Bug 475648 - kwin_wayland ~ Firefox Nightly crashing with Wayland backend when gfx.webrender.compositor.force-enabled set to true
Summary: kwin_wayland ~ Firefox Nightly crashing with Wayland backend when gfx.webrend...
Status: RESOLVED FIXED
Alias: None
Product: kwin
Classification: Plasma
Component: general (other bugs)
Version First Reported In: git master
Platform: Compiled Sources Linux
: NOR crash
Target Milestone: ---
Assignee: KWin default assignee
URL:
Keywords: qt6
Depends on:
Blocks:
 
Reported: 2023-10-15 08:06 UTC by Kyle Devir
Modified: 2023-11-08 13:18 UTC (History)
4 users (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle Devir 2023-10-15 08:06:35 UTC
Backtrace:
                #0  0x00007f3e11f91324 _ZNKSt15__uniq_ptr_implIN4KWin23SurfaceInterfacePrivateESt14default_deleteIS1_EE6_M_ptrEv (libkwin.so.5 + 0x991324)
                #1  0x00007f3e11f91128 _ZNKSt10unique_ptrIN4KWin23SurfaceInterfacePrivateESt14default_deleteIS1_EE3getEv (libkwin.so.5 + 0x991128)
                #2  0x00007f3e120735bc _ZNKSt10unique_ptrIN4KWin23SurfaceInterfacePrivateESt14default_deleteIS1_EEptEv (libkwin.so.5 + 0xa735bc)
                #3  0x00007f3e1206cd6e _ZNK4KWin16SurfaceInterface10subSurfaceEv (libkwin.so.5 + 0xa6cd6e)
                #4  0x00007f3e120bb406 mainSurface (libkwin.so.5 + 0xabb406)
                #5  0x00007f3e120bb4b1 _ZZN4KWin11Transaction5applyEvENKUlRKNS_16TransactionEntryES3_E_clES3_S3_ (libkwin.so.5 + 0xabb4b1)
                #6  0x00007f3e120bc79e operator()<__gnu_cxx::__normal_iterator<KWin::TransactionEntry*, std::vector<KWin::TransactionEntry> >, __gnu_cxx::__normal_iterator<KWin::TransactionEntry*, std::vector<KWin::TransactionEntry> > > (libkwin.so.5 + 0xabc79e)
                #7  0x00007f3e120bc1e1 __insertion_sort<__gnu_cxx::__normal_iterator<KWin::TransactionEntry*, std::vector<KWin::TransactionEntry> >, __gnu_cxx::__ops::_Iter_comp_iter<KWin::Transaction::apply()::<lambda(const KWin::TransactionEntry&, const KWin::TransactionEntry&)> > > (libkwin.so.5 + 0xabc1e1)
                #8  0x00007f3e120bbf6e __final_insertion_sort<__gnu_cxx::__normal_iterator<KWin::TransactionEntry*, std::vector<KWin::TransactionEntry> >, __gnu_cxx::__ops::_Iter_comp_iter<KWin::Transaction::apply()::<lambda(const KWin::TransactionEntry&, const KWin::TransactionEntry&)> > > (libkwin.so.5 + 0xabbf6e)
                #9  0x00007f3e120bbd7c __sort<__gnu_cxx::__normal_iterator<KWin::TransactionEntry*, std::vector<KWin::TransactionEntry> >, __gnu_cxx::__ops::_Iter_comp_iter<KWin::Transaction::apply()::<lambda(const KWin::TransactionEntry&, const KWin::TransactionEntry&)> > > (libkwin.so.5 + 0xabbd7c)
                #10 0x00007f3e120bbb9b sort<__gnu_cxx::__normal_iterator<KWin::TransactionEntry*, std::vector<KWin::TransactionEntry> >, KWin::Transaction::apply()::<lambda(const KWin::TransactionEntry&, const KWin::TransactionEntry&)> > (libkwin.so.5 + 0xabbb9b)
                #11 0x00007f3e120bb516 _ZN4KWin11Transaction5applyEv (libkwin.so.5 + 0xabb516)
                #12 0x00007f3e120bb73e _ZN4KWin11Transaction8tryApplyEv (libkwin.so.5 + 0xabb73e)
                #13 0x00007f3e120bae85 _ZN4KWin11Transaction6unlockEv (libkwin.so.5 + 0xabae85)
                #14 0x00007f3e120baaad _ZZN4KWin23TransactionDmaBufLockerC4EPKNS_16DmaBufAttributesEENKUlvE_clEv (libkwin.so.5 + 0xabaaad)
                #15 0x00007f3e120bc957 call (libkwin.so.5 + 0xabc957)
                #16 0x00007f3e120bc41b call<QtPrivate::List<>, void> (libkwin.so.5 + 0xabc41b)
                #17 0x00007f3e120bc04a impl (libkwin.so.5 + 0xabc04a)
                #18 0x00007f3e0e1b9a59 n/a (libQt6Core.so.6 + 0x1b9a59)
                #19 0x00007f3e0e1c12e0 _ZN15QSocketNotifier5eventEP6QEvent (libQt6Core.so.6 + 0x1c12e0)
                #20 0x00007f3e0f17318b _ZN19QApplicationPrivate13notify_helperEP7QObjectP6QEvent (libQt6Widgets.so.6 + 0x17318b)
                #21 0x00007f3e0e1626d8 _ZN16QCoreApplication15notifyInternal2EP7QObjectP6QEvent (libQt6Core.so.6 + 0x1626d8)
                #22 0x00007f3e0e2c7329 _ZN27QEventDispatcherUNIXPrivate23activateSocketNotifiersEv (libQt6Core.so.6 + 0x2c7329)
                #23 0x00007f3e0e2c878c _ZN20QEventDispatcherUNIX13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE (libQt6Core.so.6 + 0x2c878c)
                #24 0x00007f3e0ebe5e42 _ZN23QUnixEventDispatcherQPA13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE (libQt6Gui.so.6 + 0x5e5e42)
                #25 0x00007f3e0e16cc5e _ZN10QEventLoop4execE6QFlagsINS_17ProcessEventsFlagEE (libQt6Core.so.6 + 0x16cc5e)
                #26 0x00007f3e0e165178 _ZN16QCoreApplication4execEv (libQt6Core.so.6 + 0x165178)
                #27 0x000056531bd25757 main (kwin_wayland + 0xc5757)
                #28 0x00007f3e0da45cd0 n/a (libc.so.6 + 0x27cd0)
                #29 0x00007f3e0da45d8a __libc_start_main (libc.so.6 + 0x27d8a)
                #30 0x000056531bcad905 _start (kwin_wayland + 0x4d905)
Comment 1 Kyle Devir 2023-10-15 08:07:35 UTC
Generating the GDB backtrace was consuming all of my RAM, so I had to kill it, but got this info:

