Bug 1466654
| Summary: | Beepbleed | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Harald Hoyer <harald> |
| Component: | gtk3 | Assignee: | Matthias Clasen <mclasen> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 25 | CC: | bberg, cosimo.cecchi, debarshir, klember, mclasen, mikhail.v.gavrilov, yaneti |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | gtk3-3.22.17-2.fc26 gtk3-3.22.17-2.fc25 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-07-24 19:22:02 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Harald Hoyer
2017-06-30 07:31:05 UTC
FWIW , it looks like a vte issue. You can reproduce the same with vte-2.91 --audible-bell How long does it take to crash? Does it also crash in F26? I tried to reproduce by building the upstream code from https://git.gnome.org/browse/vte/log/?h=vte-0-48 and all I got was bash consuming close to 100% CPU. Same thing with Fedora's downstream patches. A backtrace will be helpful. It crashes in a second or two:
Core was generated by `vte-2.91 --audible-bell'.
Program terminated with signal SIGABRT, Aborted.
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51 }
[Current thread is 1 (Thread 0x7f7b48575f40 (LWP 4962))]
Missing separate debuginfos, use: dnf debuginfo-install libidn2-2.0.2-1.fc27.x86_64 libunistring-0.9.7-1.fc26.x86_64 mesa-libwayland-egl-17.1.3-2.fc27.x86_64 pcre2-10.23-8.fc27.x86_64
(gdb) bt full
#0 0x00007f7b44e09e6b in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
set =
{__val = {0, 94798807449168, 1, 140167414253711, 4222451712, 94798807449168, 94798807449168, 140167413291850, 94798807449168, 128, 140728194693072, 4, 0, 140167431313024, 0, 4}}
pid = <optimized out>
tid = <optimized out>
#1 0x00007f7b44e0bbf7 in __GI_abort () at abort.c:90
save_stage = 2
act =
{__sigaction_handler = {sa_handler = 0x1d60df810, sa_sigaction = 0x1d60df810}, sa_mask = {__val = {140167431307552, 0, 140167455737902, 94798803101136, 47244640258, 0, 0, 140728194693336, 0, 140728194693168, 140167414759040, 21474836480, 15742807583981587968, 0, 94798808421280, 0}}, sa_flags = 285198768, sa_restorer = 0xffc}
sigs = {__val = {32, 0 <repeats 15 times>}}
#2 0x00007f7b422ccd3f in wl_abort (fmt=fmt@entry=0x7f7b422ccf0e "Error sending request: %s\n") at src/wayland-util.c:419
argp = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7ffdd60df9f0, reg_save_area = 0x7ffdd60df930}}
#3 0x00007f7b422c8ded in wl_proxy_marshal_array_constructor_versioned (proxy=proxy@entry=0x563810ffc9b0, opcode=opcode@entry=2, args=args@entry=0x7ffdd60dfa90, interface=interface@entry=0x0, version=1) at src/wayland-client.c:659
closure = 0x5638114d13a0
new_proxy = 0x0
message = 0x7f7b478dbef0 <gtk_shell1_requests+48>
#4 0x00007f7b422c8e49 in wl_proxy_marshal_array_constructor (proxy=proxy@entry=0x563810ffc9b0, opcode=opcode@entry=2, args=args@entry=0x7ffdd60dfa90, interface=interface@entry=0x0) at src/wayland-client.c:599
#5 0x00007f7b422c8f3c in wl_proxy_marshal (proxy=0x563810ffc9b0, opcode=2) at src/wayland-client.c:696
args =
