1743386 - Crash in [@ mozilla::ScopedXErrorHandler::ErrorHandler]

Status: RESOLVED WORKSFORME

(Core :: Widget: Gtk, defect, P3)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/1d29fab5-0acc-420b-bf82-571090211119

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0 libxul.so mozilla::ScopedXErrorHandler::ErrorHandler gfx/src/X11Util.cpp:48
1 libX11.so.6 _XError src/XlibInt.c:1491
2 libX11.so.6 handle_error src/xcb_io.c:199
3 libX11.so.6 handle_response src/xcb_io.c:324
4 libX11.so.6 _XReply src/xcb_io.c:634
5 libX11.so.6 XInternAtom src/IntAtom.c:181
6 libgdk-3.so.0 gdk_x11_atom_to_xatom_for_display ../../../../../gdk/x11/gdkproperty-x11.c:96
7 libgdk-3.so.0 _gdk_wm_protocols_filter ../../../../../gdk/x11/gdkdisplay-x11.c:1399
8 libgdk-3.so.0 gdk_event_apply_filters ../../../../../gdk/x11/gdkeventsource.c:79
9 libgdk-3.so.0 _gdk_x11_display_queue_events ../../../../../gdk/x11/gdkeventsource.c:341

Very low-volume but seems valid. We appear to be accessing sXErrorPtr when it's NULL here. Looking at the code this doesn't seem to be possible but I guess it could be happening if two threads create a ScopedXErrorHandler object at the same time and race.

Comment 1

[Darkspirit]

bug 1741956 has a race with X Errors.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.