Attachment 81432 Details for Bug 66173 – another code path (display_sync) that segvs during wl_closure_marshal

another code path (display_sync) that segvs during wl_closure_marshal

file_66173.txt (text/plain), 12.20 KB, created by U. Artie Eoff on 2013-06-25 22:48:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: U. Artie Eoff

Created: 2013-06-25 22:48:38 UTC

Size: 12.20 KB

patch

obsolete

>Program received signal SIGSEGV, Segmentation fault.
>0x000000376327c7e4 in _int_malloc () from /lib64/libc.so.6
>(gdb) bt
>#0  0x000000376327c7e4 in _int_malloc () from /lib64/libc.so.6
>#1  0x000000376327f4b3 in malloc () from /lib64/libc.so.6
>#2  0x00007fd457ee7d3c in wl_closure_marshal (sender=0x1a23540, opcode=0, args=0x7fff7281ef90, message=0x7fd4583041d0) at connection.c:488
>#3  0x00007fd457ee8239 in wl_closure_vmarshal (sender=0x1a23540, opcode=0, ap=0x7fff7281f058, message=0x7fd4583041d0) at connection.c:566
>#4  0x00007fd457edf0aa in wl_resource_post_event (resource=0x1a23540, opcode=0) at wayland-server.c:123
>#5  0x00007fd457edef7b in wl_callback_send_done (resource_=0x1a23540, serial=274) at wayland-server-protocol.h:202
>#6  0x00007fd457ee05a3 in display_sync (client=0x17e7130, resource=0x1a4ef70, id=40) at wayland-server.c:596
>#7  0x0000003765e05e90 in ffi_call_unix64 () from /lib64/libffi.so.5
>#8  0x0000003765e058a0 in ffi_call () from /lib64/libffi.so.5
>#9  0x00007fd457ee937c in wl_closure_invoke (closure=0x1a8e420, flags=2, target=0x1a4ef70, opcode=0, data=0x17e7130) at connection.c:887
>#10 0x00007fd457edf89a in wl_client_connection_data (fd=13, mask=1, data=0x17e7130) at wayland-server.c:280
>#11 0x00007fd457ee25e6 in wl_event_source_fd_dispatch (source=0x18ae090, ep=0x7fff7281f510) at event-loop.c:86
>#12 0x00007fd457ee3264 in wl_event_loop_dispatch (loop=0x17cbc40, timeout=-1) at event-loop.c:421
>#13 0x00007fd457ee0e62 in wl_display_run (display=0x17cbbd0) at wayland-server.c:794
>#14 0x000000000041198f in main (argc=1, argv=0x7fff7281f958) at compositor.c:3339
>(gdb) bt full
>#0  0x000000376327c7e4 in _int_malloc () from /lib64/libc.so.6
>No symbol table info available.
>#1  0x000000376327f4b3 in malloc () from /lib64/libc.so.6
>No symbol table info available.
>#2  0x00007fd457ee7d3c in wl_closure_marshal (sender=0x1a23540, opcode=0, args=0x7fff7281ef90, message=0x7fd4583041d0) at connection.c:488
>        closure = 0x7281ef00
>        i = 1
>        count = 1
>        fd = 32767
>        dup_fd = 1921118096
>        object = 0x7fd458101708
>        signature = 0x7fd45810170a "wl_display"
>        arg = {type = 88 'X', nullable = 32767}
>        __PRETTY_FUNCTION__ = "wl_closure_marshal"
>#3  0x00007fd457ee8239 in wl_closure_vmarshal (sender=0x1a23540, opcode=0, ap=0x7fff7281f058, message=0x7fd4583041d0) at connection.c:566
>        args = {{i = 274, u = 274, f = 274, s = 0x100000112 <Address 0x100000112 out of bounds>, o = 0x100000112, n = 274, a = 0x100000112, h = 274}, {i = 27586416, u = 27586416, f = 27586416, s = 0x1a4ef70 "", o = 0x1a4ef70, 
>            n = 27586416, a = 0x1a4ef70, h = 27586416}, {i = 30, u = 30, f = 30, s = 0x1e <Address 0x1e out of bounds>, o = 0x1e, n = 30, a = 0x1e, h = 30}, {i = 1921118232, u = 1921118232, f = 1921118232, s = 0x7fff7281f018 "\020", 
