| Summary: | Crash in KWin::ScreenCastStream::onStreamAddBuffer() | ||
|---|---|---|---|
| Product: | [Plasma] kwin | Reporter: | Jakob Petsovits <jpetso> |
| Component: | screencasting | Assignee: | KWin default assignee <kwin-bugs-null> |
| Status: | RESOLVED FIXED | ||
| Severity: | crash | CC: | dashonwwIII, nate |
| Priority: | NOR | Keywords: | qt6 |
| Version First Reported In: | git master | ||
| Target Milestone: | --- | ||
| Platform: | Other | ||
| OS: | Linux | ||
| Latest Commit: | https://invent.kde.org/plasma/kwin/-/commit/4ebb21e8c3f259c552df2f1d693988fb564ba74a | Version Fixed/Implemented In: | |
| Sentry Crash Report: | |||
|
Description
Jakob Petsovits
2024-03-15 15:20:37 UTC
Actually I'll leave out the other threads because they're all just waiting for condition variables, polling, and such. Nothing that seems directly related on first glance. It seems I have access to some actual heap data too though: (gdb) frame 9 #9 0x0000716c1ffd0e3b in KWin::ScreenCastStream::onStreamAddBuffer (this=0x5b0c07708e80, buffer=0x5b0c07b7c3b8) at /home/kpetso/src/kde/plasma/kwin/src/plugins/screencast/screencaststream.cpp:234 234 Q_ASSERT(buffer->buffer->n_datas >= uint(dmabufAttribs->planeCount)); (gdb) print buffer->buffer->n_datas $1 = 1 (gdb) print dmabufAttribs->planeCount $2 = 2 Let me know if you're interested in any other data! A possibly relevant merge request was started @ https://invent.kde.org/plasma/kwin/-/merge_requests/5577 A possibly relevant merge request was started @ https://invent.kde.org/plasma/kwin/-/merge_requests/5578 Git commit 81ef5d3500f14c2eb1d39973f0a59bf8da3dd7dc by Vlad Zahorodnii. Committed on 08/04/2024 at 10:39. Pushed by vladz into branch 'Plasma/6.0'. plugins/screencast: Add a n_datas guard There's a crash in the onStreamAddBuffer() function. It's not totally clear why the crash happens when accessing `chunk`. This MR is a blind attempt to confirm that the crash is caused by wrong n_datas value. M +16 -13 src/plugins/screencast/screencaststream.cpp https://invent.kde.org/plasma/kwin/-/commit/81ef5d3500f14c2eb1d39973f0a59bf8da3dd7dc I hit this again. The code changed a bit since last time, but the assertion and n_datas vs. planeCount values are similar. Let's add some extra info from my new stack trace.
(gdb) bt
#0 0x0000716603aab32c in ??? () at /usr/lib/libc.so.6
#1 0x0000716603a5a6c8 in raise () at /usr/lib/libc.so.6
#2 0x0000716603a424b8 in abort () at /usr/lib/libc.so.6
#3 0x000071660408c6ac in ??? () at /usr/lib/libQt6Core.so.6
#4 0x000071660408cebd in QMessageLogger::fatal(char const*, ...) const () at /usr/lib/libQt6Core.so.6
#5 0x000071660408cf1a in qt_assert(char const*, char const*, int) () at /usr/lib/libQt6Core.so.6
#6 0x00007165f7f2ce85 in KWin::DmaBufScreenCastBuffer::create (pwBuffer=0x64d609f57e10, options=...) at /home/kpetso/src/kde/plasma/kwin/src/plugins/screencast/screencastbuffer.cpp:68
#7 0x00007165f7f38496 in KWin::ScreenCastStream::onStreamAddBuffer (this=0x64d6086b5d00, pwBuffer=0x64d609f57e10) at /home/kpetso/src/kde/plasma/kwin/src/plugins/screencast/screencaststream.cpp:218
#8 0x00007165f7f38641 in operator() (__closure=0x0, data=0x64d6086b5d00, buffer=0x64d609f57e10) at /home/kpetso/src/kde/plasma/kwin/src/plugins/screencast/screencaststream.cpp:262
#9 0x00007165f7f38669 in _FUN () at /home/kpetso/src/kde/plasma/kwin/src/plugins/screencast/screencaststream.cpp:263
#10 0x00007165f5ba146b in impl_port_use_buffers (object=0x64d609f579d0, direction=<optimized out>, port_id=<optimized out>, flags=<optimized out>, buffers=<optimized out>, n_buffers=<optimized out>) at ../pipewire/src/pipewire/stream.c:1023
