1999029 - mozilla::detail::InvalidArrayIndex_CRASH | ElementAt | mozilla::widget::WaylandBuffer::IsAttached is still present on Fedora KDE with 144.0.2

Status: RESOLVED FIXED

(Core :: Widget: Gtk, defect, P2)

Description

[Arcadiy Ivanov]

This is to reopen https://bugzilla.mozilla.org/show_bug.cgi?id=1990430
As can be clearly seen in this https://crash-stats.mozilla.org/signature/?signature=mozilla%3A%3Adetail%3A%3AInvalidArrayIndex_CRASH%20%7C%20ElementAt%20%7C%20mozilla%3A%3Awidget%3A%3AWaylandBuffer%3A%3AIsAttached the crash is still present with 144.0.2 in Fedora 42/43 KDE and is not fixed.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The bug has a crash signature, thus the bug will be considered confirmed.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:nika, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[Nika Layzell [:nika] (ni? for response)]

:emilio, do you have any idea how this might still be happening?

Comment 4

[Emilio Cobos Álvarez [:emilio]]

Not sure, if this is fedora-only it's a bit suspicious. Martin, are you enabling something wayland-related in Fedora that could explain this? Maybe the array getting modified from another thread could be the other thing that explains it if it's not a miscompilation?

Comment 5

[Martin Stránský [:stransky] (ni? me)]

(In reply to Emilio Cobos Álvarez [:emilio] from comment #4)

Not sure, if this is fedora-only it's a bit suspicious. Martin, are you enabling something wayland-related in Fedora that could explain this? Maybe the array getting modified from another thread could be the other thing that explains it if it's not a miscompilation?

No, we don't ship any extra patches/features. But we use GCC+PGO+LTO to build Firefox. I've seen the bug coming from Thunderbird too and there may be other GCC regressions there.

Comment 6

[Martin Stránský [:stransky] (ni? me)]

AFAIK The original bug is UAF but the new one looks like null crashes at wayland buffer management. But the crashes comes from Gnome/KDE/Sway so not may be compositor related and also affects Fedora 42/43 only (they may use the same GCC version).

Comment 7

[Martin Stránský [:stransky] (ni? me)]

Attachment: WIP: Bug 1999029 [Wayland] Access to WaylandBuffer::mBufferTransactions under lock

Comment 8

[Martin Stránský [:stransky] (ni? me)]

Let's try to add proper lock for the transactions access.

Comment 10

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1999029 [Wayland] Require held WaylandSurfaceLock to access WaylandBuffer transactions r?emilio

Comment 11

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1999029 [Wayland] Use WaylandSurfaceLock instead of Mutex at WindowSurfaceWaylandMB r?emilio

Comment 12

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1999029 [Wayland] Update WaylandSurface logging r?emilio

Comment 13

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1999029 [Wayland] Update SurfacePoolWayland for WaylandSurfaceLock r?emilio

Comment 14

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1999029 [Wayland] Update NativeLayerWayland for WaylandSurfaceLock r?emilio

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/8920b213567c
https://hg.mozilla.org/integration/autoland/rev/1aeee61d2939
[Wayland] Require held WaylandSurfaceLock to access WaylandBuffer transactions r=emilio
https://github.com/mozilla-firefox/firefox/commit/793b7d497dcd
https://hg.mozilla.org/integration/autoland/rev/74815d125870
[Wayland] Use WaylandSurfaceLock instead of Mutex at WindowSurfaceWaylandMB r=emilio
https://github.com/mozilla-firefox/firefox/commit/a066e82799f5
https://hg.mozilla.org/integration/autoland/rev/9ad9a74a572a
[Wayland] Update WaylandSurface logging r=emilio
https://github.com/mozilla-firefox/firefox/commit/ffc361ea5477
https://hg.mozilla.org/integration/autoland/rev/7d3393c23b4b
[Wayland] Update SurfacePoolWayland for WaylandSurfaceLock r=emilio
https://github.com/mozilla-firefox/firefox/commit/d479752de00c
https://hg.mozilla.org/integration/autoland/rev/35a6d6be5195
[Wayland] Update NativeLayerWayland for WaylandSurfaceLock r=emilio

Comment 16

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/1aeee61d2939
https://hg.mozilla.org/mozilla-central/rev/74815d125870
https://hg.mozilla.org/mozilla-central/rev/9ad9a74a572a
https://hg.mozilla.org/mozilla-central/rev/7d3393c23b4b
https://hg.mozilla.org/mozilla-central/rev/35a6d6be5195

Comment 17

[Arcadiy Ivanov]

The current is 146. Can this be backported to 146 or 147 please?

Comment 19

[Martin Stránský [:stransky] (ni? me)]

It's also possible that's another GCC/Fedora only bug similar to Bug 1990430.

Comment 20

[Martin Stránský [:stransky] (ni? me)]

If this one is GCC misscompilation bug it's related to this array:
https://searchfox.org/firefox-main/rev/e5219f2ad48f6b993c34fc25961e5900ffabfe65/widget/gtk/WaylandBuffer.h#89

AutoTArray<RefPtr<BufferTransaction>, 3> mBufferTransactions;

AutoTArray was created as copyable, so RefPtr may be the factor here?

