Closed Bug 1882021 Opened 2 years ago Closed 2 years ago

Crash in [@ handle_response | _gdk_x11_get_window_child_info]

Categories

(Core :: Widget: Gtk, defect, P2)

Product:
Core
Component:
Widget: Gtk
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
125 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- unaffected
firefox123 --- unaffected
firefox124 --- verified
firefox125 --- verified

People

(Reporter: aryx, Assigned: stransky)

References

(Blocks 1 open bug)

Details

(Keywords: crash)

Crash Data

Attachments

(3 files)

Bug 1882021 [Linux/X11] Clean up XWindow from GtkCompositorWidget and disable rendering if nsWindow is unmapped r?emilio
48 bytes, text/x-phabricator-request
Details | Review
Bug 1882021 [Linux] Make sure GtkCompositorWidget::mWidget reference is released on nsWindow::Destroy() to avoid nsWindow leak r?emilio
48 bytes, text/x-phabricator-request
Details | Review
Bug 1882021 [Linux/X11] Call GtkCompositorWidget::DisableRendering() before GtkCompositorWidget::EnableRendering() to make sure new XWindow is applied r?emilio
48 bytes, text/x-phabricator-request
RyanVM
: approval-mozilla-beta+
Details | Review

17 crashes from 5 install on Linux distros. First reported build ID is 20240225092952, second is 20240224093754.

Crash report: https://crash-stats.mozilla.org/report/index/99742dd6-5a24-4c99-9a15-81f890240226

Reason: SIGTRAP / SI_KERNEL

Top 10 frames of crashing thread:

0  libglib-2.0.so.0  g_log_writer_default  glib/gmessages.c:2827
1  libglib-2.0.so.0  g_log_structured_array  glib/gmessages.c:1973
1  libglib-2.0.so.0  g_log_structured_array  glib/gmessages.c:1946
2  libglib-2.0.so.0  g_log_structured_standard  glib/gmessages.c:2030
3  libgdk-3.so.0  gdk_x_error.lto_priv.0  /build/gtk+3.0-WfzL5N/gtk+3.0-3.24.33/gdk/x11/gdkmain-x11.c:258
4  libX11.so.6  _XError  /build/libx11-u5gazC/libx11-1.7.5/src/XlibInt.c:1503
5  libX11.so.6  handle_error  /build/libx11-u5gazC/libx11-1.7.5/src/xcb_io.c:211
6  libX11.so.6  handle_response  /build/libx11-u5gazC/libx11-1.7.5/src/xcb_io.c:403
7  libX11.so.6  _XReply  /build/libx11-u5gazC/libx11-1.7.5/src/xcb_io.c:722
8  libgdk-3.so.0  _gdk_x11_get_window_child_info  /build/gtk+3.0-WfzL5N/gtk+3.0-3.24.33/gdk/x11/gdkasync.c:562
Flags: needinfo?(stransky)

We'd need more crash data for it.

Flags: needinfo?(stransky)

i think it came from bug 1880323 too.

i am not sure is it relate to this issue or not. but i think it relate.
when i drag drop to re-order tab. only 1st times that you can see tab screenshot correctly. after that it look like it use firefox UI as screenshot
video https://youtu.be/U7xmMIg1noc
at 0:05 you can see tab preview correctly
at 0:11 you can see that tab preview look like firefox UI and no tab preview

this mozregression from that above.

