Bug 1417996

Summary: Firefox/Wayland: crash at subsurface_role_get_toplevel()
Product: [Fedora] Fedora Reporter: Martin Stransky <stransky>
Component: gnome-shellAssignee: Owen Taylor <otaylor>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 25CC: fmuellner, jadahl, j.bittner, ofourdan, otaylor, wgianopoulos
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/241ec71e8004fb3ede24f91559a4f78b11f2392d
Whiteboard: abrt_hash:8ee440234af510ad061a50806d8ebd720ccbc580;VARIANT_ID=workstation;
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-06-19 12:29:41 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: exploitable
none
File: limits
none
File: maps
none
File: mountinfo
none
File: namespaces
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages none

Description Martin Stransky 2017-01-31 14:50:51 UTC 
Description of problem:
testing wayland firefox

Version-Release number of selected component:
gnome-shell-3.22.2-2.fc25

Additional info:
reporter:       libreport-2.8.0
backtrace_rating: 4
cmdline:        /usr/bin/gnome-shell
crash_function: subsurface_role_get_toplevel
executable:     /usr/bin/gnome-shell
global_pid:     12652
kernel:         4.9.6-200.fc25.x86_64
pkg_fingerprint: 4089 D8F2 FDB1 9C98
pkg_vendor:     Fedora Project
runlevel:       N 5
type:           CCpp
uid:            500

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 subsurface_role_get_toplevel at wayland/meta-wayland-surface.c:608
 #1 actor_surface_commit at wayland/meta-wayland-surface.c:2012
 #2 subsurface_role_commit at wayland/meta-wayland-surface.c:593
 #3 meta_wayland_surface_role_commit at wayland/meta-wayland-surface.c:1886
 #4 apply_pending_state at wayland/meta-wayland-surface.c:798
 #5 ffi_call_unix64 at ../src/x86/unix64.S:76
 #6 ffi_call at ../src/x86/ffi64.c:525
 #7 wl_closure_invoke at src/connection.c:935
 #8 wl_client_connection_data at src/wayland-server.c:371
 #9 wl_event_loop_dispatch at src/event-loop.c:423
Comment 1 Martin Stransky 2017-01-31 14:50:57 UTC 
Created attachment 1246293 [details]
File: backtrace
Comment 2 Martin Stransky 2017-01-31 14:50:58 UTC 
Created attachment 1246294 [details]
File: cgroup
Comment 3 Martin Stransky 2017-01-31 14:51:00 UTC 
Created attachment 1246295 [details]
File: core_backtrace
Comment 4 Martin Stransky 2017-01-31 14:51:02 UTC 
Created attachment 1246296 [details]
File: dso_list
Comment 5 Martin Stransky 2017-01-31 14:51:03 UTC 
Created attachment 1246297 [details]
File: environ
Comment 6 Martin Stransky 2017-01-31 14:51:04 UTC 
Created attachment 1246298 [details]
File: exploitable
Comment 7 Martin Stransky 2017-01-31 14:51:06 UTC 
Created attachment 1246299 [details]
File: limits
Comment 8 Martin Stransky 2017-01-31 14:51:08 UTC 
Created attachment 1246300 [details]
File: maps
Comment 9 Martin Stransky 2017-01-31 14:51:10 UTC 
Created attachment 1246301 [details]
File: mountinfo
Comment 10 Martin Stransky 2017-01-31 14:51:11 UTC 
Created attachment 1246303 [details]
File: namespaces
Comment 11 Martin Stransky 2017-01-31 14:51:13 UTC 
Created attachment 1246304 [details]
File: open_fds
Comment 12 Martin Stransky 2017-01-31 14:51:15 UTC 
Created attachment 1246305 [details]
File: proc_pid_status
Comment 13 Martin Stransky 2017-01-31 14:51:16 UTC 
Created attachment 1246306 [details]
File: var_log_messages
Comment 14 Martin Stransky 2017-01-31 14:57:05 UTC 
I happens to me regularly when I test Firefox Wayland build.
Comment 15 Martin Stransky 2017-01-31 15:14:25 UTC 
*** Bug 1412311 has been marked as a duplicate of this bug. ***
Comment 16 Martin Stransky 2017-04-13 08:37:53 UTC 
Hello, can we move with this please? It's blocking our Firefox/Wayland effort. Not sure it's Firefox or Mutter/gnome-shell bug but needs to be fixed.

Reproduction steps:

1) Install Wayland Firefox from https://firefox-flatpak.mojefedora.cz/
2) Run it, try to show some popups repeatedly (menu, tooltips...)
3) Crashes whole session
Comment 17 Jonas Ådahl 2017-04-17 05:38:27 UTC 
Fixed in the patch on https://bugzilla.gnome.org/show_bug.cgi?id=781391 .

The problem was that Firefox committed surface state to a surface of a subsurface which had been destroyed. Mutter did not handle that well, and the patch in the upstream bug fixes that.

Now, another issue here is that Firefox uses subsurface's for popups. That is wrong for various reasons:

1) you wont be able to keep the popup window within the monitor region. At best, a popup menu can be kept within the parent window by managing the position itself, but this is not how popup menus usually work.

2) dismissing the popup menu will only work if its the Firefox client itself that does it; for example opening a popup and clicking outside of the window will not dismiss the popup.

To fix 1 and 2 and get proper popup menu semantics you must use xdg_popup (currently zxdg_popup_v6) or gtk's popup API.

Just a side note; it would have been fixed faster if this issue had been reported upstream.
Comment 18 Martin Stransky 2017-06-19 12:29:41 UTC 
(In reply to Jonas Ådahl from comment #17)

Thanks Jonas, the crashes seems to be fixed now (Fedora 26, gtk3-3.22.15-2.fc26.x86_64)

> Fixed in the patch on https://bugzilla.gnome.org/show_bug.cgi?id=781391 .
> 
> The problem was that Firefox committed surface state to a surface of a
> subsurface which had been destroyed. Mutter did not handle that well, and
> the patch in the upstream bug fixes that.

Filed as Bug 1462725 for further investigation.
 
> Now, another issue here is that Firefox uses subsurface's for popups. That
> is wrong for various reasons:
> 
> 1) you wont be able to keep the popup window within the monitor region. At
> best, a popup menu can be kept within the parent window by managing the
> position itself, but this is not how popup menus usually work.

I think we cal live with that now.
 
> 2) dismissing the popup menu will only work if its the Firefox client itself
> that does it; for example opening a popup and clicking outside of the window
> will not dismiss the popup.

That's recent popup behavior at Firefox where Firefox handles all popups by itself. It's also a reason why https://bugzilla.gnome.org/show_bug.cgi?id=783957 breaks that.

> To fix 1 and 2 and get proper popup menu semantics you must use xdg_popup
> (currently zxdg_popup_v6) or gtk's popup API.

Unfortunately xdg_popup requires exact pop-up hierarchy which Firefox does not follow. Using xdg_popup means that some sub-menus are now shown (see Bug 1457201) because FF creates all popups as a child of main window. 

To utilize the xdg_popups we will need rewrite and update FF popup code to create popup hierarchy or at least detect which popups should map together which is not so easy AFAIK.

I think we can close it now as the crashes are fixed.