Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1110713

Summary: virt-viewer crashes when connecting to a VM with two screens (via two QXL devices)
Product: Red Hat Enterprise Linux 6 Reporter: Michele Baldessari <michele>
Component: virt-viewerAssignee: Virt Viewer Maint <virt-viewer-maint>
Status: CLOSED NOTABUG QA Contact: Virtualization Bugs <virt-bugs>
Severity: low Docs Contact:
Priority: unspecified    
Version: 6.6CC: cfergeau, codong, dblechte, juzhou, marcandre.lureau, michele, mzhan, rbalakri, tzheng
Target Milestone: rcKeywords: Reopened
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-04-13 12:05:12 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
bt and bt full output from gdb
none
xorg.conf of the host where virt-viewer is launched none

Description Michele Baldessari 2014-06-18 10:14:52 UTC
Description of problem:
When connecting to a VM with two QXL Devices and respective two xorg screens we get a segfault:
virt-viewer -c qemu:///system vm

(virt-viewer:1444): virt-viewer-CRITICAL **: virt_viewer_display_spice_new: assertion `channelid == 0 || monitorid == 0' failed
(virt-viewer:1444): GLib-GObject-CRITICAL **: g_object_ref_sink: assertion `G_IS_OBJECT (object)' failed
(virt-viewer:1444): GLib-GObject-CRITICAL **: g_object_ref: assertion `G_IS_OBJECT (object)' failed
(virt-viewer:1444): GLib-GObject-CRITICAL **: g_object_get: assertion `G_IS_OBJECT (object)' failed
(virt-viewer:1444): GLib-GObject-WARNING **: invalid (NULL) pointer instance
(virt-viewer:1444): virt-viewer-CRITICAL **: virt_viewer_signal_connect_object: assertion `G_TYPE_CHECK_INSTANCE (instance)' failed
(virt-viewer:1444): GLib-GObject-CRITICAL **: g_object_notify: assertion `G_IS_OBJECT (object)' failed
(virt-viewer:1444): GLib-GObject-WARNING **: invalid (NULL) pointer instance
(virt-viewer:1444): virt-viewer-CRITICAL **: virt_viewer_signal_connect_object: assertion `G_TYPE_CHECK_INSTANCE (instance)' failed
(virt-viewer:1444): virt-viewer-CRITICAL **: virt_viewer_display_spice_new: assertion `channelid == 0 || monitorid == 0' failed
(virt-viewer:1444): GLib-GObject-CRITICAL **: g_object_ref_sink: assertion `G_IS_OBJECT (object)' failed
(virt-viewer:1444): virt-viewer-CRITICAL **: virt_viewer_display_spice_new: assertion `channelid == 0 || monitorid == 0' failed
(virt-viewer:1444): GLib-GObject-CRITICAL **: g_object_ref_sink: assertion `G_IS_OBJECT (object)' failed
(virt-viewer:1444): GSpice-WARNING **: Warning no automount-inhibiting implementation available
(virt-viewer:1444): GLib-GObject-CRITICAL **: g_object_get: assertion `G_IS_OBJECT (object)' failed
(virt-viewer:1444): GLib-GObject-WARNING **: invalid cast from `VirtViewerDisplaySpice' to `GtkWindow'
(virt-viewer:1444): Gtk-CRITICAL **: IA__gtk_window_get_position: assertion `GTK_IS_WINDOW (window)' failed
(virt-viewer:1444): GLib-GObject-CRITICAL **: g_object_get: assertion `G_IS_OBJECT (object)' failed

Here is a snippet of the gdb crash trace (will attach the full one as a separate file):
#0  virt_viewer_display_get_preferred_monitor_geometry (self=0x0, preferred=0x8a0ca0) at virt-viewer-display.c:792
#1  0x00000000004161ba in virt_viewer_session_on_monitor_geometry_changed (self=0x6e58b0, display=<value optimized out>)
    at virt-viewer-session.c:421
#2  0x000000323a80e2fe in g_closure_invoke (closure=0xe65720, return_value=0x0, n_param_values=1, param_values=0x891ca0, 
    invocation_hint=0x7fffffffc0f0) at gclosure.c:766
#3  0x000000323a824695 in signal_emit_unlocked_R (node=<value optimized out>, detail=0, instance=0x6ab5a0, emission_return=0x0, 
    instance_and_params=0x891ca0) at gsignal.c:3252
#4  0x000000323a825b36 in g_signal_emit_valist (instance=<value optimized out>, signal_id=<value optimized out>, detail=<value optimized out>, 
    var_args=0x7fffffffc300) at gsignal.c:2983
#5  0x000000323a825e88 in g_signal_emit_by_name (instance=0x6ab5a0, detailed_signal=0x4266e5 "monitor-geometry-changed") at gsignal.c:3077
#6  0x00000000004217f6 in virt_viewer_display_spice_monitor_geometry_changed (self=0x6ab5a0, allocation=0x7fffffffc880, 
    data=<value optimized out>) at virt-viewer-display-spice.c:100
#7  virt_viewer_display_spice_size_allocate (self=0x6ab5a0, allocation=0x7fffffffc880, data=<value optimized out>)
    at virt-viewer-display-spice.c:215
#8  0x000000323a80e2fe in g_closure_invoke (closure=0x89f420, return_value=0x0, n_param_values=2, param_values=0xe5b4f0, 
    invocation_hint=0x7fffffffc5a0) at gclosure.c:766