2024-02-28T12:24:31.016000: INFO : application_display_name: Firefox Nightly
2024-02-28T12:24:31.016000: INFO : application_id: {ec8030f7-c20a-464f-9b0e-13a3a9e97384}
2024-02-28T12:24:31.016000: INFO : application_name: Firefox
2024-02-28T12:24:31.017000: INFO : application_remotingname: firefox-nightly-autoland
2024-02-28T12:24:31.017000: INFO : application_repository: https://hg.mozilla.org/integration/autoland
2024-02-28T12:24:31.017000: INFO : application_vendor: Mozilla
2024-02-28T12:24:31.017000: INFO : application_version: 125.0a1
2024-02-28T12:24:31.017000: INFO : platform_buildid: 20240223121804
2024-02-28T12:24:31.017000: INFO : platform_changeset: 7346a5d91e93697de1af5ba25e9cb68dd940c215
2024-02-28T12:24:31.017000: INFO : platform_repository: https://hg.mozilla.org/integration/autoland
2024-02-28T12:24:31.017000: INFO : platform_version: 125.0a1
2024-02-28T12:24:38.757000: INFO : b"\x07[Parent 78112, Main Thread] ###!!! ASSERTION: The program 'firefox-nightly-autoland' received an X Window System error."
2024-02-28T12:24:38.758000: INFO : b'This probably reflects a bug in the program.'
2024-02-28T12:24:38.759000: INFO : b"The error was 'BadDrawable (invalid Pixmap or Window parameter)'."
2024-02-28T12:24:38.760000: INFO : b'  (Details: serial 9575 error_code 9 request_code 62 (core protocol) minor_code 0)'
2024-02-28T12:24:38.762000: INFO : b'  (Note to programmers: normally, X errors are reported asynchronously;'
2024-02-28T12:24:38.763000: INFO : b'   that is, you will receive the error a while after causing it.'
2024-02-28T12:24:38.763000: INFO : b'   To debug your program, run it with the GDK_SYNCHRONIZE environment'
2024-02-28T12:24:38.764000: INFO : b'   variable to change this behavior. You can then get a meaningful'
2024-02-28T12:24:38.765000: INFO : b"   backtrace from your debugger if you break on the gdk_x_error() function.): 'glib assertion', file /builds/worker/checkouts/gecko/toolkit/xre/nsSigHandlers.cpp:184"
2024-02-28T12:24:38.765000: INFO : b''
2024-02-28T12:24:38.767000: INFO : b"(firefox-nightly-autoland:78112): Gdk-ERROR **: 12:24:38.757: The program 'firefox-nightly-autoland' received an X Window System error."
2024-02-28T12:24:38.767000: INFO : b'This probably reflects a bug in the program.'
2024-02-28T12:24:38.768000: INFO : b"The error was 'BadDrawable (invalid Pixmap or Window parameter)'."
2024-02-28T12:24:38.769000: INFO : b'  (Details: serial 9575 error_code 9 request_code 62 (core protocol) minor_code 0)'
2024-02-28T12:24:38.771000: INFO : b'  (Note to programmers: normally, X errors are reported asynchronously;'
2024-02-28T12:24:38.772000: INFO : b'   that is, you will receive the error a while after causing it.'
2024-02-28T12:24:38.772000: INFO : b'   To debug your program, run it with the GDK_SYNCHRONIZE environment'
2024-02-28T12:24:38.773000: INFO : b'   variable to change this behavior. You can then get a meaningful'
2024-02-28T12:24:38.775000: INFO : b'   backtrace from your debugger if you break on the gdk_x_error() function.)'
2024-02-28T12:24:38.775000: INFO : b'ExceptionHandler::GenerateDump cloned child 80266'
2024-02-28T12:24:38.777000: INFO : b'ExceptionHandler::SendContinueSignalToChild sent continue signal to child'
2024-02-28T12:24:38.778000: INFO : b'ExceptionHandler::WaitForContinueSignal waiting for continue signal...'
2024-02-28T12:24:40.663000: INFO : b'Exiting due to channel error.'
