Bug 1616269

Created attachment 1476141 [details]
File: Xorg.0.log

Created attachment 1476142 [details]
File: backtrace

Created attachment 1476143 [details]
File: cpuinfo

Created attachment 1476144 [details]
File: dmesg

Created attachment 1476145 [details]
File: dso_list

Created attachment 1476146 [details]
File: etc_X11_xorg_conf_d.tar.gz

Created attachment 1476147 [details]
File: usr_share_xorg_conf_d.tar.gz

This happens approximately 50% of the time when I maximize a window of an X11 application while running Wayland.

Proposed as a Blocker for 29-beta by Fedora user sgallagh using the blocker tracking app because:

 "No part of any release-blocking desktop's panel (or equivalent) configuration may crash on startup or be entirely non-functional."

It's not necessarily a clear violation, but I'd argue that "maximizing windows crashes the desktop much of the time" should be considered "non-functional".

May be hardware dependent in some way, I don't think I've ever seen this, and I have two monitors and move windows around and maximize them quite a lot. IIRC, the traceback is fairly useless, journal output from around the time of the crash may be useful.

(In reply to Adam Williamson from comment #10)
> May be hardware dependent in some way, I don't think I've ever seen this,
> and I have two monitors and move windows around and maximize them quite a
> lot. IIRC, the traceback is fairly useless, journal output from around the
> time of the crash may be useful.

Are you running F29? Because this clearly started immediately after I upgraded to that release.

For the record, I have a Lenovo P50 laptop with hybrid Intel and nVidia Quadro M1000M graphics. The external monitor is connected only to the nVidia device; the internal to both.

I will try to get some journal data the next time it happens.

of course I am :) my desktop's been on Rawhide since f28 came out.

CCing as I may be hitting this.

Discussed during the 2018-08-20 blocker review meeting: [1]

The decision to delay the classification of this as a bug was made as we are currently unsure of exactly how many machines this affects. We will gather data and reconvene to vote on this as a blocker.

[1] https://meetbot.fedoraproject.org/fedora-blocker-review/2018-08-20/f29-blocker-review.2018-08-20-16.00.txt

So, I can reproduce this fairly consistently on my hardware. With Google Chrome, grab a tab from a window, pull it out of the current window and have it fullscreen on a new monitor. It crashes GNOME every time doing this. (It doesn't crash if the disconnect of the tab and the fullscreening on a new monitor happen in different actions).

I haven't yet figured out if this happens on other hardware, but it's *incredibly* annoying on my Lenovo P50.

Does it happen with any other apps, or just Chrome? Does it happen with packaged Chromium?

(In reply to Adam Williamson from comment #16)
> Does it happen with any other apps, or just Chrome? Does it happen with
> packaged Chromium?

It has happened with other apps, but I can't find a consistent reproducer until the Chrome one.

I'll try with Chromium if I find a few moments to spare later today.

Just now, the same crash occurred when I disconnected an external monitor.

I've not hit this in rawhide either... perhaps a call for more testers on the list would be in order?

I haven't seen that call-for-testing hit the list, but I will mention that I'm hitting this crash *constantly*.

Also, I just tested and yes, the issue does occur with packaged Chromium as well.

Better backtrace:

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
        set = {__val = {171516928, 0, 0, 0, 0, 0, 0, 0, 140123838566256, 0, 1, 140730018693532, 1, 5841042, 64377299159482369, 0}}
        pid = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
#1  0x00007f711f83e895 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x1, sa_sigaction = 0x1}, sa_mask = {__val = {5841042, 64377299159482369, 0, 0, 0, 
              6091009, 6091016, 2, 9223372036854775822, 0, 0, 0, 67108868, 140123838566256, 12917133525372909056, 0}}, sa_flags = 6031216, 
          sa_restorer = 0x5c0770}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x0000000000594390 in OsAbort () at utils.c:1350
No locals.
#3  0x0000000000599629 in AbortServer () at log.c:877
No locals.
#4  0x000000000059a49d in FatalError (f=f@entry=0x5c0770 "Caught signal %d (%s). Server aborting\n") at log.c:1015
        args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7ffe42c604a0, reg_save_area = 0x7ffe42c603d0}}
        args2 = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 0x7ffe42c604a0, reg_save_area = 0x7ffe42c603d0}}
        beenhere = 1
#5  0x0000000000591695 in OsSigHandler (signo=11, sip=<optimized out>, unused=<optimized out>) at osinit.c:156
        unused = <optimized out>
        sip = <optimized out>
        signo = 11
#6  <signal handler called>
No locals.
#7  0x0000000000439610 in xwl_present_abort_vblank (present_window=0xed8c80, crtc=<optimized out>, event_id=725, msc=<optimized out>)
    at xwayland-present.c:378
        xwl_present_window = 0xe8da50
        event = 0x5f5f5f5f5f5f5f2f
        tmp = <optimized out>
#8  0x00000000004f8580 in present_wnmd_abort_vblank (screen=<optimized out>, window=<optimized out>, crtc=<optimized out>, event_id=725, 
    msc=<optimized out>) at present_wnmd.c:651
        screen_priv = <optimized out>
        window_priv = 0xedbc40
        vblank = <optimized out>
        __PRETTY_FUNCTION__ = "present_wnmd_abort_vblank"
#9  0x00000000004f769b in present_free_window_vblank (window=0xed8c80) at present_screen.c:87
        screen = <optimized out>
        vblank = 0xeda9b0
        tmp = 0xedbc68
        screen_priv = 0xb64180
        window_priv = 0xedbc40
        screen = <optimized out>
        screen_priv = <optimized out>
        window_priv = <optimized out>
        vblank = <optimized out>
        tmp = <optimized out>
#10 present_destroy_window (window=0xed8c80) at present_screen.c:152
        ret = <optimized out>
        screen = 0x99bf00
        screen_priv = 0xb64180
        window_priv = 0xedbc40
#11 0x000000000042f572 in xwl_destroy_window (window=0xed8c80) at xwayland.c:653
        screen = 0x99bf00
        xwl_screen = 0x99c440
        ret = <optimized out>
#12 0x0000000000548321 in compDestroyWindow (pWin=0xed8c80) at compwindow.c:613
        pScreen = 0x99bf00
        cs = 0xb640a0
        cw = <optimized out>
        csw = <optimized out>
        ret = <optimized out>
#13 0x00000000004fde8c in damageDestroyWindow (pWindow=0xed8c80) at damage.c:1570
        pDamage = <optimized out>
        pScreen = 0x99bf00
        ret = <optimized out>
        pScrPriv = 0x9b0d30
#14 0x00000000004ad8c1 in DbeDestroyWindow (pWin=0xed8c80) at dbe.c:1326
        pDbeScreenPriv = 0xb74f90
        pDbeWindowPriv = <optimized out>
        pScreen = 0x99bf00
        ret = <optimized out>
#15 0x0000000000584cc7 in FreeWindowResources (pWin=pWin@entry=0xed8c80) at window.c:1031
        pScreen = 0x99bf00
#16 0x0000000000587f20 in DeleteWindow (value=0xed8c80, wid=35651586) at window.c:1099
        pParent = 0xed9fb0
        pWin = 0xed8c80
#17 0x000000000058077d in doFreeResource (res=0xea7680, skip=skip@entry=0) at resource.c:880
No locals.
#18 0x00000000005819bc in FreeClientResources (client=client@entry=0xe57460) at resource.c:1146
        head = 0xe8dbc0
        resources = <optimized out>
        this = <optimized out>
        j = 2
        resources = <optimized out>
        this = <optimized out>
        head = <optimized out>
        client = 0xe57460
        j = <optimized out>
        resources = <optimized out>
        this = <optimized out>
        j = <optimized out>
        head = <optimized out>
#19 0x000000000055aac3 in CloseDownClient (client=0xe57460) at dispatch.c:3473
        really_close_down = <optimized out>
#20 0x000000000055adb6 in ProcKillClient (client=0xe32390) at dispatch.c:3279
        stuff = <optimized out>
        killclient = 0xe57460
        rc = 0
#21 0x000000000055b72e in Dispatch () at dispatch.c:478
        result = <optimized out>
        client = 0xe32390
        start_tick = 55
#22 0x000000000055f776 in dix_main (argc=12, argv=0x7ffe42c60fc8, envp=<optimized out>) at main.c:276
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#23 0x00007f711f840413 in __libc_start_main (main=0x42e300 <main>, argc=12, argv=0x7ffe42c60fc8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffe42c60fb8) at ../csu/libc-start.c:308
        self = <optimized out>
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 7375780140962387716, 4383504, 140730018697152, 0, 0, -7376740277004691708, -7440448747047250172}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x7ffe42c61030, 0x7f71202dc150}, data = {prev = 0x0, cleanup = 0x0, canceltype = 1120276528}}}
        not_first_call = <optimized out>
#24 0x000000000042e33e in _start () at dbe.c:1007
No symbol table info available.

I can also reproduce this issue by launching "glxgears" and then closing that window. It appears to be destruction of a window using OpenGL that causes the issue. (Google Chrome uses GL-acceleration by default).

Additional information from coredumpctl:


           PID: 2352 (Xwayland)
           UID: 13041 (sgallagh)
           GID: 13041 (sgallagh)
        Signal: 6 (ABRT)
     Timestamp: Tue 2018-09-04 13:53:56 EDT (37min ago)
  Command Line: /usr/bin/Xwayland :0 -rootless -terminate -accessx -core -listen 4 -listen 5 -displayfd 6
    Executable: /usr/bin/Xwayland
 Control Group: /user.slice/user-13041.slice/session-2.scope
          Unit: session-2.scope
         Slice: user-13041.slice
       Session: 2
     Owner UID: 13041 (sgallagh)
       Boot ID: bbf8b56abb684839be46ff538870e6a7
    Machine ID: 06df243f7c7c435d806086f01e480d63
      Hostname: sgallaghp50.sgallagh.rht
       Storage: /var/lib/systemd/coredump/core.Xwayland.13041.bbf8b56abb684839be46ff538870e6a7.2352.1536083636000000.lz4
       Message: Process 2352 (Xwayland) of user 13041 dumped core.
                
                Stack trace of thread 2352:
                #0  0x00007f711f85453f raise (libc.so.6)
                #1  0x00007f711f83e895 abort (libc.so.6)
                #2  0x0000000000594390 OsAbort (Xwayland)
                #3  0x0000000000599629 AbortServer (Xwayland)
                #4  0x000000000059a49d FatalError (Xwayland)
                #5  0x0000000000591695 OsSigHandler (Xwayland)
                #6  0x00007f711f9f4f70 __restore_rt (libpthread.so.0)
                #7  0x0000000000439610 xwl_present_abort_vblank (Xwayland)
                #8  0x00000000004f8580 present_wnmd_abort_vblank (Xwayland)
                #9  0x00000000004f769b present_destroy_window (Xwayland)
                #10 0x000000000042f572 xwl_destroy_window (Xwayland)
                #11 0x0000000000548321 compDestroyWindow (Xwayland)
                #12 0x00000000004fde8c damageDestroyWindow (Xwayland)
                #13 0x00000000004ad8c1 DbeDestroyWindow (Xwayland)
                #14 0x0000000000584cc7 FreeWindowResources (Xwayland)
                #15 0x0000000000587f20 DeleteWindow (Xwayland)
                #16 0x000000000058077d doFreeResource (Xwayland)
                #17 0x00000000005819bc FreeClientResources (Xwayland)
                #18 0x000000000055aac3 CloseDownClient (Xwayland)
                #19 0x000000000055adb6 ProcKillClient (Xwayland)
                #20 0x000000000055b72e Dispatch (Xwayland)
                #21 0x000000000055f776 dix_main (Xwayland)
                #22 0x00007f711f840413 __libc_start_main (libc.so.6)
                #23 0x000000000042e33e _start (Xwayland)
                
                Stack trace of thread 2353:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711e8d6993 n/a (i965_dri.so)
                #2  0x00007f711e8d66eb n/a (i965_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)
                
                Stack trace of thread 2357:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711cc7b3f3 n/a (swrast_dri.so)
                #2  0x00007f711cc7b33b n/a (swrast_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)
                
                Stack trace of thread 2355:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711cc7b3f3 n/a (swrast_dri.so)
                #2  0x00007f711cc7b33b n/a (swrast_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)
                
                Stack trace of thread 2356:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711cc7b3f3 n/a (swrast_dri.so)
                #2  0x00007f711cc7b33b n/a (swrast_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)
                
                Stack trace of thread 2359:
                #14 0x0000000000584cc7 FreeWindowResources (Xwayland)
                #15 0x0000000000587f20 DeleteWindow (Xwayland)
                #16 0x000000000058077d doFreeResource (Xwayland)
                #17 0x00000000005819bc FreeClientResources (Xwayland)
                #18 0x000000000055aac3 CloseDownClient (Xwayland)
                #19 0x000000000055adb6 ProcKillClient (Xwayland)
                #20 0x000000000055b72e Dispatch (Xwayland)
                #21 0x000000000055f776 dix_main (Xwayland)
                #22 0x00007f711f840413 __libc_start_main (libc.so.6)
                #23 0x000000000042e33e _start (Xwayland)
                
                Stack trace of thread 2353:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711e8d6993 n/a (i965_dri.so)
                #2  0x00007f711e8d66eb n/a (i965_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)
                
                Stack trace of thread 2357:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711cc7b3f3 n/a (swrast_dri.so)
                #2  0x00007f711cc7b33b n/a (swrast_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)
                
                Stack trace of thread 2355:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711cc7b3f3 n/a (swrast_dri.so)
                #2  0x00007f711cc7b33b n/a (swrast_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)
                
                Stack trace of thread 2356:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711cc7b3f3 n/a (swrast_dri.so)
                #2  0x00007f711cc7b33b n/a (swrast_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)
                
                Stack trace of thread 2359:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711cc7b3f3 n/a (swrast_dri.so)
                #2  0x00007f711cc7b33b n/a (swrast_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)
                
                Stack trace of thread 2354:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711cc7b3f3 n/a (swrast_dri.so)
                #2  0x00007f711cc7b33b n/a (swrast_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)
                
                Stack trace of thread 2360:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711cc7b3f3 n/a (swrast_dri.so)
                #2  0x00007f711cc7b33b n/a (swrast_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)
                
                Stack trace of thread 2361:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711cc7b3f3 n/a (swrast_dri.so)
                #2  0x00007f711cc7b33b n/a (swrast_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)
                
                Stack trace of thread 2358:
                #0  0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f711cc7b3f3 n/a (swrast_dri.so)
                #2  0x00007f711cc7b33b n/a (swrast_dri.so)
                #3  0x00007f711f9ea58e start_thread (libpthread.so.0)
                #4  0x00007f711f919513 __clone (libc.so.6)

Discussed during the 2018-09-04 blocker review meeting: [1]

The decision to delay the classification of this as a blocker and accept this bug as an AcceptedFreezeException was made as we're still worried about this, but don't know how widespread the impact may be. We accept it as a Beta FE issue, and will send out a call for testing before voting on blocker status.

[1] https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2018-09-04/f29-blocker-review.2018-09-04-16.01.txt

Yes, even thoygh I cannot reproduce the crash, I got the corruption in valgrind:

==5011== Invalid read of size 8
==5011==    at 0x434184: xwl_present_abort_vblank (xwayland-present.c:378)
==5011==    by 0x53785B: present_wnmd_abort_vblank (present_wnmd.c:651)
==5011==    by 0x53695A: present_free_window_vblank (present_screen.c:87)
==5011==    by 0x53695A: present_destroy_window (present_screen.c:152)
==5011==    by 0x42A90D: xwl_destroy_window (xwayland.c:653)
==5011==    by 0x584298: compDestroyWindow (compwindow.c:613)
==5011==    by 0x53CEE3: damageDestroyWindow (damage.c:1570)
==5011==    by 0x4F1BB8: DbeDestroyWindow (dbe.c:1326)
==5011==    by 0x46F7F6: FreeWindowResources (window.c:1031)
==5011==    by 0x472847: DeleteWindow (window.c:1099)
==5011==    by 0x46B54C: doFreeResource (resource.c:880)
==5011==    by 0x46C706: FreeClientResources (resource.c:1146)
==5011==    by 0x446ADE: CloseDownClient (dispatch.c:3473)
==5011==  Address 0x182abde0 is 80 bytes inside a block of size 112 free'd
==5011==    at 0x4C2FDAC: free (vg_replace_malloc.c:530)
==5011==    by 0x42A937: xwl_destroy_window (xwayland.c:647)
==5011==    by 0x584298: compDestroyWindow (compwindow.c:613)
==5011==    by 0x53CEE3: damageDestroyWindow (damage.c:1570)
==5011==    by 0x4F1BB8: DbeDestroyWindow (dbe.c:1326)
==5011==    by 0x46F7F6: FreeWindowResources (window.c:1031)
==5011==    by 0x472847: DeleteWindow (window.c:1099)
==5011==    by 0x46B54C: doFreeResource (resource.c:880)
==5011==    by 0x46C706: FreeClientResources (resource.c:1146)
==5011==    by 0x446ADE: CloseDownClient (dispatch.c:3473)
==5011==    by 0x446DA5: ProcKillClient (dispatch.c:3279)
==5011==    by 0x4476AF: Dispatch (dispatch.c:479)
==5011==  Block was alloc'd at
==5011==    at 0x4C30B06: calloc (vg_replace_malloc.c:711)
==5011==    by 0x433F46: xwl_present_window_get_priv (xwayland-present.c:54)
==5011==    by 0x434228: xwl_present_get_crtc (xwayland-present.c:302)
==5011==    by 0x539728: proc_present_query_capabilities (present_request.c:227)
==5011==    by 0x4476AF: Dispatch (dispatch.c:479)
==5011==    by 0x44B5B5: dix_main (main.c:276)
==5011==    by 0x75F611A: (below main) (libc-start.c:308)
==5011== 
==5011== Invalid read of size 8

Posted https://patchwork.freedesktop.org/patch/247271/ upstream

I made an x86_64 scratch-build of Xorg at http://koji.fedoraproject.org/koji/taskinfo?taskID=29514503 and can confirm that the crash is gone.

I'll submit a PR to apply the patch to our Fedora package to include in the Beta immediately.

https://src.fedoraproject.org/rpms/xorg-x11-server/pull-request/1 (Rawhide)
https://src.fedoraproject.org/rpms/xorg-x11-server/pull-request/2 (F29)

Okay, I was wrong. I'm still experiencing a crash using Chrome (though the one with closing glxgears is fixed). Might be that they are different crashes. I will try to get another backtrace, but the coredumpctl info for this crash is:


           PID: 14005 (Xwayland)
           UID: 13041 (sgallagh)
           GID: 13041 (sgallagh)
        Signal: 6 (ABRT)
     Timestamp: Mon 2018-08-27 08:43:54 EDT (1 weeks 3 days ago)
  Command Line: /usr/bin/Xwayland :0 -rootless -terminate -accessx -core -listen 4 -listen 5 -displayfd 6
    Executable: /usr/bin/Xwayland
 Control Group: /user.slice/user-13041.slice/session-5.scope
          Unit: session-5.scope
         Slice: user-13041.slice
       Session: 5
     Owner UID: 13041 (sgallagh)
       Boot ID: 2cb931df249d46feb74ca37ae5ecd4b7
    Machine ID: 06df243f7c7c435d806086f01e480d63
      Hostname: sgallaghp50.sgallagh.rht
       Storage: /var/lib/systemd/coredump/core.Xwayland.13041.2cb931df249d46feb74ca37ae5ecd4b7.14005.1535373834000000.lz4 (inaccessible)
       Message: Process 14005 (Xwayland) of user 13041 dumped core.
                
