Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1467104
| Summary: | [Wayland] Crash at gtk_tooltip_show_tooltip | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Christian Stadelmann <fedora> |
| Component: | firefox | Assignee: | Martin Stransky <stransky> |
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 26 | CC: | ashie, cosmo0920.oucc, gecko-bugs-nobody, jhorak, kengert, ofourdan, pjasicek, stransky |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-07-12 10:04:18 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1054334 | ||
| Attachments: | |||
|
Description
Christian Stadelmann
2017-07-02 21:27:24 UTC
Thanks. That crash comes from showing a tooltip window - I see that sometime but don't know what causes that yet. My colleague got another gtk tooltip related crash. Our crash report already reported in GTK+ bug tracker: https://bugzilla.gnome.org/show_bug.cgi?id=784319 Just to clarify, this is not Wayland, but firefox and CSD. See https://bugzilla.gnome.org/show_bug.cgi?id=784319#c10 Created attachment 1296141 [details] Remove moz_container_unrealize() It seems that the attached patch fixes a similar case (https://bugzilla.gnome.org/show_bug.cgi?id=784319). But I can't confirm this bug's case yet since I can't reproduce it yet. Someone, please test the patch. Created attachment 1296147 [details] A stack trace of another crash bug Although it fixes tooltip's crash, sometimes another crash occurs on my environment (attached log) after I apply the patch. It's more rare than before. It seems that using a fresh profile is easier to reproduce. Probably it's different bug from this one and it would happen from before. Note that our code & hardware is different from yours (see https://bugzilla.gnome.org/show_bug.cgi?id=784319). If it's not reproduced on your environment, please ignore it. Is that stack trace from attachment 1296147 [details] coming from a current gtk+-3.22 or an older version 3.20 as found in yocto iirc? Reason I'm asking is because this might be related: https://mail.gnome.org/archives/commits-list/2016-November/msg00706.html https://bugzilla.gnome.org/show_bug.cgi?id=773274 (and that was reported my Martin for Firefox on Wayland...) backtrace says 3.20.9 btw, so this is an older issue. Therefore my advise would be to make sure to test with a current gtk+ version (this bug here being reported against fedora 26 which ships an up-to-date version of gtk+) otherwise we might end up fighting old bugs again. I've installed Fedora 26 and built Firefox using https://github.com/stransky/gecko-dev/commit/de7ad4e633e6acb32a2a0d1403ef1a8c0539ad95. Now I've got a same backtrace with attachment 1293678 [details] on closing a browser window normally. Also I've confirmed that the patch in comment 4 (attachment 1296141 [details]) fixes the bug. In addition the crash described in comment 5 isn't occurred on this environment. (Although sometimes it still crashes at FcCacheFini(), it's obviously a different bug.) Added as commit dba7baee43fd9f75ae70c76f5ec4850f392cf0b9 - please check if that fixes for you. Created attachment 1296820 [details] Another solution to call GtkWidget's "unrealize" function From https://bugzilla.gnome.org/show_bug.cgi?id=784319#c23: (In reply to Martin Stransky from comment #23) > Well, and why is the "unrealize" handler call missing here? I think the > issue here is that the unrealize handler does not remove the GdkWindow > created in realize handler, right? Yes, that's right. When GtkWidget's "unrealize" function is called, GdkWindow will be destroyed by it: https://git.gnome.org/browse/gtk+/tree/gtk/gtkwidget.c#n10589 If "unrealize" function isn't overridden by a child class (like MozContainer), it will be called by default because initial "unrealize" function pointer is set as parent class's one (GtkContainer -> GtkWidget) by GTK+. If you want to override "unrealize" func, you should call GtkWidget's "unrealize" function by yourself (like attached patch). Otherwise it's never called. > With this patch we'll leak the wayland surfaces here. At first I wrote the attached patch. It also works fine. But I noticed that moz_container_unmap_surface() in moz_container_unrealize() isn't needed because it's also called at moz_container_unmap(). Since GTK+ make sure to call "unmap" function before "unrealize" function (if the window is already mapped), moz_container_unmap_surface() in moz_container_unrealize() is redundant. If we remove it, moz_container_unrealize() do nothing, it just calls parent class's unrealize. As I mentioned above, we don't need to override "unrealize" function in this case. (In reply to Martin Stransky from comment #9) > Added as commit dba7baee43fd9f75ae70c76f5ec4850f392cf0b9 - please check if > that fixes for you. I have no way to reproduce this bug, so I won't be able to check if that patch works, sorry. (In reply to ashie from comment #10) > Created attachment 1296820 [details] > If you want to override "unrealize" func, you should call GtkWidget's > "unrealize" function by yourself (like attached patch). Or do equivalent of it like your patch (https://github.com/stransky/gecko-dev/commit/dba7baee43fd9f75ae70c76f5ec4850f392cf0b9) :-) You're right - let's remove the unrealize handler. commit e1acac5a44d411d6058b38c26596873867abf49e |