Bug 413637

Summary: Crash in EglDmabufBuffer::removeImages
Product: [Plasma] kwin Reporter: Patrick Silva <bugseforuns>
Component: wayland-genericAssignee: KWin default assignee <kwin-bugs-null>
Status: RESOLVED FIXED    
Severity: crash CC: subdiff
Priority: NOR    
Version: 5.17.2   
Target Milestone: ---   
Platform: Arch Linux   
OS: Linux   
Latest Commit: https://commits.kde.org/kwin/e2d5ec606a39e3122d5f2f729b8ab90e0523b286 Version Fixed In: 5.17.4
Sentry Crash Report:

Description Patrick Silva 2019-10-30 16:20:42 UTC 
1. start Wayland session
2. change font hitting setting or apply a global theme in system settings.
At this point Plasma apparently crashes, panel disappears and desktop is replaced with a black background.
But "coredumpctl" indicates no plasma crash and konsole just says
"wl_display@1: error 0: invalid object 839
The Wayland connection experienced a fatal error (Invalid argument)".
Plasma is not automatically restarted after its apparent crash
and I can not restart it manually because krunner does not open when I press alt+f2 or alt+space.
3. press ctrl+alt+del to open the logout screen and click on "Logout" button

OBSERVED RESULT
logout fails and my system gets stuck with a black screen. I need to use the "magic key" to force
reboot. After reboot, "coredumpctl" indicates kwin_wayland crash.

EXPECTED RESULT
kwin_wayland never crashes on logout

SOFTWARE/OS VERSIONS
Operating System: Arch Linux 
KDE Plasma Version: 5.17.2
KDE Frameworks Version: 5.63.0
Qt Version: 5.13.1
Kernel Version: 5.3.7-arch1-2-ARCH


Thread 7 (Thread 22020.22051):
#0  0x00007f9f796d8c45 in pthread_cond_wait@@GLIBC_2.3.2 () from target:/usr/lib/libpthread.so.0
#1  0x00007f9f78385edc in QTWTF::TCMalloc_PageHeap::scavengerThread (this=0x7f9f784763c0 <QTWTF::pageheap_memory>) at /tmp/makepkg/qt5-script-debug/src/qtscript-everywhere-src-5.13.1/src/3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:2359
#2  0x00007f9f78385ef9 in QTWTF::TCMalloc_PageHeap::runScavengerThread (context=<optimized out>) at /tmp/makepkg/qt5-script-debug/src/qtscript-everywhere-src-5.13.1/src/3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:1464
#3  0x00007f9f796d24cf in start_thread () from target:/usr/lib/libpthread.so.0
#4  0x00007f9f786b02d3 in clone () from target:/usr/lib/libc.so.6

Thread 5 (Thread 22020.22026):
#0  0x00007f9f796d8c45 in pthread_cond_wait@@GLIBC_2.3.2 () from target:/usr/lib/libpthread.so.0
#1  0x00007f9f69e3a50c in ?? () from target:/usr/lib/dri/i965_dri.so
#2  0x00007f9f69e3a108 in ?? () from target:/usr/lib/dri/i965_dri.so
[m#3  0x00007f9f796d24cf in start_thread () from target:/usr/lib/libpthread.so.0
#4  0x00007f9f786b02d3 in clone () from target:/usr/lib/libc.so.6

Thread 4 (Thread 22020.22023):
#0  0x00007f9f786a59ef in poll () from target:/usr/lib/libc.so.6
#1  0x00007f9f73fbf170 in ?? () from target:/usr/lib/libglib-2.0.so.0
#2  0x00007f9f73fbf241 in g_main_context_iteration () from target:/usr/lib/libglib-2.0.so.0
#3  0x00007f9f78c76a03 in QEventDispatcherGlib::processEvents (this=0x7f9f5c000b60, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#4  0x00007f9f78c1d4ec in QEventLoop::exec (this=this@entry=0x7f9f6b7fdd20, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:140
#5  0x00007f9f78a4f385 in QThread::exec (this=<optimized out>) at ../../include/QtCore/../../src/corelib/global/qflags.h:120
#6  0x00007f9f78a505b0 in QThreadPrivate::start (arg=0x55686a4ddf40) at thread/qthread_unix.cpp:360
#7  0x00007f9f796d24cf in start_thread () from target:/usr/lib/libpthread.so.0
#8  0x00007f9f786b02d3 in clone () from target:/usr/lib/libc.so.6

Thread 2 (Thread 22020.22021):
#0  0x00007f9f786a59ef in poll () from target:/usr/lib/libc.so.6
#1  0x00007f9f73fbf170 in ?? () from target:/usr/lib/libglib-2.0.so.0
#2  0x00007f9f73fbf241 in g_main_context_iteration () from target:/usr/lib/libglib-2.0.so.0
#3  0x00007f9f78c76a03 in QEventDispatcherGlib::processEvents (this=0x7f9f6c000b60, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#4  0x00007f9f78c1d4ec in QEventLoop::exec (this=this@entry=0x7f9f70e00cf0, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:140
#5  0x00007f9f78a4f385 in QThread::exec (this=this@entry=0x7f9f796c8080 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at ../../include/QtCore/../../src/corelib/global/qflags.h:120
#6  0x00007f9f79644b37 in QDBusConnectionManager::run (this=0x7f9f796c8080 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at qdbusconnection.cpp:178
#7  0x00007f9f78a505b0 in QThreadPrivate::start (arg=0x7f9f796c8080 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at thread/qthread_unix.cpp:360
#8  0x00007f9f796d24cf in start_thread () from target:/usr/lib/libpthread.so.0
#9  0x00007f9f786b02d3 in clone () from target:/usr/lib/libc.so.6

Thread 1 (Thread 22020.22020):
#0  0x00007f9f705d52d3 in std::__atomic_base<int>::load (__m=std::memory_order_relaxed, this=<optimized out>) at /usr/include/c++/9.2.0/bits/atomic_base.h:413
#1  QAtomicOps<int>::load<int> (_q_value=...) at /usr/include/qt/QtCore/qatomic_cxx11.h:227
#2  QBasicAtomicInteger<int>::load (this=<optimized out>) at /usr/include/qt/QtCore/qbasicatomic.h:103
#3  QtPrivate::RefCount::isShared (this=<optimized out>) at /usr/include/qt/QtCore/qrefcount.h:101
#4  QVector<void*>::isDetached (this=0x55686b443170) at /usr/include/qt/QtCore/qvector.h:111
#5  QVector<void*>::detach (this=0x55686b443170) at /usr/include/qt/QtCore/qvector.h:390
#6  QVector<void*>::begin (this=0x55686b443170) at /usr/include/qt/QtCore/qvector.h:210
#7  KWin::EglDmabufBuffer::removeImages (this=0x55686b443140) at /usr/src/debug/kwin-5.17.2/platformsupport/scenes/opengl/egl_dmabuf.cpp:215
#8  0x00007f9f705d55b9 in KWin::EglDmabuf::~EglDmabuf (this=0x55686a4dd040, __in_chrg=<optimized out>) at /usr/src/debug/kwin-5.17.2/platformsupport/scenes/opengl/egl_dmabuf.cpp:400
#9  0x00007f9f705d5679 in KWin::EglDmabuf::~EglDmabuf (this=0x55686a4dd040, __in_chrg=<optimized out>) at /usr/src/debug/kwin-5.17.2/platformsupport/scenes/opengl/egl_dmabuf.cpp:395
#10 0x00007f9f79772aa1 in KWayland::Server::LinuxDmabufUnstableV1Interface::Private::~Private() () from target:/usr/lib/libKF5WaylandServer.so.5
#11 0x00007f9f79772afa in KWayland::Server::LinuxDmabufUnstableV1Interface::Private::~Private() () from target:/usr/lib/libKF5WaylandServer.so.5
#12 0x00007f9f797704a7 in KWayland::Server::Global::~Global() () from target:/usr/lib/libKF5WaylandServer.so.5
#13 0x00007f9f7977335a in KWayland::Server::LinuxDmabufUnstableV1Interface::~LinuxDmabufUnstableV1Interface() () from target:/usr/lib/libKF5WaylandServer.so.5
#14 0x00007f9f78c4ab70 in QtPrivate::QSlotObjectBase::call (a=0x7ffc61954960, r=0x55686a9f5990, this=0x55686a9f5a80) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:394
#15 QMetaObject::activate (sender=0x55686a4cdcd0, signalOffset=<optimized out>, local_signal_index=<optimized out>, argv=<optimized out>) at kernel/qobject.cpp:3789
#16 0x00007f9f7976a76a in KWayland::Server::Display::terminate() () from target:/usr/lib/libKF5WaylandServer.so.5
#17 0x00007f9f7976a7be in KWayland::Server::Display::~Display() () from target:/usr/lib/libKF5WaylandServer.so.5
#18 0x00007f9f79bf0ab1 in KWin::KWinDisplay::~KWinDisplay (this=0x55686a4cdcd0, __in_chrg=<optimized out>) at /usr/include/c++/9.2.0/bits/atomic_base.h:326
#19 KWin::KWinDisplay::~KWinDisplay (this=0x55686a4cdcd0, __in_chrg=<optimized out>) at /usr/src/debug/kwin-5.17.2/wayland_server.cpp:204
#20 0x00007f9f78c4875e in QObjectPrivate::deleteChildren (this=this@entry=0x55686a4d0110) at kernel/qobject.cpp:2019
#21 0x00007f9f78c52ba8 in QObject::~QObject (this=<optimized out>, __in_chrg=<optimized out>) at kernel/qobject.cpp:1032
#22 0x00007f9f79beedaa in KWin::WaylandServer::~WaylandServer (this=0x55686a4d2db0, __in_chrg=<optimized out>) at /usr/src/debug/kwin-5.17.2/wayland_server.cpp:103
#23 0x00007f9f78c4875e in QObjectPrivate::deleteChildren (this=this@entry=0x55686a460a90) at kernel/qobject.cpp:2019
#24 0x00007f9f78c52ba8 in QObject::~QObject (this=<optimized out>, __in_chrg=<optimized out>) at kernel/qobject.cpp:1032
#25 0x00007f9f78c20b90 in QCoreApplication::~QCoreApplication (this=0x7ffc61954e40, __in_chrg=<optimized out>) at ../../include/QtCore/../../src/corelib/tools/qstringlist.h:99
#26 0x00007f9f78ff9f35 in QApplication::~QApplication (this=0x7ffc61954e40, __in_chrg=<optimized out>) at kernel/qapplication.cpp:841
#27 0x0000556868961402 in main (argc=<optimized out>, argv=<optimized out>) at /usr/include/c++/9.2.0/bits/atomic_base.h:326
Detaching from program: target:/usr/bin/kwin_wayland, process 22020
Ending remote debugging.
[Inferior 1 (process 22020) detached]
Comment 1 Roman Gilg 2019-11-27 19:48:01 UTC 
Thanks for the report Patrick. Please try https://phabricator.kde.org/D25577
Comment 2 Patrick Silva 2019-11-27 21:32:09 UTC 
(In reply to Roman Gilg from comment #1)
> Thanks for the report Patrick. Please try https://phabricator.kde.org/D25577

Hi Roman
I have just applied your patch on Neon unstable edition.
Plasma is still crashing after font hinting or global theme to be changed,
but kwin_wayland is not crashing anymore. Logout is successful.
Comment 3 Roman Gilg 2019-11-30 14:46:49 UTC 
Git commit e2d5ec606a39e3122d5f2f729b8ab90e0523b286 by Roman Gilg.
Committed on 30/11/2019 at 14:47.
Pushed by romangilg into branch 'Plasma/5.17'.

Destroy dmabuf implementation on EGL backend going down

Summary:
We leak memory if we do not destroy the dmabuf implementation on EGL backend
going down.

Also this makes sure everything is cleaned up on shutdown.

FIXED-IN: 5.17.4

Test Plan: Compiles, settings change and shutdown ok.

Reviewers: #kwin, davidedmundson

Reviewed By: #kwin, davidedmundson

Subscribers: davidedmundson, kwin

Tags: #kwin

Differential Revision: https://phabricator.kde.org/D25577

M  +1    -1    linux_dmabuf.h
M  +6    -2    platformsupport/scenes/opengl/abstract_egl_backend.cpp
M  +3    -0    platformsupport/scenes/opengl/abstract_egl_backend.h
M  +1    -1    platformsupport/scenes/opengl/egl_dmabuf.h

https://commits.kde.org/kwin/e2d5ec606a39e3122d5f2f729b8ab90e0523b286