                Stack trace of thread 14005:
                #0  0x00007fbcebdf653f raise (libc.so.6)
                #1  0x00007fbcebde0895 abort (libc.so.6)
                #2  0x0000000000594390 OsAbort (Xwayland)
                #3  0x0000000000599629 AbortServer (Xwayland)
                #4  0x000000000059a49d FatalError (Xwayland)
                #5  0x0000000000591695 OsSigHandler (Xwayland)
                #6  0x00007fbcebf96f70 __restore_rt (libpthread.so.0)
                #7  0x00000000004f6bfa present_send_complete_notify (Xwayland)
                #8  0x00000000004f7bf4 present_vblank_notify (Xwayland)
                #9  0x00000000004f94ac present_wnmd_event_notify (Xwayland)
                #10 0x0000000000439287 xwl_present_sync_callback (Xwayland)
                #11 0x00007fbcebd02ace ffi_call_unix64 (libffi.so.6)
                #12 0x00007fbcebd0248f ffi_call (libffi.so.6)
                #13 0x00007fbcec4f779d n/a (libwayland-client.so.0)
                #14 0x00007fbcec4f3f09 n/a (libwayland-client.so.0)
                #15 0x00007fbcec4f541c wl_display_dispatch_queue_pending (libwayland-client.so.0)
                #16 0x000000000042ee1b xwl_read_events (Xwayland)
                #17 0x0000000000592081 ospoll_wait (Xwayland)
                #18 0x000000000058b953 WaitForSomething (Xwayland)
                #19 0x000000000055b4e0 Dispatch (Xwayland)
                #20 0x000000000055f776 dix_main (Xwayland)
                #21 0x00007fbcebde2413 __libc_start_main (libc.so.6)
                #22 0x000000000042e33e _start (Xwayland)
                
                Stack trace of thread 14012:
                #0  0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007fbce921d3f3 n/a (swrast_dri.so)
                #2  0x00007fbce921d33b n/a (swrast_dri.so)
                #3  0x00007fbcebf8c58e start_thread (libpthread.so.0)
                #4  0x00007fbcebebb513 __clone (libc.so.6)
                
                Stack trace of thread 14011:
                #0  0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007fbce921d3f3 n/a (swrast_dri.so)
                #2  0x00007fbce921d33b n/a (swrast_dri.so)
                #3  0x00007fbcebf8c58e start_thread (libpthread.so.0)
                #4  0x00007fbcebebb513 __clone (libc.so.6)
                
                Stack trace of thread 14014:
                #0  0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007fbce921d3f3 n/a (swrast_dri.so)
                #2  0x00007fbce921d33b n/a (swrast_dri.so)
                #3  0x00007fbcebf8c58e start_thread (libpthread.so.0)
                #4  0x00007fbcebebb513 __clone (libc.so.6)
                
                Stack trace of thread 14009:
                #0  0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007fbce921d3f3 n/a (swrast_dri.so)
                #2  0x00007fbce921d33b n/a (swrast_dri.so)
                #3  0x00007fbcebf8c58e start_thread (libpthread.so.0)
                #4  0x00007fbcebebb513 __clone (libc.so.6)
                
                Stack trace of thread 14007:
                #0  0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007fbce921d3f3 n/a (swrast_dri.so)
                #2  0x00007fbce921d33b n/a (swrast_dri.so)
                #3  0x00007fbcebf8c58e start_thread (libpthread.so.0)
                #4  0x00007fbcebebb513 __clone (libc.so.6)
                
                Stack trace of thread 14006:
                #0  0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007fbceae78993 n/a (i965_dri.so)
                #2  0x00007fbceae786eb n/a (i965_dri.so)
                #3  0x00007fbcebf8c58e start_thread (libpthread.so.0)
                #4  0x00007fbcebebb513 __clone (libc.so.6)
                
                Stack trace of thread 14008:
                #0  0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007fbce921d3f3 n/a (swrast_dri.so)
                #2  0x00007fbce921d33b n/a (swrast_dri.so)
                #3  0x00007fbcebf8c58e start_thread (libpthread.so.0)
                #4  0x00007fbcebebb513 __clone (libc.so.6)
                
                Stack trace of thread 14010:
                #0  0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007fbce921d3f3 n/a (swrast_dri.so)
                #2  0x00007fbce921d33b n/a (swrast_dri.so)
                #3  0x00007fbcebf8c58e start_thread (libpthread.so.0)
                #4  0x00007fbcebebb513 __clone (libc.so.6)
                
                Stack trace of thread 14013:
                #0  0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007fbce921d3f3 n/a (swrast_dri.so)
                #2  0x00007fbce921d33b n/a (swrast_dri.so)
                #3  0x00007fbcebf8c58e start_thread (libpthread.so.0)
                #4  0x00007fbcebebb513 __clone (libc.so.6)

(In reply to Stephen Gallagher from comment #29)
> Okay, I was wrong. I'm still experiencing a crash using Chrome (though the
> one with closing glxgears is fixed). Might be that they are different
> crashes. I will try to get another backtrace, but the coredumpctl info for
> this crash is:
> [...]

It's not the exact same issue, but a corollary...

See my post here: https://bugs.freedesktop.org/show_bug.cgi?id=107314#c7

So I ran another scratch build here with both patches applied (plus another one unrelated)

https://koji.fedoraproject.org/koji/taskinfo?taskID=29516394

Once it;s complete, can you try that one?

I'm still getting the crash on Chrome (reproducible by the same steps as Comment #15)

New backtrace with xorg-x11-server-1.20.1-1.1test.fc29.x86_64:





#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
        set = {__val = {171516928, 0, 0, 0, 0, 0, 0, 0, 139676191207280, 0, 72, 12188344904638522880, 20659136, 0, 18141872, 18802016}}
        pid = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
#1  0x00007f08e5a74895 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x13b3bc0, sa_sigaction = 0x13b3bc0}, sa_mask = {__val = {0, 18141872, 18802016, 0, 0, 
              6091017, 6091024, 2, 9223372036854775822, 0, 0, 0, 67108868, 139676191207280, 12188344904638522880, 0}}, sa_flags = 6031216, 
          sa_restorer = 0x5c0770}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x0000000000594410 in OsAbort () at utils.c:1350
No locals.
#3  0x00000000005996a9 in AbortServer () at log.c:877
No locals.
#4  0x000000000059a51d in FatalError (f=f@entry=0x5c0770 "Caught signal %d (%s). Server aborting\n") at log.c:1015
        args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7ffdd3d82060, reg_save_area = 0x7ffdd3d81f90}}
        args2 = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 0x7ffdd3d82060, reg_save_area = 0x7ffdd3d81f90}}
        beenhere = 1
#5  0x0000000000591715 in OsSigHandler (signo=11, sip=<optimized out>, unused=<optimized out>) at osinit.c:156
        unused = <optimized out>
        sip = <optimized out>
        signo = 11
#6  <signal handler called>
No locals.
#7  0x00000000004f6c7a in dixGetPrivate (key=<optimized out>, privates=0xcacacacacacacaea) at ../include/privates.h:121
        __PRETTY_FUNCTION__ = "dixGetPrivate"
#8  present_window_priv (window=0xcacacacacacacaca) at present_priv.h:240
No locals.
#9  present_send_complete_notify (window=0xcacacacacacacaca, kind=kind@entry=0 '\000', mode=mode@entry=1 '\001', serial=3402287818, 
    ust=ust@entry=60265919, msc=3834029160418063685) at present_event.c:153
        window_priv = <optimized out>
#10 0x00000000004f7c74 in present_vblank_notify (vblank=vblank@entry=0x14e4c40, kind=kind@entry=0 '\000', mode=mode@entry=1 '\001', 
    ust=ust@entry=60265919, crtc_msc=15) at present_vblank.c:35
        n = <optimized out>
#11 0x00000000004f952c in present_wnmd_flip_notify (crtc_msc=<optimized out>, ust=60265919, vblank=0x14e4c40) at present_wnmd.c:194
        window = 0x1473780
        window_priv = 0x14816e0
        window = <optimized out>
        window_priv = <optimized out>
        __PRETTY_FUNCTION__ = "present_wnmd_flip_notify"
#12 present_wnmd_event_notify (window=<optimized out>, event_id=<optimized out>, ust=60265919, msc=<optimized out>) at present_wnmd.c:228
        window_priv = <optimized out>
        vblank = 0x14e4c40
        __PRETTY_FUNCTION__ = "present_wnmd_event_notify"
#13 0x0000000000439298 in xwl_present_sync_callback (data=0x14e50c0, callback=<optimized out>, time=<optimized out>)
    at xwayland-present.c:291
        event = 0x14e50c0
        xwl_present_window = 0x1473ca0
#14 0x00007f08e5996ace in ffi_call_unix64 () at ../src/x86/unix64.S:76
No locals.
#15 0x00007f08e599648f in ffi_call () at ../src/x86/ffi64.c:525
        classes = {X86_64_INTEGERSI_CLASS, 32520, 3860389004, 32520}
        stack = <optimized out>
        argp = <optimized out>
        arg_types = <optimized out>
        gprcount = <optimized out>
        ssecount = <optimized out>
        ngpr = 1
        nsse = 0
        i = <optimized out>
        avn = <optimized out>
        ret_in_memory = <optimized out>
        reg_args = <optimized out>
#16 0x00007f08e618b79d in wl_closure_invoke (closure=0x13d0a50, flags=1, target=<optimized out>, opcode=0, data=<optimized out>)
    at src/connection.c:996
        count = <optimized out>
        cif = {abi = FFI_UNIX64, nargs = 3, arg_types = 0x7ffdd3d829b0, rtype = 0x7f08e5997180 <ffi_type_void>, bytes = 0, flags = 0}
        ffi_types = {0x7f08e5997060 <ffi_type_pointer>, 0x7f08e5997060 <ffi_type_pointer>, 0x7f08e59970e0 <ffi_type_uint32>, 0x40, 
          0x7ffdd3d82a20, 0x7f08e618bec4 <wl_os_recvmsg_cloexec+36>, 0x7f08e59970c0 <ffi_type_sint32>, 0xf0a440, 0x7ffdd3d82a20, 0xf0e490, 
          0x7ffdd3d82c1c, 0x6337a0 <isItTimeToYield>, 0x0, 0x7f08e618a063 <wl_connection_read+243>, 0x0, 0x0, 0x7ffdd3d82a60, 0x2, 
          0x7ffdd3d82a80, 0x7f08e618a3db <wl_closure_clear_fds+59>, 0x75, 0xa925b31d38ebe600}
        ffi_args = {0x7ffdd3d82980, 0x7ffdd3d82988, 0x13d0a68, 0x1, 0xc, 0xf0e340, 0xf0e340, 0x7f08e618b063 <wl_connection_demarshal+259>,
          0x13c212c, 0xf0e490, 0x13c2120, 0x13c2050, 0x0, 0x7f08e618a5ed <wl_closure_close_fds+77>, 0x75, 0xa925b31d38ebe600, 0xf104a0, 
          0x1475ae0, 0xf0e420, 0x1457e60, 0x1457e60, 0x7f08e618db30}
        implementation = <optimized out>
#17 0x00007f08e6187f09 in dispatch_event (display=display@entry=0xf0e340, queue=<optimized out>) at src/wayland-client.c:1427
        closure = 0x13d0a50
        proxy = 0x1482070
        opcode = 0
        proxy_destroyed = <optimized out>
#18 0x00007f08e618941c in dispatch_queue (queue=0xf0e408, display=0xf0e340) at src/wayland-client.c:1573
        count = 4
        count = <optimized out>
#19 wl_display_dispatch_queue_pending (display=0xf0e340, queue=0xf0e408) at src/wayland-client.c:1815
        ret = <optimized out>
#20 0x00007f08e6189480 in wl_display_dispatch_pending (display=<optimized out>) at src/wayland-client.c:1878
No locals.
#21 0x000000000042ee1b in xwl_read_events (xwl_screen=0xf0a440) at xwayland.c:814
        ret = <optimized out>
#22 0x0000000000592101 in ospoll_wait (ospoll=0xeff8f0, timeout=<optimized out>) at ospoll.c:651
        ev = <optimized out>
        osfd = <optimized out>
        revents = <optimized out>
        xevents = <optimized out>
        nready = <optimized out>
        events = {{events = 1, data = {ptr = 0xf1f540, fd = 15856960, u32 = 15856960, u64 = 15856960}}, {events = 0, data = {
              ptr = 0x7ffdd3d82c50, fd = -740807600, u32 = 3554159696, u64 = 140728157613136}}, {events = 18802016, data = {
              ptr = 0x61db6000000000, fd = 0, u32 = 0, u64 = 27544278104276992}}, {events = 0, data = {ptr = 0x58fac4 <input_lock+20>, 
              fd = 5831364, u32 = 5831364, u64 = 5831364}}, {events = 6417060, data = {ptr = 0x4791df00000000, fd = 0, u32 = 0, 
              u64 = 20145110310191104}}, {events = 0, data = {ptr = 0x6000000ff, fd = 255, u32 = 255, u64 = 25769804031}}, {events = 432, 
            data = {ptr = 0x60000eb7d, fd = 60285, u32 = 60285, u64 = 25769864061}}, {events = 6, data = {ptr = 0x0, fd = 0, u32 = 0, 
              u64 = 0}}, {events = 693, data = {ptr = 0x16800000000, fd = 0, u32 = 0, u64 = 1546188226560}}, {events = 0, data = {
              ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {
              ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 3, data = {ptr = 0x300, fd = 768, u32 = 768, u64 = 768}}, {events = 0, 
            data = {ptr = 0x40c3cccccccccccd, fd = -858993459, u32 = 3435973837, u64 = 4666798818867334349}}, {events = 0, data = {
              ptr = 0x40d00000, fd = 1087373312, u32 = 1087373312, u64 = 1087373312}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, 
              u64 = 0}} <repeats 23 times>, {events = 16, data = {ptr = 0x10, fd = 16, u32 = 16, u64 = 16}}, {events = 0, data = {
              ptr = 0x10, fd = 16, u32 = 16, u64 = 16}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}} <repeats 206 times>, {
            events = 0, data = {ptr = 0xd3d837e000000000, fd = 0, u32 = 0, u64 = 15265012372184498176}}, {events = 32765, data = {
              ptr = 0x7ffdd3d9bbcc <clock_gettime+476>, fd = -740705332, u32 = 3554261964, u64 = 140728157715404}}, {events = 3554162720, 
            data = {ptr = 0x7ffd, fd = 32765, u32 = 32765, u64 = 32765}}, {events = 1, data = {ptr = 0x1, fd = 1, u32 = 1, u64 = 1}}, {
            events = 3853796117, data = {ptr = 0x61f86400007f08, fd = 32520, u32 = 32520, u64 = 27576181121384200}}, {events = 0, data = {
              ptr = 0x7f08e618954b <wl_display_flush+59>, fd = -434596533, u32 = 3860370763, u64 = 139676196836683}}, {events = 15770688, 
            data = {ptr = 0x100000000, fd = 0, u32 = 0, u64 = 4294967296}}, {events = 0, data = {ptr = 0x7ffdd3d83864, fd = -740804508, 
              u32 = 3554162788, u64 = 140728157616228}}, {events = 3838139737, data = {ptr = 0x10b401000007f08, fd = 32520, u32 = 32520, 
              u64 = 75224256245432072}}, {events = 0, data = {ptr = 0x43bd46 <_glamor_block_handler+118>, fd = 4439366, u32 = 4439366, 
              u64 = 4439366}}}
        i = <optimized out>
#23 0x000000000058b9d3 in WaitForSomething (are_ready=0) at WaitFor.c:208
        i = <optimized out>
        timeout = 980
        pollerr = <optimized out>
        were_ready = 0
        timer_is_running = 0
#24 0x000000000055b560 in Dispatch () at ../include/list.h:220
        result = <optimized out>
        client = <optimized out>
        start_tick = <optimized out>
#25 0x000000000055f7f6 in dix_main (argc=12, argv=0x7ffdd3d83a48, envp=<optimized out>) at main.c:276
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#26 0x00007f08e5a76413 in __libc_start_main (main=0x42e300 <main>, argc=12, argv=0x7ffdd3d83a48, init=<optimized out>, 
    fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffdd3d83a38) at ../csu/libc-start.c:308
        self = <optimized out>
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 4190540796469081291, 4383504, 140728157616704, 0, 0, -4189353010273291061, 
                -4308254496022301493}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x7ffdd3d83ab0, 0x7f08e6513150}, data = {prev = 0x0, 
              cleanup = 0x0, canceltype = -740803920}}}
        not_first_call = <optimized out>
#27 0x000000000042e33e in _start () at glamor.c:917
No symbol table info available.