>            o = 0x7fff7281f018, n = 1921118232, a = 0x7fff7281f018, h = 1921118232}, {i = 1921118192, u = 1921118192, f = 1921118192, s = 0x7281eff0 <Address 0x7281eff0 out of bounds>, o = 0x7281eff0, n = 1921118192, a = 0x7281eff0, 
>            h = 1921118192}, {i = 25296752, u = 25296752, f = 25296752, s = 0x181ff70 "\300_\200\001", o = 0x181ff70, n = 25296752, a = 0x181ff70, h = 25296752}, {i = 26866032, u = 26866032, f = 26866032, s = 0x199f170 "", 
>            o = 0x199f170, n = 26866032, a = 0x199f170, h = 26866032}, {i = 25186656, u = 25186656, f = 25186656, s = 0x100000001805160 <Address 0x100000001805160 out of bounds>, o = 0x100000001805160, n = 25186656, 
>            a = 0x100000001805160, h = 25186656}, {i = 1921118192, u = 1921118192, f = 1921118192, s = 0x7fff7281eff0 "0\360\201r", o = 0x7fff7281eff0, n = 1921118192, a = 0x7fff7281eff0, h = 1921118192}, {i = 1409001294, 
>            u = 1409001294, f = 1409001294, s = 0x7fd453fba74e "\311\303UH\211\345\211}\374\213E\374=\023\205", o = 0x7fd453fba74e, n = 1409001294, a = 0x7fd453fba74e, h = 1409001294}, {i = 0, u = 0, f = 0, s = 0x0, o = 0x0, n = 0, 
>            a = 0x0, h = 0}, {i = 1921118232, u = 1921118232, f = 1921118232, s = 0x7fff7281f018 "\020", o = 0x7fff7281f018, n = 1921118232, a = 0x7fff7281f018, h = 1921118232}, {i = 1921118256, u = 1921118256, f = 1921118256, 
>            s = 0x7281f030 <Address 0x7281f030 out of bounds>, o = 0x7281f030, n = 1921118256, a = 0x7281f030, h = 1921118256}, {i = 1921118788, u = 1921118788, f = 1921118788, s = 0x7fff7281f244 "\377\177", o = 0x7fff7281f244, 
>            n = 1921118788, a = 0x7fff7281f244, h = 1921118788}, {i = 1921118272, u = 1921118272, f = 1921118272, s = 0x7fff7281f040 "@\361\201r", o = 0x7fff7281f040, n = 1921118272, a = 0x7fff7281f040, h = 1921118272}, {i = 1921118944, 
>            u = 1921118944, f = 1921118944, s = 0x7fff7281f2e0 "\200a\340e7", o = 0x7fff7281f2e0, n = 1921118944, a = 0x7fff7281f2e0, h = 1921118944}, {i = 1921118624, u = 1921118624, f = 1921118624, s = 0x7fff7281f1a0 "", 
>            o = 0x7fff7281f1a0, n = 1921118624, a = 0x7fff7281f1a0, h = 1921118624}, {i = 16, u = 16, f = 16, s = 0x10 <Address 0x10 out of bounds>, o = 0x10, n = 16, a = 0x10, h = 16}, {i = 1921119120, u = 1921119120, f = 1921119120, 
>            s = 0x7fff7281f390 "\240\362\201r\377\177", o = 0x7fff7281f390, n = 1921119120, a = 0x7fff7281f390, h = 1921119120}, {i = 1475256479, u = 1475256479, f = 1475256479, s = 0x7fd457eea09f "\311\303\017\037", o = 0x7fd457eea09f, 
>            n = 1475256479, a = 0x7fd457eea09f, h = 1475256479}}
>#4  0x00007fd457edf0aa in wl_resource_post_event (resource=0x1a23540, opcode=0) at wayland-server.c:123
>        closure = 0x7fff7281f150
>        object = 0x1a23540
>        ap = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7fff7281f140, reg_save_area = 0x7fff7281f080}}
>#5  0x00007fd457edef7b in wl_callback_send_done (resource_=0x1a23540, serial=274) at wayland-server-protocol.h:202
>No locals.
>#6  0x00007fd457ee05a3 in display_sync (client=0x17e7130, resource=0x1a4ef70, id=40) at wayland-server.c:596
>        callback = 0x1a23540
>        serial = 274
>#7  0x0000003765e05e90 in ffi_call_unix64 () from /lib64/libffi.so.5
