Closed Bug 1803393 Opened 1 year ago Closed 1 year ago

MOZ_CRASH(IMContextWrapper not thread-safe) crashes

Categories

(Core :: Widget: Gtk, defect)

defect

Tracking

()

RESOLVED FIXED
109 Branch
Tracking Status
firefox-esr102 --- wontfix
firefox108 --- wontfix
firefox109 --- fixed

People

(Reporter: mccr8, Assigned: emilio)

References

Details

(Keywords: csectype-race, sec-moderate, Whiteboard: [fixed by bug 1802977][post-critsmash-triage][adv-main109+r])

There's a lot of different intermittent failures showing up with this assertion. I figured I'd file a new bug to gather them together so the crashes that happen can keep getting reported somewhere.

It looks like the existing failures on file haven't happened in awhile, so I closed them, but I did find a recent failure in bug 1728042:

Hit MOZ_CRASH(IMContextWrapper not thread-safe) at /builds/worker/checkouts/gecko/xpcom/base/nsISupportsImpl.cpp:43
#01: nsAutoOwningThread::AssertCurrentThreadOwnsMe(char const*) const [xpcom/base/nsISupportsImpl.cpp:43]
#02: mozilla::widget::IMContextWrapper::Release() [widget/gtk/IMContextWrapper.cpp:304]
#03: nsWindow::~nsWindow() [widget/gtk/nsWindow.cpp:452]
#04: nsWindow::~nsWindow() [widget/gtk/nsWindow.cpp:449]
#05: nsBaseWidget::Release() [widget/nsBaseWidget.cpp:132]
#06: RefPtr<nsWindow>::~RefPtr() [mfbt/RefPtr.h:81]
#07: mozilla::widget::GtkCompositorWidget::~GtkCompositorWidget() [widget/gtk/GtkCompositorWidget.cpp:72]
#08: mozilla::widget::InProcessGtkCompositorWidget::~InProcessGtkCompositorWidget() [widget/gtk/InProcessGtkCompositorWidget.h:16]
#09: mozilla::widget::CompositorWidget::Release() [widget/CompositorWidget.h:90]
#10: mozilla::layers::WebRenderBridgeParent::~WebRenderBridgeParent() [gfx/layers/wr/WebRenderBridgeParent.cpp:351]
#11: {virtual override thunk({offset(-64)}, mozilla::layers::WebRenderBridgeParent::~WebRenderBridgeParent())} [gfx/layers/wr/WebRenderBridgeParent.cpp:0]

I'll mark this sec-moderate because it kind of looks like one of those nasty compositor teardown issues.

Group: layout-core-security → dom-core-security

https://phabricator.services.mozilla.com/D122072 changed nsBaseWidget to use threadsafe refcounting even though nsBaseWidget has strong references to main thread only objects.

I believe this should be fixed by bug 1802977 around the time this bug was filed.

Thanks. Let's just mark this fixed then.

Assignee: nobody → emilio
Status: NEW → RESOLVED
Closed: 1 year ago
Depends on: 1802977
Resolution: --- → FIXED
Whiteboard: [fixed by bug 1802977]
Group: dom-core-security → core-security-release
Target Milestone: --- → 109 Branch
Flags: qe-verify-
Whiteboard: [fixed by bug 1802977] → [fixed by bug 1802977][post-critsmash-triage]
Whiteboard: [fixed by bug 1802977][post-critsmash-triage] → [fixed by bug 1802977][post-critsmash-triage][adv-main109+r]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.