Closed Bug 1792082 Opened 2 years ago Closed 2 years ago

Crash in [@ wl_proxy_marshal_constructor | wl_shm_create_pool]

Categories

(Core :: Widget: Gtk, defect, P3)

Firefox 107
x86_64
Linux
defect

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: matt.fagnani, Unassigned)

References

(Blocks 1 open bug)

Details

Crash Data

Attachments

(1 file)

I started Firefox Nightly 107.0a1 20220922095647 on Wayland with WebRender compositing in Plasma 5.25.5 on Wayland in a Fedora 37 KDE Plasma installation. I had previously enabled the Menu bar. I clicked on Help in the Menu bar. Firefox crashed in wl_proxy_marshal_constructor at /usr/src/debug/wayland-1.21.0-1.fc37.x86_64/src/wayland-client.c:935. I reported crashes with 105.0a1 and a different signature, but a similar trace which crashed in the same function at Bug 1786219

Crash report: https://crash-stats.mozilla.org/report/index/4663b1f2-0564-4648-8746-ae4130220922

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0 libwayland-client.so.0 wl_proxy_marshal_constructor /usr/src/debug/wayland-1.21.0-1.fc37.x86_64/src/wayland-client.c:935
1 libxul.so wl_shm_create_pool /builds/worker/fetches/sysroot-x86_64-linux-gnu/usr/include/wayland-client-protocol.h:631
1 libxul.so mozilla::widget::WaylandShmPool::Create widget/gtk/WaylandBuffer.cpp:121
2 libxul.so mozilla::widget::WaylandBufferSHM::Create widget/gtk/WaylandBuffer.cpp:194
3 libxul.so mozilla::widget::WindowSurfaceWaylandMB::ObtainBufferFromPool widget/gtk/WindowSurfaceWaylandMultiBuffer.cpp:328
4 libxul.so mozilla::widget::WindowSurfaceWaylandMB::Lock widget/gtk/WindowSurfaceWaylandMultiBuffer.cpp:199
5 libxul.so mozilla::widget::WindowSurfaceProvider::StartRemoteDrawingInRegion widget/gtk/WindowSurfaceProvider.cpp:147
6 libxul.so mozilla::wr::RenderCompositorSWGL::AllocateMappedBuffer gfx/webrender_bindings/RenderCompositorSWGL.cpp:73
7 libxul.so mozilla::wr::RenderCompositorSWGL::StartCompositing gfx/webrender_bindings/RenderCompositorSWGL.cpp:186
8 libxul.so <webrender::compositor::sw_compositor::SwCompositor as webrender::composite::Compositor>::start_compositing gfx/wr/webrender/src/compositor/sw_compositor.rs:1430
OS: Unspecified → Linux
Hardware: Unspecified → x86_64
See Also: → 1786219

Can you reproduce the crash reliably? If so, can you run Firefox on terminal with:

WAYLAND_DEBUG=1 MOZ_LOG="Widget:5 WidgetPopup:5 WidgetWayland:5"

env variables and attach the log here?

Thanks.

Blocks: wayland
Flags: needinfo?(matt.fagnani)
Priority: -- → P3

(In reply to Martin Stránský [:stransky] (ni? me) from comment #1)

Can you reproduce the crash reliably? If so, can you run Firefox on terminal with:

WAYLAND_DEBUG=1 MOZ_LOG="Widget:5 WidgetPopup:5 WidgetWayland:5"

env variables and attach the log here?

Thanks.

The crashes were infrequent so I'm not sure if they would be considered reliably reproduced. This crash and the ones at 1786219 happened within 2-4 seconds of starting Firefox according to the bug reports. I reproduced the crashes at 1786219 a few times about a month ago by clicking on the Bookmarks or Help menu in the Menu bar right after Firefox started. The Bookmarks and Help menus didn't appear before the crash. I'll try to reproduce it with the Wayland debug variables you mentioned. The traces had functions like mozilla::wr::RenderCompositorSWGL::AllocateMappedBuffer which looked like SW-WR whereas I'm running Firefox with HW-WR compositing. I guess the menus are using SW-WR in some way. Thanks.

Flags: needinfo?(matt.fagnani)

Copying crash signatures from duplicate bugs.

Crash Signature: [@ wl_proxy_marshal_constructor | wl_shm_create_pool] → [@ wl_proxy_marshal_constructor | wl_shm_create_pool] [@ wl_proxy_marshal_constructor | mozilla::widget::WaylandShmPool::Create]

Okay, Thanks. Let's add explicit assertion that we have valid shm interface.

Crash Signature: [@ wl_proxy_marshal_constructor | wl_shm_create_pool] [@ wl_proxy_marshal_constructor | mozilla::widget::WaylandShmPool::Create] → [@ wl_proxy_marshal_constructor | wl_shm_create_pool] [@ wl_proxy_marshal_constructor | mozilla::widget::WaylandShmPool::Create]

I reproduced the crash by running 107.0a1 (2022-9-22) with WAYLAND_DEBUG=1 MOZ_LOG="Widget:5 WidgetPopup:5 WidgetWayland:5" and clicking on Help in the menu bar right after it started. The crash report is https://crash-stats.mozilla.org/report/index/92be5965-365b-45e4-bfe5-87c1b0220922 I'm attaching the Wayland debug output from the console which contains output at its end from when the Crash reporter was shown. I ran 107.0a1 (2022-9-22) with the Wayland debug variables enabled and clicked on Help or Bookmarks in the menu bar right after it started about 50 times without the crash happening. So I estimate the frequency of the crash might be around 2%. Thanks.

The bug has a crash signature, thus the bug will be considered confirmed.

Status: UNCONFIRMED → NEW
Ever confirmed: true

Can you please test latest nightly where an assertion was added?
Thanks.

Flags: needinfo?(matt.fagnani)

(In reply to Martin Stránský [:stransky] (ni? me) from comment #8)

Can you please test latest nightly where an assertion was added?
Thanks.

No crashes happened when I tested 107.0a1 20221006093717 by clicking on Help in the menu bar right after Firefox started over 50 times. This problem might be fixed. Thanks.

Flags: needinfo?(matt.fagnani)

Okay, Thanks.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WORKSFORME
See Also: → 1794284
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: