segfault on quit due to output destroy event/listener

I have this with the scene-graph branch, but i believe it is a problem on master already, as i’m not aware of having touched anything relevant. Leaving this here mostly as a reminder for myself, though i wouldn’t mind if it got magically resolved all by itself :-P

It happens almost consistently – that is, most of my nested sessions end with it.

Well, now that i’ve tried kiwmi on master, it crashed due to some wl_list_remove… but it’s got debug symbols stripped & it was a bit complicated to compile (coz i needed statically linked wlroots) so i can’t tell much more atm 🤷

Thread 1 "kiwmi" received signal SIGSEGV, Segmentation fault.
0x00007ffff7e75d9f in wl_list_remove () from /usr/lib/libwayland-server.so.0
+bt full
#0  0x00007ffff7e75d9f in wl_list_remove () at /usr/lib/libwayland-server.so.0
#1  0x00007ffff7e70af8 in wl_global_destroy () at /usr/lib/libwayland-server.so.0
#2  0x00005555555c42d6 in  ()
#3  0x000055555556da79 in  ()
#4  0x00005555555c65a4 in  ()
#5  0x00005555555b779f in  ()
#6  0x000055555558f06d in  ()
#7  0x000055555557d7db in  ()
#8  0x000055555558d472 in  ()
#9  0x000055555558d665 in  ()
#10 0x00007ffff7e70877 in wl_display_destroy () at /usr/lib/libwayland-server.so.0
#11 0x000055555556c87a in  ()
#12 0x000055555556c2e9 in  ()
#13 0x00007ffff7988b25 in __libc_start_main () at /usr/lib/libc.so.6
#14 0x000055555556c41e in  ()

But now back to what i can inspect (that is, the wlr-scene branch)…

It’s a kiwmi_output::events.destroy event, so it is definitely a kiwmi issue. Relevant pieces of gdb output (telling me that some listener prolly didn’t remove itself):

Thread 1 "kiwmi" received signal SIGSEGV, Segmentation fault.
0x00007ffff7e91390 in buffer_addon_impl () from /usr/lib/libwlroots.so.10
+bt full
#0  0x00007ffff7e91390 in buffer_addon_impl () at /usr/lib/libwlroots.so.10
#1  0x000055555555bf4d in wl_signal_emit (signal=0x555555b5c148, data=0x555555b5c030) at /usr/include/wayland-server-core.h:478
        l = 0x555555b94fd0
        next = 0x700000007
#2  0x000055555555c691 in output_destroy_notify (listener=0x555555b5c088, UNUSED_data=0x555555b86b00) at ../kiwmi/desktop/output.c:287
        output = 0x555555b5c030
#3  0x00007ffff7e4bf5e in wlr_signal_emit_safe (signal=<optimized out>, data=0x555555b86b00) at ../wlroots/util/signal.c:29
#4  0x00007ffff7e1ed01 in wlr_output_destroy (output=0x555555b86b00) at ../wlroots/types/output/output.c:389
#5  wlr_output_destroy (output=0x555555b86b00) at ../wlroots/types/output/output.c:377

[...]

+up 1
#1  0x000055555555bf4d in wl_signal_emit (signal=0x555555b5c148, data=0x555555b5c030) at /usr/include/wayland-server-core.h:478
478         l->notify(l, data);
+print *signal
$1 = {
  listener_list = {
    prev = 0x555555b94fd0,
    next = 0x555555b94fd0
  }
}
+print l
$2 = (struct wl_listener *) 0x555555b94fd0
+print *l
$3 = {
  link = {
    prev = 0x555555c8db00,
    next = 0x700000007
  },
  notify = 0x7ffff7e91390 <buffer_addon_impl>
}
+print *l->link.next
Cannot access memory at address 0x700000007
+up 1
#2  0x000055555555c691 in output_destroy_notify (listener=0x555555b5c088, UNUSED_data=0x555555b86b00) at ../kiwmi/desktop/output.c:287
287     wl_signal_emit(&output->events.destroy, output);
+print output
$4 = (struct kiwmi_output *) 0x555555b5c030
+print *output
$5 = {
  link, desktop, // removed for a shorter log
  wlr_output = 0x555555b86b00,
  scene_output, frame, commit,
  destroy = {
    link = {
      prev = 0x555555b86d28,
      next = 0x7fffffffd680
    },
    notify = 0x55555555c63c <output_destroy_notify>
  },
  mode, layers, layer_strata_subtrees, layer_popups_strata_subtrees, usable_area,
  events = {
    destroy = {
      listener_list = {
        prev = 0x555555b94fd0,
        next = 0x555555b94fd0
      }
    },
    resize = {
      listener_list = {
        prev = 0x555555b5c158,
        next = 0x555555b5c158
      }
    },
    usable_area_change = {
      listener_list = {
        prev = 0x555555b5c168,
        next = 0x555555b5c168
      }
    }
  }
}

Thread 1 "kiwmi" received signal SIGSEGV, Segmentation fault.
0x00005555555b8600 in ?? ()
+bt full
#0  0x00005555555b8600 in  ()
#1  0x000055555555bf4d in wl_signal_emit (signal=0x555555b5c278, data=0x555555b5c160) at /usr/include/wayland-server-core.h:478
#2  0x000055555555c691 in output_destroy_notify (listener=0x555555b5c1b8, UNUSED_data=0x555555b86c30) at ../kiwmi/desktop/output.c:287
#3  0x00007ffff7e4bf5e in wlr_signal_emit_safe (signal=<optimized out>, data=0x555555b86c30) at ../wlroots/util/signal.c:29
#4  0x00007ffff7e1ed01 in wlr_output_destroy (output=0x555555b86c30) at ../wlroots/types/output/output.c:389
#5  wlr_output_destroy (output=0x555555b86c30) at ../wlroots/types/output/output.c:377

[...]

+up 1
#1  0x000055555555bf4d in wl_signal_emit (signal=0x555555b5c278, data=0x555555b5c160) at /usr/include/wayland-server-core.h:478
478         l->notify(l, data);
+print *l
$6 = {
  link = {
    prev = 0x555555b8d270,
    next = 0x0
  },
  notify = 0x5555555b8600
}

buffet / kiwmi

segfault on quit due to output destroy event/listener #49