Core dump on Linux Nightly under X11 when moving a window in to become a tab in another window.
Categories
(Core :: Widget: Gtk, defect, P2)
Tracking
()
Tracking | Status | |
---|---|---|
firefox-esr91 | --- | unaffected |
firefox96 | --- | unaffected |
firefox97 | --- | fixed |
firefox98 | --- | fixed |
People
(Reporter: cks+mozilla, Assigned: stransky)
References
(Blocks 1 open bug, Regression)
Details
(Keywords: crash, regression)
Crash Data
Attachments
(1 file)
(deleted),
text/x-phabricator-request
|
RyanVM
:
approval-mozilla-beta+
|
Details |
Reproduction: start Firefox Nightly in a clean profile. Open a second window with Ctrl-N. Grab the titlebar and move the second window to become a tab in the first one. Firefox Nightly dumps core. I am using fvwm on 64-bit Fedora 34 on Intel integrated graphics (i7-8700K) on a 4k display.
Mozregression narrows this to https://hg.mozilla.org/integration/autoland/rev/841415a89add828287f52888deab7c107316f095, which is a commit for bug 1743821 that changes when things are released.
Reporter | ||
Comment 1•3 years ago
|
||
Manually backing out that changeset and building Trunk from source results in a Firefox that doesn't reproduce this problem (the backout is done with hg backout --no-commit 841415a89add828287f52888deab7c107316f095
).
Reporter | ||
Comment 2•3 years ago
|
||
Running current Trunk under gdb with run --sync -no-remote
(with a clean profile, and trying to turn on the environment variable but having it apparently ignored), I get:
(firefox:1957521): Gdk-ERROR **: 11:32:12.795: The program 'firefox' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadWindow (invalid Window parameter)'.
(Details: serial 9825 error_code 3 request_code 129 (SHAPE) minor_code 2)
(Note to programmers: normally, X errors are reported asynchronously;
that is, you will receive the error a while after causing it.
To debug your program, run it with the GDK_SYNCHRONIZE environment
variable to change this behavior. You can then get a meaningful
backtrace from your debugger if you break on the gdk_x_error() function.)
Thread 1 "firefox" received signal SIGTRAP, Trace/breakpoint trap.
0x00007ffff5a9eb6f in g_log_writer_default () from /lib64/libglib-2.0.so.0
(gdb) where
#0 0x00007ffff5a9eb6f in g_log_writer_default () at /lib64/libglib-2.0.so.0
#1 0x00007ffff5a99f43 in g_log_structured_array () at /lib64/libglib-2.0.so.0
#2 0x00007ffff5a9a143 in g_log_structured_standard ()
at /lib64/libglib-2.0.so.0
#3 0x00007ffff6323b34 in gdk_x_error.lto_priv () at /lib64/libgdk-3.so.0
#4 0x00007ffff6184a84 in _XError () at /lib64/libX11.so.6
#5 0x00007ffff6184b87 in handle_error () at /lib64/libX11.so.6
#6 0x00007ffff6184c25 in handle_response () at /lib64/libX11.so.6
#7 0x00007ffff61864dd in _XReply () at /lib64/libX11.so.6
#8 0x00007ffff617965f in XSync () at /lib64/libX11.so.6
#9 0x00007ffff61796ff in _XSyncFunction.lto_priv.0 () at /lib64/libX11.so.6
#10 0x00007ffff0a02899 in mozilla::widget::WindowSurfaceX11Image::~WindowSurfaceX11Image() (this=0x7fffb68396a0)
at /data/code/mozilla-hg/mozilla-central/widget/gtk/WindowSurfaceX11Image.cpp:47
#11 mozilla::widget::WindowSurfaceX11Image::~WindowSurfaceX11Image()
(this=0x7fffb68396a0)
at /data/code/mozilla-hg/mozilla-central/widget/gtk/WindowSurfaceX11Image.cpp:40
#12 0x00007ffff0a00726 in mozilla::widget::WindowSurface::Release()
(this=0x7ffff7900020)
at /data/code/mozilla-hg/build-objdir/dist/include/mozilla/widget/WindowSurface.h:19
