Bug 1735382

Created attachment 1597469 [details]
backtrace

This bug has a number of layers to it.  I don't know why it just started crashing, though.

The issue is triggered by gnome-control-center's 512x512 icon.

icons can be attached to a window in one of two ways:

1) _NET_WM_ICON property on the window as raw pixel data
2) a separate pixmap pointed to in the WM_HINTS property

normally the first is preferred over the second.

Unfortunately gtk has a bug in it making the first path get skipped if there's a 512 icon.  the code is here:

   │3868      l = pixbufs;
   │3869      size = 0;
   │3870      n = 0;
   │3871      while (l)
   │3872        {
   │3873          pixbuf = l->data;
   │3874          g_return_if_fail (GDK_IS_PIXBUF (pixbuf));
   │3875
   │3876          width = gdk_pixbuf_get_width (pixbuf);
   │3877          height = gdk_pixbuf_get_height (pixbuf);
   │3878
   │3879          /* silently ignore overlarge icons */
   │3880          if (size + 2 + width * height > GDK_SELECTION_MAX_SIZE(display))
   │3881            break;
   │3882                                                                          
   │3883          n++;
   │3884          size += 2 + width * height;
   │3885
   │3886          l = l->next;
   │3887        }

you can see on line 3879 that it's trying to ignore icons that would be too big to fit in the property. a single 512x512 icon is too big to fit.
But line 3881 breaks out of the loop entirely; the apparent assumption is the list of pixbufs is sorted from lowest size to biggest size.

But the list isn't sorted at all!  It's just the result of a hash table turned to an array turned to a list. For whatever reason, the 512 icon
is now returned as the first pixbuf, meaning no further icons get processed and the _NET_WM_ICON isn't set at all.

This means we fall back to using a pixmap specified by WM_HINTS but that pixmap uses the same color depth as the root window.  On this cirrus machine,
we're getting a 16bpp window.

This wouldn't be a problem but mutter only supports 24bit and 32bit pixmaps for WM_HINTS icons:

   │291     static int
   │292     standard_pict_format_for_depth (int depth)
   │293     {
   │294       switch (depth)
   │295         {
   │296         case 1:
   │297           return PictStandardA1;
   │298         case 24:
   │299           return PictStandardRGB24;
   │300         case 32:
   │301           return PictStandardARGB32;
   │302         default:
   │303           g_assert_not_reached ();
   │304         }
   │305       return 0;
   │306     }

and so we're crashing.

So on the mutter side we can either skip loading the icon if it's 16bpp or support loading 16bpp icons (might be as simple as (if (depth == 16) depth = 32; not sure).
on the gtk side we can just sorting the icon list from smallest size to biggest size.

Created attachment 1599288 [details]
mutter fix that seems to work

I just took a stab at the obvious mutter fix. I figured it would either crash, work, or make a black icon.  Seems to work.

Created attachment 1599336 [details]
gtk fix

this gtk fix also works.

note the mutter fix for this bug caused bug 1737326

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3553