{{i = 0, u = 0, f = 0, s = 0x0, o = 0x0, n = 0, a = 0x0, h = 0}, {i = -703726792, u = 3591240504, f = -703726792, s = 0x7ffdd60dfb38 "", o = 0x7ffdd60dfb38, n = 3591240504, a = 0x7ffdd60dfb38, h = -703726792}, {i = 290312833, u = 290312833, f = 290312833, s = 0x5638114dd281 '\a' <repeats 200 times>..., o = 0x5638114dd281, n = 290312833, a = 0x5638114dd281, h = 290312833}, {i = -1299427840, u = 2995539456, f = -1299427840, s = 0xda79b016b28c4e00 <error: Cannot access memory at address 0xda79b016b28c4e00>, o = 0xda79b016b28c4e00, n = 2995539456, a = 0xda79b016b28c4e00, h = -1299427840}, {i = 31, u = 31, f = 31, s = 0x1f <error: Cannot access memory at address 0x1f>, o = 0x1f, n = 31, a = 0x1f, h = 31}, {i = 805349536, u = 805349536, f = 805349536, s = 0x7f7b3000a8a0 "", o = 0x7f7b3000a8a0, n = 805349536, a = 0x7f7b3000a8a0, h = 805349536}, {i = -703726648, u = 3591240648, f = -703726648, s = 0x7ffdd60dfbc8 "", o = 0x7ffdd60dfbc8, n = 3591240648, a = 0x7ffdd60dfbc8, h = -703726648}, {i = -703726784, u = 3591240512, f = -703726784, s = 0x7ffdd60dfb40 "\030", o = 0x7ffdd60dfb40, n = 3591240512, a = 0x7ffdd60dfb40, h = -703726784}, {i = 0, u = 0, f = 0, s = 0x0, o = 0x0, n = 0, a = 0x0, h = 0}, {i = -703726768, u = 3591240528, f = -703726768, s = 0x7ffdd60dfb50 "", o = 0x7ffdd60dfb50, n = 3591240528, a = 0x7ffdd60dfb50, h = -703726768}, {i = -703726792, u = 3591240504, f = -703726792, s = 0x7ffdd60dfb38 "", o = 0x7ffdd60dfb38, n = 3591240504, a = 0x7ffdd60dfb38, h = -703726792}, {i = 1210114736, u = 1210114736, f = 1210114736, s = 0x7f7b4820e2b0 <_vte_conv(VteConv, guchar const**, gsize*, guchar**, gsize*)+544> "A\211D$\374A\017\266E", o = 0x7f7b4820e2b0 <_vte_conv(VteConv, guchar const**, gsize*, guchar**, gsize*)+544>, n = 1210114736, a = 0x7f7b4820e2b0 <_vte_conv(VteConv, guchar const**, gsize*, guchar**, gsize*)+544>, h = 1210114736}, {i = -703726784, u = 3591240512, f = -703726784, s = 0x7ffdd60dfb40 "\030", o = 0x7ffdd60dfb40, n = 3591240512, a = 0x7ffdd60dfb40, h = -703726784}, {i = -1299427840, u = 2995539456, f = -1299427840, s = 0xda79b016b28c4e00 <error: Cannot access memory at address 0xda79b016b28c4e00>, o = 0xda79b016b28c4e00, n = 2995539456, a = 0xda79b016b28c4e00, h = -1299427840}, {i = -703726640, u = 3591240656, f = -703726640, s = 0x7ffdd60dfbd0 "", o = 0x7ffdd60dfbd0, n = 3591240656, a = 0x7ffdd60dfbd0, h = -703726640}, {i = 1022, u = 1022, f = 1022, s = 0x3fe <error: Cannot access memory at address 0x3fe>, o = 0x3fe, n = 1022, a = 0x3fe, h = 1022}, {i = 285290520, u = 285290520, f = 285290520, s = 0x563811013018 "\a", o = 0x563811013018, n = 285290520, a = 0x563811013018, h = 285290520}, {i = 4088, u = 4088, f = 4088, s = 0xff8 <error: Cannot access memory at address 0xff8>, o = 0xff8, n = 4088, a = 0xff8, h = 4088}, {i = 285286432, u = 285286432, f = 285286432, s = 0x563811012020 "\a", o = 0x563811012020, n = 285286432, a = 0x563811012020, h = 285286432}, {i = 1124, u = 1124, f = 1124, s = 0x464 <error: Cannot access memory at address 0x464>, o = 0x464, n = 1124, a = 0x464, h = 1124}}
ap = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7ffdd60dfc10, reg_save_area = 0x7ffdd60dfb40}}
#6 0x00007f7b4821a6a9 in vte_sequence_handler_bell(VteTerminalPrivate*, GValueArray*) (that=0x5638112be000, params=<optimized out>) at vteseq.cc:1018
#7 0x00007f7b4820835e in VteTerminalPrivate::process_incoming() (this=this@entry=0x5638112be000) at vte.cc:3589
saved_cursor = <optimized out>
saved_cursor_visible = <optimized out>
saved_cursor_style = <optimized out>