The host on which we launch virt-viewer has four 30" monitors configured in xorg as a single xinerama screen of (10240x1600). The crash seems to happen
during the loop in virt_viewer_session_on_monitor_geometry_changed() because
VIRT_VIEWER_DISPLAY(l->data) returns null when hitting the fourth monitor:
....
monitors = g_new0(GdkRectangle, nmonitors);
for (GList *l = self->priv->displays; l; l = l->next) {            
    VirtViewerDisplay *d = VIRT_VIEWER_DISPLAY(l->data);
    guint nth = 0;
    GdkRectangle *rect = NULL;
 
    g_object_get(d, "nth-display", &nth, NULL);
    g_return_if_fail(nth < nmonitors);
    rect = &monitors[nth];
    virt_viewer_display_get_preferred_monitor_geometry(d, rect);
 
    if (virt_viewer_display_get_enabled(d) &&
        !virt_viewer_display_get_fullscreen(d))
        all_fullscreen = FALSE;
}
....

I have added some debug code: 
- The variable nmonitors is 4 (defined at the beginning of the function)
- We loop through nth 3, 2, 1 and when nth is equal to 0 we get d = NULL which
  makes us crash in the virt_viewer_display_get_preferred_monitor_geometry(d, rect) call

Version-Release number of selected component (if applicable):
virt-viewer-0.6.0-6

How reproducible:
100%

Steps to Reproduce:
1. It's a very specific environment. I will attach xorg.conf and full gdb outputs

Additional info:
One important thing is that if we launch virt-viewer (or remote-viewer) with -f
in fullscreen the segfault does *not* happen.

Comment 1 Michele Baldessari 2014-06-18 10:17:45 UTC
Created attachment 909935 [details]
bt and bt full output from gdb

Comment 2 Michele Baldessari 2014-06-18 10:21:13 UTC
Created attachment 909938 [details]
xorg.conf of the host where virt-viewer is launched

Comment 5 Marc-Andre Lureau 2014-06-18 11:31:00 UTC
We don't support multiple qxl devices with RHEL6 guest, afaik, since we switched to xrandr. I don't observe the same behaviour if I have a rhel6 configured with 2 qxl devices, only one device is enabled, and no crash.

What is your version of xorg-x11-drv-qxl and spice-vdagent?

Nevertheless, to fix this crash, we would need a different backtrace.
Please run with G_DEBUG=fatal_criticals SPICE_DEBUG=1 and provide backtrace when reaching the assert. Thanks

Comment 6 Marc-Andre Lureau 2014-06-18 11:33:55 UTC
Even better would be to make this VM accessible from outside, so we could easily reproduce. thanks

Comment 12 Marc-Andre Lureau 2014-06-18 13:27:53 UTC
Thanks for the log.

(virt-viewer:5575): GSpice-DEBUG: channel-display.c:1767 display-2:3: monitors config: n: 1/4
(virt-viewer:5575): GSpice-DEBUG: channel-display.c:1787 display-2:3: monitor id: 0, surface id: 0, +0+0-1280x1024

virt-viewer/spice-gtk doesn't support multi-devices with rhel6/xrandr driver.

You must either use a single qxl device or keep an old qxl driver.

Why do you need multiple devices for this guest?

Comment 13 Marc-Andre Lureau 2014-06-18 17:24:12 UTC
nevertheless, it would be nice to avoid the crash, perhaps this is enough. Do you know how to try with that change, or I provide you a scratchbuild?

diff --git a/src/virt-viewer-session-spice.c b/src/virt-viewer-session-spice.c
index 255b3ee..405d11a 100644
--- a/src/virt-viewer-session-spice.c
+++ b/src/virt-viewer-session-spice.c
@@ -662,6 +662,8 @@ virt_viewer_session_spice_display_monitors(SpiceChannel *channel,
         display = g_ptr_array_index(displays, i);
         if (display == NULL) {
             display = virt_viewer_display_spice_new(self, channel, i);
+            if (display == NULL)
+                continue;
             g_debug("creating spice display (#:%d)", i);
             g_ptr_array_index(displays, i) = g_object_ref_sink(display);
         }

Comment 18 Marc-Andre Lureau 2014-07-15 19:09:34 UTC
I have been downgrading to xorg-x11-drv-qxl-0.1.0-7 on current rhel 6.6, which was claimed to be qxl driver version in comment 7.

However, I am unable to effectively get Xinerama to setup. It is just ignoring the second device.. No warning, no notice... 

[    19.805] (**) |-->Screen "screen0" (0)
[    19.805] (**) |   |-->Monitor "Monitor0"
[    19.806] (**) |   |-->Device "QXL0"
[    19.806] (**) |-->Screen "screen1" (1)
[    19.806] (**) |   |-->Monitor "Monitor1"
[    19.806] (**) |   |-->Device "QXL1"
[    19.806] (**) Option "Xinerama" "true"
[    19.806] (==) Automatically adding devices
[    19.806] (==) Automatically enabling devices
[    19.806] (==) Not automatically adding GPU devices
[    19.806] (**) Xinerama: enabled

Also I wonder why is "Xinerama"    "0" in provided guest xorg config file?

Comment 19 Marc-Andre Lureau 2014-07-15 19:13:04 UTC
Please help give precise instructions to set up a guest reproducing the bug.

Comment 22 Marc-Andre Lureau 2014-07-25 15:07:09 UTC
by design, multimonitor on linux guest works with a single qxl device.

Comment 27 Marc-Andre Lureau 2014-08-19 12:15:45 UTC
moving to 6.7