#0  0x00007f3e11f91324 in std::__uniq_ptr_impl<KWin::SurfaceInterfacePrivate, std::default_delete<KWin::SurfaceInterfacePrivate> >::_M_ptr (this=0x10) at /usr/include/c++/13.2.1/bits/unique_ptr.h:199
199           pointer    _M_ptr() const noexcept { return std::get<0>(_M_t); }
[Current thread is 1 (Thread 0x7f3e08d8ca00 (LWP 995223))]
(gdb) 
(gdb) bt
#0  0x00007f3e11f91324 in std::__uniq_ptr_impl<KWin::SurfaceInterfacePrivate, std::default_delete<KWin::SurfaceInterfacePrivate> >::_M_ptr() const (this=0x10) at /usr/include/c++/13.2.1/bits/unique_ptr.h:199
#1  0x00007f3e11f91128 in std::unique_ptr<KWin::SurfaceInterfacePrivate, std::default_delete<KWin::SurfaceInterfacePrivate> >::get() const (this=0x10) at /usr/include/c++/13.2.1/bits/unique_ptr.h:470
#2  0x00007f3e120735bc in std::unique_ptr<KWin::SurfaceInterfacePrivate, std::default_delete<KWin::SurfaceInterfacePrivate> >::operator->() const (this=0x10) at /usr/include/c++/13.2.1/bits/unique_ptr.h:463
^C#3  0x00007f3e1206cd6e in KWin::SurfaceInterface::subSurface() const (this=Exception ignored in: <gdb._GdbFile object at 0x7fa1ff1cd650>
Comment 2 Vlad Zahorodnii 2023-10-23 13:59:55 UTC
Do you know if you ran kwin with https://invent.kde.org/plasma/kwin/-/commit/8d3b4a21c8ec67d62b683d02512fa790a82e6ea3 ?
Comment 3 Kyle Devir 2023-10-24 00:33:21 UTC
(In reply to Vlad Zahorodnii from comment #2)
> Do you know if you ran kwin with
> https://invent.kde.org/plasma/kwin/-/commit/
> 8d3b4a21c8ec67d62b683d02512fa790a82e6ea3 ?

Yes. Still crashes for me. (I rebuild KDE Git weekly.)
Comment 4 fanzhuyifan 2023-10-24 03:18:24 UTC
Are you using a nvidia gpu? Many people (with nvidia) reported problems running firefox on wayland with `egl-wayland` version 1.1.12. Either downgrading to 1.1.11 or upgrading to 1.1.13 may solve the issue.

https://www.reddit.com/r/archlinux/comments/12eoj2b/wayland12201_update_causes_a_lot_of_crashes/
https://arcolinuxforum.com/viewtopic.php?t=3560
Comment 5 Kyle Devir 2023-10-24 12:11:32 UTC
(In reply to fanzhuyifan from comment #4)
> Are you using a nvidia gpu? Many people (with nvidia) reported problems
> running firefox on wayland with `egl-wayland` version 1.1.12. Either
> downgrading to 1.1.11 or upgrading to 1.1.13 may solve the issue.
> 
> https://www.reddit.com/r/archlinux/comments/12eoj2b/
> wayland12201_update_causes_a_lot_of_crashes/
> https://arcolinuxforum.com/viewtopic.php?t=3560

Arch Linux with AMD RX 6700 using Mesa Git commit 96345ae2ed3 and Linux 6.5.6.
Comment 6 Kyle Devir 2023-10-24 13:57:23 UTC
So, through testing a new Firefox profile, I discovered the culprit:

Setting gfx.webrender.compositor.force-enabled to true results in a crash with the Wayland backend, but not the X11 backend.

I hope this helps with fixing this curious bug. :)
Comment 7 Kyle Devir 2023-10-24 14:01:54 UTC
From Firefox troubleshooting info:

WEBRENDER_COMPOSITOR:
default: disabled, Disabled by default, Blocklisted; failure code FEATURE_FAILURE_DISABLED
env: blocklisted, Blocklisted by gfxInfo, Blocklisted; failure code FEATURE_FAILURE_WEBRENDER_COMPOSITOR_DISABLED
Comment 8 Vlad Zahorodnii 2023-10-26 09:45:39 UTC
I also run firefox with gfx.webrender.compositor.force-enabled=true. Maybe you've changed something else too? Can you start with a fresh profile please?
Comment 9 Vlad Zahorodnii 2023-10-26 09:50:20 UTC
Okay, it's reproducible with Firefox Nightly, but not Firefox
Comment 10 Kyle Devir 2023-10-26 12:42:42 UTC
(In reply to Vlad Zahorodnii from comment #8)
> I also run firefox with gfx.webrender.compositor.force-enabled=true. Maybe
> you've changed something else too? Can you start with a fresh profile please?

(In reply to Vlad Zahorodnii from comment #9)
> Okay, it's reproducible with Firefox Nightly, but not Firefox

With a fresh profile, changing only this setting resulted in a compositor crash, yeah.
Comment 11 Vlad Zahorodnii 2023-11-08 13:18:39 UTC
Git commit d52ba8c3fe93f90e7754e641494c1d3bd81bec16 by Vlad Zahorodnii.
Committed on 08/11/2023 at 14:09.
Pushed by vladz into branch 'master'.

wayland: Fix transaction cleanup with destroyed surfaces

When sorting surfaces in the ancestor order we need to ignore null
surfaces.

In addition to that, we also need to properly handle the case where
a transaction with dependencies is unlocked and it contains null
surfaces.

For example, if there are three transactions A -> B -> C, and the B
transaction is unlocked, we cannot apply it until transaction A is
applied. The readiness check is based on checking the first pending
transaction of the surface. But if the surface is null, the check
will be skipped, which is not ideal as transaction B can be applied
before transaction A now. To address that, this change makes every
transaction entry remember the previous transaction. With that, the
readiness check can be performed even if the surface has been destroyed.

M  +17   -10   src/wayland/transaction.cpp
M  +5    -0    src/wayland/transaction.h

https://invent.kde.org/plasma/kwin/-/commit/d52ba8c3fe93f90e7754e641494c1d3bd81bec16