Comment 21

[Martin Stránský [:stransky] (ni? me)]

GCC throws various nsTArray warnings for widget/gtk. Let's investigate and fix that first.

Comment 22

[Martin Stránský [:stransky] (ni? me)]

Filed as Bug 2011283.

Comment 23

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:stransky, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox148 to wontfix.

For more information, please visit BugBot documentation.

Comment 24

[Martin Stránský [:stransky] (ni? me)]

Backported to Fedora 147.0 packages directly. Let's see if it helps as we have Fedora crashes only so far.

Comment 25

[Arcadiy Ivanov]

(In reply to Martin Stránský [:stransky] (ni? me) from comment #24)

Backported to Fedora 147.0 packages directly. Let's see if it helps as we have Fedora crashes only so far.

Thank you! I've installed on the problem machine and waiting for crash reports (if any).

Comment 26

[Donal Meehan [:dmeehan]]

(In reply to Martin Stránský [:stransky] (ni? me) from comment #24)

Backported to Fedora 147.0 packages directly. Let's see if it helps as we have Fedora crashes only so far.

:stransky, is there any need to uplift this to beta? Just wondering about the Fx148 status

Comment 27

[Arcadiy Ivanov]

I'd like to report that the crashes continue, unfortunately.

Comment 28

[Martin Stránský [:stransky] (ni? me)]

Okay, then it looks like Fedora specific GCC bug then.

Comment 29

[Martin Stránský [:stransky] (ni? me)]

There's new Firefox update for Fedora with the patches backported:
https://bodhi.fedoraproject.org/updates/FEDORA-2026-9d760b70d5
Let's see if the volume goes down with the patches there.

Comment 30

[Martin Stránský [:stransky] (ni? me)]

The crash volume looks promising - I don't see crashes from builds installed after 2026-01-20 which is the one with backports.

Comment 31

[Martin Stránský [:stransky] (ni? me)]

(In reply to Arcadiy Ivanov from comment #27)

I'd like to report that the crashes continue, unfortunately.

Can you please install these builds and test:
https://bodhi.fedoraproject.org/updates/FEDORA-2026-7a3e7d9328
https://bodhi.fedoraproject.org/updates/FEDORA-2026-0e5dfe99f0

and if you see any crashes please submit crash ID here from about:crashes.
Thanks.

Comment 32

[Arcadiy Ivanov]

Hi

Sorry, I'm confused. Would you like me to try one and then another? They contain different patches? Or you want me to try the latest of the two?

Comment 33

[Arcadiy Ivanov]

The latest crash is this: https://crash-stats.mozilla.org/report/index/d5b2fd11-fc5e-4afe-b6d9-3ab9b0260120

Comment 34

[Martin Stránský [:stransky] (ni? me)]

(In reply to Arcadiy Ivanov from comment #33)

The latest crash is this: https://crash-stats.mozilla.org/report/index/d5b2fd11-fc5e-4afe-b6d9-3ab9b0260120

Please install latest package for your Fedora and try again. This is from the old one.

firefox-147.0.1-5 has the backported fixes:
https://bodhi.fedoraproject.org/updates/FEDORA-2026-b870bff523
https://bodhi.fedoraproject.org/updates/FEDORA-2026-4d2a7298e1

Comment 35

[Martin Stránský [:stransky] (ni? me)]

As the patches here fixes the crash here it seems to affects Fedora only so we may not need to uplift them as they're pretty intrusive.

Comment 36

[Arcadiy Ivanov]

https://crash-stats.mozilla.org/report/index/d8fa3dde-5c2c-4576-96bd-655c90260202
https://crash-stats.mozilla.org/report/index/63a78bb8-ac8f-4a50-8196-60de90260202

These are from https://bodhi.fedoraproject.org/updates/FEDORA-2026-4d2a7298e1

Comment 37

[Martin Stránský [:stransky] (ni? me)]

Thanks, but these looks different - I see it crashes at SurfacePoolWayland::ReturnBufferToPool () directly.

Comment 38

[Martin Stránský [:stransky] (ni? me)]

(In reply to Arcadiy Ivanov from comment #36)

https://crash-stats.mozilla.org/report/index/d8fa3dde-5c2c-4576-96bd-655c90260202
https://crash-stats.mozilla.org/report/index/63a78bb8-ac8f-4a50-8196-60de90260202

These are from https://bodhi.fedoraproject.org/updates/FEDORA-2026-4d2a7298e1

Please test latest nightly:
https://fedoraproject.org/wiki/How_to_debug_Firefox_problems#Testing_Mozilla_Nightly_binaries
and if you see it please file a new report. The two crashes comes from HDR code which is disabled by default.
Thanks.

Comment 39

[Arcadiy Ivanov]

The latest nightly experienced a different crash: https://bugzilla.mozilla.org/show_bug.cgi?id=2022411