Bug 1729925

Frequent crashes of XWayland on F30. Triggered mostly by clicking on save in Firefox download dialog. Also very easy to trigger doing anything (clicking) in GIMP. Since I spend most of the time in terminal and firefox I don't know if other programs trigger the same bug.

Relevant backtrace from XWayland:

-----------------------------------------------------------
Thread 1 (Thread 0x7f3221b9da80 (LWP 1504)):
#0  0x00007f322148fe75 in raise () from /lib64/libc.so.6
No symbol table info available.
#1  0x00007f322147a895 in abort () from /lib64/libc.so.6
No symbol table info available.
#2  0x00005587bce17b20 in OsAbort () at utils.c:1351
No locals.
#3  0x00005587bce1cdb9 in AbortServer () at log.c:879
No locals.
#4  0x00005587bce1dc1a in FatalError (f=f@entry=0x5587bce43970 "Caught signal %d (%s). Server aborting\n") at log.c:1017
        args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7fff5774af60, reg_save_area = 0x7fff5774ae90}}
        args2 = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 0x7fff5774af60, reg_save_area = 0x7fff5774ae90}}
        beenhere = 1
#5  0x00005587bce14e69 in OsSigHandler (unused=<optimized out>, sip=0x7fff5774b0b0, signo=11) at osinit.c:156
No locals.
#6  OsSigHandler (signo=11, sip=0x7fff5774b0b0, unused=<optimized out>) at osinit.c:110
No locals.
#7  <signal handler called>
No symbol table info available.
#8  0x00007f322185bef5 in gbm_bo_destroy (bo=0x0) at ../src/gbm/main/gbm.c:439
No locals.
#9  0x00005587bccbd027 in xwl_glamor_gbm_create_pixmap (screen=0x5587bdd96420, width=77, height=32, depth=32, hint=0) at xwayland-glamor-gbm.c:245
        format = <optimized out>
        xwl_screen = <optimized out>
        xwl_gbm = <optimized out>
        bo = 0x0
        pixmap = <optimized out>
#10 0x00005587bcdd9ede in ProcCreatePixmap (client=0x5587be1749c0) at dispatch.c:1440
        pMap = <optimized out>
        pDraw = 0x5587be22b8d0
        stuff = <optimized out>
        pDepth = <optimized out>
        i = <optimized out>
        rc = 0
#11 0x00005587bcddede4 in Dispatch () at dispatch.c:478
        result = <optimized out>
        client = 0x5587be1749c0
        start_tick = 66375
#12 0x00005587bcde2ec4 in dix_main (argc=12, argv=0x7fff5774b788, envp=<optimized out>) at main.c:276
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#13 0x00007f322147bf33 in __libc_start_main () from /lib64/libc.so.6
No symbol table info available.
#14 0x00005587bccb23ee in _start ()
No symbol table info available.
-----------------------------------------------------------


It seems that xwl_glamor_gbm_create_pixmap function calls gbm_bo_destroy with NULL argument:

-----------------------------------------------------------
/usr/src/debug/xorg-x11-server-1.20.5-4.fc30.x86_64/hw/xwayland/xwayland-glamor-gbm.c

236	        {
237	            bo = gbm_bo_create(xwl_gbm->gbm, width, height, format,
238	                               GBM_BO_USE_SCANOUT | GBM_BO_USE_RENDERING);
239	        }
240	
241	        if (bo)
242	            pixmap = xwl_glamor_gbm_create_pixmap_for_bo(screen, bo, depth);
243	
244	        if (!pixmap)
245	            gbm_bo_destroy(bo);
246	    }
247	
248	    if (!pixmap)
249	        pixmap = glamor_create_pixmap(screen, width, height, depth, hint);
250	
251	    return pixmap;
252	}
-----------------------------------------------------------

From the source of gbm_bo_destroy function it is clear that it can't handle NULL argument very well (i.e. it dereferences NULL pointer ... and then happens crash!)

-----------------------------------------------------------
/usr/src/debug/mesa-19.0.8-1.fc30.x86_64/src/gbm/main/gbm.c

436	GBM_EXPORT void
437	gbm_bo_destroy(struct gbm_bo *bo)
438	{
439	   if (bo->destroy_user_data)
440	      bo->destroy_user_data(bo, bo->user_data);
441	
442	   bo->gbm->bo_destroy(bo);
443	}
-----------------------------------------------------------