#11 0x00007165f5b98f5b in negotiate_mixer_buffers (n_buffers=3, buffers=0x7ffde3c4fba0, flags=<optimized out>, port=0x64d609d79c90) at ../pipewire/src/pipewire/impl-port.c:1818
#12 pw_impl_port_use_buffers (port=0x64d609d79c90, mix=mix@entry=0x64d60a2fba58, flags=flags@entry=1, buffers=buffers@entry=0x7ffde3c4fba0, n_buffers=n_buffers@entry=3) at ../pipewire/src/pipewire/impl-port.c:1860
#13 0x00007165f5b138e6 in client_node_port_use_buffers (_data=<optimized out>, direction=<optimized out>, port_id=<optimized out>, mix_id=<optimized out>, flags=<optimized out>, n_buffers=<optimized out>, buffers=<optimized out>) at ../pipewire/src/modules/module-client-node/remote-node.c:719
#14 0x00007165f5b22bc7 in client_node_demarshal_port_use_buffers (data=<optimized out>, msg=<optimized out>) at ../pipewire/src/modules/module-client-node/protocol-native.c:572
#15 0x00007165f7ebc162 in process_remote (impl=impl@entry=0x64d6086aaf90) at ../pipewire/src/modules/module-protocol-native.c:1037
#16 0x00007165f7ebc940 in on_remote_data (data=0x64d6086aaf90, fd=51, mask=1) at ../pipewire/src/modules/module-protocol-native.c:1071
#17 0x00007165f7efc646 in loop_iterate (object=0x64d6088f0a88, timeout=<optimized out>) at ../pipewire/spa/plugins/support/loop.c:496
#18 0x00007165f7f27412 in operator() (__closure=0x64d6086f19e0) at /home/kpetso/src/kde/plasma/kwin/src/plugins/screencast/pipewirecore.cpp:67
#19 0x00007165f7f281b7 in QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, KWin::PipeWireCore::init()::<lambda()> >::call(struct {...} &, void **) (f=..., arg=0x7ffde3c50590) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:137
#20 0x00007165f7f28189 in QtPrivate::FunctorCallable<KWin::PipeWireCore::init()::<lambda()> >::call<QtPrivate::List<>, void>(struct {...} &, void *, void **) (f=..., arg=0x7ffde3c50590) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:345
#21 0x00007165f7f28140 in QtPrivate::QCallableObject<KWin::PipeWireCore::init()::<lambda()>, QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase *, QObject *, void **, bool *) (which=1, this_=0x64d6086f19d0, r=0x64d6086c1c80, a=0x7ffde3c50590, ret=0x0) at /usr/include/qt6/QtCore/qobjectdefs_impl.h:555
#22 0x0000716604197679 in ??? () at /usr/lib/libQt6Core.so.6
#23 0x00007166041a05ea in QSocketNotifier::event(QEvent*) () at /usr/lib/libQt6Core.so.6
#24 0x00007166052fbfcb in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib/libQt6Widgets.so.6
#25 0x000071660413db38 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () at /usr/lib/libQt6Core.so.6
#26 0x00007166042ac689 in QEventDispatcherUNIXPrivate::activateSocketNotifiers() () at /usr/lib/libQt6Core.so.6
#27 0x00007166042b262b in QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/libQt6Core.so.6
#28 0x0000716604bc1472 in QUnixEventDispatcherQPA::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/libQt6Gui.so.6
#29 0x0000716604145cce in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/libQt6Core.so.6
#30 0x0000716604141738 in QCoreApplication::exec() () at /usr/lib/libQt6Core.so.6
#31 0x000064d606484830 in main (argc=14, argv=0x7ffde3c50f78) at /home/kpetso/src/kde/plasma/kwin/src/main_wayland.cpp:634
(gdb) frame 6
#6 0x00007165f7f2ce85 in KWin::DmaBufScreenCastBuffer::create (pwBuffer=0x64d609f57e10, options=...) at /home/kpetso/src/kde/plasma/kwin/src/plugins/screencast/screencastbuffer.cpp:68
68 Q_ASSERT(pwBuffer->buffer->n_datas >= uint(attrs->planeCount));
(gdb) print pwBuffer->buffer->n_datas
$1 = 1
(gdb) print attrs->planeCount
$2 = 2
So far, so similar. I'm noticing that the pipewire code locations are also included this time (Arch package: pipewire 1:1.0.5-1).
