Bug 105275

Summary:	Xorg server crashes with assertion failure: Xorg: ../src/evdev-mt-touchpad-tap.c:1030: tp_tap_handle_state: Assertion `tp->tap.nfingers_down >= 1' failed.
Product:	Wayland	Reporter:	Aaron Plattner <aplattner>
Component:	libinput	Assignee:	Wayland bug list <wayland-bugs>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	major
Priority:	medium	CC:	peter.hutterer
Version:	unspecified
Hardware:	x86-64 (AMD64)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:

Description Aaron Plattner 2018-02-27 19:10:55 UTC

I was trying to clean cat hair off of my laptop, and swiped my hand gently across the touchpad. The X server crashed:

Xorg: ../src/evdev-mt-touchpad-tap.c:1030: tp_tap_handle_state: Assertion `tp->tap.nfingers_down >= 1' failed.

Thread 2 "InputThread" received signal SIGABRT, Aborted.
[Switching to Thread 0x7f58e7254700 (LWP 11644)]
0x00007f58ee846860 in raise () from /usr/lib/libc.so.6
(gdb) bt
#0  0x00007f58ee846860 in raise () at /usr/lib/libc.so.6
#1  0x00007f58ee847ec9 in abort () at /usr/lib/libc.so.6
#2  0x00007f58ee83f0bc in __assert_fail_base () at /usr/lib/libc.so.6
#3  0x00007f58ee83f133 in  () at /usr/lib/libc.so.6
#4  0x00007f58e7f0e2f0 in tp_tap_handle_state (tp=0x5619dd09aab0, time=2162337668) at ../src/evdev-mt-touchpad-tap.c:1030
#5  0x00007f58e7f08d17 in tp_post_events (tp=0x5619dd09aab0, time=2162337668) at ../src/evdev-mt-touchpad.c:1561
#6  0x00007f58e7f08e03 in tp_handle_state (tp=0x5619dd09aab0, time=2162337668) at ../src/evdev-mt-touchpad.c:1586
#7  0x00007f58e7f08ed6 in tp_interface_process (dispatch=0x5619dd09aab0, device=0x5619dd0976b0, e=0x7f58e7252dc0, time=2162337668) at ../src/evdev-mt-touchpad.c:1633
#8  0x00007f58e7efabe2 in evdev_process_event (device=0x5619dd0976b0, e=0x7f58e7252dc0) at ../src/evdev.c:857
#9  0x00007f58e7efac27 in evdev_device_dispatch_one (device=0x5619dd0976b0, ev=0x7f58e7252dc0) at ../src/evdev.c:865
#10 0x00007f58e7efae0c in evdev_device_dispatch (data=0x5619dd0976b0) at ../src/evdev.c:924
#11 0x00007f58e7ef4f3b in libinput_dispatch (libinput=0x5619dd021580) at ../src/libinput.c:1989
#12 0x00007f58e8141984 in xf86libinput_read_input (pInfo=0x5619dd040690) at xf86libinput.c:2180
#13 0x00005619dc6e8163 in  ()
#14 0x00005619dc6ea861 in  ()
#15 0x00005619dc6e7fae in  ()
#16 0x00007f58eebd008c in start_thread () at /usr/lib/libpthread.so.0
#17 0x00007f58ee907e7f in clone () at /usr/lib/libc.so.6

I'm using a debug build of libinput built from commit 5b29be3998d5f3670ec66147abc32e7d992ff876 with "arch-meson build --buildtype=debug -Dtests=false -Db_lto=false".

Earlier, performing the same swiping gesture caused a crash similar to bug 105160. I rebuilt from commit 5b29be3998 to pick up the fix for that in commit 01a633b6eb, and now I'm seeing this new assert instead.

