mate-desktop / marco

MATE default window manager
https://mate-desktop.org
GNU General Public License v2.0
195 stars 86 forks source link

segfault with meta_frame_get_frame_bounds () #596

Closed raveit65 closed 4 years ago

raveit65 commented 4 years ago

Expected behaviour

no segfault with current master at https://github.com/mate-desktop/marco/commit/db25f27fd3670e2ebc8ed6f6fa5f918a3251fc96

Actual behaviour

I clicked on the window-decoration of a window. Boom and marco restarted.

core-dump found at /var/lib/systemd/coredump/core.marco.1000.16c906b46e054d2ab6ebb6b85f981b9a.2513.1582449665000000.lz4 from 23. Feb 10:21, 2020 For some reasons abrt (fedora bug-reporting tool) doesn't create a backtrace from coredump because my marco RPM is self-compiled and unsigned. Well, that is new for me.

Feb 23 10:21:06 mother.mother.loc abrt-server[3540]: Deleting problem directory '/var/spool/abrt/ccpp-2020-02-23-10:21:05.926041-2513'
Feb 23 10:21:06 mother.mother.loc abrt-server[3540]: 'post-create' on '/var/spool/abrt/ccpp-2020-02-23-10:21:05.926041-2513' exited with 1
Feb 23 10:21:06 mother.mother.loc abrt-server[3540]: Package 'marco' isn't signed with proper key
Feb 23 10:21:05 mother.mother.loc audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-coredump@0-3521-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Feb 23 10:21:05 mother.mother.loc systemd[1]: systemd-coredump@0-3521-0.service: Succeeded.

Any way, i was able to create a backtrace with gdb from coredump.

# gdb marco core.marco.1000.16c906b46e054d2ab6ebb6b85f981b9a.2513.1582449665000000

<cut>

Core was generated by `marco'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f69848f7775 in meta_frame_get_frame_bounds (frame=0x55e164da2830) at core/frame.c:410
410   return meta_ui_get_frame_bounds (frame->window->screen->ui,
[Current thread is 1 (Thread 0x7f6982a70a80 (LWP 2513))]
(gdb) thread apply all bt full

<cut>

#1  0x00007f698491ad7d in meta_window_get_frame_bounds (window=0x55e16511c800) at core/window.c:8904
#2  0x00007f69848e6ac0 in border_size (cw=0x55e164fd60b0) at compositor/compositor-xrender.c:1154
        screen = <optimized out>
        xdisplay = 0x55e164bc2440
        border = <optimized out>
        display = 0x55e164ce3840
        visible_region = <optimized out>
        visible = 0
        __func__ = "border_size"
        xdisplay = 0x55e164bc2440
        last = 0x55e164e47f80 = {0x55e164fd60b0, 0x55e1651aa2a0, 0x55e165076690, 0x55e164d46600, 0x55e164d93830, 0x55e164dd62d0, 0x55e164de7540, 0x55e164d4dda0, 0x55e164f5ffe0, 0x55e164f19b80, 0x55e164d22c00, 0x55e164ea5200, 0x55e164e021c0, 0x55e164f599b0}
        paint_region = 10531550
        display = 0x55e164ce3840
        info = 0x55e164d835e0
        index = 0x55e164e47f80 = {0x55e164fd60b0, 0x55e1651aa2a0, 0x55e165076690, 0x55e164d46600, 0x55e164d93830, 0x55e164dd62d0, 0x55e164de7540, 0x55e164d4dda0, 0x55e164f5ffe0, 0x55e164f19b80, 0x55e164d22c00, 0x55e164ea5200, 0x55e164e021c0, 0x55e164f599b0}
        screen_width = 3840
        screen_height = 2160
        cw = 0x55e164fd60b0
        desktop_region = 0
        info = <optimized out>
        display = <optimized out>
        xdisplay = <optimized out>
        screen_width = 3840
        screen_height = 2160
#3  0x00007f69848e6ac0 in paint_windows (region=10531525, root_pixmap=<optimized out>, root_buffer=<optimized out>, windows=<optimized out>, screen=0x55e164c70680) at compositor/compositor-xrender.c:1420
        xdisplay = 0x55e164bc2440
        last = 0x55e164e47f80 = {0x55e164fd60b0, 0x55e1651aa2a0, 0x55e165076690, 0x55e164d46600, 0x55e164d93830, 0x55e164dd62d0, 0x55e164de7540, 0x55e164d4dda0, 0x55e164f5ffe0, 0x55e164f19b80, 0x55e164d22c00, 0x55e164ea5200, 0x55e164e021c0, 0x55e164f599b0}
        paint_region = 10531550
        display = 0x55e164ce3840
        info = 0x55e164d835e0
        index = 0x55e164e47f80 = {0x55e164fd60b0, 0x55e1651aa2a0, 0x55e165076690, 0x55e164d46600, 0x55e164d93830, 0x55e164dd62d0, 0x55e164de7540, 0x55e164d4dda0, 0x55e164f5ffe0, 0x55e164f19b80, 0x55e164d22c00, 0x55e164ea5200, 0x55e164e021c0, 0x55e164f599b0}
        screen_width = 3840
        screen_height = 2160
        cw = 0x55e164fd60b0
        desktop_region = 0
        info = <optimized out>
        display = <optimized out>
        xdisplay = <optimized out>
        screen_width = 3840
        screen_height = 2160
#4  0x00007f69848e6ac0 in paint_all (screen=screen@entry=0x55e164c70680, region=region@entry=10531525, b=<optimized out>) at compositor/compositor-xrender.c:1593
        info = <optimized out>
        display = <optimized out>
        xdisplay = <optimized out>
        screen_width = 3840
        screen_height = 2160
#5  0x00007f69848e7c6e in repair_screen (screen=0x55e164c70680) at compositor/compositor-xrender.c:1620
        damage = 10531525
        info = 0x55e164d835e0
        display = 0x55e164ce3840
        xdisplay = 0x55e164bc2440
        __func__ = "repair_screen"
#6  0x00007f69848e7d78 in repair_display (display=<optimized out>) at compositor/compositor-xrender.c:1662
        screens = 0x55e164db1e40 = {0x55e164c70680}
        compositor = <optimized out>
        compositor = 0x7f696c00b640
#7  0x00007f69848e7d78 in compositor_idle_cb (data=data@entry=0x7f696c00b640) at compositor/compositor-xrender.c:1672
        compositor = 0x7f696c00b640
#8  0x00007f69847dc7cb in g_idle_dispatch (source=source@entry=0x55e1651ad040, callback=0x7f69848e7d30 <compositor_idle_cb>, user_data=0x7f696c00b640) at ../glib/gmain.c:5627
        again = <optimized out>
#9  0x00007f69847dfecd in g_main_dispatch (context=0x55e164bb7640) at ../glib/gmain.c:3189
        dispatch = <optimized out>
        prev_source = 0x0
        was_in_call = <optimized out>
        user_data = 0x7f696c00b640
        callback = 0x7f69848e7d30 <compositor_idle_cb>
        cb_funcs = 0x7f69848b2280 <g_source_callback_funcs>
        cb_data = 0x55e165222550
        need_destroy = <optimized out>
        source = 0x55e1651ad040
        current = 0x55e164cfa6d0
        i = 0
        __FUNCTION__ = "g_main_dispatch"
#10 0x00007f69847dfecd in g_main_context_dispatch (context=context@entry=0x55e164bb7640) at ../glib/gmain.c:3854
#11 0x00007f69847e0260 in g_main_context_iterate (context=0x55e164bb7640, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:3927
        max_priority = 100
        timeout = 0
        some_ready = 1
        nfds = <optimized out>
        allocated_nfds = <optimized out>
        fds = 0x55e164ddffa0
#12 0x00007f69847e0593 in g_main_loop_run (loop=0x55e164bb7a50) at ../glib/gmain.c:4123
        __FUNCTION__ = "g_main_loop_run"
#13 0x000055e163c2d243 in main (argc=<optimized out>, argv=<optimized out>) at core/main.c:579
        act = {__sigaction_handler = {sa_handler = 0x55e163c2d740 <sigterm_handler>, sa_sigaction = 0x55e163c2d740 <sigterm_handler>}, sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0x0}
        empty_mask = {__val = {0 <repeats 16 times>}}
        meta_args = {save_file = 0x0, display_name = 0x0, client_id = 0x55e164c9b1c0 "\035\b", replace_wm = 0, disable_sm = 0, print_version = <optimized out>, sync = <optimized out>, composite = <optimized out>, no_composite = <optimized out>, no_force_fullscreen = <optimized out>}
        log_domains = {0x0, 0x55e163c2e016 "marco", 0x55e163c2e01c "Gtk", 0x55e163c2e020 "Gdk", 0x55e163c2e024 "GLib", 0x55e163c2e029 "Pango", 0x55e163c2e02f "GLib-GObject", 0x55e163c2e03c "GThread"}
        i = <optimized out>
        channel = <optimized out>
(gdb) 

full logs and backtrace at https://www.dropbox.com/s/64q7bfc0hit16c3/core-dump-marco?dl=0

Stacktrace is similar to reported bugs at redhat bugzilla. https://bugzilla.redhat.com/show_bug.cgi?id=1787131 https://bugzilla.redhat.com/show_bug.cgi?id=1787184 https://bugzilla.redhat.com/show_bug.cgi?id=1793524

Steps to reproduce the behaviour

I don't have a clear reproducer. It happens randomly.

MATE general version

1.24.0

Package version

master, 1.24 and 1.22.4

Linux Distribution

Fedora 30

Link to downstream report of your Distribution

https://bugzilla.redhat.com/show_bug.cgi?id=1787131 https://bugzilla.redhat.com/show_bug.cgi?id=1787184 https://bugzilla.redhat.com/show_bug.cgi?id=1793524

raveit65 commented 4 years ago

Probably fixed by https://github.com/mate-desktop/marco/commit/c0a61756c01f5d8fa1e58fe97d0cb3a9d42c9871 https://github.com/mate-desktop/marco/commit/1748fcb3c74836c8f59453f8a1689bb7c612f035