>No symbol table info available.
>#8  0x0000003765e058a0 in ffi_call () from /lib64/libffi.so.5
>No symbol table info available.
>#9  0x00007fd457ee937c in wl_closure_invoke (closure=0x1a8e420, flags=2, target=0x1a4ef70, opcode=0, data=0x17e7130) at connection.c:887
>        count = 1
>        ffi_types = {0x3765e06180, 0x3765e06180, 0x3765e06200, 0x100, 0x0, 0x0, 0x0, 0x0, 0x330000000e, 0x6e0000005b, 0x7c00000077, 0x7fff7281f350, 0x7fff7281f450, 0x7fd457ee69d4, 0x17d1f98, 0xc, 0x1a8e4f0, 0x17ed380, 0xdc, 
>          0x86400407e90, 0x287281f3b0, 0x17e7168}
>        implementation = 0x7fd4580ef490
>        cif = {abi = FFI_UNIX64, nargs = 3, arg_types = 0x7fff7281f2e0, rtype = 0x3765e062a0, bytes = 0, flags = 0}
>        ffi_args = {0x7fff7281f2a0, 0x7fff7281f2a8, 0x1a8e438, 0x17ed380, 0x7fff7281f450, 0x7fd457ee8a5d, 0x7fd458304080, 0x17e7168, 0xc017d1da0, 0x17ed380, 0x6e, 0x7fd4581016e6, 0x7fff7281f420, 0x7fd4581016e5, 0x7fff7281f450, 
>          0x7fd457ee8d8e, 0x17e7168, 0x1a8e420, 0x7281f46e, 0x100000001, 0x7fd458304080, 0x100000001}
>#10 0x00007fd457edf89a in wl_client_connection_data (fd=13, mask=1, data=0x17e7130) at wayland-server.c:280
>        connection = 0x17ed380
>        resource = 0x1a4ef70
>        message = 0x7fd458304080
>        p = {1, 786432}
>        size = 12
>        closure = 0x1a8e420
>        client = 0x17e7130
>        object = 0x1a4ef70
>        opcode = 0
>        len = 0
>#11 0x00007fd457ee25e6 in wl_event_source_fd_dispatch (source=0x18ae090, ep=0x7fff7281f510) at event-loop.c:86
>---Type <return> to continue, or q <return> to quit---
>        fd_source = 0x18ae090
>        mask = 1
>#12 0x00007fd457ee3264 in wl_event_loop_dispatch (loop=0x17cbc40, timeout=-1) at event-loop.c:421
>        i = 0
>        count = 1
>        ep = {{events = 1, data = {ptr = 0x18ae090, fd = 25878672, u32 = 25878672, u64 = 25878672}}, {events = 0, data = {ptr = 0x7fff7281f560, fd = 1921119584, u32 = 1921119584, u64 = 140735114507616}}, {events = 1475243507, data = {
>              ptr = 0x404000007fd4, fd = 32724, u32 = 32724, u64 = 70643622117332}}, {events = 0, data = {ptr = 0x7fff7281f660, fd = 1921119840, u32 = 1921119840, u64 = 140735114507872}}, {events = 1921119712, data = {
>              ptr = 0x17f039800007fff, fd = 32767, u32 = 32767, u64 = 107808867450126335}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 1464108585, data = {ptr = 0x7281f67000007fd4, fd = 32724, u32 = 32724, 
>              u64 = 8251146953216262100}}, {events = 32767, data = {ptr = 0x7fd457ee7113, fd = 1475244307, u32 = 1475244307, u64 = 140549985038611}}, {events = 327306929, data = {ptr = 0x17ed38000000000, fd = 0, u32 = 0, 
>              u64 = 107755987812745216}}, {events = 0, data = {ptr = 0x17eed84, fd = 25095556, u32 = 25095556, u64 = 25095556}}, {events = 24, data = {ptr = 0x17ee38800000000, fd = 0, u32 = 0, u64 = 107773614358528000}}, {events = 0, 
>            data = {ptr = 0x18, fd = 24, u32 = 24, u64 = 24}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 32724, data = {ptr = 0x7fff7281f580, fd = 1921119616, u32 = 1921119616, u64 = 140735114507648}}, {