More gdb info:
(gdb) frame 4
#4  0x00007f58e7f0e2f0 in tp_tap_handle_state (tp=0x5619dd09aab0, time=2162337668) at ../src/evdev-mt-touchpad-tap.c:1030
1030					assert(tp->tap.nfingers_down >= 1);
(gdb) info locals
_i = 0
t = 0x5619dd09ba60
filter_motion = 0
__PRETTY_FUNCTION__ = "tp_tap_handle_state"
(gdb) p *t
$8 = {tp = 0x5619dd09aab0, index = 0, state = TOUCH_END, has_ended = true, dirty = true, point = {x = 2960, y = 2860}, time = 2162337668, pressure = 72, is_tool_palm = false, 
  major = 0, minor = 0, was_down = true, quirks = {reset_motion_history = false}, history = {samples = {{time = 2162254619, point = {x = 2008, y = 2476}}, {time = 2162302736, 
        point = {x = 2960, y = 2860}}, {time = 2162337668, point = {x = 2960, y = 2860}}, {time = 2162224450, point = {x = 1694, y = 1398}}}, index = 2, count = 1}, 
  hysteresis_center = {x = 2960, y = 2860}, pinned = {is_pinned = false, center = {x = 0, y = 0}}, button = {state = BUTTON_STATE_NONE, curr = 0, timer = {
      libinput = 0x5619dd021580, timer_name = 0x5619dd09b330 "event11 (1) button", link = {prev = 0x0, next = 0x0}, expire = 0, timer_func = 
    0x7f58e7f0ffac <tp_button_handle_timeout>, timer_func_data = 0x5619dd09ba60}}, tap = {state = TAP_TOUCH_STATE_DEAD, initial = {x = 0, y = 0}, is_thumb = false, 
    is_palm = false}, scroll = {edge_state = EDGE_SCROLL_TOUCH_STATE_NONE, edge = 0, direction = -1, timer = {libinput = 0x5619dd021580, 
      timer_name = 0x5619dd09c2b0 "event11 (0) edgescroll", link = {prev = 0x0, next = 0x0}, expire = 0, timer_func = 0x7f58e7f11f47 <tp_edge_scroll_handle_timeout>, 
      timer_func_data = 0x5619dd09ba60}, initial = {x = 0, y = 0}}, palm = {state = PALM_NONE, first = {x = 1473, y = 1407}, time = 0}, gesture = {initial = {x = 0, y = 0}}, 
  thumb = {state = THUMB_STATE_MAYBE, first_touch_time = 2162224450, initial = {x = 0, y = 0}}, speed = {last_speed = 0, exceeded_count = 0}}
(gdb) p *tp
$9 = {base = {dispatch_type = DISPATCH_TOUCHPAD, interface = 0x7f58e8136860 <tp_interface>, sendevents = {config = {get_modes = 0x0, set_mode = 0x0, get_mode = 0x0, 
        get_default_mode = 0x0}, current_mode = LIBINPUT_CONFIG_SEND_EVENTS_ENABLED}}, device = 0x5619dd0976b0, nfingers_down = 1, old_nfingers_down = 1, slot = 0, 
  has_mt = true, semi_mt = false, arbitration = {in_arbitration = false, arbitration_timer = {libinput = 0x5619dd021580, timer_name = 0x5619dd09c250 "event11 arbitration", 
      link = {prev = 0x0, next = 0x0}, expire = 0, timer_func = 0x7f58e7f0a342 <tp_arbitration_timeout>, timer_func_data = 0x5619dd09aab0}}, num_slots = 2, ntouches = 5, 
  touches = 0x5619dd09ba60, fake_touches = 5, pressure = {use_pressure = true, high = 30, low = 25}, touch_size = {use_touch_size = false, high = 0, low = 0, 
    orientation_to_angle = 0}, hysteresis = {enabled = true, margin = {x = 20, y = 30}, other_event_count = 0, last_motion_time = 2162337668}, accel = {
    x_scale_coeff = 0.96024582293067029, y_scale_coeff = 0.64541112688782754, xy_scale_coeff = 0.67213114754098358}, gesture = {enabled = true, started = false, 
    finger_count = 1, finger_count_pending = 0, finger_count_switch_timer = {libinput = 0x5619dd021580, timer_name = 0x5619dd09c350 "event11 gestures", link = {prev = 0x0, 
        next = 0x0}, expire = 0, timer_func = 0x7f58e7f14814 <tp_gesture_finger_count_switch_timeout>, timer_func_data = 0x5619dd09aab0}, state = GESTURE_STATE_NONE, 
    touches = {0x0, 0x0}, initial_time = 0, initial_distance = 0, prev_scale = 0, angle = 0, center = {x = 0, y = 0}}, buttons = {is_clickpad = false, has_topbuttons = false, 
    use_clickfinger = false, click_pending = false, state = 0, old_state = 0, motion_dist = {x_scale_coeff = 0.024390243902439025, y_scale_coeff = 0.016393442622950821}, 
    active = 0, active_is_topbutton = false, bottom_area = {top_edge = 2147483647, rightbutton_left_edge = 0, middlebutton_left_edge = 0}, top_area = {
      bottom_edge = -2147483648, rightbutton_left_edge = 0, leftbutton_right_edge = 0}, trackpoint = 0x0, click_method = LIBINPUT_CONFIG_CLICK_METHOD_NONE, config_method = {
      get_methods = 0x7f58e7f10471 <tp_button_config_click_get_methods>, set_method = 0x7f58e7f10534 <tp_button_config_click_set_method>, get_method = 
    0x7f58e7f10582 <tp_button_config_click_get_method>, get_default_method = 0x7f58e7f10635 <tp_button_config_click_get_default_method>}}, scroll = {config_method = {
