Created attachment 137616 [details]
Systemd core dump info

install the debug info package for libinput please (whatever that's called on arch, I don't know for sure) and run:

$ eu-addr2line -e /usr/lib64/libinput.so

and provide:
libinput_event_get_pointer_event+0xec9e

That should give you the line number where it crashes, same with the few other references. This should help a bit identifying what's going on.

Please also provide an evemu recording of one of the crashers, thanks.

Here is a new crash with an updated libinput, rebuilt without stripping symbols.

libinput version: 1.10.0+25+g3e77f2e9-1
libinput commit: 3e77f2e9f5a98fc5917642bd47ceeef89b95c858

Backtrace from Xorg log:
    [  1580.664] (EE) Backtrace:
    [  1580.671] (EE) 0: /usr/lib/xorg-server/Xorg (OsLookupColor+0x139) [0x55ed7d51ee99]
    [  1580.673] (EE) 1: /usr/lib/libpthread.so.0 (funlockfile+0x50) [0x7fbf098d4e1f]
    [  1580.677] (EE) 2: /usr/lib/libc.so.6 (gsignal+0x110) [0x7fbf09540860]
    [  1580.679] (EE) 3: /usr/lib/libc.so.6 (abort+0x1c9) [0x7fbf09541ec9]
    [  1580.681] (EE) 4: /usr/lib/libc.so.6 (__assert_fail_base+0x14c) [0x7fbf095390bc]
    [  1580.683] (EE) 5: /usr/lib/libc.so.6 (__assert_fail+0x43) [0x7fbf09539133]
    [  1580.685] (EE) 6: /usr/lib/libinput.so.10 (tp_handle_state+0x332c) [0x7fbf023396dc]
    [  1580.686] (EE) 7: /usr/lib/libinput.so.10 (tp_interface_process+0xb8) [0x7fbf0233a438]
    [  1580.687] (EE) 8: /usr/lib/libinput.so.10 (evdev_device_dispatch+0x3f8) [0x7fbf02326178]
    [  1580.687] (EE) 9: /usr/lib/libinput.so.10 (libinput_dispatch+0x5f) [0x7fbf02325a5f]
    [  1580.688] (EE) 10: /usr/lib/xorg/modules/input/libinput_drv.so (_init+0x29b9) [0x7fbf0255c5b9]
    [  1580.689] (EE) 11: /usr/lib/xorg-server/Xorg (input_unlock+0x293) [0x55ed7d51d3d3]
    [  1580.689] (EE) 12: /usr/lib/xorg-server/Xorg (OsCleanup+0x621) [0x55ed7d51fe01]
    [  1580.690] (EE) 13: /usr/lib/xorg-server/Xorg (input_unlock+0xde) [0x55ed7d51cfce]
    [  1580.691] (EE) 14: /usr/lib/libpthread.so.0 (start_thread+0xdc) [0x7fbf098ca08c]
    [  1580.694] (EE) 15: /usr/lib/libc.so.6 (clone+0x3f) [0x7fbf09601eb8]


Line numbers:
    tp_handle_state+0x332c: ../libinput/src/evdev-mt-touchpad-gestures.c:85
    tp_interface_process+0xb8: ../libinput/src/evdev-mt-touchpad.c:1639
    evdev_device_dispatch+0x3f8: ../libinput/src/evdev.c:857
    libinput_dispatch+0x5f: ../libinput/src/libinput.c:1989

I'll try to have an evemu recording setup next.

Created attachment 137672 [details]
evemu recording

Here is an evemu recording for the last crash (with the exact same backtrace as the one showed previously).

I left only the last minute or so in the recording. I cannot pinpoint exactly where in that recording the crash happened, but it is close to the end as I stopped touching the touchpad as soon as I noticed the crash.

well, that was more effort than expected. patch series is here:
https://lists.freedesktop.org/archives/wayland-devel/2018-March/037268.html

branch for testing is here:
https://github.com/whot/libinput/tree/wip/touchpad-maybe-end-state

*** Bug 105275 has been marked as a duplicate of this bug. ***

Just did some tests and it seems to have fixed the crash. Thanks!

I first tried to have a near-systematic reproduction pattern by trying to reproduce the sequence you described on wayland-devel, and managed to make it crash in a few seconds every time.

Then I updated and tried again with the same pattern for a few minutes, and no crash.

Again, thanks a lot for your work.

