1730079 - Closing extension popups is crashing the browser [@ nsMenuPopupFrame::IsDirectionRTL]

Status: VERIFIED FIXED

(Core :: Widget: Gtk, defect)

Description

[Chris Morgan]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0

Steps to reproduce:

1. Open an extension popup (from a toolbar button), such as for uBlock Origin or Bitwarden.
2. Close it.

Actual results:

Crash. Here are four reports from exercising it:

• https://crash-stats.mozilla.org/report/index/bp-e8ab2886-99d1-4c89-93fb-577810210910
• https://crash-stats.mozilla.org/report/index/bp-13744bae-aa04-4d91-8b9d-c8c1b0210910
• https://crash-stats.mozilla.org/report/index/bp-35bdaf18-c8fd-41b5-922c-487160210910
• https://crash-stats.mozilla.org/report/index/bp-d41c958c-8c89-4b3b-8ab7-2e2cf0210910

I discovered this shortly after updating from a 2021-09-02 build to 2021-09-10.

Given the subject area here (popups and gtk3), it’s important to note that I’ve been using a custom build of gtk3, tracking gtk!3898, because of https://github.com/swaywm/sway/issues/6426. That is the version of gtk3 in use in the first, second and fourth of those crash reports. But for the third, I switched back to Arch Linux’s stock gtk3 package, and the crash still happened, so I don’t believe it’s related to that after all, however suspicious the combined circumstances are. Other possibly relevant things: Arch Linux, Sway, output scale 1.5.

Expected results:

No crash.

Comment 1

[Chris Morgan]

One more crash report: https://crash-stats.mozilla.org/report/index/6c4d0e41-9b78-44f6-940e-4ec050210910, changed output scale to 1 and it still happened (which is what I expected, from the nature of the crash signature), so it’s probably not related to scaling either.

I should also clarify that this only happens for extension popups, not the Application Menu or the tools overflow menu. (I find this unsurprising on reading the crash trace.)

Let me know if you’d like me to crash it in any more interesting ways! 😀

Comment 2

[Jan Alexander Steffens [:heftig]]

I'm also seeing this. Nightly, Arch Linux, GNOME, scale 2.

Comment 3

[yasharjit]

Can reproduce this in Fedora 34, GNOME Wayland Session

Corresponding report - https://crash-stats.mozilla.org/report/index/a485d1d7-167e-4de2-b91b-90c2f0210910

Comment 4

[Jan Alexander Steffens [:heftig]]

Last good revision: a3f6c7094ec4c85bc0973ebfa64e674c288d6a33
First bad revision: 457c297c9bf274a9463bc8fa30ee73a024ad516f
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=a3f6c7094ec4c85bc0973ebfa64e674c288d6a33&tochange=457c297c9bf274a9463bc8fa30ee73a024ad516f

Regressed by bug 1718867.

Comment 5

[Martin Stránský [:stransky] (ni? me)]

Interesting, we have a popup without popup frame :) I'll look at it, thanks.

Comment 6

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1730079 [Wayland] Get popup text direction by nsWindow::IsPopupDirectionRTL(), r?emilio

Comment 7

[Francois Guerraz]

Workaround: closing the pop-up windows with the Escape key doesn't trigger the crash.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/38bd8f0b3351
[Wayland] Get popup text direction by nsWindow::IsPopupDirectionRTL(), r=emilio

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1718867

Comment 10

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/38bd8f0b3351

Comment 11

[Ciprian Georgiu, Desktop QA]

Hi Chris, are you still seeing this issue with latest Beta 94? I'm unable to reproduce the crash, unfortunately. I don't have Arch Linux or GNOME installed, so I've tried only on Ubuntu 18.04 x64, but the extension work as expected on my end. Could you please verify this?

Comment 12

[Ciprian Georgiu, Desktop QA]

Thank you!