      get_methods = 0x7f58e7f0a971 <tp_scroll_config_scroll_method_get_methods>, set_method = 0x7f58e7f0a9aa <tp_scroll_config_scroll_method_set_method>, get_method = 
    0x7f58e7f0aa40 <tp_scroll_config_scroll_method_get_method>, get_default_method = 0x7f58e7f0aae1 <tp_scroll_config_scroll_method_get_default_method>, set_button = 0x0, 
      get_button = 0x0, get_default_button = 0x0}, method = LIBINPUT_CONFIG_SCROLL_2FG, right_edge = 5369, bottom_edge = 4301}, queued = 
    (TOUCHPAD_EVENT_MOTION | TOUCHPAD_EVENT_OTHERAXIS), tap = {config = {count = 0x7f58e7f0e72b <tp_tap_config_count>, set_enabled = 
    0x7f58e7f0e775 <tp_tap_config_set_enabled>, get_enabled = 0x7f58e7f0e7eb <tp_tap_config_is_enabled>, get_default = 0x7f58e7f0e869 <tp_tap_config_get_default>, set_map = 
    0x7f58e7f0e893 <tp_tap_config_set_map>, get_map = 0x7f58e7f0e8e9 <tp_tap_config_get_map>, get_default_map = 0x7f58e7f0e928 <tp_tap_config_get_default_map>, 
      set_drag_enabled = 0x7f58e7f0e937 <tp_tap_config_set_drag_enabled>, get_drag_enabled = 0x7f58e7f0e985 <tp_tap_config_get_drag_enabled>, get_default_drag_enabled = 
    0x7f58e7f0e9d7 <tp_tap_config_get_default_drag_enabled>, set_draglock_enabled = 0x7f58e7f0ea01 <tp_tap_config_set_draglock_enabled>, get_draglock_enabled = 
    0x7f58e7f0ea4f <tp_tap_config_get_draglock_enabled>, get_default_draglock_enabled = 0x7f58e7f0eaa1 <tp_tap_config_get_default_draglock_enabled>}, enabled = true, 
    suspended = false, timer = {libinput = 0x5619dd021580, timer_name = 0x5619dd09aa20 "event11 tap", link = {prev = 0x0, next = 0x0}, expire = 0, timer_func = 
    0x7f58e7f0e57f <tp_tap_handle_timeout>, timer_func_data = 0x5619dd09aab0}, state = TAP_STATE_IDLE, buttons_pressed = 0, saved_press_time = 2162224450, 
    saved_release_time = 2162302736, map = LIBINPUT_CONFIG_TAP_MAP_LRM, want_map = LIBINPUT_CONFIG_TAP_MAP_LRM, drag_enabled = true, drag_lock_enabled = false, 
    nfingers_down = 0}, palm = {right_edge = 5328, left_edge = 1612, upper_edge = 1308, trackpoint_active = false, trackpoint_listener = {link = {prev = 0x0, next = 0x0}, 
      notify_func = 0x0, notify_func_data = 0x0}, trackpoint_timer = {libinput = 0x5619dd021580, timer_name = 0x5619dd09c270 "event11 trackpoint", link = {prev = 0x0, 
        next = 0x0}, expire = 0, timer_func = 0x7f58e7f09545 <tp_trackpoint_timeout>, timer_func_data = 0x5619dd09aab0}, trackpoint_last_event_time = 0, 
    trackpoint_event_count = 0, monitor_trackpoint = true, use_mt_tool = false, use_pressure = true, pressure_threshold = 130, use_size = false, size_threshold = 0}, 
  sendevents = {config = {get_modes = 0x7f58e7f0be7e <tp_sendevents_get_modes>, set_mode = 0x7f58e7f0bf48 <tp_sendevents_set_mode>, get_mode = 
    0x7f58e7f0c012 <tp_sendevents_get_mode>, get_default_mode = 0x7f58e7f0c049 <tp_sendevents_get_default_mode>}, current_mode = LIBINPUT_CONFIG_SEND_EVENTS_ENABLED}, dwt = {
    config = {is_available = 0x7f58e7f0abef <tp_dwt_config_is_available>, set_enabled = 0x7f58e7f0abfe <tp_dwt_config_set>, get_enabled = 0x7f58e7f0ac54 <tp_dwt_config_get>, 
      get_default_enabled = 0x7f58e7f0ac9e <tp_dwt_config_get_default>}, dwt_enabled = true, paired_keyboard = {{device = 0x5619dd087580, listener = {link = {
            prev = 0x5619dd0875a0, next = 0x5619dd0875a0}, notify_func = 0x7f58e7f097b7 <tp_keyboard_event>, notify_func_data = 0x5619dd09aab0}}, {device = 0x0, listener = {
          link = {prev = 0x0, next = 0x0}, notify_func = 0x0, notify_func_data = 0x0}}, {device = 0x0, listener = {link = {prev = 0x0, next = 0x0}, notify_func = 0x0, 
          notify_func_data = 0x0}}}, key_mask = {0 <repeats 12 times>}, mod_mask = {0 <repeats 12 times>}, keyboard_active = false, keyboard_timer = {
      libinput = 0x5619dd021580, timer_name = 0x5619dd09c290 "event11 keyboard", link = {prev = 0x0, next = 0x0}, expire = 0, timer_func = 
    0x7f58e7f0964f <tp_keyboard_timeout>, timer_func_data = 0x5619dd09aab0}, keyboard_last_press_time = 0}, thumb = {detect_thumbs = false, threshold = 0, 
    upper_thumb_line = 0, lower_thumb_line = 0}, quirks = {nonmotion_event_count = 0}, lid_switch = {listener = {link = {prev = 0x0, next = 0x0}, notify_func = 0x0, 
      notify_func_data = 0x0}, lid_switch = 0x0}, tablet_mode_switch = {listener = {link = {prev = 0x0, next = 0x0}, notify_func = 0x0, notify_func_data = 0x0}, 
    tablet_mode_switch = 0x0}}