*** Bug 105336 has been marked as a duplicate of this bug. ***

Thanks for testing, pushed to master and I'll get this into the next 1.10 release too

commit 6ccd8e934f965150173866db265ca544031c6e6b
Author: Peter Hutterer <>
Date:   Wed Feb 28 12:51:27 2018 +1000

     touchpad: add a TOUCH_MAYBE_END state

*** Bug 105370 has been marked as a duplicate of this bug. ***

Thanks Peter! I built from commit 12410dfba4b903108c8926d68c64ed1c7468902d and so far, haven't been able to reproduce the problem.

Peter, I'm afraid the issue is still there.
I had libinput 1.10.2 installed which was still crashing Xorg. Then I upgraded to commit 12410dfba4b903108c8926d68c64ed1c7468902d and rebuilt. I still was able to reproduce the issue.

Here is the bactrace:

#0  0x00007fa3f4197860 in raise () at /usr/lib/libc.so.6
#1  0x00007fa3f4198ec9 in abort () at /usr/lib/libc.so.6
#2  0x00005593d7ac0cea in  ()
#3  0x00005593d799c674 in  ()
#4  0x00005593d7ac67e2 in  ()
#5  0x00005593d7ac7625 in  ()
#6  0x00005593d7abddde in  ()
#7  0x00007fa3f452bdd0 in <signal handler called> () at /usr/lib/libpthread.so.0
#8  0x00007fa3f4197860 in raise () at /usr/lib/libc.so.6
#9  0x00007fa3f4198ec9 in abort () at /usr/lib/libc.so.6
#10 0x00007fa3f41900bc in __assert_fail_base () at /usr/lib/libc.so.6
#11 0x00007fa3f4190133 in  () at /usr/lib/libc.so.6
#12 0x00007fa3e6438671 in tp_tap_handle_state (time=94093507188400, tp=0x5593da14f8b0) at ../libinput/src/evdev-mt-touchpad-tap.c:1030
#13 0x00007fa3e6438671 in tp_post_events (time=94093507188400, tp=0x5593da14f8b0) at ../libinput/src/evdev-mt-touchpad.c:1650
#14 0x00007fa3e6438671 in tp_handle_state (tp=0x5593da14f8b0, time=time@entry=3849255224) at ../libinput/src/evdev-mt-touchpad.c:1673
#15 0x00007fa3e6439108 in tp_interface_process (dispatch=
    0x5593da14f8b0, device=<optimized out>, e=0x7fa3e598bd80, time=3849255224, time=<optimized out>, e=<optimized out>, dispatch=<optimized out>)
    at ../libinput/src/evdev-mt-touchpad.c:1720
#16 0x00007fa3e64243d8 in evdev_process_event (e=0x7fa3e598bd80, device=0x5593da1443e0) at ../libinput/src/evdev.c:863
#17 0x00007fa3e64243d8 in evdev_device_dispatch_one (ev=0x7fa3e598bd80, device=0x5593da1443e0) at ../libinput/src/evdev.c:871
#18 0x00007fa3e64243d8 in evdev_device_dispatch (data=0x5593da1443e0) at ../libinput/src/evdev.c:930
#19 0x00007fa3e6423cbf in libinput_dispatch (libinput=0x5593d9c9e5a0) at ../libinput/src/libinput.c:1989
#20 0x00007fa3e6658c19 in  () at /usr/lib/xorg/modules/input/libinput_drv.so
#21 0x00005593d7abc163 in  ()
#22 0x00005593d7abe861 in  ()
#23 0x00005593d7abbfae in  ()
#24 0x00007fa3f452108c in start_thread () at /usr/lib/libpthread.so.0
#25 0x00007fa3f4258e7f in clone () at /usr/lib/libc.so.6

Reproduction steps: open gnome-terminal and swipe inside its window with three fingers quickly left-to-right and right-to-left few times.

Apparently this assertion fails when t->state == TOUCH_END and t->was_down:
assert(tp->tap.nfingers_down >= 1);

Some more details.

Distribution: arch
Hardware: Hewlett-Packard HP Pavilion TS Sleekbook 15/18FD
Packages:
  libinput 1.10.0+68+g12410dfb-1
  linux 4.15.7-1
  xf86-input-libinput 0.26.0-1
  xorg-server 1.19.6+13+gd0d1a694f-1

