1656727 - Crash in [@ mozilla::widget::WindowSurfaceWayland::DelayedCommitHandler]

Status: RESOLVED FIXED

(Core :: Widget: Gtk, defect, P2)

Description

[Matt Fagnani]

This bug is for crash report bp-0fc94f9c-f27f-42bc-94f0-ccbee0200802.

Top 10 frames of crashing thread:

0 libxul.so mozilla::widget::WindowSurfaceWayland::DelayedCommitHandler widget/gtk/WindowSurfaceWayland.cpp:1189
1 libxul.so RunnableFunction<void  ipc/chromium/src/base/task.h:324
2 libxul.so {virtual override thunk} 
3 libxul.so nsTimerImpl::Fire xpcom/threads/nsTimerImpl.cpp:565
4 libxul.so nsTimerEvent::Run xpcom/threads/TimerThread.cpp:251
5 libxul.so nsThread::ProcessNextEvent xpcom/threads/nsThread.cpp:1234
6 libxul.so mozilla::ipc::MessagePumpForNonMainThreads::Run ipc/glue/MessagePump.cpp:332
7 libxul.so MessageLoop::Run ipc/chromium/src/base/message_loop.cc:309
8 libxul.so nsThread::ThreadFunc xpcom/threads/nsThread.cpp:447
9 libnspr4.so _pt_root nsprpub/pr/src/pthreads/ptthread.c:201

I was using Firefox Nightly 81.0a1 (2020-8-1) on Wayland in Plasma 5.19.4 in Fedora Rawhide. I clicked on Help > About Nightly. An update to the second build of 81.0a1 (2020-8-1) was downloaded. I clicked on Restart. Firefox had a segmentation fault in mozilla::widget::WindowSurfaceWayland::DelayedCommitHandler at widget/gtk/WindowSurfaceWayland.cpp:1189 which was *mDelayedCommitHandle = nullptr;
The crash address was 0x0, so a null pointer dereference might have happened there.
This crash doesn't usually happen when I update Nightly as above, but I have seen crashes with this trace infrequently.

Comment 1

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1656727 [Wayland] Check mDelayedCommitHandle before we use it, r?jhorak

Comment 2

[Martin Stránský [:stransky] (ni? me)]

Looks like we need to add more thread safe checks there.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1d7a48a5e3fb
[Wayland] Check mDelayedCommitHandle before we use it, r=jhorak

Comment 4

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/1d7a48a5e3fb

Comment 5

[Matt Fagnani]

I've seen two crashes with this trace when closing Nightly 81.0a1 (2020-8-12 and 2020-8-15) on Wayland in Plasma 5.19.4. https://crash-stats.mozilla.org/report/index/2dfb8545-00a0-4534-a8b9-307230200813 https://crash-stats.mozilla.org/report/index/860c75e5-9790-4b5e-ab0e-86e4d0200815 Those builds appeared to have the patch in comment 1 by Martin which looked like it should've avoided the null pointer dereference in mozilla::widget::WindowSurfaceWayland::DelayedCommitHandler. These crashes happened less than 10% of the time when closing Nightly on Wayland.

Comment 6

[Matt Fagnani]

I had four tabs open in Nightly 83.0a1 (2020-9-25) on Wayland with WebRender compositing enabled in Plasma 5.19.5 in Fedora 33. When I closed one of the tabs, a segmentation fault occurred in mozilla::widget::WindowSurfaceWayland::DelayedCommitHandler with a trace like those I reported here https://crash-stats.mozilla.org/report/index/469200fd-119c-47ba-a078-3bcfd0200926 This problem might not be fixed. There are 27 reports with this signature from 82.0a1 and 3 from 83.0a1 https://crash-stats.mozilla.org/signature/?signature=mozilla%3A%3Awidget%3A%3AWindowSurfaceWayland%3A%3ADelayedCommitHandler&date=%3E%3D2020-03-26T07%3A19%3A00.000Z&date=%3C2020-09-26T07%3A19%3A00.000Z

Comment 7

[Martin Stránský [:stransky] (ni? me)]

The bug is still here.

Comment 8

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1656727 [Wayland] Track delayed commits globally, r?jhorak

Track delayed commits in a global list and don't store them in actual wayland surfaces.
When a delayed commit is called, check that the associated wayland surface is still valid.

Comment 9

[Martin Stránský [:stransky] (ni? me)]

(In reply to Martin Stránský [:stransky] from comment #8)

Created attachment 9179589 [details]
Bug 1656727 [Wayland] Track delayed commits globally, r?jhorak

Track delayed commits in a global list and don't store them in actual wayland surfaces.
When a delayed commit is called, check that the associated wayland surface is still valid.

This patch causes a popup regression - https://bugzilla.redhat.com/show_bug.cgi?id=1886243

Comment 10

[Martin Stránský [:stransky] (ni? me)]

Updated with the regression fixed.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f565fc1e59ad
[Wayland] Track delayed commits globally, r=jhorak

Comment 12

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/f565fc1e59ad