# ./libinput list-devices
Device:           Power Button
Kernel:           /dev/input/event3
Group:            1
Seat:             seat0, default
Capabilities:     keyboard 
Tap-to-click:     n/a
Tap-and-drag:     n/a
Tap drag lock:    n/a
Left-handed:      n/a
Nat.scrolling:    n/a
Middle emulation: n/a
Calibration:      n/a
Scroll methods:   none
Click methods:    none
Disable-w-typing: n/a
Accel profiles:   n/a
Rotation:         n/a

Device:           Video Bus
Kernel:           /dev/input/event4
Group:            2
Seat:             seat0, default
Capabilities:     keyboard 
Tap-to-click:     n/a
Tap-and-drag:     n/a
Tap drag lock:    n/a
Left-handed:      n/a
Nat.scrolling:    n/a
Middle emulation: n/a
Calibration:      n/a
Scroll methods:   none
Click methods:    none
Disable-w-typing: n/a
Accel profiles:   n/a
Rotation:         n/a

Device:           Power Button
Kernel:           /dev/input/event0
Group:            3
Seat:             seat0, default
Capabilities:     keyboard 
Tap-to-click:     n/a
Tap-and-drag:     n/a
Tap drag lock:    n/a
Left-handed:      n/a
Nat.scrolling:    n/a
Middle emulation: n/a
Calibration:      n/a
Scroll methods:   none
Click methods:    none
Disable-w-typing: n/a
Accel profiles:   n/a
Rotation:         n/a

