Bug 105557 - SIGSEGV with touchscreen when taping on window decorations
Summary: SIGSEGV with touchscreen when taping on window decorations
Status: RESOLVED DUPLICATE of bug 96536
Alias: None
Product: xorg
Classification: Unclassified
Component: Server/Input/Core (show other bugs)
Version: unspecified
Hardware: All Linux (All)
: medium normal
Assignee: Xorg Project Team
QA Contact: Xorg Project Team
Depends on:
Reported: 2018-03-16 14:02 UTC by Jean-Noël AVILA
Modified: 2018-11-12 22:08 UTC (History)
0 users

See Also:
i915 platform:
i915 features:

gdb trace of the crash 1 (3.44 KB, text/plain)
2018-03-16 14:02 UTC, Jean-Noël AVILA
no flags Details
gdb trace of the crash 2 (1.76 KB, text/plain)
2018-03-16 14:03 UTC, Jean-Noël AVILA
no flags Details

Description Jean-Noël AVILA 2018-03-16 14:02:55 UTC
Created attachment 138155 [details]
gdb trace of the crash 1

Viewed on ubuntu 16.04.3, Xorg 1.18.4 with various DE

Repeatability: always

When using a touch screen and using applications based on chrome (chrome, chromium, electron apps), if a menu is opened and the user taps on the window bar, the Xorg server crashes.

The gdb stack traces are attached. The crash seems to be a double free  in ProcXIUngrabDevice.

This crash does not happen when using a mouse.

My interpretation (which is surely utterly wrong):

A simple touch to the screen generates a sequence of 3 events: ButtonPress, MotionNotify and ButtonRelease, which is interpreted as a drag. On the window with menu opened, the first ButtonPress makes the app kill the window of the menu but too late before the Xserver interprets the sequence as a Drag event start and tries to drag both windows. At the time the Drag event ends, the window of the menu no longer exists and the ProcXIUngrabDevice happens on an already freed device.
Comment 1 Jean-Noël AVILA 2018-03-16 14:03:58 UTC
Created attachment 138156 [details]
gdb trace of the crash 2
Comment 2 Jean-Noël AVILA 2018-03-19 10:04:57 UTC
Reproduced with Chromium on Raspbian 9.

This is not architecture dependent.
Comment 3 Marco Trevisan (Treviño) 2018-11-12 22:08:45 UTC

*** This bug has been marked as a duplicate of bug 96536 ***

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.