Bug 253870

Summary:	Close of window during Cover/Flip Switch can cause crash
Product:	[Plasma] kwin	Reporter:	ultr <ultr>
Component:	effects-tabbox	Assignee:	KWin default assignee <kwin-bugs-null>
Status:	RESOLVED FIXED
Severity:	crash	CC:	dkesh, dog0012
Priority:	NOR
Version:	unspecified
Target Milestone:	---
Platform:	Debian unstable
OS:	Linux
Latest Commit:		Version Fixed In:	4.6.3
Sentry Crash Report:

Description ultr 2010-10-11 20:13:10 UTC

Version:           unspecified (using KDE 4.5.1) 
OS:                Linux

Cover Flow switcher makes KWin crash when a window is closed while it is active.

It does not happen every time a window is closed.

Situations when it DOES happen:
- the only open window is closed
- 2 windows open, switcher's active window is closed

Situations when it does NOT happen:
- 2 windows open, switcher's active window stays, the other one is closed
- 3 or more windows, any of them is closed (active or not)

Also, if there is no crash, windows should still reposition themselves after one of them is closed, so that you don't end up with empty spaces.


Reproducible: Always

Steps to Reproduce:
1) Open given number of Konsole windows.
2) Use "sleep 5 && exit" to close one of them.
3) Activate the Cover Flow switcher.
4) Wait for crash.

Comment 1 Martin Flöser 2010-10-11 20:20:39 UTC

I was just able to reproduce also with FlipSwitch. I'll have a look at it. Thanks for the easy way how to trigger a crash (never though of closing konsole programmatically).

Application: KWin (kwin), signal: Segmentation fault
[Current thread is 1 (Thread 0x7f92e1c0a780 (LWP 2384))]

Thread 2 (Thread 0x7f92c2aab710 (LWP 2387)):
#0  0x00007f92deec616c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#1  0x00007f92e12a8954 in ?? () from /usr/lib/libQtScript.so.4
#2  0x00007f92e12a8989 in ?? () from /usr/lib/libQtScript.so.4
#3  0x00007f92deec18ba in start_thread () from /lib/libpthread.so.0
#4  0x00007f92db57b02d in clone () from /lib/libc.so.6
#5  0x0000000000000000 in ?? ()

Thread 1 (Thread 0x7f92e1c0a780 (LWP 2384)):
[KCrash Handler]
#6  0x00007f92c7dc77ee in KWin::FlipSwitchEffect::tabBoxUpdated (this=0x90cfb0) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/effects/flipswitch/flipswitch.cpp:609
#7  0x00007f92e18ec344 in KWin::EffectsHandlerImpl::tabBoxUpdated (this=<value optimized out>) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/effects.cpp:393
#8  0x00007f92e186788c in KWin::TabBox::TabBox::nextPrev (this=0x98eb30, next=<value optimized out>) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/tabbox.cpp:371
#9  0x00007f92e1845658 in KWin::Workspace::removeClient (this=0x87e730, c=0xcdb580) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/workspace.cpp:686
#10 0x00007f92e185494e in KWin::Client::releaseWindow (this=0xcdb580, on_shutdown=false) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/client.cpp:263
#11 0x00007f92e1887e9b in KWin::Client::windowEvent (this=0xcdb580, e=0x7fffeb89bd20) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/events.cpp:655
#12 0x00007f92e18884b8 in KWin::Workspace::workspaceEvent (this=0x87e730, e=0x7fffeb89bd20) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/events.cpp:307
#13 0x00007f92e1863aa8 in KWin::Application::x11EventFilter (this=0x7fffeb89bfa0, e=0x7fffeb89bd20) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/main.cpp:367
#14 0x00007f92de1b6da1 in ?? () from /usr/lib/libQtGui.so.4
#15 0x00007f92de1c6951 in QApplication::x11ProcessEvent(_XEvent*) () from /usr/lib/libQtGui.so.4
#16 0x00007f92de1f3967 in ?? () from /usr/lib/libQtGui.so.4
#17 0x00007f92df253732 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4
#18 0x00007f92df253b1c in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4
#19 0x00007f92df257bbb in QCoreApplication::exec() () from /usr/lib/libQtCore.so.4
#20 0x00007f92e18662de in kdemain (argc=<value optimized out>, argv=<value optimized out>) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/main.cpp:541
#21 0x00007f92db4cac4d in __libc_start_main () from /lib/libc.so.6
#22 0x0000000000400869 in _start ()

