Bug 107384

Some websites trigger it more often and more reliably than others. Simpler (?) websites seem to never crash it, reddit sometimes crashes it, gitter channels always crash it after ~2-3 seconds.

A website that instantly crashes the tab is https://www.kraken.com/en-us/login

Emil landed a bunch of changes to libdrm/xf86drm.c last Tuesday, maybe one of those caused this? The Mesa code just passes the pointer it received from drmGetDevice2 to drmFreeDevice.

I've also been getting random tab crashes since a few days ago, mesa git (and I upgraded to the latest git master HEAD at around the time the issues started happening), but my backtrace is difference.

(gdb) bt
#0  0x00007f7d1f0c8087 in drm_get_pci_id_for_fd (fd=fd@entry=36, vendor_id=vendor_id@entry=0x7ffd32efaaa0, chip_id=chip_id@entry=0x7ffd32efaaa4) at ../mesa-9999/src/loader/loader.c:281
#1  0x00007f7d1f0c86e9 in loader_get_pci_id_for_fd (fd=fd@entry=36, vendor_id=vendor_id@entry=0x7ffd32efaaa0, chip_id=chip_id@entry=0x7ffd32efaaa4) at ../mesa-9999/src/loader/loader.c:306
#2  0x00007f7d1f0c7e35 in pipe_loader_drm_probe_fd (dev=dev@entry=0x7ffd32efaad0, fd=fd@entry=36) at ../mesa-9999/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:180
#3  0x00007f7d1f0c7f5f in pipe_loader_drm_probe (devs=devs@entry=0x0, ndev=ndev@entry=0) at ../mesa-9999/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:237
#4  0x00007f7d1f0c750f in pipe_loader_probe (devs=devs@entry=0x0, ndev=ndev@entry=0) at ../mesa-9999/src/gallium/auxiliary/pipe-loader/pipe_loader.c:65
#5  0x00007f7d1f0c19f8 in clover::platform::platform() () at ../mesa-9999/src/gallium/state_trackers/clover/core/platform.cpp:28
#6  0x00007f7d1f096d66 in __static_initialization_and_destruction_0 (__initialize_p=1, __priority=65535) at ../mesa-9999/src/gallium/state_trackers/clover/api/platform.cpp:145
#7  _GLOBAL__sub_I_platform.cpp(void) () at ../mesa-9999/src/gallium/state_trackers/clover/api/platform.cpp:145
#8  0x00007f7d5496954a in call_init (l=<optimized out>, argc=argc@entry=17, argv=argv@entry=0x7ffd32efcbd8, env=env@entry=0x7f7d52f15400) at dl-init.c:72
#9  0x00007f7d54969654 in call_init (env=0x7f7d52f15400, argv=0x7ffd32efcbd8, argc=17, l=<optimized out>) at dl-init.c:30
#10 _dl_init (main_map=main_map@entry=0x7f7d37925000, argc=17, argv=0x7ffd32efcbd8, env=0x7f7d52f15400) at dl-init.c:119
#11 0x00007f7d5496d8f3 in dl_open_worker (a=a@entry=0x7ffd32efb0d0) at dl-open.c:511
#12 0x00007f7d53a6694f in __GI__dl_catch_exception (exception=exception@entry=0x7ffd32efb0b0, operate=operate@entry=0x7f7d5496d550 <dl_open_worker>, args=args@entry=0x7ffd32efb0d0) at dl-error-skeleton.c:196
#13 0x00007f7d5496d187 in _dl_open (file=0x7f7d47ca6e89 "libavcodec.so.58", mode=-2147483646, caller_dlopen=0x7f7d536ecc73 <PR_LoadLibraryWithFlags+275>, nsid=<optimized out>, argc=17, argv=0x7ffd32efcbd8, 
    env=0x7f7d52f15400) at dl-open.c:594
#14 0x00007f7d54311fba in dlopen_doit (a=a@entry=0x7ffd32efb320) at dlopen.c:66
#15 0x00007f7d53a6694f in __GI__dl_catch_exception (exception=exception@entry=0x7ffd32efb2b0, operate=operate@entry=0x7f7d54311f50 <dlopen_doit>, args=args@entry=0x7ffd32efb320) at dl-error-skeleton.c:196
#16 0x00007f7d53a669ef in __GI__dl_catch_error (objname=objname@entry=0x7f7d52f140b0, errstring=errstring@entry=0x7f7d52f140b8, mallocedp=mallocedp@entry=0x7f7d52f140a8, 
    operate=operate@entry=0x7f7d54311f50 <dlopen_doit>, args=args@entry=0x7ffd32efb320) at dl-error-skeleton.c:215
#17 0x00007f7d5431283d in _dlerror_run (operate=operate@entry=0x7f7d54311f50 <dlopen_doit>, args=args@entry=0x7ffd32efb320) at dlerror.c:162
#18 0x00007f7d54312066 in __dlopen (file=file@entry=0x7f7d47ca6e89 "libavcodec.so.58", mode=<optimized out>) at dlopen.c:87
#19 0x00007f7d536ecc73 in pr_LoadLibraryByPathname (flags=10, name=0x7f7d47ca6e89 "libavcodec.so.58") at /usr/src/debug/dev-libs/nspr-4.19/nspr-4.19/nspr/pr/src/linking/prlink.c:803
