User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0

Steps to reproduce:

KDE / Plasma / KWin on Arch Linux with proprietary NVidia drivers

Using Firefox on Wayland, trigger requestPointerLock while site already has pointer lock. Example here:

https://pastebin.com/27kgcFM1

Actual results:

Firefox crashes. Here are the last few log messages with Wayland debugging on:

[1621939.326] wl_callback@76.done(30121746)
[1621939.347] -> wl_surface@45.frame(new id wl_callback@76)
[1621939.354] -> wl_surface@45.commit()
[1621939.456] -> wl_compositor@51.create_region(new id wl_region@74)
[1621939.471] -> wl_region@74.add(0, 0, 1920, 1015)
[1621939.480] -> wl_surface@45.set_opaque_region(wl_region@74)
[1621939.491] -> wl_region@74.destroy()
[1621939.507] -> wl_surface@45.commit()
[1621940.051] -> zwp_pointer_constraints_v1@54.lock_pointer(new id zwp_locked_pointer_v1@79, wl_surface@40, wl_pointer@18, nil, 2)
[1621940.070] -> zwp_relative_pointer_manager_v1@55.get_relative_pointer(new id zwp_relative_pointer_v1@77, wl_pointer@18)
[1621940.570] -> wl_surface@45.attach(wl_buffer@67, 0, 0)
[1621940.586] -> wl_surface@45.damage(0, 0, 1920, 1015)
[1621940.594] -> wl_surface@45.commit()
[1621940.602] -> wl_display@1.sync(new id wl_callback@81)
[1621940.699] wl_display@1.delete_id(74)
[1621940.701] wl_display@1.error(zwp_pointer_constraints_v1@54, 1, "the surface is already constrained")
Gdk-Message: 16:35:00.593: Error reading events from display: Connection reset by peer
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.

Expected results:

Firefox doesn't crash.

The Bugbug bot thinks this bug should belong to the 'Core::Widget: Gtk' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Gnome Wayland, Debian Testing, Intel
bp-bf35c60e-2690-4b48-9b2d-392730230110

bad = Crash if you click into the black box.
$ MOZ_DISABLE_CONTENT_SANDBOX=1 MOZ_ENABLE_WAYLAND=1 mozregression --good 2021-01-01 --bad 2023-01-09 -a https://bugzilla.mozilla.org/attachment.cgi?id=9311534

4:51.13 INFO: Last good revision: 683c2a81d1a3230a9b2ae93162277244a99d4921 (2021-04-21)
4:51.13 INFO: First bad revision: 33143ef17c70c76f39ac75fe51d3ae9342365845 (2021-04-22)
4:51.13 INFO: Pushlog:
https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=683c2a81d1a3230a9b2ae93162277244a99d4921&tochange=33143ef17c70c76f39ac75fe51d3ae9342365845

This one sounds relevant:

94659f852c6663b297d2476fef3d4f19e2fd1ae9 Greg V — Bug 1580595 - [Wayland] Add support for pointer lock via relative-pointer and pointer-constraints r=stransky,rmader,emilio

Thanks for the reproducer, will have a look.

The bug is linked to a topcrash signature, which matches the following criterion:

• Top 5 desktop browser crashes on Linux on release

:stransky, could you consider increasing the severity of this top-crash bug?

For more information, please visit auto_nag documentation.

Thanks!

Based on comment #5, this bug contains a bisection range found by mozregression. However, the Regressed by field is still not filled.

:stransky, if possible, could you fill the Regressed by field?

For more information, please visit auto_nag documentation.

Regression comes from original implementation.

Set release status flags based on info from the regressing bug 1580595

https://hg.mozilla.org/mozilla-central/rev/650a44964036

Should we uplit to beta or can it ride the 111 train? Thanks

Comment on attachment 9312423 [details]
Bug 1809350 [Wayland] Unlock mouse pointer before repeated lock r?emilio

Beta/Release Uplift Approval Request

• User impact if declined: Crash on Wayland when mouse pointer is captured twice.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Release mouse lock before we get another one.
• String changes made/needed:
• Is Android affected?: No

Comment on attachment 9312423 [details]
Bug 1809350 [Wayland] Unlock mouse pointer before repeated lock r?emilio

Approved for 110 beta 3, thanks

https://hg.mozilla.org/releases/mozilla-beta/rev/453f2fd228bb

Reproduced the issue on Ubuntu 22.04 Gnome Wayland with Firefox 110.0a1 (2023-01-09) by opening the test case from comment 4 and clicking the box (crash id).
I can no longer reproduce the crash by clicking the box in the test case with Firefox 111.0a1 (2023-01-19) and 110.0b3 on Ubuntu 22.04 with Wayland.

Since I don't have Arch Linux available can you please verify that Firefox Beta and Firefox Nightly are no longer crashing on your end as well? Thank you in advance!

No crash for me on Arch with 110.0b3 or 111.0a1 using the attachment from comment 4. Thanks.

(In reply to rbrauer from comment #20)

No crash for me on Arch with 110.0b3 or 111.0a1 using the attachment from comment 4. Thanks.

Thank you!

I am going to close this based on comment 20 and comment 19.