https://bugs.kde.org/show_bug.cgi?id=414411

Matt Fagnani <matthew.fagn...@utoronto.ca> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|plasmashell 5.17.3 on       |plasmashell on Wayland
                   |Wayland segmentation fault  |segmentation fault in
                   |in update_buffers at        |update_buffers in
                   |../src/egl/drivers/dri2/pla |mesa-libEGL
                   |tform_wayland.c:633 in      |
                   |mesa-libEGL-19.2.6-1.fc31.x |
                   |86_64                       |
            Version|5.17.3                      |5.19.4
                URL|                            |https://bugzilla.redhat.com
                   |                            |/show_bug.cgi?id=1777733

--- Comment #3 from Matt Fagnani <matthew.fagn...@utoronto.ca> ---
I was using Plasma 5.19.4 on Wayland in Fedora 33 with KF 5.73.0 and Qt 5.14.2.
I set the desktop to use the Application Menu by right-clicking on the button
at the bottom left of the screen, selecting Show Alternatives > Application
Menu > Switch. I quickly left-clicked to open the Application Menu many times.
The Task Manager bar at the bottom of the screen disappeared and reappeared
automatically. plasmashell segmentation faulted in thread 1 in update_buffers
at ../src/egl/drivers/dri2/platform_wayland.c:675 in
mesa-libEGL-20.1.5-1.fc33.x86_64. 

Core was generated by `/usr/bin/plasmashell'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __GI_raise (sig=<optimized out>) at ../sysdeps/unix/sysv/linux/raise.c:49
49        return ret;
[Current thread is 1 (Thread 0x7ff43ebf5640 (LWP 8914))]
(gdb) bt
#0  __GI_raise (sig=<optimized out>) at ../sysdeps/unix/sysv/linux/raise.c:49
#1  <signal handler called>
#2  0x00007ff4c815026d in update_buffers
(dri2_surf=dri2_surf@entry=0x7ff428166b70)
    at ../src/egl/drivers/dri2/platform_wayland.c:675
#3  0x00007ff4c81507e8 in image_get_buffers (driDrawable=<optimized out>,
format=<optimized out>, 
    stamp=<optimized out>, loaderPrivate=0x7ff428166b70, buffer_mask=<optimized
out>, 
    buffers=0x7ff43ebf3ba0) at ../src/egl/drivers/dri2/platform_wayland.c:810
#4  0x00007ff4c2a46b11 in dri_image_drawable_get_buffers
(statts_count=<optimized out>, 
    statts=<optimized out>, images=<optimized out>, drawable=<optimized out>)
    at ../src/gallium/state_trackers/dri/dri2.c:282
#5  dri2_allocate_textures (ctx=0x55cc55a25e20, drawable=0x7ff42816b200,
statts=0x7ff428163cd8, 
    statts_count=2) at ../src/gallium/state_trackers/dri/dri2.c:415
#6  0x00007ff4c2a39ee4 in dri_st_framebuffer_validate (stctx=<optimized out>,
stfbi=<optimized out>, 
    statts=0x7ff428163cd8, count=2, out=0x7ff43ebf3d40)
    at ../src/gallium/state_trackers/dri/dri_drawable.c:82
#7  0x00007ff4c2a5609b in st_framebuffer_validate
(stfb=stfb@entry=0x7ff428163800, 
    st=st@entry=0x55cc56ce6510) at ../src/mesa/state_tracker/st_manager.c:223
#8  0x00007ff4c2a57143 in st_manager_validate_framebuffers (st=0x55cc56ce6510)
    at ../src/mesa/state_tracker/st_manager.c:1185
#9  0x00007ff4c2a8e605 in st_validate_state (st=st@entry=0x55cc56ce6510, 
    pipeline=pipeline@entry=ST_PIPELINE_CLEAR) at
../src/mesa/state_tracker/st_atom.c:203
#10 0x00007ff4c2a8f100 in st_Clear (ctx=0x55cc56cabe50, mask=50)
    at ../src/mesa/state_tracker/st_cb_clear.c:442
#11 0x00007ff4de231d6b in QSGBatchRenderer::Renderer::renderBatches
(this=this@entry=0x7ff4280079a0)
    at
../../include/QtQuick/5.14.2/QtQuick/private/../../../../../src/quick/scenegraph/coreapi/qsgrend--Type
<RET> for more, q to quit, c to continue without paging--c
erer_p.h:131
#12 0x00007ff4de2324d2 in QSGBatchRenderer::Renderer::render (this=<optimized
out>) at scenegraph/coreapi/qsgbatchrenderer.cpp:4320
#13 0x00007ff4de21bcd0 in QSGRenderer::renderScene (bindable=...,
this=0x7ff4280079a0) at scenegraph/coreapi/qsgrenderer.cpp:259
#14 QSGRenderer::renderScene (this=0x7ff4280079a0, bindable=...) at
scenegraph/coreapi/qsgrenderer.cpp:219
#15 0x00007ff4de21c1a3 in QSGRenderer::renderScene (this=<optimized out>,
fboId=<optimized out>) at scenegraph/coreapi/qsgrenderer.cpp:211
#16 0x00007ff4de26f8e1 in QSGDefaultRenderContext::renderNextFrame
(this=0x55cc55d1d880, renderer=0x7ff4280079a0, fboId=<optimized out>) at
scenegraph/qsgdefaultrendercontext.cpp:223
#17 0x00007ff4de2c99a9 in QQuickWindowPrivate::renderSceneGraph
(this=0x55cc55d1ccf0, size=..., surfaceSize=...) at items/qquickwindow.cpp:541
#18 0x00007ff4de27c7e3 in QSGRenderThread::syncAndRender (this=0x55cc56979f50,
grabImage=0x0) at /usr/include/qt5/QtGui/5.14.2/QtGui/private/qrhi_p.h:1230
#19 0x00007ff4de283e0f in QSGRenderThread::run (this=0x55cc56979f50) at
scenegraph/qsgthreadedrenderloop.cpp:980
#20 0x00007ff4dc7eb690 in QThreadPrivate::start (arg=0x55cc56979f50) at
thread/qthread_unix.cpp:342
#21 0x00007ff4dbc4f3f9 in start_thread (arg=0x7ff43ebf5640) at
pthread_create.c:463
#22 0x00007ff4dc46fb03 in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:95

platform_wayland.c:675 corresponds to that in the crash I reported here before.
 if (dri2_surf->base.Width != dri2_surf->wl_win->width ||
       dri2_surf->base.Height != dri2_surf->wl_win->height) {


The pointer dri2_surf=dri2_surf@entry=0x7ff428166b70 passed to update_buffers
pointed to a invalid pointer possibly to dri2_surf->wl_win

(gdb) x 0x7ff428166b70
0x7ff428166b70: 0x553e66e0
(gdb) x 0x553e66e0
0x553e66e0:     Cannot access memory at address 0x553e66e0

I've seen crashes with this trace 2-3 times in the last few days. The crashes
might involve a race condition in which the Wayland surface of the Application
menu was occasionally freed or corrupted before it was used.
plasmashell crashed when I've quickly left-clicked to open the Application Menu
many times in the last day with errors like The Wayland connection experienced
a fatal error: Invalid argument
https://bugs.kde.org/show_bug.cgi?id=424879 and a segmentation fault in
wl_proxy_set_queue https://bugs.kde.org/show_bug.cgi?id=409021 Those crashes
might have been related to this one.

I reported previous plasmashell crashes in updates_buffers and assigned them to
mesa at https://bugzilla.redhat.com/show_bug.cgi?id=1777733 Michel Dänzer
replied "Note that while the linked upstream issue is technically a Mesa bug,
Firefox was triggering this condition by accident and has been modified not to
trigger it anymore. Might be similar for plasmashell." Firefox Nightly
80.0a1-81.0a1 had segmentation faults occasionally in update_buffers at
../src/egl/drivers/dri2/platform_wayland.c:675 in
mesa-libEGL-20.1.3-1.fc33.x86_64 and later when I've clicked on toolbar buttons
at the top right of the Firefox window in the last 3 weeks or so. I reported
those crashes at https://bugzilla.mozilla.org/show_bug.cgi?id=1655120

-- 
You are receiving this mail because:
You are watching all bug changes.

Reply via email to