Description of problem: Moving windows between monitors sometimes causes XWayland to crash. Version-Release number of selected component: xorg-x11-server-Xwayland-1.20.1-1.fc29 Additional info: reporter: libreport-2.9.5 crash_function: OsLookupColor executable: /usr/bin/Xwayland kernel: 4.18.0-0.rc8.git2.1.fc29.x86_64 runlevel: N 5 type: xorg uid: 0 Truncated backtrace: 0: /usr/bin/Xwayland (OsLookupColor+0x13d) [0x59175d] 1: /lib64/libpthread.so.0 (funlockfile+0x50) [0x7f24e4621fbf] 2: /usr/bin/Xwayland (present_register_complete_notify+0x5a) [0x4f6c0a] 3: /usr/bin/Xwayland (present_extension_init+0x124) [0x4f7cd4] 4: /usr/bin/Xwayland (present_wnmd_event_notify+0x1ec) [0x4f94ac] 5: /usr/bin/Xwayland (glamor_egl_fd_from_pixmap+0x5e7) [0x439827] 6: /lib64/libffi.so.6 (ffi_call_unix64+0x4c) [0x7f24e438dace] 7: /lib64/libffi.so.6 (ffi_call+0x35f) [0x7f24e438d48f] 8: /lib64/libwayland-client.so.0 (wl_log_set_handler_client+0x1efd) [0x7f24e4b834dd]
Created attachment 1476141 [details] File: Xorg.0.log
Created attachment 1476142 [details] File: backtrace
Created attachment 1476143 [details] File: cpuinfo
Created attachment 1476144 [details] File: dmesg
Created attachment 1476145 [details] File: dso_list
Created attachment 1476146 [details] File: etc_X11_xorg_conf_d.tar.gz
Created attachment 1476147 [details] File: usr_share_xorg_conf_d.tar.gz
This happens approximately 50% of the time when I maximize a window of an X11 application while running Wayland.
Proposed as a Blocker for 29-beta by Fedora user sgallagh using the blocker tracking app because: "No part of any release-blocking desktop's panel (or equivalent) configuration may crash on startup or be entirely non-functional." It's not necessarily a clear violation, but I'd argue that "maximizing windows crashes the desktop much of the time" should be considered "non-functional".
May be hardware dependent in some way, I don't think I've ever seen this, and I have two monitors and move windows around and maximize them quite a lot. IIRC, the traceback is fairly useless, journal output from around the time of the crash may be useful.
(In reply to Adam Williamson from comment #10) > May be hardware dependent in some way, I don't think I've ever seen this, > and I have two monitors and move windows around and maximize them quite a > lot. IIRC, the traceback is fairly useless, journal output from around the > time of the crash may be useful. Are you running F29? Because this clearly started immediately after I upgraded to that release. For the record, I have a Lenovo P50 laptop with hybrid Intel and nVidia Quadro M1000M graphics. The external monitor is connected only to the nVidia device; the internal to both. I will try to get some journal data the next time it happens.
of course I am :) my desktop's been on Rawhide since f28 came out.
CCing as I may be hitting this.
Discussed during the 2018-08-20 blocker review meeting: [1] The decision to delay the classification of this as a bug was made as we are currently unsure of exactly how many machines this affects. We will gather data and reconvene to vote on this as a blocker. [1] https://meetbot.fedoraproject.org/fedora-blocker-review/2018-08-20/f29-blocker-review.2018-08-20-16.00.txt
So, I can reproduce this fairly consistently on my hardware. With Google Chrome, grab a tab from a window, pull it out of the current window and have it fullscreen on a new monitor. It crashes GNOME every time doing this. (It doesn't crash if the disconnect of the tab and the fullscreening on a new monitor happen in different actions). I haven't yet figured out if this happens on other hardware, but it's *incredibly* annoying on my Lenovo P50.
Does it happen with any other apps, or just Chrome? Does it happen with packaged Chromium?
(In reply to Adam Williamson from comment #16) > Does it happen with any other apps, or just Chrome? Does it happen with > packaged Chromium? It has happened with other apps, but I can't find a consistent reproducer until the Chrome one. I'll try with Chromium if I find a few moments to spare later today.
Just now, the same crash occurred when I disconnected an external monitor.
I've not hit this in rawhide either... perhaps a call for more testers on the list would be in order?
I haven't seen that call-for-testing hit the list, but I will mention that I'm hitting this crash *constantly*. Also, I just tested and yes, the issue does occur with packaged Chromium as well.
Better backtrace: #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 set = {__val = {171516928, 0, 0, 0, 0, 0, 0, 0, 140123838566256, 0, 1, 140730018693532, 1, 5841042, 64377299159482369, 0}} pid = <optimized out> tid = <optimized out> ret = <optimized out> #1 0x00007f711f83e895 in __GI_abort () at abort.c:79 save_stage = 1 act = {__sigaction_handler = {sa_handler = 0x1, sa_sigaction = 0x1}, sa_mask = {__val = {5841042, 64377299159482369, 0, 0, 0, 6091009, 6091016, 2, 9223372036854775822, 0, 0, 0, 67108868, 140123838566256, 12917133525372909056, 0}}, sa_flags = 6031216, sa_restorer = 0x5c0770} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x0000000000594390 in OsAbort () at utils.c:1350 No locals. #3 0x0000000000599629 in AbortServer () at log.c:877 No locals. #4 0x000000000059a49d in FatalError (f=f@entry=0x5c0770 "Caught signal %d (%s). Server aborting\n") at log.c:1015 args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7ffe42c604a0, reg_save_area = 0x7ffe42c603d0}} args2 = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 0x7ffe42c604a0, reg_save_area = 0x7ffe42c603d0}} beenhere = 1 #5 0x0000000000591695 in OsSigHandler (signo=11, sip=<optimized out>, unused=<optimized out>) at osinit.c:156 unused = <optimized out> sip = <optimized out> signo = 11 #6 <signal handler called> No locals. #7 0x0000000000439610 in xwl_present_abort_vblank (present_window=0xed8c80, crtc=<optimized out>, event_id=725, msc=<optimized out>) at xwayland-present.c:378 xwl_present_window = 0xe8da50 event = 0x5f5f5f5f5f5f5f2f tmp = <optimized out> #8 0x00000000004f8580 in present_wnmd_abort_vblank (screen=<optimized out>, window=<optimized out>, crtc=<optimized out>, event_id=725, msc=<optimized out>) at present_wnmd.c:651 screen_priv = <optimized out> window_priv = 0xedbc40 vblank = <optimized out> __PRETTY_FUNCTION__ = "present_wnmd_abort_vblank" #9 0x00000000004f769b in present_free_window_vblank (window=0xed8c80) at present_screen.c:87 screen = <optimized out> vblank = 0xeda9b0 tmp = 0xedbc68 screen_priv = 0xb64180 window_priv = 0xedbc40 screen = <optimized out> screen_priv = <optimized out> window_priv = <optimized out> vblank = <optimized out> tmp = <optimized out> #10 present_destroy_window (window=0xed8c80) at present_screen.c:152 ret = <optimized out> screen = 0x99bf00 screen_priv = 0xb64180 window_priv = 0xedbc40 #11 0x000000000042f572 in xwl_destroy_window (window=0xed8c80) at xwayland.c:653 screen = 0x99bf00 xwl_screen = 0x99c440 ret = <optimized out> #12 0x0000000000548321 in compDestroyWindow (pWin=0xed8c80) at compwindow.c:613 pScreen = 0x99bf00 cs = 0xb640a0 cw = <optimized out> csw = <optimized out> ret = <optimized out> #13 0x00000000004fde8c in damageDestroyWindow (pWindow=0xed8c80) at damage.c:1570 pDamage = <optimized out> pScreen = 0x99bf00 ret = <optimized out> pScrPriv = 0x9b0d30 #14 0x00000000004ad8c1 in DbeDestroyWindow (pWin=0xed8c80) at dbe.c:1326 pDbeScreenPriv = 0xb74f90 pDbeWindowPriv = <optimized out> pScreen = 0x99bf00 ret = <optimized out> #15 0x0000000000584cc7 in FreeWindowResources (pWin=pWin@entry=0xed8c80) at window.c:1031 pScreen = 0x99bf00 #16 0x0000000000587f20 in DeleteWindow (value=0xed8c80, wid=35651586) at window.c:1099 pParent = 0xed9fb0 pWin = 0xed8c80 #17 0x000000000058077d in doFreeResource (res=0xea7680, skip=skip@entry=0) at resource.c:880 No locals. #18 0x00000000005819bc in FreeClientResources (client=client@entry=0xe57460) at resource.c:1146 head = 0xe8dbc0 resources = <optimized out> this = <optimized out> j = 2 resources = <optimized out> this = <optimized out> head = <optimized out> client = 0xe57460 j = <optimized out> resources = <optimized out> this = <optimized out> j = <optimized out> head = <optimized out> #19 0x000000000055aac3 in CloseDownClient (client=0xe57460) at dispatch.c:3473 really_close_down = <optimized out> #20 0x000000000055adb6 in ProcKillClient (client=0xe32390) at dispatch.c:3279 stuff = <optimized out> killclient = 0xe57460 rc = 0 #21 0x000000000055b72e in Dispatch () at dispatch.c:478 result = <optimized out> client = 0xe32390 start_tick = 55 #22 0x000000000055f776 in dix_main (argc=12, argv=0x7ffe42c60fc8, envp=<optimized out>) at main.c:276 i = <optimized out> alwaysCheckForInput = {0, 1} #23 0x00007f711f840413 in __libc_start_main (main=0x42e300 <main>, argc=12, argv=0x7ffe42c60fc8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffe42c60fb8) at ../csu/libc-start.c:308 self = <optimized out> result = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 7375780140962387716, 4383504, 140730018697152, 0, 0, -7376740277004691708, -7440448747047250172}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x7ffe42c61030, 0x7f71202dc150}, data = {prev = 0x0, cleanup = 0x0, canceltype = 1120276528}}} not_first_call = <optimized out> #24 0x000000000042e33e in _start () at dbe.c:1007 No symbol table info available.
I can also reproduce this issue by launching "glxgears" and then closing that window. It appears to be destruction of a window using OpenGL that causes the issue. (Google Chrome uses GL-acceleration by default).
Additional information from coredumpctl: PID: 2352 (Xwayland) UID: 13041 (sgallagh) GID: 13041 (sgallagh) Signal: 6 (ABRT) Timestamp: Tue 2018-09-04 13:53:56 EDT (37min ago) Command Line: /usr/bin/Xwayland :0 -rootless -terminate -accessx -core -listen 4 -listen 5 -displayfd 6 Executable: /usr/bin/Xwayland Control Group: /user.slice/user-13041.slice/session-2.scope Unit: session-2.scope Slice: user-13041.slice Session: 2 Owner UID: 13041 (sgallagh) Boot ID: bbf8b56abb684839be46ff538870e6a7 Machine ID: 06df243f7c7c435d806086f01e480d63 Hostname: sgallaghp50.sgallagh.rht Storage: /var/lib/systemd/coredump/core.Xwayland.13041.bbf8b56abb684839be46ff538870e6a7.2352.1536083636000000.lz4 Message: Process 2352 (Xwayland) of user 13041 dumped core. Stack trace of thread 2352: #0 0x00007f711f85453f raise (libc.so.6) #1 0x00007f711f83e895 abort (libc.so.6) #2 0x0000000000594390 OsAbort (Xwayland) #3 0x0000000000599629 AbortServer (Xwayland) #4 0x000000000059a49d FatalError (Xwayland) #5 0x0000000000591695 OsSigHandler (Xwayland) #6 0x00007f711f9f4f70 __restore_rt (libpthread.so.0) #7 0x0000000000439610 xwl_present_abort_vblank (Xwayland) #8 0x00000000004f8580 present_wnmd_abort_vblank (Xwayland) #9 0x00000000004f769b present_destroy_window (Xwayland) #10 0x000000000042f572 xwl_destroy_window (Xwayland) #11 0x0000000000548321 compDestroyWindow (Xwayland) #12 0x00000000004fde8c damageDestroyWindow (Xwayland) #13 0x00000000004ad8c1 DbeDestroyWindow (Xwayland) #14 0x0000000000584cc7 FreeWindowResources (Xwayland) #15 0x0000000000587f20 DeleteWindow (Xwayland) #16 0x000000000058077d doFreeResource (Xwayland) #17 0x00000000005819bc FreeClientResources (Xwayland) #18 0x000000000055aac3 CloseDownClient (Xwayland) #19 0x000000000055adb6 ProcKillClient (Xwayland) #20 0x000000000055b72e Dispatch (Xwayland) #21 0x000000000055f776 dix_main (Xwayland) #22 0x00007f711f840413 __libc_start_main (libc.so.6) #23 0x000000000042e33e _start (Xwayland) Stack trace of thread 2353: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711e8d6993 n/a (i965_dri.so) #2 0x00007f711e8d66eb n/a (i965_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6) Stack trace of thread 2357: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711cc7b3f3 n/a (swrast_dri.so) #2 0x00007f711cc7b33b n/a (swrast_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6) Stack trace of thread 2355: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711cc7b3f3 n/a (swrast_dri.so) #2 0x00007f711cc7b33b n/a (swrast_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6) Stack trace of thread 2356: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711cc7b3f3 n/a (swrast_dri.so) #2 0x00007f711cc7b33b n/a (swrast_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6) Stack trace of thread 2359: #14 0x0000000000584cc7 FreeWindowResources (Xwayland) #15 0x0000000000587f20 DeleteWindow (Xwayland) #16 0x000000000058077d doFreeResource (Xwayland) #17 0x00000000005819bc FreeClientResources (Xwayland) #18 0x000000000055aac3 CloseDownClient (Xwayland) #19 0x000000000055adb6 ProcKillClient (Xwayland) #20 0x000000000055b72e Dispatch (Xwayland) #21 0x000000000055f776 dix_main (Xwayland) #22 0x00007f711f840413 __libc_start_main (libc.so.6) #23 0x000000000042e33e _start (Xwayland) Stack trace of thread 2353: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711e8d6993 n/a (i965_dri.so) #2 0x00007f711e8d66eb n/a (i965_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6) Stack trace of thread 2357: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711cc7b3f3 n/a (swrast_dri.so) #2 0x00007f711cc7b33b n/a (swrast_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6) Stack trace of thread 2355: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711cc7b3f3 n/a (swrast_dri.so) #2 0x00007f711cc7b33b n/a (swrast_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6) Stack trace of thread 2356: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711cc7b3f3 n/a (swrast_dri.so) #2 0x00007f711cc7b33b n/a (swrast_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6) Stack trace of thread 2359: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711cc7b3f3 n/a (swrast_dri.so) #2 0x00007f711cc7b33b n/a (swrast_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6) Stack trace of thread 2354: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711cc7b3f3 n/a (swrast_dri.so) #2 0x00007f711cc7b33b n/a (swrast_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6) Stack trace of thread 2360: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711cc7b3f3 n/a (swrast_dri.so) #2 0x00007f711cc7b33b n/a (swrast_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6) Stack trace of thread 2361: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711cc7b3f3 n/a (swrast_dri.so) #2 0x00007f711cc7b33b n/a (swrast_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6) Stack trace of thread 2358: #0 0x00007f711f9f067c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007f711cc7b3f3 n/a (swrast_dri.so) #2 0x00007f711cc7b33b n/a (swrast_dri.so) #3 0x00007f711f9ea58e start_thread (libpthread.so.0) #4 0x00007f711f919513 __clone (libc.so.6)
Discussed during the 2018-09-04 blocker review meeting: [1] The decision to delay the classification of this as a blocker and accept this bug as an AcceptedFreezeException was made as we're still worried about this, but don't know how widespread the impact may be. We accept it as a Beta FE issue, and will send out a call for testing before voting on blocker status. [1] https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2018-09-04/f29-blocker-review.2018-09-04-16.01.txt
Yes, even thoygh I cannot reproduce the crash, I got the corruption in valgrind: ==5011== Invalid read of size 8 ==5011== at 0x434184: xwl_present_abort_vblank (xwayland-present.c:378) ==5011== by 0x53785B: present_wnmd_abort_vblank (present_wnmd.c:651) ==5011== by 0x53695A: present_free_window_vblank (present_screen.c:87) ==5011== by 0x53695A: present_destroy_window (present_screen.c:152) ==5011== by 0x42A90D: xwl_destroy_window (xwayland.c:653) ==5011== by 0x584298: compDestroyWindow (compwindow.c:613) ==5011== by 0x53CEE3: damageDestroyWindow (damage.c:1570) ==5011== by 0x4F1BB8: DbeDestroyWindow (dbe.c:1326) ==5011== by 0x46F7F6: FreeWindowResources (window.c:1031) ==5011== by 0x472847: DeleteWindow (window.c:1099) ==5011== by 0x46B54C: doFreeResource (resource.c:880) ==5011== by 0x46C706: FreeClientResources (resource.c:1146) ==5011== by 0x446ADE: CloseDownClient (dispatch.c:3473) ==5011== Address 0x182abde0 is 80 bytes inside a block of size 112 free'd ==5011== at 0x4C2FDAC: free (vg_replace_malloc.c:530) ==5011== by 0x42A937: xwl_destroy_window (xwayland.c:647) ==5011== by 0x584298: compDestroyWindow (compwindow.c:613) ==5011== by 0x53CEE3: damageDestroyWindow (damage.c:1570) ==5011== by 0x4F1BB8: DbeDestroyWindow (dbe.c:1326) ==5011== by 0x46F7F6: FreeWindowResources (window.c:1031) ==5011== by 0x472847: DeleteWindow (window.c:1099) ==5011== by 0x46B54C: doFreeResource (resource.c:880) ==5011== by 0x46C706: FreeClientResources (resource.c:1146) ==5011== by 0x446ADE: CloseDownClient (dispatch.c:3473) ==5011== by 0x446DA5: ProcKillClient (dispatch.c:3279) ==5011== by 0x4476AF: Dispatch (dispatch.c:479) ==5011== Block was alloc'd at ==5011== at 0x4C30B06: calloc (vg_replace_malloc.c:711) ==5011== by 0x433F46: xwl_present_window_get_priv (xwayland-present.c:54) ==5011== by 0x434228: xwl_present_get_crtc (xwayland-present.c:302) ==5011== by 0x539728: proc_present_query_capabilities (present_request.c:227) ==5011== by 0x4476AF: Dispatch (dispatch.c:479) ==5011== by 0x44B5B5: dix_main (main.c:276) ==5011== by 0x75F611A: (below main) (libc-start.c:308) ==5011== ==5011== Invalid read of size 8
Posted https://patchwork.freedesktop.org/patch/247271/ upstream
I made an x86_64 scratch-build of Xorg at http://koji.fedoraproject.org/koji/taskinfo?taskID=29514503 and can confirm that the crash is gone. I'll submit a PR to apply the patch to our Fedora package to include in the Beta immediately.
https://src.fedoraproject.org/rpms/xorg-x11-server/pull-request/1 (Rawhide) https://src.fedoraproject.org/rpms/xorg-x11-server/pull-request/2 (F29)
Okay, I was wrong. I'm still experiencing a crash using Chrome (though the one with closing glxgears is fixed). Might be that they are different crashes. I will try to get another backtrace, but the coredumpctl info for this crash is: PID: 14005 (Xwayland) UID: 13041 (sgallagh) GID: 13041 (sgallagh) Signal: 6 (ABRT) Timestamp: Mon 2018-08-27 08:43:54 EDT (1 weeks 3 days ago) Command Line: /usr/bin/Xwayland :0 -rootless -terminate -accessx -core -listen 4 -listen 5 -displayfd 6 Executable: /usr/bin/Xwayland Control Group: /user.slice/user-13041.slice/session-5.scope Unit: session-5.scope Slice: user-13041.slice Session: 5 Owner UID: 13041 (sgallagh) Boot ID: 2cb931df249d46feb74ca37ae5ecd4b7 Machine ID: 06df243f7c7c435d806086f01e480d63 Hostname: sgallaghp50.sgallagh.rht Storage: /var/lib/systemd/coredump/core.Xwayland.13041.2cb931df249d46feb74ca37ae5ecd4b7.14005.1535373834000000.lz4 (inaccessible) Message: Process 14005 (Xwayland) of user 13041 dumped core. Stack trace of thread 14005: #0 0x00007fbcebdf653f raise (libc.so.6) #1 0x00007fbcebde0895 abort (libc.so.6) #2 0x0000000000594390 OsAbort (Xwayland) #3 0x0000000000599629 AbortServer (Xwayland) #4 0x000000000059a49d FatalError (Xwayland) #5 0x0000000000591695 OsSigHandler (Xwayland) #6 0x00007fbcebf96f70 __restore_rt (libpthread.so.0) #7 0x00000000004f6bfa present_send_complete_notify (Xwayland) #8 0x00000000004f7bf4 present_vblank_notify (Xwayland) #9 0x00000000004f94ac present_wnmd_event_notify (Xwayland) #10 0x0000000000439287 xwl_present_sync_callback (Xwayland) #11 0x00007fbcebd02ace ffi_call_unix64 (libffi.so.6) #12 0x00007fbcebd0248f ffi_call (libffi.so.6) #13 0x00007fbcec4f779d n/a (libwayland-client.so.0) #14 0x00007fbcec4f3f09 n/a (libwayland-client.so.0) #15 0x00007fbcec4f541c wl_display_dispatch_queue_pending (libwayland-client.so.0) #16 0x000000000042ee1b xwl_read_events (Xwayland) #17 0x0000000000592081 ospoll_wait (Xwayland) #18 0x000000000058b953 WaitForSomething (Xwayland) #19 0x000000000055b4e0 Dispatch (Xwayland) #20 0x000000000055f776 dix_main (Xwayland) #21 0x00007fbcebde2413 __libc_start_main (libc.so.6) #22 0x000000000042e33e _start (Xwayland) Stack trace of thread 14012: #0 0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007fbce921d3f3 n/a (swrast_dri.so) #2 0x00007fbce921d33b n/a (swrast_dri.so) #3 0x00007fbcebf8c58e start_thread (libpthread.so.0) #4 0x00007fbcebebb513 __clone (libc.so.6) Stack trace of thread 14011: #0 0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007fbce921d3f3 n/a (swrast_dri.so) #2 0x00007fbce921d33b n/a (swrast_dri.so) #3 0x00007fbcebf8c58e start_thread (libpthread.so.0) #4 0x00007fbcebebb513 __clone (libc.so.6) Stack trace of thread 14014: #0 0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007fbce921d3f3 n/a (swrast_dri.so) #2 0x00007fbce921d33b n/a (swrast_dri.so) #3 0x00007fbcebf8c58e start_thread (libpthread.so.0) #4 0x00007fbcebebb513 __clone (libc.so.6) Stack trace of thread 14009: #0 0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007fbce921d3f3 n/a (swrast_dri.so) #2 0x00007fbce921d33b n/a (swrast_dri.so) #3 0x00007fbcebf8c58e start_thread (libpthread.so.0) #4 0x00007fbcebebb513 __clone (libc.so.6) Stack trace of thread 14007: #0 0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007fbce921d3f3 n/a (swrast_dri.so) #2 0x00007fbce921d33b n/a (swrast_dri.so) #3 0x00007fbcebf8c58e start_thread (libpthread.so.0) #4 0x00007fbcebebb513 __clone (libc.so.6) Stack trace of thread 14006: #0 0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007fbceae78993 n/a (i965_dri.so) #2 0x00007fbceae786eb n/a (i965_dri.so) #3 0x00007fbcebf8c58e start_thread (libpthread.so.0) #4 0x00007fbcebebb513 __clone (libc.so.6) Stack trace of thread 14008: #0 0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007fbce921d3f3 n/a (swrast_dri.so) #2 0x00007fbce921d33b n/a (swrast_dri.so) #3 0x00007fbcebf8c58e start_thread (libpthread.so.0) #4 0x00007fbcebebb513 __clone (libc.so.6) Stack trace of thread 14010: #0 0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007fbce921d3f3 n/a (swrast_dri.so) #2 0x00007fbce921d33b n/a (swrast_dri.so) #3 0x00007fbcebf8c58e start_thread (libpthread.so.0) #4 0x00007fbcebebb513 __clone (libc.so.6) Stack trace of thread 14013: #0 0x00007fbcebf9267c pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0) #1 0x00007fbce921d3f3 n/a (swrast_dri.so) #2 0x00007fbce921d33b n/a (swrast_dri.so) #3 0x00007fbcebf8c58e start_thread (libpthread.so.0) #4 0x00007fbcebebb513 __clone (libc.so.6)
(In reply to Stephen Gallagher from comment #29) > Okay, I was wrong. I'm still experiencing a crash using Chrome (though the > one with closing glxgears is fixed). Might be that they are different > crashes. I will try to get another backtrace, but the coredumpctl info for > this crash is: > [...] It's not the exact same issue, but a corollary... See my post here: https://bugs.freedesktop.org/show_bug.cgi?id=107314#c7 So I ran another scratch build here with both patches applied (plus another one unrelated) https://koji.fedoraproject.org/koji/taskinfo?taskID=29516394 Once it;s complete, can you try that one?
I'm still getting the crash on Chrome (reproducible by the same steps as Comment #15) New backtrace with xorg-x11-server-1.20.1-1.1test.fc29.x86_64: #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 set = {__val = {171516928, 0, 0, 0, 0, 0, 0, 0, 139676191207280, 0, 72, 12188344904638522880, 20659136, 0, 18141872, 18802016}} pid = <optimized out> tid = <optimized out> ret = <optimized out> #1 0x00007f08e5a74895 in __GI_abort () at abort.c:79 save_stage = 1 act = {__sigaction_handler = {sa_handler = 0x13b3bc0, sa_sigaction = 0x13b3bc0}, sa_mask = {__val = {0, 18141872, 18802016, 0, 0, 6091017, 6091024, 2, 9223372036854775822, 0, 0, 0, 67108868, 139676191207280, 12188344904638522880, 0}}, sa_flags = 6031216, sa_restorer = 0x5c0770} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x0000000000594410 in OsAbort () at utils.c:1350 No locals. #3 0x00000000005996a9 in AbortServer () at log.c:877 No locals. #4 0x000000000059a51d in FatalError (f=f@entry=0x5c0770 "Caught signal %d (%s). Server aborting\n") at log.c:1015 args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7ffdd3d82060, reg_save_area = 0x7ffdd3d81f90}} args2 = {{gp_offset = 8, fp_offset = 48, overflow_arg_area = 0x7ffdd3d82060, reg_save_area = 0x7ffdd3d81f90}} beenhere = 1 #5 0x0000000000591715 in OsSigHandler (signo=11, sip=<optimized out>, unused=<optimized out>) at osinit.c:156 unused = <optimized out> sip = <optimized out> signo = 11 #6 <signal handler called> No locals. #7 0x00000000004f6c7a in dixGetPrivate (key=<optimized out>, privates=0xcacacacacacacaea) at ../include/privates.h:121 __PRETTY_FUNCTION__ = "dixGetPrivate" #8 present_window_priv (window=0xcacacacacacacaca) at present_priv.h:240 No locals. #9 present_send_complete_notify (window=0xcacacacacacacaca, kind=kind@entry=0 '\000', mode=mode@entry=1 '\001', serial=3402287818, ust=ust@entry=60265919, msc=3834029160418063685) at present_event.c:153 window_priv = <optimized out> #10 0x00000000004f7c74 in present_vblank_notify (vblank=vblank@entry=0x14e4c40, kind=kind@entry=0 '\000', mode=mode@entry=1 '\001', ust=ust@entry=60265919, crtc_msc=15) at present_vblank.c:35 n = <optimized out> #11 0x00000000004f952c in present_wnmd_flip_notify (crtc_msc=<optimized out>, ust=60265919, vblank=0x14e4c40) at present_wnmd.c:194 window = 0x1473780 window_priv = 0x14816e0 window = <optimized out> window_priv = <optimized out> __PRETTY_FUNCTION__ = "present_wnmd_flip_notify" #12 present_wnmd_event_notify (window=<optimized out>, event_id=<optimized out>, ust=60265919, msc=<optimized out>) at present_wnmd.c:228 window_priv = <optimized out> vblank = 0x14e4c40 __PRETTY_FUNCTION__ = "present_wnmd_event_notify" #13 0x0000000000439298 in xwl_present_sync_callback (data=0x14e50c0, callback=<optimized out>, time=<optimized out>) at xwayland-present.c:291 event = 0x14e50c0 xwl_present_window = 0x1473ca0 #14 0x00007f08e5996ace in ffi_call_unix64 () at ../src/x86/unix64.S:76 No locals. #15 0x00007f08e599648f in ffi_call () at ../src/x86/ffi64.c:525 classes = {X86_64_INTEGERSI_CLASS, 32520, 3860389004, 32520} stack = <optimized out> argp = <optimized out> arg_types = <optimized out> gprcount = <optimized out> ssecount = <optimized out> ngpr = 1 nsse = 0 i = <optimized out> avn = <optimized out> ret_in_memory = <optimized out> reg_args = <optimized out> #16 0x00007f08e618b79d in wl_closure_invoke (closure=0x13d0a50, flags=1, target=<optimized out>, opcode=0, data=<optimized out>) at src/connection.c:996 count = <optimized out> cif = {abi = FFI_UNIX64, nargs = 3, arg_types = 0x7ffdd3d829b0, rtype = 0x7f08e5997180 <ffi_type_void>, bytes = 0, flags = 0} ffi_types = {0x7f08e5997060 <ffi_type_pointer>, 0x7f08e5997060 <ffi_type_pointer>, 0x7f08e59970e0 <ffi_type_uint32>, 0x40, 0x7ffdd3d82a20, 0x7f08e618bec4 <wl_os_recvmsg_cloexec+36>, 0x7f08e59970c0 <ffi_type_sint32>, 0xf0a440, 0x7ffdd3d82a20, 0xf0e490, 0x7ffdd3d82c1c, 0x6337a0 <isItTimeToYield>, 0x0, 0x7f08e618a063 <wl_connection_read+243>, 0x0, 0x0, 0x7ffdd3d82a60, 0x2, 0x7ffdd3d82a80, 0x7f08e618a3db <wl_closure_clear_fds+59>, 0x75, 0xa925b31d38ebe600} ffi_args = {0x7ffdd3d82980, 0x7ffdd3d82988, 0x13d0a68, 0x1, 0xc, 0xf0e340, 0xf0e340, 0x7f08e618b063 <wl_connection_demarshal+259>, 0x13c212c, 0xf0e490, 0x13c2120, 0x13c2050, 0x0, 0x7f08e618a5ed <wl_closure_close_fds+77>, 0x75, 0xa925b31d38ebe600, 0xf104a0, 0x1475ae0, 0xf0e420, 0x1457e60, 0x1457e60, 0x7f08e618db30} implementation = <optimized out> #17 0x00007f08e6187f09 in dispatch_event (display=display@entry=0xf0e340, queue=<optimized out>) at src/wayland-client.c:1427 closure = 0x13d0a50 proxy = 0x1482070 opcode = 0 proxy_destroyed = <optimized out> #18 0x00007f08e618941c in dispatch_queue (queue=0xf0e408, display=0xf0e340) at src/wayland-client.c:1573 count = 4 count = <optimized out> #19 wl_display_dispatch_queue_pending (display=0xf0e340, queue=0xf0e408) at src/wayland-client.c:1815 ret = <optimized out> #20 0x00007f08e6189480 in wl_display_dispatch_pending (display=<optimized out>) at src/wayland-client.c:1878 No locals. #21 0x000000000042ee1b in xwl_read_events (xwl_screen=0xf0a440) at xwayland.c:814 ret = <optimized out> #22 0x0000000000592101 in ospoll_wait (ospoll=0xeff8f0, timeout=<optimized out>) at ospoll.c:651 ev = <optimized out> osfd = <optimized out> revents = <optimized out> xevents = <optimized out> nready = <optimized out> events = {{events = 1, data = {ptr = 0xf1f540, fd = 15856960, u32 = 15856960, u64 = 15856960}}, {events = 0, data = { ptr = 0x7ffdd3d82c50, fd = -740807600, u32 = 3554159696, u64 = 140728157613136}}, {events = 18802016, data = { ptr = 0x61db6000000000, fd = 0, u32 = 0, u64 = 27544278104276992}}, {events = 0, data = {ptr = 0x58fac4 <input_lock+20>, fd = 5831364, u32 = 5831364, u64 = 5831364}}, {events = 6417060, data = {ptr = 0x4791df00000000, fd = 0, u32 = 0, u64 = 20145110310191104}}, {events = 0, data = {ptr = 0x6000000ff, fd = 255, u32 = 255, u64 = 25769804031}}, {events = 432, data = {ptr = 0x60000eb7d, fd = 60285, u32 = 60285, u64 = 25769864061}}, {events = 6, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 693, data = {ptr = 0x16800000000, fd = 0, u32 = 0, u64 = 1546188226560}}, {events = 0, data = { ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = { ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 3, data = {ptr = 0x300, fd = 768, u32 = 768, u64 = 768}}, {events = 0, data = {ptr = 0x40c3cccccccccccd, fd = -858993459, u32 = 3435973837, u64 = 4666798818867334349}}, {events = 0, data = { ptr = 0x40d00000, fd = 1087373312, u32 = 1087373312, u64 = 1087373312}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}} <repeats 23 times>, {events = 16, data = {ptr = 0x10, fd = 16, u32 = 16, u64 = 16}}, {events = 0, data = { ptr = 0x10, fd = 16, u32 = 16, u64 = 16}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}} <repeats 206 times>, { events = 0, data = {ptr = 0xd3d837e000000000, fd = 0, u32 = 0, u64 = 15265012372184498176}}, {events = 32765, data = { ptr = 0x7ffdd3d9bbcc <clock_gettime+476>, fd = -740705332, u32 = 3554261964, u64 = 140728157715404}}, {events = 3554162720, data = {ptr = 0x7ffd, fd = 32765, u32 = 32765, u64 = 32765}}, {events = 1, data = {ptr = 0x1, fd = 1, u32 = 1, u64 = 1}}, { events = 3853796117, data = {ptr = 0x61f86400007f08, fd = 32520, u32 = 32520, u64 = 27576181121384200}}, {events = 0, data = { ptr = 0x7f08e618954b <wl_display_flush+59>, fd = -434596533, u32 = 3860370763, u64 = 139676196836683}}, {events = 15770688, data = {ptr = 0x100000000, fd = 0, u32 = 0, u64 = 4294967296}}, {events = 0, data = {ptr = 0x7ffdd3d83864, fd = -740804508, u32 = 3554162788, u64 = 140728157616228}}, {events = 3838139737, data = {ptr = 0x10b401000007f08, fd = 32520, u32 = 32520, u64 = 75224256245432072}}, {events = 0, data = {ptr = 0x43bd46 <_glamor_block_handler+118>, fd = 4439366, u32 = 4439366, u64 = 4439366}}} i = <optimized out> #23 0x000000000058b9d3 in WaitForSomething (are_ready=0) at WaitFor.c:208 i = <optimized out> timeout = 980 pollerr = <optimized out> were_ready = 0 timer_is_running = 0 #24 0x000000000055b560 in Dispatch () at ../include/list.h:220 result = <optimized out> client = <optimized out> start_tick = <optimized out> #25 0x000000000055f7f6 in dix_main (argc=12, argv=0x7ffdd3d83a48, envp=<optimized out>) at main.c:276 i = <optimized out> alwaysCheckForInput = {0, 1} #26 0x00007f08e5a76413 in __libc_start_main (main=0x42e300 <main>, argc=12, argv=0x7ffdd3d83a48, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffdd3d83a38) at ../csu/libc-start.c:308 self = <optimized out> result = <optimized out> unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 4190540796469081291, 4383504, 140728157616704, 0, 0, -4189353010273291061, -4308254496022301493}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x7ffdd3d83ab0, 0x7f08e6513150}, data = {prev = 0x0, cleanup = 0x0, canceltype = -740803920}}} not_first_call = <optimized out> #27 0x000000000042e33e in _start () at glamor.c:917 No symbol table info available.
Based on comments in the patch I'm +1 beta freeze exception. But unless there are more people affected, -1 beta blocker.
(In reply to Stephen Gallagher from comment #31) > I'm still getting the crash on Chrome (reproducible by the same steps as > Comment #15) > > New backtrace with xorg-x11-server-1.20.1-1.1test.fc29.x86_64: > [...] That's actually a different issue, the backtrace matches https://bugs.freedesktop.org/show_bug.cgi?id=107314 for which a patch was already submitted upstream. Can you try this scratch build, which contains that other fix as well: https://koji.fedoraproject.org/koji/taskinfo?taskID=29594440
(In reply to Olivier Fourdan from comment #33) > Can you try this scratch build, which contains that other fix as well: > > https://koji.fedoraproject.org/koji/taskinfo?taskID=29594440 I can confirm that with this scratch-build, I'm not seeing a crash either with Chrome or glxgears. Can we get this in a formal build, please? Thank you for tracking this down, Olivier!
xorg-x11-server-1.20.1-2.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-4b01c3a7d8
Discussed at 2018-09-10 blocker review meeting: https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2018-09-10/f29-blocker-review.2018-09-10-16.01.html . We agreed that there doesn't seem to be an indication that enough people will hit this often enough to qualify as a blocker, but there are certainly real crashes here that it would be a good idea to fix for Beta, so it is accepted as a freeze exception issue.
coremodule: process note - when we accepted this as an FE before, you added 'AcceptedFreezeException' to the whiteboard but didn't actually mark the bug as blocking BetaFreezeException . you have to do both :)
xorg-x11-server-1.20.1-2.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-4b01c3a7d8
xorg-x11-server-1.20.1-2.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.