This Linux crash signature first appeared in 79 Nightly build ID 20200629094229, but spiked yesterday in 80 Nightly build ID 20200723095657. About 52% of the crash reports have Fission enabled.

This crash might be related to Wayland crash bug 1645678.

This bug is for crash report bp-bf89a02a-2415-4365-98c8-0f92a0200724.

Top 10 frames of crashing thread:

0 libxul.so mozilla::layers::DMABUFTextureData::FillInfo const gfx/layers/opengl/DMABUFTextureClientOGL.cpp:55
1 libxul.so mozilla::layers::TextureClient::TextureClient gfx/layers/client/TextureClient.cpp:1430
2 libxul.so mozilla::layers::TextureClient::CreateForDrawing gfx/layers/client/TextureClient.cpp:1244
3 libxul.so mozilla::layers::TextureClient::CreateForDrawing gfx/layers/client/TextureClient.cpp:1216
4 libxul.so mozilla::layers::PersistentBufferProviderShared::Create gfx/layers/PersistentBufferProvider.cpp:126
5 libxul.so mozilla::layers::WebRenderLayerManager::CreatePersistentBufferProvider gfx/layers/wr/WebRenderLayerManager.cpp:707
6 libxul.so mozilla::dom::CanvasRenderingContext2D::TrySharedTarget dom/canvas/CanvasRenderingContext2D.cpp:1412
7 libxul.so mozilla::dom::CanvasRenderingContext2D::EnsureTarget dom/canvas/CanvasRenderingContext2D.cpp:1276
8 libxul.so mozilla::dom::CanvasRenderingContext2D::ClearRect dom/canvas/CanvasRenderingContext2D.cpp:2485
9 libxul.so mozilla::dom::CanvasRenderingContext2D_Binding::clearRect dom/bindings/CanvasRenderingContext2DBinding.cpp:5847

I wonder if this is another path we can crash that I was trying to fix in bug 1650748. It landed in the aforementioned build 20200723095657. The crash report indicates the user does not have Wayland.

Startup crash with MOZ_X11_EGL=1 firefox/firefox if widget.dmabuf-textures.enabled is true.
bp-e22e85f3-bb5e-4450-90f1-76c140200726
MOZ_X11_EGL=1 mozregression --launch 20200725211804 --pref gfx.webrender.all:true widget.dmabuf-textures.enabled:true

No crashes before build 20200723095657 (bug 1650748).

MOZ_X11_EGL=1 mozregression --good 2020-07-20 --bad 20200725211804 --pref gfx.webrender.all:true widget.dmabuf-textures.enabled:true layers.gpu-process.enabled:false

9:40.23 INFO: Last good revision: 36b357364a21a1bb95efffc911d2b8d02fea007e
9:40.23 INFO: First bad revision: fe7075f48cf031d5686b3268a0e738581721b386
9:40.23 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=36b357364a21a1bb95efffc911d2b8d02fea007e&tochange=fe7075f48cf031d5686b3268a0e738581721b386

fe7075f48cf031d5686b3268a0e738581721b386 Andrew Osmond — Bug 1650748 - Prevent DMABUF usage with GLX. r=nical

The env var check was moved into an if (XRE_IsParentProcess()). Could that be the cause?
https://hg.mozilla.org/mozilla-central/rev/fe7075f48cf031d5686b3268a0e738581721b386#l3.23

MOZ_X11_EGL=1 mozregression --launch 20200725211804 --pref gfx.webrender.all:true widget.dmabuf-textures.enabled:true layers.gpu-process.enabled:false -B debug

0:32.82 INFO: b'Assertion failure: mSurface, at /builds/worker/checkouts/gecko/gfx/layers/opengl/DMABUFTextureClientOGL.cpp:18'

https://searchfox.org/mozilla-central/rev/397cecfb2bcf336068ac19d60d953545185d8282/gfx/layers/opengl/DMABUFTextureClientOGL.cpp#18

bad: startup crash
good: no crash
MOZ_X11_EGL=1 mozregression --find-fix --bad 20200725211804 --good 2020-08-02 --pref gfx.webrender.all:true widget.dmabuf-textures.enabled:true

6:09.95 INFO: First good revision: ffcc8759332879300c63fafc4a01521d9fbb6aec
6:09.95 INFO: Last bad revision: 5358ce55a5f4e1129df9c194ed6c1bf2a5aac26c
6:09.95 INFO: Pushlog:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=5358ce55a5f4e1129df9c194ed6c1bf2a5aac26c&tochange=ffcc8759332879300c63fafc4a01521d9fbb6aec

ffcc8759332879300c63fafc4a01521d9fbb6aec Martin Stransky — Bug 1655026 [Linux] Move dmabuf format setup from nsWaylandDisplay to nsDMABufDevice, r=rmader

It [...] and allows to create dmabuf surfaces on X11 EGL config.

The real cause was that https://hg.mozilla.org/mozilla-central/rev/fe7075f48cf031d5686b3268a0e738581721b386#l3.45 allowed enabling DMABUF textures on EGL/X11.