabled
firefox81 --- affected
firefox82 --- affected


(Reporter: matt.fagnani, Unassigned)


(Blocks 1 open bug)


Crash Data

This bug is for crash report bp-65db34b7-b36d-447b-9749-52f580200724.

Top 10 frames of crashing thread:

0 <name omitted> ../src/egl/drivers/dri2/platform_wayland.c:675
1 <name omitted> ../src/egl/drivers/dri2/platform_wayland.c:810
2 dri2_allocate_textures ../src/gallium/state_trackers/dri/dri2.c:415
3 dri_st_framebuffer_validate ../src/gallium/state_trackers/dri/dri_drawable.c:82
4 <name omitted> ../src/mesa/state_tracker/st_manager.c:223
5 <name omitted> ../src/mesa/state_tracker/st_manager.c:1064
6 dri_make_current ../src/gallium/state_trackers/dri/dri_context.c:303
7 <name omitted> ../src/mesa/drivers/dri/common/dri_util.c:581
8 dri2_make_current ../src/egl/drivers/dri2/egl_dri2.c:1811
9 eglMakeCurrent ../src/egl/main/eglapi.c:882

I was using Firefox 80.0a1 (2020-7-23) on Wayland with Webrender enabled in Fedora Rawhide/33 in Plasma 5.19.3. I clicked on the green arrow icon indicating an update was available in the top right. Firefox crashed before the popup would've been shown. A segmentation fault occurred in ../src/egl/drivers/dri2/platform_wayland.c:675 in mesa-libEGL-20.1.3-1.fc33.x86_64 in update_buffers(struct dri2_egl_surface *dri2_surf) in the Renderer thread. The line 675 where the segmentation fault occurred was 
if (dri2_surf->base.Width != dri2_surf->wl_win->width ||
       dri2_surf->base.Height != dri2_surf->wl_win->height) {

The crash address was 0x8. dri2_surf might've been an invalid pointer. The radeonsi mesa driver and the amdgpu kernel driver were in use. I've seen occasional crashes which haven't had crash reports saved, such as when clicking on Bookmarks and Help in the menu bar. The crashes might be related to a problem when rendering popup menus.

Firefox Nightly 81.0a1 (2020-7-30) on Wayland with WebRender and opengl acceleration enabled in Plasma 5.19.3 in Fedora Rawhide crashed when I clicked on the Privacy Badger icon at the top right. The crash report showed the segmentation fault was at in mesa-libEGL-20.1.4-1.fc33.x86_64 at a crash address of 0x8 in the Renderer thread.

gdb showed that was in update buffers in platform_wayland.c:675 as in the original crash I reported here.

gdb /usr/lib64/
(gdb) info line *0x2a24d
Line 675 of "../src/egl/drivers/dri2/platform_wayland.c" starts at address 0x2a246 <update_buffers+38>
and ends at 0x2a257 <update_buffers+55>.
(gdb) info line *0x2a7c7
Line 810 of "../src/egl/drivers/dri2/platform_wayland.c"
starts at address 0x2a7b4 <image_get_buffers+4> and ends at 0x2a7d2 <image_get_buffers+34>.

This crash has been infrequent. I guess that a race condition between when the Wayland buffer for the popup was created by Firefox and when it was used by update_buffers in after occasionally being changed to an invalid pointer might have happened.

Duping due to same STR.

Closed: 1 year ago
Resolution: --- → DUPLICATE
See Also: 1645677
Duplicate of bug: 1645677

Do you see the crash also on Gnome or is that KDE specific?

Flags: needinfo?(matthew.fagnani)

(In reply to Martin Stránský [:stransky] from comment #3)

Do you see the crash also on Gnome or is that KDE specific?

Martin, I've only been using the Fedora Rawhide KDE Plasma spin. I haven't had Gnome installed. The crash signature <name omitted> | <name omitted> | dri2_allocate_textures shows 34 crashes from Fedora 32 (Workstation Edition) by others in the last 6 months.

So I guess crashes with that signature happened in Gnome also. Thanks.

Flags: needinfo?(matthew.fagnani)

Clicking on the Bookmarks and Help menus occasionally resulted in crashes almost all of which didn't have crash reports saved. A crash report was saved when I clicked on the Edit this Bookmark in the Bookmark menu in Nightly 81.0a1 (2020-8-17) on Wayland in Plasma 5.19.4 in Fedora 33. A segmentation fault occurred in update_buffers in ../src/egl/drivers/dri2/platform_wayland.c:675 in mesa-libEGL-20.1.5-1.fc33.x86_64. Although most of the signatures showed <name omitted>, the trace had the same files and lines as in the crashes I reported here before. The same crash happened the next time I tried to reproduce the crash, but no crash report was saved. These crashes might involve the Wayland surfaces of popups infrequently being freed or corrupted before being used due to a race condition.

I've seen one crash in 82.0a1 (2020-9-5) and three crashes in 82.0a1 (2020-9-6) on Wayland in update_buffers of the type I reported here while clicking on the toolbar buttons repeatedly in Plasma 5.19.5 in Fedora 33.

I clicked on Bookmarks in the menu bar then Bookmark This Page when a crash happened in update_buffers in /src/egl/drivers/dri2/platform_wayland.c:674 in mesa-libEGL-20.2.0~rc4-1.fc33 using Nightly 82.0a1 (2020-9-20) on Wayland with WebRender enabled in Plasma 5.19.5 in Fedora 33.

dri2_surf->wl_win might've been an invalid pointer, as dri2_surf was dereferenced on the previous line without the segmentation fault happening.

static int
update_buffers(struct dri2_egl_surface *dri2_surf)
struct dri2_egl_display *dri2_dpy =

if (dri2_surf->base.Width != dri2_surf->wl_win->width ||
dri2_surf->base.Height != dri2_surf->wl_win->height) {

You need to log in before you can comment on or make changes to this bug.