2024-02-28T12:24:40.664000: INFO : b'Exiting due to channel error.'
2024-02-28T12:24:40.664000: INFO : b'Exiting due to channel error.'
2024-02-28T12:24:40.664000: INFO : b'Exiting due to channel error.'
2024-02-28T12:24:40.664000: INFO : b'Exiting due to channel error.'
2024-02-28T12:24:40.710000: WARNING : Process exited with code -5
2024-02-28T12:24:42.152000: INFO : Narrowed integration regression window from [75e12d12, b1c67b9f] (4 builds) to [75e12d12, 7346a5d9] (3 builds) (~1 steps left)
2024-02-28T12:24:42.155000: INFO : Running autoland build built on 2024-02-27 00:45:49.593000, revision 3475061c
2024-02-28T12:24:42.350000: DEBUG : urllib3.connectionpool: https://firefox-ci-tc.services.mozilla.com:443 "GET /api/queue/v1/task/Cc8QCYiJQhK3GdO11ATOxw/runs/0/artifacts/public%2Fbuild%2Ftarget.tar.bz2 HTTP/1.1" 303 134
2024-02-28T12:24:42.762000: DEBUG : urllib3.connectionpool: https://firefoxci.taskcluster-artifacts.net:443 "GET /Cc8QCYiJQhK3GdO11ATOxw/0/public/build/target.tar.bz2 HTTP/1.1" 200 94694038
2024-02-28T12:24:49.259000: INFO : Launching /tmp/tmpjwba6a13/firefox/firefox
2024-02-28T12:24:49.260000: INFO : Application command: /tmp/tmpjwba6a13/firefox/firefox --allow-downgrade -profile /tmp/tmp0dxzien7.mozrunner
2024-02-28T12:24:49.269000: INFO : application_buildid: 20240223120617
2024-02-28T12:24:49.269000: INFO : application_changeset: 3475061cb5df2fea5ed9e240a7508368ff6f23b8
2024-02-28T12:24:49.270000: INFO : application_display_name: Firefox Nightly
2024-02-28T12:24:49.270000: INFO : application_id: {ec8030f7-c20a-464f-9b0e-13a3a9e97384}
2024-02-28T12:24:49.270000: INFO : application_name: Firefox
2024-02-28T12:24:49.270000: INFO : application_remotingname: firefox-nightly-autoland
2024-02-28T12:24:49.270000: INFO : application_repository: https://hg.mozilla.org/integration/autoland
2024-02-28T12:24:49.271000: INFO : application_vendor: Mozilla
2024-02-28T12:24:49.271000: INFO : application_version: 125.0a1
2024-02-28T12:24:49.271000: INFO : platform_buildid: 20240223120617
2024-02-28T12:24:49.271000: INFO : platform_changeset: 3475061cb5df2fea5ed9e240a7508368ff6f23b8
2024-02-28T12:24:49.271000: INFO : platform_repository: https://hg.mozilla.org/integration/autoland
2024-02-28T12:24:49.271000: INFO : platform_version: 125.0a1
2024-02-28T12:25:13.860000: INFO : Narrowed integration regression window from [75e12d12, 7346a5d9] (3 builds) to [3475061c, 7346a5d9] (2 builds) (~1 steps left)
2024-02-28T12:25:13.864000: DEBUG : Starting merge handling...
2024-02-28T12:25:13.864000: DEBUG : Using url: https://hg.mozilla.org/integration/autoland/json-pushes?changeset=7346a5d91e93697de1af5ba25e9cb68dd940c215&full=1
2024-02-28T12:25:13.865000: DEBUG : redo: attempt 1/3
2024-02-28T12:25:13.865000: DEBUG : redo: retry: calling _default_get with args: ('https://hg.mozilla.org/integration/autoland/json-pushes?changeset=7346a5d91e93697de1af5ba25e9cb68dd940c215&full=1',), kwargs: {}, attempt #1
2024-02-28T12:25:13.868000: DEBUG : urllib3.connectionpool: Resetting dropped connection: hg.mozilla.org
2024-02-28T12:25:15.392000: DEBUG : urllib3.connectionpool: https://hg.mozilla.org:443 "GET /integration/autoland/json-pushes?changeset=7346a5d91e93697de1af5ba25e9cb68dd940c215&full=1 HTTP/1.1" 200 None
2024-02-28T12:25:15.428000: DEBUG : Found commit message:
Bug 1880323 [Linux] Make nsWindow::GetTitlebarRect() thread safe r=emilio