#20 PR_LoadLibraryWithFlags (libSpec=..., flags=flags@entry=10) at /usr/src/debug/dev-libs/nspr-4.19/nspr-4.19/nspr/pr/src/linking/prlink.c:418
#21 0x00007f7d45c2d746 in mozilla::FFmpegRuntimeLinker::Init () at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp:64
#22 0x00007f7d45c2d9df in mozilla::FFmpegRuntimeLinker::Init () at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/dom/media/platforms/ffmpeg/FFmpegRuntimeLinker.cpp:51
#23 0x00007f7d45c037b7 in mozilla::PDMFactoryImpl::PDMFactoryImpl (this=0x7f7d2dab89f8) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/dom/media/platforms/PDMFactory.cpp:76
#24 mozilla::PDMFactory::EnsureInit (this=<optimized out>) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/dom/media/platforms/PDMFactory.cpp:188
#25 0x00007f7d45c04510 in mozilla::PDMFactory::PDMFactory (this=0x7f7d2dbe7c70) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/dom/media/platforms/PDMFactory.cpp:168
#26 0x00007f7d45cebc91 in mozilla::MP4Decoder::IsSupportedType(mozilla::MediaContainerType const&, mozilla::DecoderDoctorDiagnostics*) [clone .part.299] ()
    at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ff/dist/include/mozilla/mozalloc.h:156
#27 0x00007f7d45a47b48 in mozilla::DecoderTraits::IsSupportedType (aType=...) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/dom/media/DecoderTraits.cpp:289
#28 0x00007f7d45a7e936 in mozilla::ChannelMediaDecoder::Create (aInit=..., aDiagnostics=aDiagnostics@entry=0x7ffd32efb660)
    at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/dom/media/ChannelMediaDecoder.cpp:213
#29 0x00007f7d459edf7b in mozilla::dom::HTMLMediaElement::InitializeDecoderForChannel (this=this@entry=0x7f7d2ed61000, aChannel=<optimized out>, aListener=<optimized out>)
    at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/dom/html/HTMLMediaElement.cpp:4891
#30 0x00007f7d459ee44b in mozilla::dom::HTMLMediaElement::MediaLoadListener::OnStartRequest (this=0x7f7d377b6ce0, aRequest=0x7f7d37939868, aContext=0x0)
    at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ff/dist/include/nsCOMPtr.h:795
#31 0x00007f7d444fcf23 in mozilla::net::HttpChannelChild::DoOnStartRequest (this=this@entry=0x7f7d37939800, aRequest=aRequest@entry=0x7f7d37939868, aContext=0x0)
    at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/netwerk/protocol/http/HttpChannelChild.cpp:744
#32 0x00007f7d444fd4b2 in mozilla::net::HttpChannelChild::OnStartRequest(nsresult const&, mozilla::net::nsHttpResponseHead const&, bool const&, mozilla::net::nsHttpHeaderArray const&, mozilla::net::ParentLoadInfoForwarderArgs const&, bool const&, bool const&, unsigned long const&, int const&, unsigned int const&, nsTString<char> const&, nsTString<char> const&, mozilla::net::NetAddr const&, mozilla::net::NetAddr const&, unsigned int const&, nsTString<char> const&, long const&, mozilla::Maybe<mozilla::dom::ServiceWorkerDescriptor> const&, bool const&) ()
    at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ff/dist/include/nsCOMPtr.h:1109
#33 0x00007f7d444fd86d in mozilla::net::StartRequestEvent::Run (this=0x7f7d37c5e3f0) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/netwerk/protocol/http/HttpChannelChild.cpp:467
#34 0x00007f7d444fa42d in mozilla::net::ChannelEventQueue::RunOrEnqueue (aAssertionWhenNotQueued=false, aCallback=<optimized out>, this=0x7f7d2dc12a00)
    at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ff/dist/include/mozilla/UniquePtr.h:326
#35 mozilla::net::HttpChannelChild::RecvOnStartRequest(nsresult const&, mozilla::net::nsHttpResponseHead const&, bool const&, mozilla::net::nsHttpHeaderArray const&, mozilla::net::ParentLoadInfoForwarderArgs const&, bool const&, bool const&, unsigned long const&, int const&, unsigned int const&, nsTString<char> const&, nsTString<char> const&, mozilla::net::NetAddr const&, mozilla::net::NetAddr const&, short const&, unsigned int const&, nsTString<char> const&, long const&, mozilla::dom::OptionalIPCServiceWorkerDescriptor const&, bool const&) ()
    at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/netwerk/protocol/http/HttpChannelChild.cpp:537
#36 0x00007f7d44728c2f in mozilla::net::PHttpChannelChild::OnMessageReceived (this=0x7f7d37939800, msg__=...) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ff/ipc/ipdl/PHttpChannelChild.cpp:701
#37 0x00007f7d446c8338 in mozilla::dom::PContentChild::OnMessageReceived (this=0x7f7d52f71020, msg__=...) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ff/ipc/ipdl/PContentChild.cpp:5316
#38 0x00007f7d44639e7f in mozilla::ipc::MessageChannel::DispatchAsyncMessage(IPC::Message const&) () at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ipc/glue/MessageChannel.cpp:2142
#39 0x00007f7d44640c99 in mozilla::ipc::MessageChannel::DispatchMessage(IPC::Message&&) () at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ipc/glue/MessageChannel.cpp:2072
#40 0x00007f7d44642b2f in mozilla::ipc::MessageChannel::RunMessage(mozilla::ipc::MessageChannel::MessageTask&) () at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ipc/glue/MessageChannel.cpp:1918
#41 0x00007f7d44642cda in mozilla::ipc::MessageChannel::MessageTask::Run() () at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ipc/glue/MessageChannel.cpp:1951
#42 0x00007f7d4431731c in mozilla::SchedulerGroup::Runnable::Run() () at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ff/dist/include/nsCOMPtr.h:805
#43 0x00007f7d4431a1fe in nsThread::ProcessNextEvent(bool, bool*) () at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/xpcom/threads/nsThread.cpp:1090
#44 0x00007f7d44323438 in NS_ProcessNextEvent (aThread=<optimized out>, aThread@entry=0x7f7d52fcbc80, aMayWait=aMayWait@entry=false)
    at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/xpcom/threads/nsThreadUtils.cpp:519
#45 0x00007f7d4463309a in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) () at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ipc/glue/MessagePump.cpp:97
#46 0x00007f7d4460f774 in MessageLoop::RunInternal (this=<optimized out>) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ff/dist/include/mozilla/RefPtr.h:315
#47 MessageLoop::RunHandler (this=<optimized out>) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ipc/chromium/src/base/message_loop.cc:319
#48 MessageLoop::Run (this=<optimized out>) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ipc/chromium/src/base/message_loop.cc:299
#49 0x00007f7d460e2b98 in nsBaseAppShell::Run (this=0x7f7d3bab8580) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/widget/nsBaseAppShell.cpp:157
#50 0x00007f7d46e56477 in XRE_RunAppShell () at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/toolkit/xre/nsEmbedFunctions.cpp:896
#51 0x00007f7d4460f774 in MessageLoop::RunInternal (this=0x7ffd32efc890) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ff/dist/include/mozilla/RefPtr.h:315
#52 MessageLoop::RunHandler (this=0x7ffd32efc890) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ipc/chromium/src/base/message_loop.cc:319
#53 MessageLoop::Run (this=this@entry=0x7ffd32efc890) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ipc/chromium/src/base/message_loop.cc:299
#54 0x00007f7d46e56971 in XRE_InitChildProcess(int, char**, XREChildData const*) () at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/toolkit/xre/nsEmbedFunctions.cpp:722
#55 0x00005579a32fc226 in content_process_main (bootstrap=0x7f7d52f30630, argc=16, argv=0x7ffd32efcbd8) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ipc/contentproc/plugin-container.cpp:50
#56 0x00005579a32fbd60 in main (argc=17, argv=0x7ffd32efcbd8, envp=0x7ffd32efcc68) at /usr/src/debug/www-client/firefox-61.0-r1/firefox-61.0/ff/dist/include/mozilla/UniquePtr.h:326

