Bug 60675

Summary: with fullscreen mode=driver killing client when on another VT and returning to weston segvs
Product: Wayland Reporter: Rob Bradford <rob>
Component: westonAssignee: Wayland bug list <wayland-bugs>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: medium    
Version: unspecified   
Hardware: Other   
OS: All   
Whiteboard:
i915 platform: i915 features:

Description Rob Bradford 2013-02-11 17:17:36 UTC
Using gstreamer-vaapi hacked to use fullscreen mode 'driver' if you kill the client whilst on another VT e.g X and then switch back to weston then it SEGVs.

Killing the client whilst remaining on the weston VT has no problem. Here is the bt full:

#0  drm_compositor_set_modes (compositor=0x21c8340) at compositor-drm.c:2238
        output = 0x21d5da0
        drm_mode = 0x21d6130
        ret = 0
#1  0x00007fd428382025 in vt_func (compositor=0x21c8340, event=0) at compositor-drm.c:2268
        ec = 0x21c8340
        seat = 0x0
        sprite = 0x0
        output = 0x7fffed736ae0
#2  0x00007fd42838346b in vt_handler (signal_number=10, data=0x21c9560) at tty.c:68
        tty = 0x21c9560
#3  0x00007fd428e0ac3a in wl_event_source_signal_dispatch (source=0x21c9630, ep=0x7fffed7365e0) at event-loop.c:242
        signal_source = 0x21c9630
        signal_info = {ssi_signo = 10, ssi_errno = 0, ssi_code = 128, ssi_pid = 0, ssi_uid = 0, ssi_fd = 0, ssi_tid = 0, ssi_band = 0, ssi_overrun = 0, ssi_trapno = 0, ssi_status = 0, ssi_int = 0, ssi_ptr = 0, ssi_utime = 0, ssi_stime = 0, ssi_addr = 0, __pad = '\000' <repeats 47 times>}
        len = 128
#4  0x00007fd428e0b19d in wl_event_loop_dispatch (loop=0x21c69c0, timeout=-1) at event-loop.c:421
        ep = {{events = 1, data = {ptr = 0x21c9630, fd = 35427888, u32 = 35427888, u64 = 35427888}}, {events = 1, data = {ptr = 0x21c95e0, fd = 35427808, u32 = 35427808, u64 = 35427808}}, {events = 3983763016, data = {ptr = 0xed73665000007fff, fd = 32767, u32 = 32767, u64 = 17110131903094095871}}, {events = 32767, data = {ptr = 0x24ea248, fd = 38707784, u32 = 38707784, u64 = 38707784}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x7fffed736740, fd = -311204032, u32 = 3983763264, u64 = 140737177151296}}, {events = 685816556, data = {ptr = 0xffffffff00007fd4, fd = 32724, u32 = 32724, u64 = 18446744069414617044}}, {events = 0, data = {ptr = 0x24e7230, fd = 38695472, u32 = 38695472, u64 = 38695472}}, {events = 327306929, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 1, data = {ptr = 0x14, fd = 20, u32 = 20, u64 = 20}}, {events = 1, data = {ptr = 0x3600000001, fd = 1, u32 = 1, u64 = 231928233985}}, {events = 32767, data = {ptr = 0x383ba0e3f4 <_dl_fixup+228>, fd = 1000399860, u32 = 1000399860, u64 = 241518568436}}, {events = 685772296, data = {ptr = 0x2901400000007fd4, fd = 32724, u32 = 32724, u64 = 2954713199275966420}}, {events = 32724, data = {ptr = 0x3848200a28, fd = 1210059304, u32 = 1210059304, u64 = 241728227880}}, {events = 6444312, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x7fffed736ae0, fd = -311203104, u32 = 3983764192, u64 = 140737177152224}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x7fffed736780, fd = -311203968, u32 = 3983763328, u64 = 140737177151360}}, {events = 1000399860, data = {ptr = 0x100000038, fd = 56, u32 = 56, u64 = 4294967352}}, {events = 32767, data = {ptr = 0x7fd429013330, fd = 687944496, u32 = 687944496, u64 = 140549197738800}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 32767, data = {ptr = 0x7fffed736710, fd = -311204080, u32 = 3983763216, u64 = 140737177151248}}, {events = 1, data = {ptr = 0xed73665000000000, fd = 0, u32 = 0, u64 = 17110131903094063104}}, {events = 32767, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x24e82a0, fd = 38699680, u32 = 38699680, u64 = 38699680}}, {events = 60, data = {ptr = 0x24ec26800000000, fd = 0, u32 = 0, u64 = 166283988191674368}}, {events = 0, data = {ptr = 0x4, fd = 4, u32 = 4, u64 = 4}}, {events = 4223552, data = {ptr = 0x206800000000, fd = 0, u32 = 0, u64 = 35631048687616}}, {events = 0, data = {ptr = 0x7fffed736780, fd = -311203968, u32 = 3983763328, u64 = 140737177151360}}, {events = 685802900, data = {ptr = 0x21c699800007fd4, fd = 32724, u32 = 32724, u64 = 152112588979732436}}, {events = 0, data = {ptr = 0x21c6950, fd = 35416400, u32 = 35416400, u64 = 35416400}}}
        source = 0x21c9630
        i = 0
        count = 1
        n = 0
#5  0x00007fd428e0853a in wl_display_run (display=0x21c6950) at wayland-server.c:1213
No locals.
#6  0x000000000040f651 in main (argc=1, argv=0x7fffed736ae8) at compositor.c:3368
        ret = 0
        display = 0x21c6950
        ec = 0x21c8340
        signals = {0x21c6a50, 0x21c6aa0, 0x21c7460, 0x21c74b0}
        loop = 0x21c69c0
        segv_action = {__sigaction_handler = {sa_handler = 0x40eba7 <on_segv_signal>, sa_sigaction = 0x40eba7 <on_segv_signal>}, sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = -2147483644, sa_restorer = 0x21c4010}
        backend_init = 0x7fd428383198 <backend_init>
        i = 1
        backend = 0x41da13 "drm-backend.so"
        modules = 0x41d84b "desktop-shell.so"
        option_modules = 0x0
        log = 0x0
        idle_time = 300
        help = 0
        socket_name = 0x41d85c "wayland-0"
        version = 0
        config_file = 0x21c7500 "WAYLAND_DISPLAY=wayland-0"
        core_config_keys = {{name = 0x41d866 "modules", type = CONFIG_KEY_STRING, data = 0x7fffed736900}}
        cs = {{name = 0x41d86e "core", keys = 0x7fffed7368c0, num_keys = 1, done = 0x0}}
        core_options = {{type = WESTON_OPTION_STRING, name = 0x41d873 "backend", short_name = 66, data = 0x7fffed736908}, {type = WESTON_OPTION_STRING, name = 0x41d87b "socket", short_name = 83, data = 0x7fffed7368e0}, {type = WESTON_OPTION_INTEGER, name = 0x41d882 "idle-time", short_name = 105, data = 0x7fffed7368ec}, {type = WESTON_OPTION_STRING, name = 0x41d866 "modules", short_name = 0, data = 0x7fffed7368f8}, {type = WESTON_OPTION_STRING, name = 0x41d88c "log", short_name = 0, data = 0x7fffed7368f0}, {type = WESTON_OPTION_BOOLEAN, name = 0x41d890 "help", short_name = 104, data = 0x7fffed7368e8}, {type = WESTON_OPTION_BOOLEAN, name = 0x41d895 "version", short_name = 0, data = 0x7fffed7368dc}}


The problem appears to be output->current is NULL.
Comment 1 Kristian Høgsberg 2013-02-26 16:16:43 UTC
commit 2002f8888800f6a416fa873003a9098ff9de8468
Author: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
Date:   Tue Feb 26 13:44:58 2013 +0200

    compositor-drm: Fix a crash with a fullscreen surface with driver mode
    
    If there was a fullscreen surface using driver mode when a vt switch is
    triggered, but something caused it to be gone when switching back (such
    as the client being killed), a call to drm_output_switch_mode() is made
    to restore the old mode, and that sets the output's current drm_fb to
    NULL, so that the new mode is set drm_output_repaint(). This led to a
    crash in vt_func(), because it tried to access output->current for
    restoring the old mode.
    
    Fix this by not setting the mode if there's no current fb. Instead,
    schedule a repaint so that the mode is set in drm_output_repaint().
    
    https://bugs.freedesktop.org/show_bug.cgi?id=60675

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.