- Implement nsWindow::SetTitlebarRect() and update titlebar area when nsWindow is resized.
- Make GetTitlebarRect() to only return value calculated at SetTitlebarRect().
- Protect both by mutex to make it thread safe.

Differential Revision: https://phabricator.services.mozilla.com/D202565```

I've seen this twice, and indeed dragging tabs so they're the last tab is something I'd do regularly.

Bug 1882462 may help here.

Blocks: linuxdad
status-firefox124: unaffected → affected
Priority: -- → P2

I can reproduce it, it's X11 only.

Bug 1882462 fixes it for me, but will try to find root cause here.

Flags: needinfo?(stransky)

The bug here is caused by rendering to old XWindow after popup hide/show:

[Parent 316068: Main Thread]: D/WidgetPopup [7f8ec3070200]: nsWindow::OnMap
[Parent 316068: Main Thread]: D/WidgetPopup [7f8ec3070200]: nsWindow::ConfigureGdkWindow()
[Parent 316068: Main Thread]: D/WidgetPopup [7f8ec3070200]: GtkCompositorWidget::GtkCompositorWidget() [7f8ec3070200] mXWindow 10000c2 
[Parent 316068: Main Thread]: D/WidgetPopup [7f8ec3070200]: nsWindow::OnUnmap
....
[Parent 316068: Main Thread]: D/WidgetPopup [7f8ec3070200]: nsWindow::OnMap
[Parent 316068: Main Thread]: D/WidgetPopup [7f8ec3070200]: nsWindow::ConfigureGdkWindow()
[Parent 316068: Main Thread]: D/WidgetPopup [7f8ec3070200]:   finished, new GdkWindow 7f8ec30fb8c0 XID 0x10000e1
[Parent 316068, Main Thread] WARNING: X_CopyArea: BadDrawable (invalid Pixmap or Window parameter); 2 requests ago; id=0x10000c2
Assignee: nobody → stransky
Flags: needinfo?(stransky)

We removed compositor Pause/Resume sequence from popup hide/show as it causes UI freezes. But it also removes XWindow refresh on X11 so we keep old X11 window in GtkCompositorWidget in some cases.

Flags: needinfo?(stransky)

Will come with fix today as it affects beta too.

Duplicate of this bug: 1882580
Flags: needinfo?(stransky)
Pushed by stransky@redhat.com: https://hg.mozilla.org/integration/autoland/rev/f4eb76daa674 [Linux/X11] Clean up XWindow from GtkCompositorWidget and disable rendering if nsWindow is unmapped r=emilio
See Also: → 1880619

Backed out for causing multiple mochitest failures

Backout link

Push with failures

Failure log // Failure log 2

Flags: needinfo?(stransky)

Looks like we're missing ~WindowSurfaceProvider() implementation.

Flags: needinfo?(stransky)
Pushed by stransky@redhat.com: https://hg.mozilla.org/integration/autoland/rev/7fab2be8b268 [Linux/X11] Clean up XWindow from GtkCompositorWidget and disable rendering if nsWindow is unmapped r=emilio https://hg.mozilla.org/integration/autoland/rev/9da201be1e1d [Linux] Make sure GtkCompositorWidget::mWidget reference is released on nsWindow::Destroy() to avoid nsWindow leak r=emilio

The patch landed in nightly and beta is affected.
:stransky, is this bug important enough to require an uplift?

  • If yes, please nominate the patch for beta approval.
  • If no, please set status-firefox124 to wontfix.

For more information, please visit BugBot documentation.

Flags: needinfo?(stransky)

Comment on attachment 9388345 [details]
Bug 1882021 [Linux/X11] Clean up XWindow from GtkCompositorWidget and disable rendering if nsWindow is unmapped r?emilio

Beta/Release Uplift Approval Request

  • User impact if declined: Crash if window tab is D&D between browsers on X11.
  • Is this code covered by automated tests?: No
  • Has the fix been verified in Nightly?: No
  • Needs manual test from QE?: Yes
  • If yes, steps to reproduce: On X11 / XWayland.
  1. Open browser, open more tabs
  2. Repeatedly move tabs
  3. Should on crash
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Disables rendering on window hide, we have it here before already.
  • String changes made/needed:
  • Is Android affected?: No
Flags: needinfo?(stransky)
Attachment #9388345 - Flags: approval-mozilla-beta?
Attachment #9388500 - Flags: approval-mozilla-beta?