I'm not sure if the issues are connected, but I can try downgrading to mesa stable and seeing if the issues still happen. If they don't, I'll attempt bisecting.

Sigh.

diff --git a/src/loader/loader.c b/src/loader/loader.c
index 43275484cc..87b7281f78 100644
--- a/src/loader/loader.c
+++ b/src/loader/loader.c
@@ -274,7 +274,7 @@ int loader_get_user_preferred_fd(int default_fd, bool *different_device)
 static int
 drm_get_pci_id_for_fd(int fd, int *vendor_id, int *chip_id)
 {
-   drmDevicePtr device;
+   drmDevicePtr device = NULL;
    int ret;
 
    if (drmGetDevice2(fd, 0, &device) == 0) {

Concerning my issue, which I now believe is unrelated, I tracked it down to this commit in libdrm:

a02900133b32dd4a7d6da4966f455ab337e80dfc is the first bad commit
commit a02900133b32dd4a7d6da4966f455ab337e80dfc
Author: Emil Velikov <emil.velikov@collabora.com>
Date:   Tue May 15 17:29:44 2018 +0100

    xf86drm: introduce a get_real_pci_path() helper
    
    Introduce a helper which gets the real sysfs path for the given pci
    device.
    
    In other words, instead opening the /sys/dev/char/*/device symlink, we
    opt for the actual /sys/devices/pci*/*/
    
    It folds three (nearly identical) snprintf's and paves the way of adding
    extra devices (see next patch) a piece of pie.
    
    v2: use a caller (on stack) provided real_path (Eric)
    
    Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
    Tested-by: Robert Foss <robert.foss@collabora.com> (v1)
    Reviewed-by: Robert Foss <robert.foss@collabora.com> (v1)
    Reviewed-by: Eric Engestrom <eric@engestrom.ch> (v1)

:100644 100644 02da3e1f9b2ac5be41caf0178aefc07da018c945 51e00d23d90fd4a5217eb1aeae964140002cf417 M	xf86drm.c

(In reply to Chris Wilson from comment #5)
> Sigh.
> 
> diff --git a/src/loader/loader.c b/src/loader/loader.c
> index 43275484cc..87b7281f78 100644
> --- a/src/loader/loader.c
> +++ b/src/loader/loader.c
> @@ -274,7 +274,7 @@ int loader_get_user_preferred_fd(int default_fd, bool
> *different_device)
>  static int
>  drm_get_pci_id_for_fd(int fd, int *vendor_id, int *chip_id)
>  {
> -   drmDevicePtr device;
> +   drmDevicePtr device = NULL;
>     int ret;
>  
>     if (drmGetDevice2(fd, 0, &device) == 0) {

Thanks, looks like this is my issue too.

diff --git a/src/loader/loader.c b/src/loader/loader.c
index 43275484cc2..02a1f97684f 100644
--- a/src/loader/loader.c
+++ b/src/loader/loader.c
@@ -167,7 +167,7 @@ static bool drm_device_matches_tag(drmDevicePtr device, const char *prime_tag)

 static char *drm_get_id_path_tag_for_fd(int fd)
 {
-   drmDevicePtr device;
+   drmDevicePtr device = NULL;
    char *tag;

    if (drmGetDevice2(fd, 0, &device) != 0)
@@ -274,7 +274,7 @@ int loader_get_user_preferred_fd(int default_fd, bool *different_device)
 static int
 drm_get_pci_id_for_fd(int fd, int *vendor_id, int *chip_id)
 {
-   drmDevicePtr device;
+   drmDevicePtr device = NULL;
    int ret;

    if (drmGetDevice2(fd, 0, &device) == 0) {

Still smells like a libdrm bug to me, surely drmGetDevice2 can't rely on its caller initializing the device pointer.

Thanks for the report, fixed in drm Git master:

commit 4519db23ef716f37f804485f50955c26c38a6ae6
Author: Mariusz Ceier <mceier+mesa-dev@gmail.com>
Date:   Sun Jul 29 10:20:14 2018 +0200

    xf86drm: Fix error path in drmGetDevice2