Based on comments in the patch I'm +1 beta freeze exception. But unless there are more people affected, -1 beta blocker.

(In reply to Stephen Gallagher from comment #31)
> I'm still getting the crash on Chrome (reproducible by the same steps as
> Comment #15)
> 
> New backtrace with xorg-x11-server-1.20.1-1.1test.fc29.x86_64:
> [...]

That's actually a different issue, the backtrace matches https://bugs.freedesktop.org/show_bug.cgi?id=107314 for which a patch was already submitted upstream.

Can you try this scratch build, which contains that other fix as well:

https://koji.fedoraproject.org/koji/taskinfo?taskID=29594440

(In reply to Olivier Fourdan from comment #33)
> Can you try this scratch build, which contains that other fix as well:
> 
> https://koji.fedoraproject.org/koji/taskinfo?taskID=29594440


I can confirm that with this scratch-build, I'm not seeing a crash either with Chrome or glxgears.

Can we get this in a formal build, please? Thank you for tracking this down, Olivier!

xorg-x11-server-1.20.1-2.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-4b01c3a7d8

Discussed at 2018-09-10 blocker review meeting: https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2018-09-10/f29-blocker-review.2018-09-10-16.01.html . We agreed that there doesn't seem to be an indication that enough people will hit this often enough to qualify as a blocker, but there are certainly real crashes here that it would be a good idea to fix for Beta, so it is accepted as a freeze exception issue.

coremodule: process note - when we accepted this as an FE before, you added 'AcceptedFreezeException' to the whiteboard but didn't actually mark the bug as blocking BetaFreezeException . you have to do both :)

xorg-x11-server-1.20.1-2.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-4b01c3a7d8

xorg-x11-server-1.20.1-2.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.