https://bugs.kde.org/show_bug.cgi?id=409021

            Bug ID: 409021
           Summary: Segmentation faults of plasmashell in
                    wl_proxy_set_queue at wayland-client.c:2094 in
                    libwayland-client in Plasma 5.15.5 on Wayland with Qt
                    5.12.4
           Product: plasmashell
           Version: 5.15.5
          Platform: Other
                OS: Linux
            Status: REPORTED
          Severity: normal
          Priority: NOR
         Component: generic-wayland
          Assignee: plasma-b...@kde.org
          Reporter: matthew.fagn...@utoronto.ca
  Target Milestone: 1.0

Created attachment 121069
  --> https://bugs.kde.org/attachment.cgi?id=121069&action=edit
trace of plasmashell segmentation fault in Plasma 5.15.5 on Wayland with Qt
5.12.4

SUMMARY

I saw segmentation faults of plasmashell in wl_proxy_set_queue at
wayland-client.c:2094 in libwayland-client in Plasma 5.15.5 on Wayland with Qt
5.12.4 in Fedora 30. These crashes occurred on startup of one session, and once
in another session. These crashes started right after I updated from Qt 5.12.1
to 5.12.4 from koji along with the dependent Plasma and KF5 rebuilds. drkonqi
wouldn't allow me to submit the attached trace which had the following
segmentation fault and crashing thread.

Application: Plasma (plasmashell), signal: Segmentation fault
Using host libthread_db library "/lib64/libthread_db.so.1".
futex_wait_cancelable (private=0, expected=0, futex_word=0x5653f336ece4) at
../sysdeps/unix/sysv/linux/futex-internal.h:88
88        int err = lll_futex_timed_wait (futex_word, expected, NULL, private);
[Current thread is 1 (Thread 0x7f61ca7bbd00 (LWP 1499))]

Thread 22 (Thread 0x7f616a7f9700 (LWP 1746)):
[KCrash Handler]
#6  0x00007f61c81846f9 in wl_proxy_set_queue (proxy=0x0, queue=0x5653f2af0370)
at src/wayland-client.c:2094
#7  0x00007f61b78f2b50 in QtWaylandClient::QWaylandWindow::waitForFrameSync
(this=0x5653f3779360, timeout=100) at qwaylandwindow.cpp:646
#8  0x00007f61b4b4f022 in QtWaylandClient::QWaylandGLContext::swapBuffers
(this=0x5653f361ac70, surface=<optimized out>) at
../../../../hardwareintegration/client/wayland-egl/qwaylandglcontext.cpp:566
#9  0x00007f61c8c98441 in QOpenGLContext::swapBuffers (this=0x5653f3930280,
surface=<optimized out>) at kernel/qopenglcontext.cpp:1115
#10 0x00007f61ca4b7401 in QSGRenderThread::syncAndRender
(this=this@entry=0x5653f3915590) at scenegraph/qsgthreadedrenderloop.cpp:652
#11 0x00007f61ca4bb168 in QSGRenderThread::run (this=0x5653f3915590) at
scenegraph/qsgthreadedrenderloop.cpp:730
#12 0x00007f61c86e2786 in QThreadPrivate::start (arg=0x5653f3915590) at
thread/qthread_unix.cpp:361
#13 0x00007f61c7b455a2 in start_thread (arg=<optimized out>) at
pthread_create.c:486
#14 0x00007f61c8358303 in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:95

I think that the segmentation faults might've been due to null pointer
dereferences since proxy=0x0 in the wl_proxy_set_queue call, and proxy was
dereferenced at wayland-client:2095 as proxy->queue without checking if proxy
was null and queue was not null as shown in the wl_proxy_set_queue function.

2091    WL_EXPORT void
2092    wl_proxy_set_queue(struct wl_proxy *proxy, struct wl_event_queue
*queue)
2093    {
2094            if (queue)
2095                    proxy->queue = queue;
2096            else
2097                    proxy->queue = &proxy->display->default_queue;
2098    }

qt5-qtwayland functions at #7-8 in the crashing thread and other qt5 functions
lower in the stack might be involved.


STEPS TO REPRODUCE
1. Boot F30 Plasma spin fully updated with updates-testing enabled
2. Log in to Plasma on Wayland from sddm
3. if qt5-qtnetworkauth is installed, sudo dnf remove qt5-qtnetworkauth (due to
dnf dependency problems since qt5-qtnetworkauth-5.12.4 was not available on
koji)
4. dnf upgrade to qt5 5.12.4 with dependent Plasma and kf5 rebuilds from koji
5. reboot
6. Log in to Plasma on Wayland
7. coredumpctl
8. coredumpctl debug
9. gnome-abrt

OBSERVED RESULT
Crashes of plasmashell in Plasma on Wayland with Qt 5.12.4.

EXPECTED RESULT
No crashes.

SOFTWARE/OS VERSIONS
Operating System: Fedora 30, 5.1.12 kernel
KDE Plasma Version: 5.15.5
KDE Frameworks Version: 5.59.0
Qt Version: 5.12.4

kf5-kwayland-0:5.59.0-2.fc30.x86_64
libwayland-client-0:1.17.0-1.fc30.x86_64
plasma-workspace-0:5.15.5-1.fc30.x86_64
qt5-qtwayland-0:5.12.4-1.fc30.x86_64

ADDITIONAL INFORMATION

I haven't seen any such crashes in Plasma on X with Qt 5.12.4.

I've commented on a report of a plasmashell crash in Plasma on Wayland with a
similar trace at https://bugs.kde.org/show_bug.cgi?id=408847

-- 
You are receiving this mail because:
You are watching all bug changes.

Reply via email to