Comment on attachment 9388345 [details]
Bug 1882021 [Linux/X11] Clean up XWindow from GtkCompositorWidget and disable rendering if nsWindow is unmapped r?emilio

Approved for 124.0b7

Attachment #9388345 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Attachment #9388500 - Flags: approval-mozilla-beta? → approval-mozilla-beta+

Needed to backout of beta for 124.0b7 due to serveral mochitest failures on that push
:stransky can you take a look at these mochitest failures ?
looks like this caused bug 1883250

Pre-Beta try build
Beta push
Backout Push

status-firefox124: fixed → affected
Flags: needinfo?(stransky)
Regressions: 1883250

Sure, will look at it.

https://phabricator.services.mozilla.com/D203485 is Beta patch only. Nightly doesn't need is as we destroy later manager for hidden popups there (Bug 1882462).

Flags: needinfo?(stransky)

Comment on attachment 9389160 [details]
Bug 1882021 [Linux/X11] Call GtkCompositorWidget::DisableRendering() before GtkCompositorWidget::EnableRendering() to make sure new XWindow is applied r?emilio

Beta/Release Uplift Approval Request

  • User impact if declined: Browser freeze after browser tab D&D on X11/XWayland.
  • Is this code covered by automated tests?: No
  • Has the fix been verified in Nightly?: No
  • Needs manual test from QE?: Yes
  • If yes, steps to reproduce: Test on X11 / XWayland
  1. Open browser, open more tabs
  2. Repeatedly move tabs
  3. Should on crash
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Force refresh XWindow before we use it.
  • String changes made/needed:
  • Is Android affected?: No
Attachment #9389160 - Flags: approval-mozilla-beta?
Flags: qe-verify+
Attachment #9388345 - Flags: approval-mozilla-beta+
Attachment #9388500 - Flags: approval-mozilla-beta+

Comment on attachment 9389160 [details]
Bug 1882021 [Linux/X11] Call GtkCompositorWidget::DisableRendering() before GtkCompositorWidget::EnableRendering() to make sure new XWindow is applied r?emilio

Approved for 124.0b8.

Attachment #9389160 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
QA Whiteboard: [qa-triaged]

Reproduced the issue with Firefox 125.0a1 (2024-02-26) and 124.0b6 on Ubuntu 23.10 X11 Windows Protocol by following steps from comment 20. Firefox silently crashes after dragging tabs on the tabstrip but the issue is intermittent and I could not find reliable steps because it happens randomly.

I could no longer reproduce the issue on Ubuntu 23.10 and Ubuntu 22.04 using the X11 Window Protocol by randomly moving tabs in the tab trip approximately 100 times while multiple tabs were open in Firefox versions 125.0a1 (2024-03-05) and 124.0b8 (20240304193224) treeherder build from comment 30. On Firefox 124.0b8 treeherder build I have also tried the XWayland window protocol and the issue was not reproduced. I think it's safe to mark this as verified since the issue could not be reproduced after so many tries.

Status: RESOLVED → VERIFIED
Has STR: --- → yes
QA Whiteboard: [qa-triaged]
status-firefox124: fixed → verified
status-firefox125: fixed → verified
Flags: qe-verify+
Duplicate of this bug: 1884165

Copying crash signatures from duplicate bugs.

Crash Signature: [@ handle_response | _gdk_x11_get_window_child_info] → [@ handle_response | _gdk_x11_get_window_child_info] [@ handle_response | XCompositeGetOverlayWindow] [@ handle_response | XShapeGetRectangles]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: