Closed Bug 1830215 Opened 2 years ago Closed 2 years ago

[Wayland] Screensharing crashes Gnome Shell when certain surfaces are created

Categories

(Core :: Widget: Gtk, defect)

Product:
Core
Component:
Widget: Gtk
Type:
defect

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: kode54, Unassigned)

References

(Blocks 1 open bug)

Details

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/114.0

Steps to reproduce:

  1. Started Gnome Wayland session on Intel Arc A770 LE 16GB, using Mesa 23.0.3, with a screen scale of 2.0.
  2. Started Firefox Nightly 114.0a1 (2023-04-26) (64-bit) with MOZ_ENABLE_WAYLAND=1 set, and the following enabled in about:config to force hardware accelerated Webrender: gfx.webrender.all=true, gfx.webrender.compositor=true, gfx.webrender.fallback.software=false.
  3. Activate Screen Sharing, such as by using OBS to record the 2.0 scale panel.
  4. Load the following web site: https://cohost.org/mcc/post/1372446-empty
  5. Move the mouse cursor over the inlined image a few times, causing the custom cursor to swap in and out a few times.

Actual results:

Gnome Shell crashes with the following backtrace:

#0  __memcpy_avx_unaligned_erms ()
    at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:491
#1  0x00007f444a2ac6f9 in  () at /usr/lib/dri/iris_dri.so
#2  0x00007f444a4e715a in  () at /usr/lib/dri/iris_dri.so
#3  0x00007f444a4e734e in  () at /usr/lib/dri/iris_dri.so
#4  0x00007f444a4e892c in  () at /usr/lib/dri/iris_dri.so
#5  0x00007f4461312265 in _cogl_texture_driver_gl_get_tex_image
    (ctx=<optimized out>, gl_target=<optimized out>, dest_gl_format=<optimized out>, dest_gl_type=<optimized out>, dest=<optimized out>)
    at ../mutter-vrr/cogl/cogl/driver/gl/gl/cogl-texture-driver-gl.c:358
#6  0x00007f446130facf in _cogl_texture_2d_gl_get_data
    (tex_2d=0x557d3fa59720, format=COGL_PIXEL_FORMAT_RGBA_8888_PRE, rowstride=2048, data=0x7f43a5218288 "+G{\204+G{\204=d\254\270=d\254\270?e\256\270?e\256\2706`\256\2706`\256\270-W\250\270-W\250\270/W\250\270/W\250\270/W\251\270/W\251\270/W\252\270/W\252\2702Y\254\2702Y\254\2701Z\256\2701Z\256\2700Y\255\2700Y\255\270/W\253\270/W\253\270/X\252\270/X\252\270.X\251\270.X\251\270.W\251\270.W\251\270.W\251\270.W\251\270-V\251\270-V\251\270-V\252\270-V\252\270-W\253\270-W\253\270-W\253\270-W\253\270.V\252\270.V\252\270.V\251\270.V\251\270-V\251\270-V\251\270-U\251\270-U\251\270-U\251\270-U\251\270"...)
    at ../mutter-vrr/cogl/cogl/driver/gl/cogl-texture-2d-gl.c:654
#7  0x00007f44613509cf in _cogl_texture_2d_get_data
    (tex=<optimized out>, format=<optimized out>, rowstride=<optimized out>, data=<optimized out>) at ../mutter-vrr/cogl/cogl/cogl-texture-2d.c:476
#8  0x00007f446135a9af in texture_get_cb
    (subtexture=0x557d3fa59720, subtexture_coords=0x7ffe6e6e9e20, virtual_coords=<optimized out>, user_data=0x7ffe6e6e9f50)
    at ../mutter-vrr/cogl/cogl/cogl-texture.c:705
#9  0x00007f4461360dd1 in re_normalize_sub_texture_coords_cb
    (user_data=0x7ffe6e6e9d60, meta_coords=<synthetic pointer>, sub_texture_coords=0x7ffe6e6e9e20, sub_texture=<optimized out>)
    at ../mutter-vrr/cogl/cogl/cogl-texture-2d-sliced.c:93
#10 _cogl_texture_spans_foreach_in_region
    (user_data=0x7ffe6e6e9d60, callback=0x7f446135e050 <normalize_meta_coords_cb>, wrap_y=<optimized out>, wrap_x=<optimized out>, y_normalize_factor=<optimized out>, x_normalize_factor=<optimized out>, virtual_coords=<synthetic pointer>, textures=0x7ffe6e6e9d40, n_y_spans=1, y_spans=0x7ffe6e6e9d48, n_x_spans=1, x_spans=0x7ffe6e6e9d54) at ../mutter-vrr/cogl/cogl/cogl-texture.c:1057
#11 cogl_meta_texture_foreach_in_region
    (meta_texture=meta_texture@entry=0x557d3fa59720, tx_1=<optimized out>, 
    tx_1@entry=0, ty_1=<optimized out>, ty_1@entry=0, tx_2=<optimized out>, 
    tx_2@entry=1, ty_2=<optimized out>, ty_2@entry=1, wrap_s=<optimized out>, 
    wrap_s@entry=COGL_PIPELINE_WRAP_MODE_REPEAT, wrap_t=<optimized out>, 
