segfault in sway

[podhorsky-ksj]

Hi,
I found this segfault and decoded parts, which have something to do with sway:

Backtrace: /usr/bin/sway(error_handler+0x2f) [0x41b25f]
/home/ksj/sway-git/src/sway/common/log.c:151
Backtrace: /usr/lib/libc.so.6(+0x33680) [0x7f64050cf680]
Backtrace: /usr/bin/sway(swayc_parent_by_type+0x58) [0x4110f8]
/home/ksj/sway-git/src/sway/sway/container.c:474 (discriminator 1)
Backtrace: /usr/bin/sway(set_focused_container+0x80) [0x413510]
/home/ksj/sway-git/src/sway/sway/focus.c:109
Backtrace: /usr/bin/sway() [0x4144bd]
/home/ksj/sway-git/src/sway/sway/handlers.c:260
Backtrace: /usr/lib/libwlc.so.0(+0x1e27f) [0x7f6405fdc27f]
Backtrace: /usr/lib/libwlc.so.0(+0x15839) [0x7f6405fd3839]
Backtrace: /usr/lib/libffi.so.6(ffi_call_unix64+0x4c) [0x7f6402fb61f0]
Backtrace: /usr/lib/libffi.so.6(ffi_call+0x2f8) [0x7f6402fb5c58]
Backtrace: /usr/lib/libwayland-server.so.0(+0xafb8) [0x7f640596bfb8]
Backtrace: /usr/lib/libwayland-server.so.0(+0x74a6) [0x7f64059684a6]
Backtrace: /usr/lib/libwayland-server.so.0(wl_event_loop_dispatch+0x72) [0x7f640596a242]
Backtrace: /usr/lib/libwayland-server.so.0(wl_display_run+0x25) [0x7f64059689a5]
Backtrace: /usr/lib/libwlc.so.0(wlc_run+0xec) [0x7f6405fe623c]
Backtrace: /usr/bin/sway(main+0x39c) [0x40716c]
/home/ksj/sway-git/src/sway/sway/main.c:214
Backtrace: /usr/lib/libc.so.6(__libc_start_main+0xf0) [0x7f64050bc610]
Backtrace: /usr/bin/sway(_start+0x29) [0x4071b9]
??:?

log file is there:
sway-err.txt

commits:
sway 6793648
wlc faa4d3c

[mikkeloscar]

Thanks for the report, do you happen to know how to trigger this crash?

It happens because workspace->fullscreen is corrupted when called here, but I'm not sure I can figure out what caused it without running sway through gdb and trigger the crash manually.

[podhorsky-ksj]

I tried to run sway through gdb, but whole pc got frozen just after sway was run through gdb.

[mikkeloscar]

@podhorsky-ksj it's most likely because wlc sends a SIGUSR1 when ready so gdb will pause on that signal. Just run handle SIGUSR1 noprint nostop in gdb before you run sway. Then it shouldn't stop.

[PluMGMK]

This is happening unpredictably for me now. It tends to happen when I try to edit certain documents in LibreOffice Writer (running as an X app), or more occasionally when opening a window (or menu) in Wine. Also randomly happens when changing workspace.

[mikkeloscar]

@PluMGMK could please post a backtrace of the crashes so we can get a better understanding of when this happens. Remember to run addr2line on the backtrace and post that along with it. Thanks!

[PluMGMK]

I'd love to, but of course now I can't seem to trigger it anymore. Typical! If it happens again I'll post what I can.

[podhorsky-ksj]

@mikkeloscar I think I got a segfault in gdb, but then the sway will freeze and I can't use any keyboard bindings. Do you think it can be replaced by set unlimited settings in ulimit to make core file and then load it into gdb?

[sce]

Whenever I would debug a segfault in sway I ran the following:

gdb -batch -ex "run -d" -ex "continue" -ex "bt" ./bin/sway

This runs gdb in batch mode: After the first signal it simply continues and after the second one it prints a backtrace and exits. Hope this helps. [s/backspace/backtrace/, need more coffee]

[podhorsky-ksj]

@sce Thanks for it, It works good, but I think is better use:
gdb -batch -ex "run -d" -ex "continue" -ex "generate-core-file" ./bin/sway
Because then you get corefile, and you can then load it into gdb like:
gdb ./bin/sway core.1234
or exec file and core file give to someone else.

[sce]

@podhorsky-ksj that's even better, thanks.

[PluMGMK]

Segfaults seem to happen when I (frustratedly) give a lot of keyboard input in rapid succession. At one point I launched Steam which (as usual) popped up an XTerm window trying to install Debian packages, which is neither possible nor necessary since I'm not on Debian, but I still had to type my password for sudo. I mistyped about half of it and started frustratedly hitting the backspace key, causing the window manager to crash and producing this output:

[log.c:150] Error: Signal 11. Printing backtrace
[log.c:160] Backtrace: sway(error_handler+0xb7) [0x42444a]
[log.c:160] Backtrace: /lib64/libc.so.6(+0x35410) [0x7f0a79ae7410]
[log.c:160] Backtrace: sway() [0x4156de]
[log.c:160] Backtrace: sway() [0x41572c]
[log.c:160] Backtrace: sway() [0x41572c]
[log.c:160] Backtrace: sway(swayc_by_handle+0x22) [0x415777]
[log.c:160] Backtrace: sway() [0x4193bf]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0x19414) [0x7f0a7ac31414]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0x2beba) [0x7f0a7ac43eba]
[log.c:160] Backtrace: /usr/lib64/libwayland-server.so.0(wl_event_loop_dispatch+0x62) [0x7f0a7a384f52]
[log.c:160] Backtrace: /usr/lib64/libwayland-server.so.0(wl_display_run+0x25) [0x7f0a7a3837e5]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(wlc_run+0xc4) [0x7f0a7ac410fc]
[log.c:160] Backtrace: sway(main+0x456) [0x420ed7]
[log.c:160] Backtrace: /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f0a79ad3b15]
[log.c:160] Backtrace: sway() [0x406e49]

Another one happened when I tried to play a game with Wine, but then a message box (from Uplay, also under Wine) popped up causing it to freeze. After frustratedly pressing Mod+Shift+Q, I got it to close, then when I right-clicked the Steam icon in the Wine system tray the window manager crashed (instead of bringing up a menu).

[log.c:150] Error: Signal 11. Printing backtrace
[log.c:160] Backtrace: sway(error_handler+0xb7) [0x42444a]
[log.c:160] Backtrace: /lib64/libc.so.6(+0x35410) [0x7fb4f82e6410]
[log.c:160] Backtrace: /lib64/libc.so.6(cfree+0x14) [0x7fb4f832d784]
[log.c:160] Backtrace: /usr/lib64/dri/radeonsi_dri.so(+0x202801) [0x7fb4f2bec801]
[log.c:160] Backtrace: /usr/lib64/dri/radeonsi_dri.so(+0x198131) [0x7fb4f2b82131]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0x207ac) [0x7fb4f94377ac]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0x20905) [0x7fb4f9437905]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0x21a40) [0x7fb4f9438a40]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0xfb18) [0x7fb4f9426b18]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0x24cbf) [0x7fb4f943bcbf]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0xfc63) [0x7fb4f9426c63]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0x107bc) [0x7fb4f94277bc]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0x19cfa) [0x7fb4f9430cfa]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(wlc_view_bring_to_front+0x3f) [0x7fb4f94310ba]
[log.c:160] Backtrace: sway() [0x41f825]
[log.c:160] Backtrace: sway(arrange_windows+0x48) [0x4203f9]
[log.c:160] Backtrace: sway() [0x418f88]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0x182c7) [0x7fb4f942f2c7]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0x18130) [0x7fb4f942f130]
[log.c:160] Backtrace: /usr/lib64/libwlc.so.0(+0x241af) [0x7fb4f943b1af]

From the looks of it, I'm not even sure if it's the same problem that caused these two crashes. I've attached the full log files anyway.

@mikkeloscar When you say to run addr2line "on it", what exactly do you mean? Do I take each individual address and check it? I don't have much debugging experience.

segfault.txt
segfault2.txt

[mikkeloscar]

@PluMGMK yes, that's right. This script can be helpful: https://gist.github.com/mikkeloscar/badebca2b9766a067397

You run it like this:

$  cat sway.log | python addr2line_sway.py path/to/bin/sway

It will take all the relevant addresses in the backtrace of the log, and translate them to line numbers in the sway source.

[PluMGMK]

Ah, okay then. The first segfault gave me:

[log.c:160] Backtrace: sway(error_handler+0xb7) [0x42444a]
/sources/sway/common/log.c:151
()
[log.c:160] Backtrace: sway() [0x4156de]
/sources/sway/sway/container.c:534
()
[log.c:160] Backtrace: sway() [0x41572c]
/sources/sway/sway/container.c:541
()
[log.c:160] Backtrace: sway() [0x41572c]
/sources/sway/sway/container.c:541
()
[log.c:160] Backtrace: sway(swayc_by_handle+0x22) [0x415777]
/sources/sway/sway/container.c:551
()
[log.c:160] Backtrace: sway() [0x4193bf]
/sources/sway/sway/handlers.c:336
()
[log.c:160] Backtrace: sway(main+0x456) [0x420ed7]
/sources/sway/sway/main.c:217
()
[log.c:160] Backtrace: sway() [0x406e49]
??:?
()

And the second gave me:

[log.c:160] Backtrace: sway(error_handler+0xb7) [0x42444a]
/sources/sway/common/log.c:151
()
[log.c:160] Backtrace: sway() [0x41f825]
/sources/sway/sway/layout.c:472 (discriminator 3)
()
[log.c:160] Backtrace: sway(arrange_windows+0x48) [0x4203f9]
/sources/sway/sway/layout.c:617
()
[log.c:160] Backtrace: sway() [0x418f88]
/sources/sway/sway/handlers.c:249
()

[mikkeloscar]

@PluMGMK thanks, one last thing, please post the version of sway you are using. I can see that this must be at least a couple of commits behind master.

[PluMGMK]

@mikkeloscar As far as I can tell I'm only one commit behind (i.e. on 91d6113).

[podhorsky-ksj]

I also get one segfault in gdb:

#0  update_focus (c=c@entry=0x627201 <root_container+1>) at /home/ksj/sway-git/src/sway/sway/focus.c:19
#1  0x0000000000413600 in set_focused_container (c=0xc3d450) at /home/ksj/sway-git/src/sway/sway/focus.c:122
#2  0x00007ffff7bb5767 in wlc_view_unmap (view=0xc6e868) at /home/ksj/wlc-git/src/wlc/src/compositor/view.c:67
#3  0x00007ffff7bb67d2 in wlc_view_release (view=0xc6e868) at /home/ksj/wlc-git/src/wlc/src/compositor/view.c:629
#4  0x00007ffff7bbc1c6 in handle_release (pool=pool@entry=0x7ffff7dda5e0 <handles>, handle=0x7843c0, preremove=preremove@entry=0x0)
    at /home/ksj/wlc-git/src/wlc/src/resources/resources.c:165
#5  0x00007ffff7bbc479 in wlc_handle_release (handle=<optimized out>) at /home/ksj/wlc-git/src/wlc/src/resources/resources.c:350
#6  0x00007ffff7bbc925 in wlc_handle_release (handle=<optimized out>) at /home/ksj/wlc-git/src/wlc/src/resources/resources.c:347
#7  0x00007ffff7bbe244 in wlc_surface_release (surface=0xc630e0) at /home/ksj/wlc-git/src/wlc/src/resources/types/surface.c:301
#8  0x00007ffff7bbc1c6 in handle_release (pool=0x7ffff7dda680 <resources>, handle=0xc553d0, preremove=0x7ffff7bbbf60 <resource_prerelase>)
    at /home/ksj/wlc-git/src/wlc/src/resources/resources.c:165
#9  0x00007ffff754a5b4 in ?? () from /usr/lib/libwayland-server.so.0
#10 0x00007ffff754afd4 in wl_resource_destroy () from /usr/lib/libwayland-server.so.0
#11 0x00007ffff497c1f0 in ffi_call_unix64 () from /usr/lib/libffi.so.6
#12 0x00007ffff497bc58 in ffi_call () from /usr/lib/libffi.so.6
#13 0x00007ffff754efb8 in ?? () from /usr/lib/libwayland-server.so.0
#14 0x00007ffff754b4a6 in ?? () from /usr/lib/libwayland-server.so.0
#15 0x00007ffff754d242 in wl_event_loop_dispatch () from /usr/lib/libwayland-server.so.0
#16 0x00007ffff754b9a5 in wl_display_run () from /usr/lib/libwayland-server.so.0
#17 0x00007ffff7bc14ec in wlc_run () at /home/ksj/wlc-git/src/wlc/src/wlc.c:260
#18 0x00000000004071bc in main (argc=2, argv=0x7fffffffea08) at /home/ksj/sway-git/src/sway/sway/main.c:214

sway commit id is: 016a774

I also have exec and core file. I'm attaching them here:
core.zip

You can use it as:
gdb ./sway core.15654
if needed.

[PluMGMK]

I don't think this is Sway's fault because I reverted to 0ba3f08 (predating this issue by a considerable amount of time) and it's still happening.

[PluMGMK]

Since updating to the latest wlc and sway commits last Saturday, the window manager has crashed only once. That was when I attempted to use the clipboard in the Otter Browser, so it's probably QtWayland's fault. So for me, this issue seems to be resolved!

[podhorsky-ksj]

Now I'm only seeing crashes, dependent on Intel drivers, so it can't be corrected in sway or wlc. But no crashes with bt wlc or sway. So, I'm closing the ticket.