1736601 - Crash at window_size_sanity_check(device_rect.size());

Status: RESOLVED DUPLICATE of bug 1746812

(Core :: Graphics: WebRender, defect, P2)

Description

[Kevin Locke]

Attachment: Bookmarks backup with "Big Folder" in "Bookmarks Toolbar"

With 95.0a1 (2021-10-19) (64-bit) on Wayland, attempting to open a folder on the Bookmarks Toolbar which contains enough bookmarks to require scrolling causes Firefox to crash. Steps to reproduce:

1. Open Manage Bookmarks. (Ctrl+Shift+O)
2. Import and Backup->Restore->Choose file...
3. Choose the attached bookmark backup JSON file.
4. Confirm "This will replace all of your current bookmarks [...]"
5. Click on "Big Folder" on the Bookmarks Toolbar. Firefox will crash.

Crash report: https://crash-stats.mozilla.org/report/index/667f1174-2c5f-4de7-abf5-243e40211019

MOZ_CRASH Reason: ```[destroyed object]: error 1: invalid width, height or stride (486x15994621, 1944)

Top 10 frames of crashing thread:

0 libxul.so mozilla::widget::WlCrashHandler widget/gtk/nsWaylandDisplay.cpp:328
1 libwayland-client.so.0 wl_log src/wayland-util.c:404
2 libwayland-client.so.0 display_handle_error src/wayland-client.c:919
3 libffi.so.8 ffi_call_unix64
4 libffi.so.8 ffi_call_int
5 libwayland-client.so.0 wl_closure_invoke src/connection.c:1018
6 libwayland-client.so.0 dispatch_event.isra.0 src/wayland-client.c:1452
7 libwayland-client.so.0 wl_display_dispatch_queue_pending src/wayland-client.c:1840
8 libgdk-3.so.0 _gdk_wayland_display_queue_events gdk/wayland/gdkeventsource.c:201
9 libgdk-3.so.0 gdk_display_get_event gdk/gdkdisplay.c:442

Mozregression:  https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=2d978650c932ee4951ce97d9e29da955f4a11cbf&tochange=1c581d243b8752eef64ab15aca97e11afae39b67

Suggesting this was regressed by Bug 1733620.

Comment 1

[Martin Stránský [:stransky] (ni? me)]

Can you please run Firefox with MOZ_LOG="WidgetPopup:5" env variable and attach the log here?
Thanks.

Comment 2

[Kevin Locke]

Attachment: MOZ_LOG=WidgetPopup:5 with build 20211019095357

(In reply to Martin Stránský [:stransky] (ni? me) from comment #1)

Can you please run Firefox with MOZ_LOG="WidgetPopup:5" env variable and attach the log here?

Sure thing. Attached. Thanks for looking into it!

Comment 3

[Martin Stránský [:stransky] (ni? me)]

I see. Looks like we don't restrict the size limits now.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1733620

Comment 5

[Martin Stránský [:stransky] (ni? me)]

I tried latest nightly and I'm unable to reproduce it with the provided JSON file - I see a popup window which can be scrolled.
Can you re-test with latest nightly please?
Thanks.

Comment 6

[Kevin Locke]

Thanks :stransky! With Nightly 96.0a1 (2021-11-01) (64-bit), the crash is less easily reproducible. Clicking on "Big Folder" from the Bookmarks Toolbar causes the button to become active, but does not show the popup with the bookmarks. Doing so also causes the CPU usage of the GeckoMain process to shoot up significantly until "closed". If I hover the mouse where the popup should appear, I sometimes see a flash of the popup below the cursor. Doing so can often, but not always, produce a crash. (Is there a way to get crash reports from mozregression?)

Comment 7

[Kevin Locke]

Crash Report on Nightly 96.0a1 (2021-11-02) (64-bit): https://crash-stats.mozilla.org/report/index/3f5ede61-5ea6-47cc-b61c-d505c0211102

Comment 8

[Martin Stránský [:stransky] (ni? me)]

(In reply to Kevin Locke from comment #7)

Crash Report on Nightly 96.0a1 (2021-11-02) (64-bit): https://crash-stats.mozilla.org/report/index/3f5ede61-5ea6-47cc-b61c-d505c0211102

That's a different bug, it crashes at WebRender:
https://hg.mozilla.org/mozilla-central/file/b11349b0406fac3f80b562b5357070b2d3fa73ac/gfx/wr/webrender/src/render_api.rs#l320