    wrap_t@entry=COGL_PIPELINE_WRAP_MODE_REPEAT, callback=0x7f446135e050 <normalize_meta_coords_cb>, 
    callback@entry=0x7f446135a7b0 <texture_get_cb>, user_data=0x7ffe6e6e9d60, 
    user_data@entry=0x7ffe6e6e9f50)
    at ../mutter-vrr/cogl/cogl/cogl-meta-texture.c:568
#12 0x00007f446135b250 in cogl_texture_get_data
    (texture=texture@entry=0x557d3fa59720, format=format@entry=COGL_PIXEL_FORMAT_RGBA_8888_PRE, rowstride=rowstride@entry=2048, data=data@entry=0x7f43a5218288 "+G{\204+G{\204=d\254\270=d\254\270?e\256\270?e\256\2706`\256\2706`\256\270-W\250\270-W\250\270/W\250\270/W\250\270/W\251\270/W\251\270/W\252\270/W\252\2702Y\254\2702Y\254\2701Z\256\2701Z\256\2700Y\255\2700Y\255\270/W\253\270/W\253\270/X\252\270/X\252\270.X\251\270.X\251\270.W\251\270.W\251\270.W\251\270.W\251\270-V\251\270-V\251\270-V\252\270-V\252\270-W\253\270-W\253\270-W\253\270-W\253\270.V\252\270.V\252\270.V\251\270.V\251\270-V\251\270-V\251\270-U\251\270-U\251\270-U\251\270-U\251\270"...) at ../mutter-vrr/cogl/cogl/cogl-texture.c:859
#13 0x00007f4461a19193 in meta_screen_cast_stream_src_draw_cursor_into
    (src=src@entry=0x557d3fc78fb0, cursor_texture=cursor_texture@entry=0x557d3fa59720, scale=scale@entry=1, transform=transform@entry=META_MONITOR_TRANSFORM_NORMAL, data=0x7f43a5218288 "+G{\204+G{\204=d\254\270=d\254\270?e\256\270?e\256\2706`\256\2706`\256\270-W\250\270-W\250\270/W\250\270/W\250\270/W\251\270/W\251\270/W\252\270/W\252\2702Y\254\2702Y\254\2701Z\256\2701Z\256\2700Y\255\2700Y\255\270/W\253\270/W\253\270/X\252\270/X\252\270.X\251\270.X\251\270.W\251\270.W\251\270.W\251\270.W\251\270-V\251\270-V\251\270-V\252\270-V\252\270-W\253\270-W\253\270-W\253\270-W\253\270.V\252\270.V\252\270.V\251\270.V\251\270-V\251\270-V\251\270-U\251\270-U\251\270-U\251\270-U\251\270"..., error=error@entry=0x7ffe6e6ea0a0)
    at ../mutter-vrr/src/backends/meta-screen-cast-stream-src.c:337
#14 0x00007f4461a1934c in meta_screen_cast_stream_src_set_cursor_sprite_metadata (src=0x557d3fc78fb0, spa_meta_cursor=0x7f43a5218258, cursor_sprite=<optimized out>, x=<optimized out>, y=<optimized out>, scale=1, transform=META_MONITOR_TRANSFORM_NORMAL) at ../mutter-vrr/src/backends/meta-screen-cast-stream-src.c:459
#15 0x00007f4461a09c26 in meta_screen_cast_monitor_stream_src_set_cursor_metadata (src=0x557d3fc78fb0, spa_meta_cursor=0x7f43a5218258)
    at ../mutter-vrr/src/backends/meta-screen-cast-monitor-stream-src.c:696
#16 0x00007f4461a1987e in meta_screen_cast_stream_src_set_cursor_metadata
    (spa_meta_cursor=<optimized out>, src=0x557d3fc78fb0)
    at ../mutter-vrr/src/backends/meta-screen-cast-stream-src.c:244
#17 add_cursor_metadata (spa_buffer=<optimized out>, src=<optimized out>)
    at ../mutter-vrr/src/backends/meta-screen-cast-stream-src.c:481
#18 maybe_record_cursor (spa_buffer=0x557d3fd42830, src=0x557d3fc78fb0)
    at ../mutter-vrr/src/backends/meta-screen-cast-stream-src.c:496
#19 meta_screen_cast_stream_src_maybe_record_frame
    (src=0x557d3fc78fb0, flags=<optimized out>)
    at ../mutter-vrr/src/backends/meta-screen-cast-stream-src.c:721
#20 0x00007f4461a074b6 in maybe_record_frame_on_idle.lto_priv ()
    at ../mutter-vrr/src/backends/meta-screen-cast-monitor-stream-src.c:123
#21 0x00007f446264653b in g_main_dispatch (context=0x557d3c80f4b0)
    at ../glib/glib/gmain.c:3460
#22 g_main_context_dispatch (context=0x557d3c80f4b0)
    at ../glib/glib/gmain.c:4200
#23 0x00007f44626a3219 in g_main_context_iterate.constprop.0
    (context=0x557d3c80f4b0, block=1, dispatch=1, self=<optimized out>)
    at ../glib/glib/gmain.c:4276
#24 0x00007f4462645c7f in g_main_loop_run (loop=0x557d3e82fab0)
    at ../glib/glib/gmain.c:4479
#25 0x00007f4461998b6b in meta_context_run_main_loop
    (context=context@entry=0x557d3c80d3e0, error=error@entry=0x7ffe6e6ea3c0)
    at ../mutter-vrr/src/core/meta-context.c:465
#26 0x0000557d3bc6c478 in main (argc=<optimized out>, argv=<optimized out>)
    at ../gnome-shell/src/main.c:582

Expected results:

Compositor should not crash.

Reported to Mesa, as it may also be a long standing Mesa issue:

https://gitlab.freedesktop.org/mesa/mesa/-/issues/8888

(I cannot find any local backups of Mesa far enough back that don't also remove DG2 support.)

Please try without gfx.webrender.compositor=true - that's an experimental feature and it's known to be broken somehow.
Thanks.

Flags: needinfo?(kode54)

(In reply to Martin Stránský [:stransky] (ni? me) from comment #2)

Please try without gfx.webrender.compositor=true - that's an experimental feature and it's known to be broken somehow.
Thanks.

I have turned this and gfx.webrender.compositor.force-enable to their defaults. It still crashes Gnome Shell. It also crashes Gnome Shell if I use Firefox through Zink. Sometimes instead of crashing Gnome Shell, it just crashes OBS, the screen sharing app I am using for testing.

No crashes occur under labwc when using xdg-desktop-portal-wlr for screen capture with OBS.

While this does appear to be Firefox triggered, perhaps it is instead either a Mesa or a Gnome Shell bug.

Flags: needinfo?(kode54)

Okay, please try mozilla binaries with clean profile:
https://fedoraproject.org/wiki/How_to_debug_Firefox_problems#Testing_Mozilla_binaries
Thanks.

Flags: needinfo?(kode54)

(In reply to Martin Stránský [:stransky] (ni? me) from comment #4)

Okay, please try mozilla binaries with clean profile:
https://fedoraproject.org/wiki/How_to_debug_Firefox_problems#Testing_Mozilla_binaries
Thanks.

I am using official Mozilla binaries, just repackaged into my distribution's packaging system using an AUR PKGBUILD script, firefox-nightly-bin. I will reply with the reply button when I test it using those directions to use the profile manager.

Blocks: wayland

Still crashes with a fresh profile.

Flags: needinfo?(kode54)

Do I understand correctly that the crash happens in mutter? If so you should report it there, not in Firefox.

Status: UNCONFIRMED → RESOLVED
Closed: 2 years ago
Resolution: --- → INVALID

Sorry for reporting here, wasn't sure if Firefox may have been doing something invalid to exacerbate an inevitable crash. The crash also does not occur when running against the Xe KMD instead of i915, so it's possibly also a Mesa bug instead of a Mutter bug. I'll file a Mutter issue anyway.

You need to log in before you can comment on or make changes to this bug.