Pressing on.
(gdb) print *pwBuffer
$3 = {buffer = 0x64d609e0d730, user_data = 0x0, size = 0, requested = 0, time = 0}
(gdb) print *pwBuffer->buffer
$4 = {n_metas = 1, n_datas = 1, metas = 0x64d609e0d748, datas = 0x64d609e0d758}
(gdb) print *pwBuffer->buffer->datas
$5 = {type = 12, flags = 0, fd = -1, mapoffset = 0, maxsize = 0, data = 0xd1c10020, chunk = 0x7165ec3eb008}
(gdb) frame 7
#7 0x00007165f7f38496 in KWin::ScreenCastStream::onStreamAddBuffer (this=0x64d6086b5d00, pwBuffer=0x64d609f57e10) at /home/kpetso/src/kde/plasma/kwin/src/plugins/screencast/screencaststream.cpp:218
218 if (auto dmabuf = DmaBufScreenCastBuffer::create(pwBuffer, GraphicsBufferOptions{
(gdb) print m_dmabufParams
$8 = std::optional = {[contained value] = {planeCount = 2, width = 800, height = 1021, format = 875713089, modifier = 72057594037927940}}
(gdb) print m_videoFormat
$9 = {format = SPA_VIDEO_FORMAT_BGRA, flags = 4, modifier = 72057594037927940, size = {width = 800, height = 1021}, framerate = {num = 0, denom = 1}, max_framerate = {num = 59, denom = 1}, views = 299, interlace_mode = 1048, pixel_aspect_ratio = {num = 1619, denom = 1016}, multiview_mode = 1684, multiview_flags = (SPA_VIDEO_MULTIVIEW_FLAGS_RIGHT_FLIPPED | SPA_VIDEO_MULTIVIEW_FLAGS_RIGHT_FLOPPED | unknown: 0x400), chroma_site = 234, color_range = (SPA_VIDEO_COLOR_RANGE_0_255 | unknown: 0x418), color_matrix = 1684, transfer_function = 1079, color_primaries = SPA_VIDEO_COLOR_PRIMARIES_UNKNOWN}
The coredump will probably stick around for a few more days, I can post more info if you tell me what to look for.
Maybe one more.
(gdb) frame 6
#6 0x00007165f7f2ce85 in KWin::DmaBufScreenCastBuffer::create (pwBuffer=0x64d609f57e10, options=...) at /home/kpetso/src/kde/plasma/kwin/src/plugins/screencast/screencastbuffer.cpp:68
68 Q_ASSERT(pwBuffer->buffer->n_datas >= uint(attrs->planeCount));
(gdb) print *attrs
$11 = {planeCount = 2, width = 800, height = 1021, format = 875713089, modifier = 72057594037927940, fd = {_M_elems = {{m_fd = 274}, {m_fd = 276}, {m_fd = -1}, {m_fd = -1}}}, offset = {_M_elems = {0, 3276800, 0, 0}}, pitch = {_M_elems = {3200, 128, 0, 0}}}
Added a guard in master. The same guard already exists in Plasma/6.0 and it seems like it has "fixed" the crash |