Device:           Lid Switch
Kernel:           /dev/input/event2
Group:            4
Seat:             seat0, default
Capabilities:     switch
Tap-to-click:     n/a
Tap-and-drag:     n/a
Tap drag lock:    n/a
Left-handed:      n/a
Nat.scrolling:    n/a
Middle emulation: n/a
Calibration:      n/a
Scroll methods:   none
Click methods:    none
Disable-w-typing: n/a
Accel profiles:   n/a
Rotation:         n/a

Device:           Sleep Button
Kernel:           /dev/input/event1
Group:            5
Seat:             seat0, default
Capabilities:     keyboard 
Tap-to-click:     n/a
Tap-and-drag:     n/a
Tap drag lock:    n/a
Left-handed:      n/a
Nat.scrolling:    n/a
Middle emulation: n/a
Calibration:      n/a
Scroll methods:   none
Click methods:    none
Disable-w-typing: n/a
Accel profiles:   n/a
Rotation:         n/a

Device:           Chicony USB 2.0 Camera: Chicony
Kernel:           /dev/input/event7
Group:            6
Seat:             seat0, default
Capabilities:     keyboard 
Tap-to-click:     n/a
Tap-and-drag:     n/a
Tap drag lock:    n/a
Left-handed:      n/a
Nat.scrolling:    n/a
Middle emulation: n/a
Calibration:      n/a
Scroll methods:   none
Click methods:    none
Disable-w-typing: n/a
Accel profiles:   n/a
Rotation:         n/a

Device:           HDA Intel PCH Mic
Kernel:           /dev/input/event9
Group:            7
Seat:             seat0, default
Capabilities:     
Tap-to-click:     n/a
Tap-and-drag:     n/a
Tap drag lock:    n/a
Left-handed:      n/a
Nat.scrolling:    n/a
Middle emulation: n/a
Calibration:      n/a
Scroll methods:   none
Click methods:    none
Disable-w-typing: n/a
Accel profiles:   n/a
Rotation:         n/a

Device:           HDA Intel PCH Line Out
Kernel:           /dev/input/event10
Group:            7
Seat:             seat0, default
Capabilities:     
Tap-to-click:     n/a
Tap-and-drag:     n/a
Tap drag lock:    n/a
Left-handed:      n/a
Nat.scrolling:    n/a
Middle emulation: n/a
Calibration:      n/a
Scroll methods:   none
Click methods:    none
Disable-w-typing: n/a
Accel profiles:   n/a
Rotation:         n/a

Device:           AT Translated Set 2 keyboard
Kernel:           /dev/input/event5
Group:            8
Seat:             seat0, default
Capabilities:     keyboard 
Tap-to-click:     n/a
Tap-and-drag:     n/a
Tap drag lock:    n/a
Left-handed:      n/a
Nat.scrolling:    n/a
Middle emulation: n/a
Calibration:      n/a
Scroll methods:   none
Click methods:    none
Disable-w-typing: n/a
Accel profiles:   n/a
Rotation:         n/a

Device:           SynPS/2 Synaptics TouchPad
Kernel:           /dev/input/event11
Group:            9
Seat:             seat0, default
Size:             107x59mm
Capabilities:     pointer gesture
Tap-to-click:     disabled
Tap-and-drag:     enabled
Tap drag lock:    disabled
Left-handed:      disabled
Nat.scrolling:    disabled
Middle emulation: n/a
Calibration:      n/a
Scroll methods:   *two-finger edge 
Click methods:    none
Disable-w-typing: enabled
Accel profiles:   none
Rotation:         n/a

Comment 1 Peter Hutterer 2018-02-27 22:42:58 UTC

Any chance you can reproduce that? Would be useful to get the evemu recording for that to cut down on debugging time :)

Comment 2 Peter Hutterer 2018-02-28 07:28:36 UTC

almost certain this is a dupe of 105258 for which I'll have patches very soon

Comment 3 Peter Hutterer 2018-03-01 02:28:14 UTC


*** This bug has been marked as a duplicate of bug 105258 ***

Comment 4 Aaron Plattner 2018-03-10 00:15:42 UTC

Verified that this is fixed now. Closing.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.