bbox_topleft = {x = 2147483647, y = 2147483647}
bbox_bottomright = {x = -2147483647, y = -2147483647}
wbuf = 0x563811012020
c = <optimized out>
wcount = 1124
start = <optimized out>
leftovers = 0
modified = 1
bottom = <optimized out>
again = 0
invalidated_text = 0
in_scroll_region = 0
chunk = <optimized out>
next_chunk = <optimized out>
achunk = <optimized out>
previous_screen = <optimized out>
top_row = 0
bottom_row = 107
__PRETTY_FUNCTION__ = "void VteTerminalPrivate::process_incoming()"
#8 0x00007f7b482094f1 in VteTerminalPrivate::time_process_incoming() (this=this@entry=0x5638112be000) at vte.cc:10458
elapsed = <optimized out>
target = <optimized out>
#9 0x00007f7b482095c3 in VteTerminalPrivate::process(bool) (this=this@entry=0x5638112be000, emit_adj_changed=emit_adj_changed@entry=false) at vte.cc:10482
---Type <return> to continue, or q <return> to quit---
is_active = <optimized out>
#10 0x00007f7b4820964e in process_timeout(gpointer) (data=data@entry=0x0) at vte.cc:10524
that = 0x5638112be000
active = <optimized out>
l = <optimized out>
next = 0x0
again = <optimized out>
#11 0x00007f7b45f35fed in g_timeout_dispatch (source=0x5638114e8910, callback=0x7f7b48209610 <process_timeout(gpointer)>, user_data=0x0) at gmain.c:4629
timeout_source = 0x5638114e8910
again = <optimized out>
#12 0x00007f7b45f35587 in g_main_dispatch (context=0x563810fe2fa0) at gmain.c:3148
dispatch = 0x7f7b45f35fd0 <g_timeout_dispatch>
prev_source = 0x0
was_in_call = 0
user_data = 0x0
callback = 0x7f7b48209610 <process_timeout(gpointer)>
cb_funcs = 0x7f7b461fd280 <g_source_callback_funcs>
cb_data = 0x5638114c7240
need_destroy = <optimized out>
source = 0x5638114e8910
current = 0x56381104f200
i = 0
#13 0x00007f7b45f35587 in g_main_context_dispatch (context=context@entry=0x563810fe2fa0) at gmain.c:3813
#14 0x00007f7b45f35928 in g_main_context_iterate (context=context@entry=0x563810fe2fa0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3886
max_priority = 0
timeout = 0
some_ready = 1
nfds = <optimized out>
allocated_nfds = 4
fds = 0x5638114c0b90
#15 0x00007f7b45f359bc in g_main_context_iteration (context=context@entry=0x563810fe2fa0, may_block=may_block@entry=1) at gmain.c:3947
retval = <optimized out>
#16 0x00007f7b464ff8cd in g_application_run (application=0x7f7b3400f6d0 [TestApp], argc=<optimized out>, argv=<optimized out>) at gapplication.c:2378
arguments = 0x56381104f1c0
status = 0
context = 0x563810fe2fa0
acquired_context = <optimized out>
__func__ = "g_application_run"
#17 0x000056380f477c40 in test_app_main (argv=<optimized out>, argv_length1=<optimized out>) at app.c:3110
result = 0
_tmp0_ = <optimized out>
_tmp1_ = <optimized out>
_tmp12_ = <optimized out>
_tmp13_ = <optimized out>
app = 0x7f7b3400f6d0 [TestApp]
_tmp15_ = 0x7f7b3400f6d0 [TestApp]
_tmp16_ = 0x7f7b3400f6d0 [TestApp]
_tmp17_ = <optimized out>
_inner_error_ = 0x0
#18 0x00007f7b44df3dca in __libc_start_main (main=
0x56380f473780 <main>, argc=2, argv=0x7ffdd60e0058, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffdd60e0048)
at ../csu/libc-start.c:301
result = <optimized out>
unwind_buf =
{cancel_jmp_buf = {{jmp_buf = {0, -8258205728197462630, 94798774482848, 140728194695248, 0, 0, -2382607398212618854, -2314178869070547558}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x7f7b48453e53 <_dl_init+259>, 0x7f7b484385b0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 1212497491}}}
not_first_call = <optimized out>
#19 0x000056380f4737ca in _start ()
(gdb) bt
#0 0x00007ffff461564b in raise () from /lib64/libc.so.6
#1 0x00007ffff4617450 in abort () from /lib64/libc.so.6
#2 0x00007ffff1de447c in wl_abort (fmt=0x7ffff1de451f "Error sending request: %s\n")
at /home/gicmo/Code/gnome/wayland/src/wayland-util.c:419
#3 0x00007ffff1ddeee2 in wl_proxy_marshal_array_constructor_versioned (proxy=0x5555557b3820, opcode=2,
args=0x7fffffffd510, interface=0x0, version=1) at /home/gicmo/Code/gnome/wayland/src/wayland-client.c:659
#4 0x00007ffff1ddedaa in wl_proxy_marshal_array_constructor (proxy=0x5555557b3820, opcode=2, args=0x7fffffffd510,
interface=0x0) at /home/gicmo/Code/gnome/wayland/src/wayland-client.c:599
#5 0x00007ffff1ddeff9 in wl_proxy_marshal (proxy=0x5555557b3820, opcode=2)
at /home/gicmo/Code/gnome/wayland/src/wayland-client.c:696
#6 0x00007ffff6ef772e in gtk_shell1_system_bell (gtk_shell1=0x5555557b3820, surface=0x0)
at ../../gdk/wayland/gtk-shell-client-protocol.h:161
#7 0x00007ffff6ef8b38 in gdk_wayland_display_beep (display=0x5555557b0040)
at /home/gicmo/Code/gnome/gtk+-3/gdk/wayland/gdkdisplay-wayland.c:671
#8 0x00007ffff6e779a3 in gdk_display_beep (display=0x5555557b0040) at /home/gicmo/Code/gnome/gtk+-3/gdk/gdkdisplay.c:1653
#9 0x00007ffff7bb46a9 in vte_sequence_handler_bell (that=0x5555559ec600, params=<optimized out>) at vteseq.cc:1018
#10 0x00007ffff7ba235e in VteTerminalPrivate::process_incoming (this=this@entry=0x5555559ec600) at vte.cc:3589
#11 0x00007ffff7ba34f1 in VteTerminalPrivate::time_process_incoming (this=this@entry=0x5555559ec600) at vte.cc:10458
#12 0x00007ffff7ba35c3 in VteTerminalPrivate::process (this=this@entry=0x5555559ec600,
emit_adj_changed=emit_adj_changed@entry=false) at vte.cc:10482
#13 0x00007ffff7ba364e in process_timeout (data=<optimized out>) at vte.cc:10524
#14 0x00007ffff573b706 in g_timeout_dispatch (source=0x5555557f21a0, callback=0x7ffff7ba3610 <process_timeout(gpointer)>,
user_data=0x0) at /home/gicmo/Code/gnome/glib/glib/gmain.c:4629
#15 0x00007ffff573987c in g_main_dispatch (context=0x5555557a8d10) at /home/gicmo/Code/gnome/glib/glib/gmain.c:3148
#16 0x00007ffff573a74c in g_main_context_dispatch (context=0x5555557a8d10) at /home/gicmo/Code/gnome/glib/glib/gmain.c:3813
#17 0x00007ffff573a931 in g_main_context_iterate (context=0x5555557a8d10, block=1, dispatch=1, self=0x555555908120)
at /home/gicmo/Code/gnome/glib/glib/gmain.c:3886
#18 0x00007ffff573a9f5 in g_main_context_iteration (context=0x5555557a8d10, may_block=1)
at /home/gicmo/Code/gnome/glib/glib/gmain.c:3947
#19 0x00007ffff5d3206c in g_application_run (application=0x7fffe000f710, argc=0, argv=0x0)
at /home/gicmo/Code/gnome/glib/gio/gapplication.c:2378
#20 0x000055555555dc40 in test_app_main (argv=<optimized out>, argv_length1=<optimized out>) at app.c:3110
#21 0x00007ffff45ff4da in __libc_start_main () from /lib64/libc.so.6
#22 0x00005555555597ca in _start ()
Thanks for the backtraces. So, it is Wayland-specific and isn't new. Simpler version:
cat << EOF > bleepdeath.c
heredoc> #include <gdk/gdk.h>
int
main(int argc, char **argv)
{
GdkDisplay *display;
gdk_init(&argc, &argv);
display = gdk_display_get_default();
while (1)
{
gdk_display_beep(display);
}
return 0;
}
EOF
gcc -o beepdeath -Wall bleepdeath.c `pkg-config --libs --cflags gdk-3.0`
(gdb) bt
#0 0x00007ffff63b364b in raise () from /lib64/libc.so.6
#1 0x00007ffff63b5450 in abort () from /lib64/libc.so.6
#2 0x00007ffff43f847c in wl_abort (fmt=0x7ffff43f851f "Error sending request: %s\n")
at /home/gicmo/Code/gnome/wayland/src/wayland-util.c:419
#3 0x00007ffff43f2ee2 in wl_proxy_marshal_array_constructor_versioned (proxy=0x657fb0, opcode=2, args=0x7fffffffd8b0,
interface=0x0, version=1) at /home/gicmo/Code/gnome/wayland/src/wayland-client.c:659
#4 0x00007ffff43f2daa in wl_proxy_marshal_array_constructor (proxy=0x657fb0, opcode=2, args=0x7fffffffd8b0, interface=0x0)
at /home/gicmo/Code/gnome/wayland/src/wayland-client.c:599
#5 0x00007ffff43f2ff9 in wl_proxy_marshal (proxy=0x657fb0, opcode=2) at /home/gicmo/Code/gnome/wayland/src/wayland-client.c:696
#6 0x00007ffff7b6a72e in gtk_shell1_system_bell (gtk_shell1=0x657fb0, surface=0x0)
at ../../gdk/wayland/gtk-shell-client-protocol.h:161
#7 0x00007ffff7b6bb38 in gdk_wayland_display_beep (display=0x61a080)
at /home/gicmo/Code/gnome/gtk+-3/gdk/wayland/gdkdisplay-wayland.c:671
#8 0x00007ffff7aea9a3 in gdk_display_beep (display=0x61a080) at /home/gicmo/Code/gnome/gtk+-3/gdk/gdkdisplay.c:1653
#9 0x000000000040071e in main ()
With the simpler testcase here on rawhide, its bleeping continuously without crashing, the compositor seems to stop working and control can be regained only by logging from outside and killing the bleeper > With the simpler testcase here on rawhide, its bleeping continuously without
> crashing
Opps. This is just under gdb. A normal run of the test crashes again in a second or two.
This might be misguided but adding a gdk_display_sync(display) after the gdk_display_beep, prevents the overload/abort. Everything is jerky but one can still stop the offending beeper There is a GTK+ patch (not yet committed, seems to have been forgotten) upstream which will fix this by throttling the event sounds send to the display. I updated the URL in the bug. This likely should be reassigned to the GTK+ package and the patches backported. Kalev has built gtk3-3.22.17 for Fedoras >= 25, so it should be fixed for every release since Wayland became the default. (In reply to Debarshi Ray from comment #11) > Kalev has built gtk3-3.22.17 for Fedoras >= 25, so it should be fixed for > every release since Wayland became the default. Oops! Sorry. I didn't realize that the fix missed 3.22.17. gtk3-3.22.17-2.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-3b5470b48e gtk3-3.22.17-2.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-3b5470b48e gtk3-3.22.17-2.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-64455b107f gtk3-3.22.17-2.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-64455b107f gtk3-3.22.17-2.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-3b5470b48e gtk3-3.22.17-2.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-64455b107f gtk3-3.22.17-2.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report. gtk3-3.22.17-2.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report. *** Bug 1394154 has been marked as a duplicate of this bug. *** *** Bug 1371608 has been marked as a duplicate of this bug. *** |