#13 mozilla::RefPtrTraits<mozilla::widget::WindowSurface>::Release(mozilla::widget::WindowSurface*) (aPtr=0x7ffff7900020)
at /data/code/mozilla-hg/build-objdir/dist/include/mozilla/RefPtr.h:50
#14 RefPtr<mozilla::widget::WindowSurface>::ConstRemovingRefPtrTraits<mozilla::widget::WindowSurface>::Release(mozilla::widget::WindowSurface*)
(aPtr=0x7ffff7900020)
at /data/code/mozilla-hg/build-objdir/dist/include/mozilla/RefPtr.h:381
#15 RefPtr<mozilla::widget::WindowSurface>::assign_assuming_AddRef(mozilla::widget::WindowSurface*) (this=0x7fffbaec22a0, aNewPtr=0x0)
at /data/code/mozilla-hg/build-objdir/dist/include/mozilla/RefPtr.h:69
#16 RefPtr<mozilla::widget::WindowSurface>::operator=(decltype(nullptr))
(this=0x7fffbaec22a0)
at /data/code/mozilla-hg/build-objdir/dist/include/mozilla/RefPtr.h:168
#17 mozilla::widget::WindowSurfaceProvider::CleanupWindowSurface()
(this=0x7fffbaec22a0)
at /data/code/mozilla-hg/mozilla-central/widget/gtk/WindowSurfaceProvider.cpp:93
#18 mozilla::widget::WindowSurfaceProvider::~WindowSurfaceProvider()
(this=0x7fffbaec22a0)
at /data/code/mozilla-hg/mozilla-central/widget/gtk/WindowSurfaceProvider.cpp:59
#19 0x00007ffff09f7daf in mozilla::widget::GtkCompositorWidget::~GtkCompositorWidget() (this=0x7fffbaec2240)
at /data/code/mozilla-hg/mozilla-central/widget/gtk/GtkCompositorWidget.cpp:60
--Type <RET> for more, q to quit, c to continue without paging--
#20 0x00007ffff09fd391 in mozilla::widget::InProcessGtkCompositorWidget::~InProcessGtkCompositorWidget() (this=0x7fffbaec2240)
at /data/code/mozilla-hg/mozilla-central/widget/gtk/InProcessGtkCompositorWidget.h:16
#21 0x00007fffeed4fbc2 in mozilla::widget::CompositorWidget::Release()
(this=0x7ffff7900020)
at /data/code/mozilla-hg/build-objdir/dist/include/mozilla/widget/CompositorWidget.h:89
#22 mozilla::RefPtrTraits<mozilla::widget::CompositorWidget>::Release(mozilla::widget::CompositorWidget*) (aPtr=0x7ffff7900020)
at /data/code/mozilla-hg/build-objdir/dist/include/mozilla/RefPtr.h:50
#23 RefPtr<mozilla::widget::CompositorWidget>::ConstRemovingRefPtrTraits<mozilla::widget::CompositorWidget>::Release(mozilla::widget::CompositorWidget*)
(aPtr=0x7ffff7900020)
at /data/code/mozilla-hg/build-objdir/dist/include/mozilla/RefPtr.h:381
#24 RefPtr<mozilla::widget::CompositorWidget>::assign_assuming_AddRef(mozilla::widget::CompositorWidget*) (this=0x7fffb3fdd938, aNewPtr=0x0)
at /data/code/mozilla-hg/build-objdir/dist/include/mozilla/RefPtr.h:69
#25 RefPtr<mozilla::widget::CompositorWidget>::operator=(decltype(nullptr))
(this=0x7fffb3fdd938)
at /data/code/mozilla-hg/build-objdir/dist/include/mozilla/RefPtr.h:168
#26 mozilla::layers::InProcessCompositorSession::Shutdown()
(this=0x7fffb3fdd900)
at /data/code/mozilla-hg/mozilla-central/gfx/ipc/InProcessCompositorSession.cpp:92
#27 0x00007ffff094d6ad in nsBaseWidget::DestroyCompositor() (this=
0x7fffae3c8000)
at /data/code/mozilla-hg/mozilla-central/widget/nsBaseWidget.cpp:365
#28 0x00007ffff09b4f89 in nsWindow::Destroy() (this=0x7fffae3c8000)
at /data/code/mozilla-hg/mozilla-central/widget/gtk/nsWindow.cpp:592
#29 0x00007ffff0942d96 in DestroyWidgetRunnable::Run() (this=0x7fffb1f7cf40)
at /data/code/mozilla-hg/mozilla-central/view/nsView.cpp:120
#30 0x00007fffedcdbef9 in mozilla::RunnableTask::Run() (this=0x7fffb0f26700)
at /data/code/mozilla-hg/mozilla-central/xpcom/threads/TaskController.cpp:468
#31 0x00007fffedcc2840 in mozilla::TaskController::DoExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
(this=this@entry=0x7fffdc473280, aProofOfLock=...)
