Emil Ghitta, QA [:emilghitta] Reporter
	Description • 7 years ago

[Affected versions]:
Firefox 58.0a1 (BuildId:20171109220104)
Firefox 57.0 (BuildId:20171109183137)

[Affected platforms]:
Ubuntu 16.04  64bit.

[Unaffected platforms]:
Windows 10 64bit.
macOS 10.11.6.

[Steps to reproduce]:
1. Launch Firefox with a clean profile.
2. Access the https://maps.google.com/ webpage.
3. Perform a zoom out on the map.
4. Change to “Satellite” view.
5. Continue zooming out.

[Expected result]:
No issues are encountered.

[Actual result]:
The tab crashes.

[Regression range]:
This looks like a possible regression.

I will get back with a regression asap.

[Additional notes]:
For further details regarding this issue, access the following link to observe the screen cast:
https://drive.google.com/file/d/19o5hsW2BStFsxF64WtyNeXmf3bl6kT1I/view

Please feel free to change the component if necessary.

	Emil Ghitta, QA [:emilghitta] Reporter
	Comment 1 • 7 years ago

It seems that this is a regression:

Last good revision: 8e1e06adf80f82d3d5cf08eadaf569a107bd1ecf
First bad revision: b5fa08551d6e74d8300fa94f3161afdffd867764

Pushlog:
https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=8e1e06adf80f82d3d5cf08eadaf569a107bd1ecf&tochange=b5fa08551d6e74d8300fa94f3161afdffd867764

Hi Gian!

Can you please have a look into this? 

Thanks a lot!

	Julien Cristau [:jcristau] (back April 22)
	Comment 2 • 7 years ago

Do you have a crash-stats link to the crash report?

	Emil Ghitta, QA [:emilghitta] Reporter
	Comment 3 • 7 years ago

Unfortunately no. It seems that no crash report is generated.

	Gian-Carlo Pascutto [:gcp]
	Comment 4 • 7 years ago

What's the exact hardware (GPU *and* drivers) being used here?

Is there no logging in the console?

What does running with MOZ_SANDBOX_LOGGING=1 say?

	Emil Ghitta, QA [:emilghitta] Reporter
	Comment 5 • 7 years ago

Graphics and drivers details:

https://pastebin.com/XPUFadzS

Loggings after using MOZ_SANDBOX_LOGGING=1:

https://pastebin.com/0KDZfdKr

	Gian-Carlo Pascutto [:gcp]
	Comment 6 • 7 years ago

(In reply to Emil Ghitta, QA [:emilghitta] from comment #5)
> Loggings after using MOZ_SANDBOX_LOGGING=1:
> 
> https://pastebin.com/0KDZfdKr

Looks like that didn't take hold. Try "export MOZ_SANDBOX_LOGGING=1" or put it on the command line.

The errors look similar to https://bugzilla.mozilla.org/show_bug.cgi?id=1401666#c20. But this is an even older Mesa.

	Gian-Carlo Pascutto [:gcp]
	Comment 7 • 7 years ago

To be honest, the lack of crash report makes this smell a bit like a driver crash. But why did sandboxing regress it? Are we blocking one driver and causing another to get loaded again?

	Emil Ghitta, QA [:emilghitta] Reporter
	Comment 8 • 7 years ago

Yep, sorry. 

https://pastebin.com/6G9zrVq9

I hope that this helps.

	Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧
	Comment 9 • 7 years ago

From the log, this looks exactly like bug 1401666, but that was fixed and uplifted to 57.

	Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧
	Comment 10 • 7 years ago

So this is… kind of a mess.  I can reproduce this[*] on an unpatched Ubuntu 16.04.1, and make graphics acceleration work by allowing all of:

1. reading the /run/udev/data/+pci:* file for the device.
2. readlink on *all* the directory prefixes of the weird semi-canonicalized sysfs paths that libudev uses
3. readlink on the "subsystem" node in the PCI device's sysfs directory

Note that the broker's permission model currently requires "read" permission for readlink(), even just to return EINVAL or ENOENT rather than EACCES (i.e., to reveal information that can be obtained with lesser permissions via lstat), so without changing the broker we'd also be giving away the ability to read entries from all of the directories in question, which probably isn't catastrophically bad but it's not exactly good.

All of which leads me to wonder whether there are any distributions where this can happen with an up-to-date supported release — Ubuntu 16.04.2 was released 9+ months ago and has a newer version of Mesa.


[*] I can't reproduce the crash; it's probably the LLVM bug seen in bug 1290896, in which case it requires a Skylake CPU.  I'm using the library shim I posted to bug 1401666 and checking whether frame rate decreases by ~10x.

	Jim Mathies [:jimm]
	Comment 11 • 7 years ago

based on the previous comment from jld - out of date linux distro.