Bug 453026

Summary: kwin_wayland crashes when disconnecting monitor
Product: [Plasma] kwin Reporter: Nicolas Fella <nicolas.fella>
Component: wayland-genericAssignee: KWin default assignee <kwin-bugs-null>
Status: RESOLVED FIXED    
Severity: normal CC: nate
Priority: NOR    
Version: git master   
Target Milestone: ---   
Platform: Other   
OS: Linux   
Latest Commit: Version Fixed In: 5.25

Description Nicolas Fella 2022-04-26 00:23:22 UTC
#0  0x00007f3dd901c06e in cmsPipelineUnlinkStage () at /usr/lib/liblcms2.so.2
#1  0x00007f3dda35877b in KWin::ColorTransformation::~ColorTransformation() (this=0x559489de6550, __in_chrg=<optimized out>) at /home/nico/kde/src/kwin/src/colors.cpp:25
#2  0x00007f3dda355a0f in QtSharedPointer::ExternalRefCountWithContiguousData<KWin::ColorTransformation>::deleter(QtSharedPointer::ExternalRefCountData*) (self=0x559489de6540) at /home/nico/kde/usr/include/QtCore/qsharedpointer_impl.h:248
#3  0x00007f3dd150ff13 in QtSharedPointer::ExternalRefCountData::destroy() (this=0x559489de6540) at /home/nico/kde/usr/include/QtCore/qsharedpointer_impl.h:149
#4  0x00007f3dd152f115 in QSharedPointer<KWin::ColorTransformation>::deref(QtSharedPointer::ExternalRefCountData*) (dd=0x559489de6540) at /home/nico/kde/usr/include/QtCore/qsharedpointer_impl.h:458
#5  0x00007f3dd152eca0 in QSharedPointer<KWin::ColorTransformation>::deref() (this=0x5594892a97a0) at /home/nico/kde/usr/include/QtCore/qsharedpointer_impl.h:453
#6  0x00007f3dd152e448 in QSharedPointer<KWin::ColorTransformation>::~QSharedPointer() (this=0x5594892a97a0, __in_chrg=<optimized out>) at /home/nico/kde/usr/include/QtCore/qsharedpointer_impl.h:310
#7  0x00007f3dd154838c in KWin::DrmPipeline::State::~State() (this=0x5594892a9770, __in_chrg=<optimized out>) at /home/nico/kde/src/kwin/src/backends/drm/drm_pipeline.h:92
#8  0x00007f3dd1544bbd in KWin::DrmPipeline::~DrmPipeline() (this=0x5594892a9770, __in_chrg=<optimized out>) at /home/nico/kde/src/kwin/src/backends/drm/drm_pipeline.cpp:44
#9  0x00007f3dd15239b8 in QScopedPointerDeleter<KWin::DrmPipeline>::cleanup(KWin::DrmPipeline*) (pointer=0x5594892a9770) at /home/nico/kde/usr/include/QtCore/qscopedpointer.h:60
#10 0x00007f3dd152264f in QScopedPointer<KWin::DrmPipeline, QScopedPointerDeleter<KWin::DrmPipeline> >::~QScopedPointer() (this=0x5594892a9538, __in_chrg=<optimized out>) at /home/nico/kde/usr/include/QtCore/qscopedpointer.h:107
#11 0x00007f3dd1525116 in KWin::DrmConnector::~DrmConnector() (this=0x5594892a9510, __in_chrg=<optimized out>) at /home/nico/kde/src/kwin/src/backends/drm/drm_object_connector.h:49
#12 0x00007f3dd152513e in KWin::DrmConnector::~DrmConnector() (this=0x5594892a9510, __in_chrg=<optimized out>) at /home/nico/kde/src/kwin/src/backends/drm/drm_object_connector.h:49
#13 0x00007f3dd15342c8 in KWin::DrmGpu::updateOutputs() (this=0x55948901ca70) at /home/nico/kde/src/kwin/src/backends/drm/drm_gpu.cpp:305
#14 0x00007f3dd150b181 in KWin::DrmBackend::updateOutputs() (this=0x5594890087b0) at /home/nico/kde/src/kwin/src/backends/drm/drm_backend.cpp:316
#15 0x00007f3dd150aa46 in KWin::DrmBackend::handleUdevEvent() (this=0x5594890087b0) at /home/nico/kde/src/kwin/src/backends/drm/drm_backend.cpp:258
#16 0x00007f3dd1516894 in QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, void (KWin::DrmBackend::*)()>::call(void (KWin::DrmBackend::*)(), KWin::DrmBackend*, void**)
    (f=(void (KWin::DrmBackend::*)(KWin::DrmBackend * const)) 0x7f3dd150a398 <KWin::DrmBackend::handleUdevEvent()>, o=0x5594890087b0, arg=0x7ffe1d016050) at /home/nico/kde/usr/include/QtCore/qobjectdefs_impl.h:152
#17 0x00007f3dd1515ce4 in QtPrivate::FunctionPointer<void (KWin::DrmBackend::*)()>::call<QtPrivate::List<>, void>(void (KWin::DrmBackend::*)(), KWin::DrmBackend*, void**)
    (f=(void (KWin::DrmBackend::*)(KWin::DrmBackend * const)) 0x7f3dd150a398 <KWin::DrmBackend::handleUdevEvent()>, o=0x5594890087b0, arg=0x7ffe1d016050) at /home/nico/kde/usr/include/QtCore/qobjectdefs_impl.h:185
#18 0x00007f3dd1514a25 in QtPrivate::QSlotObject<void (KWin::DrmBackend::*)(), QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*)
    (which=1, this_=0x55948901c890, r=0x5594890087b0, a=0x7ffe1d016050, ret=0x0) at /home/nico/kde/usr/include/QtCore/qobjectdefs_impl.h:418
#19 0x00007f3dd867b203 in QtPrivate::QSlotObjectBase::call(QObject*, void**) (a=0x7ffe1d016050, r=0x5594890087b0, this=0x55948901c890) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#20 doActivate<false>(QObject*, int, void**) (sender=0x55948901b0c0, signal_index=3, argv=0x7ffe1d016050) at kernel/qobject.cpp:3886
#21 0x00007f3dd86746cf in QMetaObject::activate(QObject*, QMetaObject const*, int, void**)
    (sender=sender@entry=0x55948901b0c0, m=m@entry=0x7f3dd891b120 <QSocketNotifier::staticMetaObject>, local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x7ffe1d016050) at kernel/qobject.cpp:3946
#22 0x00007f3dd867e6ef in QSocketNotifier::activated(QSocketDescriptor, QSocketNotifier::Type, QSocketNotifier::QPrivateSignal) (this=this@entry=0x55948901b0c0, _t1=..., _t2=<optimized out>, _t3=...) at .moc/moc_qsocketnotifier.cpp:178
#23 0x00007f3dd867eeeb in QSocketNotifier::event(QEvent*) (this=0x55948901b0c0, e=0x7ffe1d016170) at kernel/qsocketnotifier.cpp:302
#24 0x00007f3dd71bd69f in QApplicationPrivate::notify_helper(QObject*, QEvent*) (this=<optimized out>, receiver=0x55948901b0c0, e=0x7ffe1d016170) at kernel/qapplication.cpp:3637
#25 0x00007f3dd8644a0a in QCoreApplication::notifyInternal2(QObject*, QEvent*) (receiver=0x55948901b0c0, event=0x7ffe1d016170) at kernel/qcoreapplication.cpp:1064
#26 0x00007f3dd869947b in QEventDispatcherUNIXPrivate::activateSocketNotifiers() (this=0x559488fa27d0) at kernel/qeventdispatcher_unix.cpp:304
#27 0x00007f3dd86998db in QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=<optimized out>, flags=...) at kernel/qeventdispatcher_unix.cpp:511
#28 0x0000559486e309bd in QUnixEventDispatcherQPA::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=<optimized out>, flags=...) at qunixeventdispatcher.cpp:63
#29 0x00007f3dd864340b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (this=this@entry=0x7ffe1d016300, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#30 0x00007f3dd864b6e0 in QCoreApplication::exec() () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#31 0x0000559486d0b4d4 in main(int, char**) (argc=14, argv=0x7ffe1d016758) at /home/nico/kde/src/kwin/src/main_wayland.cpp:657
Comment 1 Zamundaaa 2022-04-26 16:34:13 UTC
Git commit 14e7afcb4ea930839931cfa4aeb1b1b1b9f658b6 by Xaver Hugl.
Committed on 26/04/2022 at 16:20.
Pushed by zamundaaa into branch 'master'.

color management: refactor and move to its own directory

The pipeline stages are also now properly managed, which should prevent
use-after-free errors.

M  +1    -0    CMakeLists.txt
M  +5    -3    src/CMakeLists.txt
M  +0    -1    src/backends/drm/drm_output.h
M  +1    -1    src/backends/drm/drm_pipeline.h
M  +1    -1    src/backends/x11/standalone/x11_output.cpp
R  +11   -44   src/colors/colordevice.cpp [from: src/colordevice.cpp - 083% similarity]
R  +0    -0    src/colors/colordevice.h [from: src/colordevice.h - 100% similarity]
R  +2    -24   src/colors/colorlut.cpp [from: src/colors.cpp - 063% similarity]
C  +1    -14   src/colors/colorlut.h [from: src/colors.h - 067% similarity]
R  +0    -0    src/colors/colormanager.cpp [from: src/colormanager.cpp - 100% similarity]
R  +0    -0    src/colors/colormanager.h [from: src/colormanager.h - 100% similarity]
A  +49   -0    src/colors/colorpipelinestage.cpp     [License: GPL(v2.0+)]
A  +33   -0    src/colors/colorpipelinestage.h     [License: GPL(v2.0+)]
A  +61   -0    src/colors/colortransformation.cpp  *
R  +9    -17   src/colors/colortransformation.h [from: src/colors.h - 056% similarity]

The files marked with a * at the end have a non valid license. Please read: https://community.kde.org/Policies/Licensing_Policy and use the headers which are listed at that page.


https://invent.kde.org/plasma/kwin/commit/14e7afcb4ea930839931cfa4aeb1b1b1b9f658b6