>            events = 1, data = {ptr = 0x7281f5e000000000, fd = 0, u32 = 0, u64 = 8251146334740938752}}, {events = 32767, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x580efbe800000000, fd = 0, u32 = 0, 
>              u64 = 6345285898862592000}}, {events = 32724, data = {ptr = 0x14, fd = 20, u32 = 20, u64 = 20}}, {events = 1, data = {ptr = 0x1b00000001, fd = 1, u32 = 1, u64 = 115964116993}}, {events = 0, data = {ptr = 0x7fd4580efce8, 
>              fd = 1477377256, u32 = 1477377256, u64 = 140549987171560}}, {events = 0, data = {ptr = 0x7281f95000000000, fd = 0, u32 = 0, u64 = 8251150114312159232}}, {events = 32767, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {
>            events = 0, data = {ptr = 0x7281f6d000000000, fd = 0, u32 = 0, u64 = 8251147365533089792}}, {events = 32767, data = {ptr = 0x3762e0e2d4, fd = 1658905300, u32 = 1658905300, u64 = 237882106580}}, {events = 5, data = {
>              ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x7fd457eda168, fd = 1475191144, u32 = 1475191144, u64 = 140549984985448}}, {events = 1658905300, data = {ptr = 0x37, fd = 55, u32 = 55, u64 = 55}}, {
>            events = 0, data = {ptr = 0x7fff7281f6d0, fd = 1921119952, u32 = 1921119952, u64 = 140735114507984}}, {events = 0, data = {ptr = 0x29fc00000001, fd = 1, u32 = 1, u64 = 46162308497409}}, {events = 24, data = {
>              ptr = 0x7fff7281f6b0, fd = 1921119920, u32 = 1921119920, u64 = 140735114507952}}, {events = 1475219161, data = {ptr = 0x17cbc1800007fd4, fd = 32724, u32 = 32724, u64 = 107167302415318996}}, {events = 0, data = {
>              ptr = 0x17cbbd0, fd = 24951760, u32 = 24951760, u64 = 24951760}}}
>        source = 0x18ae090
>        n = 24
>#13 0x00007fd457ee0e62 in wl_display_run (display=0x17cbbd0) at wayland-server.c:794
>No locals.
>#14 0x000000000041198f in main (argc=1, argv=0x7fff7281f958) at compositor.c:3339
>        ret = 0
>        loop = 0x17cbc40
>        i = 1
>        section = 0x17cc8c0
>        display = 0x17cbbd0
>        option_modules = 0x0
>        help = 0
>        ec = 0x17d1da0
>        signals = {0x17cbcd0, 0x17cbd20, 0x17cc5c0, 0x17cc610}
>        config_fd = 8
>        modules = 0x17cc680 "desktop-shell.so"
>        socket_name = 0x430373 "wayland-0"
>        config = 0x17cc660
>        core_options = {{type = WESTON_OPTION_STRING, name = 0x43037d "backend", short_name = 66, data = 0x7fff7281f828}, {type = WESTON_OPTION_STRING, name = 0x430385 "socket", short_name = 83, data = 0x7fff7281f800}, {
>            type = WESTON_OPTION_INTEGER, name = 0x43038c "idle-time", short_name = 105, data = 0x7fff7281f80c}, {type = WESTON_OPTION_STRING, name = 0x430396 "modules", short_name = 0, data = 0x7fff7281f818}, {
>            type = WESTON_OPTION_STRING, name = 0x43039e "log", short_name = 0, data = 0x7fff7281f810}, {type = WESTON_OPTION_BOOLEAN, name = 0x4303a2 "help", short_name = 104, data = 0x7fff7281f808}, {type = WESTON_OPTION_BOOLEAN, 
>            name = 0x4303a7 "version", short_name = 0, data = 0x7fff7281f7fc}}
>        backend_init = 0x7fd455a246a9 <backend_init>
>        backend = 0x4304bc "x11-backend.so"
>        log = 0x0
>        idle_time = 0
>        version = 0
>(gdb)

Actions: View

Attachments on bug 66173: 81427 | 81428 | 81432

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.