Closed Bug 1660263 Opened 4 years ago Closed 4 years ago

wl_surface use-after-free

Categories

(Core :: Widget: Gtk, defect, P2)

Desktop
Linux
defect

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox81 --- affected

People

(Reporter: heftig, Unassigned)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

Firefox suddenly exits without the crashreporter activating. The log reports:

gnome-shell[1342]: WL: error in client communication (pid 50220)
MainThread[50220]: Error 22 (Invalid argument) dispatching to Wayland display.

I can provoke it like this:

  1. Make a new profile with gfx.webrender.all = true.
  2. Open https://developer.mozilla.org
  3. Make a few (5-10) searches using the search field in the top right to fill up its autocomplete popup.
  4. Open the autocomplete popup by double-clicking on the search field.
  5. Rapidly close and open the popup by clicking in the search field as fast as possible.
    The popup disappears on mouse-down and reappears on mouse-up.

I've attached a WAYLAND_DEBUG=1 log of the crashing Firefox, which shows:

[157125.605]  -> wl_compositor@57.create_surface(new id wl_surface@130)
...
[157127.058]  -> wl_surface@130.destroy()
...
[157131.931]  -> wl_surface@130.attach(wl_buffer@109, 0, 0)
...
[157132.730] wl_display@1.error(wl_display@1, 0, "invalid object 130")

Sometimes it falls back to the old OpenGL compositing instead of exiting. In this case I see:

[GFX1-]: Updating unknown shared surface: 17179869412
...
[GFX1-]: window is null
[GFX1-]: Failed to create EGLSurface
[GFX1-]: We don't have EGLSurface to draw into. Called too early?
[GFX1-]: We don't have EGLSurface to draw into. Called too early?
[GFX1-]: Compositors might be mixed (5,2)

Firefox Nightly 069bb8bd2356
GNOME Shell 3.36.5
GTK 3.24.22
Arch Linux
Dell XPS 13 2-in-1 7390 (Ice Lake)

Priority: -- → P2

I was able to confirm that on latest nightly + gnome master + mesa master.

Guys, do you still see it?
Thanks.

Flags: needinfo?(jan.steffens)

Haven't seen this in a while. Thanks.

Flags: needinfo?(jan.steffens)

Okay, let's close it for now.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: