Red Hat Bugzilla – Bug 713474
spice server crash on ring_remove ASSERT(item->next != NULL && item->prev != NULL)
Last modified: 2012-03-06 05:22:43 EST
Description of problem:
When spice client connects/reconnects to the server, the red_worker might reach a scenario where it tries to remove from the "current tree" an item that has already been removed and released. Specifically:
1. client is not connected
2. surface's x current tree contains drawable d1
3. client gets connected
4. drawable d2 is being processed. It has the same surface and region as d1.
5. red_current_add_equal is called
(i) red_pipe_add_drawable(d2) is called ==> since the client wasn’t connected before, red_handle_drawable_surfaces_client_synced performs red_current_flush on surface x.
(ii) remove_drawable(d2) is called while d2 is no longer in "current" and has already been released.
(iii) ASSERT(item->next != NULL && item->prev != NULL) occurs in the call
to ring_remove in current_remove_drawable
I encountered the crash while preforming tests on S3/4 support (the patches are not yet committed). The guest was Windows xp.
1) I logged in
2) I started playing a movie with VLC, and then I performed standby.
3) While returning from stand by, I disconnected the client and reconnected it. Then the crash occurred.
However, this bug is not related to S3 and exists since offscreen surfaces were introduced (RHEL 6.1)
Created attachment 504884 [details]
Created attachment 512413 [details]
This version is more efficient since it removes the other_drawable
from the tree before red_handle_drawable_surfaces_client_synced is called.
In this manner, other_drawable won't be unnecessarily rendered if
update_area is called.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.