Bug 64689 - NULL deref in busy_cursor_grab_focus causes SEGV
Summary: NULL deref in busy_cursor_grab_focus causes SEGV
Status: VERIFIED FIXED
Alias: None
Product: Wayland
Classification: Unclassified
Component: weston (show other bugs)
Version: unspecified
Hardware: Other All
: high critical
Assignee: Wayland bug list
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-05-16 22:16 UTC by U. Artie Eoff
Modified: 2013-05-23 03:00 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
weston gdb backtrace (8.02 KB, text/plain)
2013-05-16 22:16 UTC, U. Artie Eoff
Details

Description U. Artie Eoff 2013-05-16 22:16:39 UTC
Created attachment 79444 [details]
weston gdb backtrace

Weston crashes due to a NULL deref in busy_cursor_grab_focus() on "grab->shsurf" (see attached gdb backtrace).  This is triggered with various clutter and efl client test cases that I've tried.  If you run the following clutter conform test, you can trigger the crash about 95% of the time:

./test-conformance -k --verbose -p /conform/actor/actor_pick  

When weston crashes, it prints the following message to the console:

[15:12:54.169] caught signal: 11
[15:12:54.170]   [000000000040e176]  --  (weston)
[15:12:54.170]   [000000000040e25e]  --  (weston)
[15:12:54.170]   [00007f70b2a03fe0]  --  (/lib64/libpthread.so.0)
[15:12:54.170]   [00007f70ad63b00c]  --  (/home/uartie/Work/intel/wayland/install/lib/weston/desktop-shell.so)
[15:12:54.170]   [000000000040f67d]  --  (weston)
[15:12:54.170]   [000000000040a86a]  --  (weston)
[15:12:54.170]   [000000000040b834]  --  (weston)
[15:12:54.170]   [000000000040ba1d]  weston_output_finish_frame  (weston)
[15:12:54.170]   [00007f70b0fdd438]  --  (/home/uartie/Work/intel/wayland/install/lib/weston/x11-backend.so)
[15:12:54.170]   [00007f70b0fdd736]  --  (/home/uartie/Work/intel/wayland/install/lib/weston/x11-backend.so)
[15:12:54.170]   [00007f70b349d29b]  --  (/home/uartie/Work/intel/wayland/install/lib/libwayland-server.so.0)
[15:12:54.170]   [00007f70b349dba4]  wl_event_loop_dispatch  (/home/uartie/Work/intel/wayland/install/lib/libwayland-server.so.0)
[15:12:54.170]   [00007f70b349b673]  wl_display_run  (/home/uartie/Work/intel/wayland/install/lib/libwayland-server.so.0)
[15:12:54.170]   [000000000040ee88]  --  (weston)
[15:12:54.170]   [0000003763221735]  __libc_start_main  (/lib64/libc.so.6)
[15:12:54.170]   [0000000000407659]  --  (weston)

It appears that the client-side crashes before the server-side.

First bad Weston commit is be6403ed5c4fdab884d391778e2572aae109f1a0
Comment 1 Rob Bradford 2013-05-20 10:38:43 UTC
Hi Artie, I tried running that test but it didn't trigger the problem for me. Re you using Clutter 1.16?
Comment 2 Rob Bradford 2013-05-20 12:01:10 UTC
Possible solution patch posted to list.
Comment 3 U. Artie Eoff 2013-05-20 12:50:38 UTC
Rob, ah yes I forgot to list my s/w:

wayland (master) heads/master-0-g508dd69
fontconfig (master) heads/master-0-g0f9aa87
drm (master) heads/master-0-gacfbf39
mesa (master) heads/master-0-g4f518e1
libxkbcommon (master) heads/master-0-ga392d26
pixman (master) heads/master-0-gcb5d131
cairo (master) heads/master-0-g631bf29
weston (master) heads/master-0-geb1e130
harfbuzz (master) heads/master-0-gfa3d0a0
glib (master) heads/master-0-gad7959c
atk (master) heads/master-0-gc71edfa
cogl (cogl-1.16) heads/cogl-1.16-0-gc08fe74
clutter (clutter-1.16) heads/clutter-1.16-0-g323ec19

Try running it on x11-backend if you haven't done so... it's harder to trigger on the drm-backend.  Our CI agrees with that.  Also, try running the entire clutter conform suite all at once since it may be intermittently triggered by running back-to-back tests.

I'll grab the patch you mentioned and see if that helps.
Comment 4 U. Artie Eoff 2013-05-20 13:50:36 UTC
Rob, the efl/egl/ListUserMouseScrollTest in wayland-fits triggers this issue 100%.

https://github.com/01org/wayland-fits

Run: CK_FORK=no wfits --filter efl/egl/ListUserMouseScrollTest

Note: you'll need upstream EFL Wayland


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.