at /data/code/mozilla-hg/mozilla-central/xpcom/threads/TaskController.cpp:771
#32 0x00007fffedcc1919 in mozilla::TaskController::ExecuteNextTaskOnlyMainThreadInternal(mozilla::detail::BaseAutoLock<mozilla::Mutex&> const&)
(this=this@entry=0x7fffdc473280, aProofOfLock=...)
at /data/code/mozilla-hg/mozilla-central/xpcom/threads/TaskController.cpp:607
#33 0x00007fffedcc1b0f in mozilla::TaskController::ProcessPendingMTTask(bool)
(this=0x7fffdc473280, aMayWait=false)
at /data/code/mozilla-hg/mozilla-central/xpcom/threads/TaskController.cpp:39--Type <RET> for more, q to quit, c to continue without paging--
1
#34 0x00007fffedcd7a32 in mozilla::TaskController::InitializeInternal()::$_0::operator()() const (this=<optimized out>)
at /data/code/mozilla-hg/mozilla-central/xpcom/threads/TaskController.cpp:124
#35 mozilla::detail::RunnableFunction<mozilla::TaskController::InitializeInternal()::$_0>::Run() (this=<optimized out>)
at /data/code/mozilla-hg/mozilla-central/xpcom/threads/nsThreadUtils.h:531
#36 0x00007fffedccdfc0 in nsThread::ProcessNextEvent(bool, bool*)
(this=0x7ffff78e4430, aMayWait=<optimized out>, aResult=0x7fffffffc14f)
at /data/code/mozilla-hg/mozilla-central/xpcom/threads/nsThread.cpp:1195
#37 0x00007fffedcd2068 in NS_ProcessNextEvent(nsIThread*, bool)
(aThread=0x7ffff7900020, aThread@entry=0x7ffff78e4430, aMayWait=false)
at /data/code/mozilla-hg/mozilla-central/xpcom/threads/nsThreadUtils.cpp:467
#38 0x00007fffee3e38e8 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) (this=0x7fffdc452180, aDelegate=0x7ffff788c200)
at /data/code/mozilla-hg/mozilla-central/ipc/glue/MessagePump.cpp:85
#39 0x00007fffee35ed56 in MessageLoop::RunInternal() (this=0x3)
at /data/code/mozilla-hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:331
#40 MessageLoop::RunHandler() (this=0x3)
at /data/code/mozilla-hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:324
#41 MessageLoop::Run() (this=0x3)
at /data/code/mozilla-hg/mozilla-central/ipc/chromium/src/base/message_loop.cc:306
#42 0x00007ffff0989819 in nsBaseAppShell::Run() (this=0x7fffdc4ca0a0)
at /data/code/mozilla-hg/mozilla-central/widget/nsBaseAppShell.cpp:137
#43 0x00007ffff222ad07 in nsAppStartup::Run() (this=0x7fffdc137790)
at /data/code/mozilla-hg/mozilla-central/toolkit/components/startup/nsAppStartup.cpp:295
#44 0x00007ffff231509e in XREMain::XRE_mainRun() (this=this@entry=
0x7fffffffc480)
at /data/code/mozilla-hg/mozilla-central/toolkit/xre/nsAppRunner.cpp:5348
#45 0x00007ffff23158b4 in XREMain::XRE_main(int, char**, mozilla::BootstrapConfig const&)
(this=this@entry=0x7fffffffc480, argc=argc@entry=3, argv=argv@entry=0x7fffffffd728, aConfig=...)
at /data/code/mozilla-hg/mozilla-central/toolkit/xre/nsAppRunner.cpp:5533
#46 0x00007ffff2315c0a in XRE_main(int, char**, mozilla::BootstrapConfig const&) (argc=3, argv=0x3, aConfig=...)
at /data/code/mozilla-hg/mozilla-central/toolkit/xre/nsAppRunner.cpp:5592
#47 0x000055555557b586 in do_main(int, char**, char**)
(argc=3, argv=0x7fffffffd728, envp=0x7fffffffd748)
at /data/code/mozilla-hg/mozilla-central/browser/app/nsBrowserApp.cpp:225
#48 main(int, char**, char**)
(argc=<optimized out>, argv=<optimized out>, envp=0x7fffffffd748)
--Type <RET> for more, q to quit, c to continue without paging--
at /data/code/mozilla-hg/mozilla-central/browser/app/nsBrowserApp.cpp:395
Updated•3 years ago
|
Comment 3•3 years ago
|
||
4 months ago, I could reproduce such a BadWindow XShape crash with GPU process on Nvidia: bug 1730991
From the reports, it seems to occur now even without GPU process and without Nvidia.