libinput list-devices --version
1.10.900

xinput list-props "SynPS/2 Synaptics TouchPad"
Device 'SynPS/2 Synaptics TouchPad':
	Device Enabled (142):	1
	Coordinate Transformation Matrix (144):	1.000000, 0.000000, 0.000000, 0.000000, 1.000000, 0.000000, 0.000000, 0.000000, 1.000000
	libinput Tapping Enabled (285):	1
	libinput Tapping Enabled Default (286):	0
	libinput Tapping Drag Enabled (287):	1
	libinput Tapping Drag Enabled Default (288):	1
	libinput Tapping Drag Lock Enabled (289):	0
	libinput Tapping Drag Lock Enabled Default (290):	0
	libinput Tapping Button Mapping Enabled (291):	1, 0
	libinput Tapping Button Mapping Default (292):	1, 0
	libinput Natural Scrolling Enabled (293):	1
	libinput Natural Scrolling Enabled Default (294):	0
	libinput Left Handed Enabled (295):	0
	libinput Left Handed Enabled Default (296):	0
	libinput Accel Speed (297):	0.010989
	libinput Accel Speed Default (298):	0.000000
	libinput Scroll Methods Available (299):	1, 1, 0
	libinput Scroll Method Enabled (300):	1, 0, 0
	libinput Scroll Method Enabled Default (301):	1, 0, 0
	libinput Send Events Modes Available (266):	1, 1
	libinput Send Events Mode Enabled (267):	0, 0
	libinput Send Events Mode Enabled Default (268):	0, 0
	libinput Disable While Typing Enabled (302):	1
	libinput Disable While Typing Enabled Default (303):	1
	Device Node (269):	"/dev/input/event11"
	Device Product ID (270):	2, 7
	libinput Drag Lock Buttons (304):	<no items>
	libinput Horizontal Scroll Enabled (305):	1

Created attachment 137991 [details]
evemu-record output

These events result in Xorg crash in this context:

...
#12 0x00007f6e4d01d671 in tp_tap_handle_state (time=94242228317136, tp=0x55b67a8a9be0) at ../libinput/src/evdev-mt-touchpad-tap.c:1030
#13 0x00007f6e4d01d671 in tp_post_events (time=94242228317136, tp=0x55b67a8a9be0) at ../libinput/src/evdev-mt-touchpad.c:1650
#14 0x00007f6e4d01d671 in tp_handle_state (tp=0x55b67a8a9be0, time=time@entry=19144585374) at ../libinput/src/evdev-mt-touchpad.c:1673
...

*** Bug 105437 has been marked as a duplicate of this bug. ***

*** Bug 105407 has been marked as a duplicate of this bug. ***

*** Bug 105443 has been marked as a duplicate of this bug. ***

*** Bug 105439 has been marked as a duplicate of this bug. ***

Thanks for the evemu, that helped a lot. Caused by a corner-case where a fake finger touch ended up hovering and was never terminated on the input event sequence. On the next real touch with high-enough pressure it was continued and caused a miscount of tapping fingers.

commit d8db6b5927f61460b2991479a85056256c819485
Author: Peter Hutterer <>
Date:   Mon Mar 12 10:33:21 2018 +1000

     touchpad: end hovering touches in maybe_end_touch

*** Bug 105459 has been marked as a duplicate of this bug. ***

It better if change summary to something new, the "1.10-branch" make me thought it was a  old bug on libinput version 1.10.0

Done. It's the same assertion, just line 1030 in master and line 1028 in 1.10-branch.

Created attachment 138073 [details]
coredump info

I am still getting crashes with 1.10.2.

I tried to provide more information by following the instructions in comment #2, but I'm afraid I don't quite understand how to. I am also experiencing the crashes on Arch Linux.

I rebuilt the libinput package specifying --builtype debug. Then I triggered another crash and got a coredump (attached info).

I will attach an evemu recording shortly.

There is nothing in my Xorg log, apart from this line:
[  1149.033] (II) Axis 0x1 value 5120 is outside expected range [1237, 4990]

I also ran "eu-addr2line -e /usr/lib64/libinput.so", but I don't know what I'm supposed to do with it since there was no output.
Can someone help me to provide more information?

Created attachment 138074 [details]
evemu-record of touchpad

evemu-record of my SynPS/2 Synaptics TouchPad on a Thinkpad T410.

regarding addr2line: https://who-t.blogspot.com.au/2014/02/making-sense-of-backtraces-with.html

see comment #20, this bug is fixed on master, and I cannot reproduce it with the recording (but I can with the commit before d8db6b59).

Thank you. I have tested it with 1.10.3 and it's fixed.
I got confused for a bit, because the bug tracker on the distribution said it was fixed in 1.10.2, but they meant the first bug in this report.

*** Bug 105791 has been marked as a duplicate of this bug. ***

I confirm running libinput 1.10.900 it solved the issue for me