Bug 66167

Summary: Weston encounters SIGABRT in popup_grab_end()
Product: Wayland Reporter: U. Artie Eoff <ullysses.a.eoff>
Component: westonAssignee: Wayland bug list <wayland-bugs>
Status: VERIFIED FIXED QA Contact:
Severity: major    
Priority: medium    
Version: unspecified   
Hardware: Other   
OS: All   
Whiteboard:
i915 platform: i915 features:
Attachments: gdb backtrace

Description U. Artie Eoff 2013-06-25 17:34:49 UTC
Created attachment 81422 [details]
gdb backtrace

This one is a little tough to trigger/reproduce, but reachable nonetheless.  See attached gdb backtrace.  I have only been able to occasionally trigger it via gtk3-demo so far.


Steps:
------
1. Launch gtk3-demo
2. In the left pane (titled Widget), double-click the "Application window" demo from the list. 
3. On the toolbar, click on the drop-down arrow.
4. Observe Weston aborts.

wayland (master) heads/master-0-g3af748b
fontconfig (master) heads/master-0-gcd9b103
drm (master) heads/master-0-ga0178c0
mesa (master) heads/master-0-ge3cbb18
libxkbcommon (master) heads/master-0-g6f06eb5
pixman (master) heads/master-0-g279bdcd
cairo (master) heads/master-0-g4d94391
weston (master) heads/master-0-g18aac88
harfbuzz (master) heads/master-0-gf5da11e
glib (master) heads/master-0-g5841267
atk (master) ATK_2_9_3-0-gb2edff1
gdk-pixbuf (master) heads/master-0-g5f8c246
pango (master) heads/master-0-g5441062
at-spi2-core (master) AT_SPI2_CORE_2_9_3-0-gfeb130f
at-spi2-atk (master) AT_SPI2_ATK_2_9_3-0-g58d3185
gtk+ (master) heads/master-0-g2b571f4
Comment 1 U. Artie Eoff 2013-06-26 18:27:14 UTC
This issue can be triggered more reliably with the gtk3-demo "Combo boxes" demo:

1. Open the "Combo boxes" demo
2. Select the "Where are we" combo box
3. Cycle through each "main" drop-down option ("A-B", "C-D", etc.) by moving/hovering the mouse over each option.  Allow some options to popup there submenus.
4. eventually weston aborts while doing step 3.
Comment 2 Rob Bradford 2013-06-26 18:39:04 UTC
This is an interesting flow:

- we're trying to show a popup surface - shell_map_popup
- but then for some reason our client is unresponsive so we call set_busy_cursor
- which then tries to setup a shell grab using shell_grab_start which then tries to end the popup_end_grab
- popup_end_grab checks the invariant: assert(!wl_list_empty(&shseat->popup_grab.surfaces_list)); but because we didn't finish starting the grab this fails

We can fix this by removing the assertion.

The more worrying thing is why is the client unresponsive?
Comment 3 Rob Bradford 2013-06-26 18:40:30 UTC
Actually removing the assertion is wrong. We need to move the list insertion before - because otherwise we'll try to add the popup grab that we just tried to remove.
Comment 4 Kristian Høgsberg 2013-07-04 05:25:26 UTC
commit dfe310512b4ed8f5dd591611b61a5dfd114403b0
Author: Rob Bradford <rob@linux.intel.com>
Date:   Wed Jun 26 19:49:11 2013 +0100

    shell: Allow ending of popup grabs from within the starting of the grab
    
    Calling weston_pointer_start_grab can lead to a code path (in this case
    when the shell surface is unresponsive) that can try and remove the
    popup grab to setup a shell grab.
    
    Ending the popup grab requires removing the surface from the grab's
    surfaces list - however the grab had not yet been fully setup so the
    grabbed surface was not yet in this list.
    
    With this change we ensure we add the surface to the list before setting
    up the pointer grab.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.