Updated•3 years ago
|
Updated•3 years ago
|
Assignee | ||
Comment 4•3 years ago
|
||
Will look at it on Monday.
Reporter | ||
Comment 5•3 years ago
|
||
If I run the picom
or xcompmgr
composition managers in my fvwm-based session, this crash doesn't happen. I can start one, run Firefox, have it work, Ctrl-C the program to stop it to revert to the same fvwm environment but without a composition manager, and re-run Firefox and get the crash.
Updated•3 years ago
|
Updated•3 years ago
|
Assignee | ||
Comment 8•3 years ago
|
||
Don't clear shape mask with XShapeCombineMask(), it's not needed and target darawable may be already deleted.
Updated•3 years ago
|
Assignee | ||
Updated•3 years ago
|
Assignee | ||
Comment 9•3 years ago
|
||
This affects non-compositing screens only.
Assignee | ||
Updated•3 years ago
|
Assignee | ||
Updated•3 years ago
|
Comment 10•3 years ago
|
||
Pushed by stransky@redhat.com: https://hg.mozilla.org/integration/autoland/rev/c0f80b6e8df2 [Linux] Don't set shape mask to released drawable, r=lsalzman
Comment 11•3 years ago
|
||
bugherder |
Comment 12•3 years ago
|
||
When was/will this be merged ? I ask because https://bugzilla.mozilla.org/show_bug.cgi?id=1749805 is a dupe but I am still getting crashes without any report screen or dump and just had one where I could not interact with my desktop (but saw other windows being updated behind firefox) and had to switch to a terminal session to kill the browser.
Comment 13•3 years ago
|
||
Does this crash still occur with https://nightly.mozilla.org?
Comment 14•3 years ago
|
||
I'm on 98.0a1 (2022-01-18) (64-bit)
Comment 15•3 years ago
|
||
The patch landed in nightly and beta is affected.
:stransky, is this bug important enough to require an uplift?
If not please set status_beta
to wontfix
.
For more information, please visit auto_nag documentation.
Comment 16•3 years ago
|
||
(In reply to zlice from comment #15)
I'm on 98.0a1 (2022-01-18) (64-bit)
Does the remaining unknown crash still occur after setting media.cubeb.sandbox_v2 to false on about:config and restarting Nightly? (bug 1750810)
Assignee | ||
Comment 17•3 years ago
|
||
Comment on attachment 9259385 [details]
Bug 1750017 [Linux] Don't set shape mask to released drawable, r?lsalzman
Beta/Release Uplift Approval Request
- User impact if declined: Crashes on X11 on non-compositing screen when window is closed.
- Is this code covered by automated tests?: No
- Has the fix been verified in Nightly?: No
- Needs manual test from QE?: No
- If yes, steps to reproduce:
- List of other uplifts needed: None
- Risk to taking this patch: Low
- Why is the change risky/not risky? (and alternatives if risky): Removed redundant X11 code. It's not needed and causes such crash due to invalid window handle.
- String changes made/needed:
Comment 18•3 years ago
|
||
Comment on attachment 9259385 [details]
Bug 1750017 [Linux] Don't set shape mask to released drawable, r?lsalzman
Approved for 97.0b7.
Chris, Beta builds with this fix should be available late Sunday/early Monday. If you have a chance, can you please check and see if the crashes are resolved for you after that? Otherwise, a current Nightly build should also have the fix if you wanted to try that out. Thanks!
Reporter | ||
Comment 19•3 years ago
|
||
A personal build made from Trunk no longer has this problem for me (and hasn't for some days). I just pulled and tested the current Nightly and it also seems to be fixed there.
Comment 20•3 years ago
|
||
bugherder uplift |
Updated•3 years ago
|
Updated•3 years ago
|
Updated•3 years ago
|
Description
•