Comment 2 Martin Flöser 2010-10-11 20:22:03 UTC

and for coverswitch:


Application: KWin (kwin), signal: Segmentation fault
[Current thread is 1 (Thread 0x7fa0b109c780 (LWP 4456))]

Thread 2 (Thread 0x7fa09b09b710 (LWP 4464)):
#0  0x00007fa0ae35816c in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/libpthread.so.0
#1  0x00007fa0b073a954 in ?? () from /usr/lib/libQtScript.so.4
#2  0x00007fa0b073a989 in ?? () from /usr/lib/libQtScript.so.4
#3  0x00007fa0ae3538ba in start_thread () from /lib/libpthread.so.0
#4  0x00007fa0aaa0d02d in clone () from /lib/libc.so.6
#5  0x0000000000000000 in ?? ()

Thread 1 (Thread 0x7fa0b109c780 (LWP 4456)):
[KCrash Handler]
#6  0x0000000000000abe in ?? ()
#7  0x00007fa0aff31d56 in WindowPaintData (this=0x7fffd1da6260, w=0x1b02630) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/lib/kwineffects.cpp:78
#8  0x00007fa09b32869b in KWin::CoverSwitchEffect::paintFrontWindow (this=0x1d734a0, frontWindow=0x1b02630, width=1920, leftWindows=0, rightWindows=0, reflectedWindow=true)
    at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/effects/coverswitch/coverswitch.cpp:789
#9  0x00007fa09b328d63 in KWin::CoverSwitchEffect::paintScene (this=0x1d734a0, frontWindow=<value optimized out>, leftWindows=..., rightWindows=..., reflectedWindows=<value optimized out>)
    at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/effects/coverswitch/coverswitch.cpp:463
#10 0x00007fa09b329ad5 in KWin::CoverSwitchEffect::paintScreen (this=0x1d734a0, mask=<value optimized out>, region=<value optimized out>, data=<value optimized out>)
    at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/effects/coverswitch/coverswitch.cpp:254
#11 0x00007fa0b0d7cb9e in KWin::EffectsHandlerImpl::paintScreen (this=0x1c61080, mask=32, region=) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/effects.cpp:169
#12 0x00007fa0aff2fbdf in KWin::Effect::paintScreen (this=<value optimized out>, mask=32, region=<value optimized out>, data=...)
    at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/lib/kwineffects.cpp:227
#13 0x00007fa0b0d7cb9e in KWin::EffectsHandlerImpl::paintScreen (this=0x1c61080, mask=32, region=) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/effects.cpp:169
#14 0x00007fa0aff2fbdf in KWin::Effect::paintScreen (this=<value optimized out>, mask=32, region=<value optimized out>, data=...)
    at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/lib/kwineffects.cpp:227
#15 0x00007fa0b0d7cb9e in KWin::EffectsHandlerImpl::paintScreen (this=0x1c61080, mask=32, region=) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/effects.cpp:169
#16 0x00007fa0aff2fbdf in KWin::Effect::paintScreen (this=<value optimized out>, mask=32, region=<value optimized out>, data=...)
    at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/lib/kwineffects.cpp:227
#17 0x00007fa0b0d7cb9e in KWin::EffectsHandlerImpl::paintScreen (this=0x1c61080, mask=32, region=) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/effects.cpp:169
#18 0x00007fa09b31f781 in KWin::ZoomEffect::paintScreen (this=0x1d16570, mask=32, region=) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/effects/zoom/zoom.cpp:341
#19 0x00007fa0b0d7cb9e in KWin::EffectsHandlerImpl::paintScreen (this=0x1c61080, mask=32, region=) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/effects.cpp:169
#20 0x00007fa0b0d5eff5 in KWin::Scene::paintScreen (this=0x1c56ea0, mask=0x7fffd1da6a9c, region=0x7fffd1da6bc0) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/scene.cpp:137
#21 0x00007fa0b0d74240 in KWin::SceneOpenGL::paint (this=0x1c56ea0, damage=<value optimized out>, toplevels=<value optimized out>)
    at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/scene_opengl.cpp:754
#22 0x00007fa0b0d59f97 in KWin::Workspace::performCompositing (this=<value optimized out>) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/composite.cpp:454
#23 0x00007fa0b0cda097 in KWin::Workspace::qt_metacall (this=0x7fa094002ad0, _c=QMetaObject::InvokeMetaMethod, _id=<value optimized out>, _a=0x7fffd1da6d70)
    at /opt/kdebranch/build/KDE/kdebase/workspace/kwin/workspace.moc:603
#24 0x00007fa0ae6fe6d7 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) () from /usr/lib/libQtCore.so.4
#25 0x00007fa0ae6f7d69 in QObject::event(QEvent*) () from /usr/lib/libQtCore.so.4
#26 0x00007fa0ad5d2a8c in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib/libQtGui.so.4
#27 0x00007fa0ad5d862d in QApplication::notify(QObject*, QEvent*) () from /usr/lib/libQtGui.so.4
#28 0x00007fa0af3d1546 in KApplication::notify (this=0x7fffd1da78e0, receiver=0x7fa094002fa0, event=0x7fffd1da74c0) at /opt/kdebranch/src/KDE/kdelibs/kdeui/kernel/kapplication.cpp:310
#29 0x00007fa0ae6e6a0c in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/lib/libQtCore.so.4
#30 0x00007fa0ae715cf2 in ?? () from /usr/lib/libQtCore.so.4
#31 0x00007fa0ae715e2c in QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4
#32 0x00007fa0ad685a2d in ?? () from /usr/lib/libQtGui.so.4
#33 0x00007fa0ae6e5732 in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4
#34 0x00007fa0ae6e5b1c in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/lib/libQtCore.so.4
#35 0x00007fa0ae6e9bbb in QCoreApplication::exec() () from /usr/lib/libQtCore.so.4
#36 0x00007fa0b0cf82de in kdemain (argc=<value optimized out>, argv=<value optimized out>) at /opt/kdebranch/src/KDE/kdebase/workspace/kwin/main.cpp:541
#37 0x00007fa0aa95cc4d in __libc_start_main () from /lib/libc.so.6
#38 0x0000000000400869 in _start ()

Comment 3 Thomas Lübking 2011-03-15 21:31:56 UTC

fix: https://git.reviewboard.kde.org/r/100865/

Comment 4 Thomas Lübking 2011-03-18 21:15:56 UTC

*** Bug 240155 has been marked as a duplicate of this bug. ***

Comment 5 Thomas Lübking 2011-04-04 00:01:07 UTC

Git commit 1f538883559565d2f50bc60a83692348dfca16a2 by Thomas Lübking.
Committed on 04/04/2011 at 00:04.
Pushed by luebking into branch 'master'.

Sanitize special window pointers in flip/coverswitch

CCBUG:253870

M  +2    -0    kwin/effects/coverswitch/coverswitch.cpp     
M  +2    -0    kwin/effects/flipswitch/flipswitch.cpp     

http://commits.kde.org/kde-workspace/1f538883559565d2f50bc60a83692348dfca16a2

Comment 6 Thomas Lübking 2011-04-13 20:40:48 UTC

Git commit ea4db06507244212e04a57e4ef41470919828bfb by Thomas Lübking.
Committed on 15/03/2011 at 21:25.
Pushed by luebking into branch 'KDE/4.6'.

sanitize special window pointers in flip/coverswitch

BUG:253870
FIXED-IN:4.6.3

M  +2    -0    kwin/effects/coverswitch/coverswitch.cpp     
M  +2    -0    kwin/effects/flipswitch/flipswitch.cpp     

http://commits.kde.org/kde-workspace/ea4db06507244212e04a57e4ef41470919828bfb

Comment 7 Thomas Lübking 2011-05-09 02:30:28 UTC

*** Bug 272823 has been marked as a duplicate of this bug. ***