400311 – Wayland session crashes when I click "Copy to clipboard" button in Info Center

Bug 400311 - Wayland session crashes when I click "Copy to clipboard" button in Info Center

Summary: Wayland session crashes when I click "Copy to clipboard" button in Info Center

Status:	RESOLVED FIXED

Alias:	None

Product:	kwin
Classification:	Plasma
Component:	wayland-generic (other bugs)
Version First Reported In:	unspecified
Platform:	Neon Linux

Importance:	NOR crash
Target Milestone:	---
Assignee:	KWin default assignee

URL:
Keywords:

Depends on:
Blocks:

Reported:	2018-10-25 22:37 UTC by Patrick Silva
Modified:	2018-10-29 10:09 UTC (History)
CC List:	1 user (show)

See Also:
Latest Commit:	https://commits.kde.org/kwayland/8fe4a2756cdb6b71d7e7b0d346ad84ffa9051ee9
Version Fixed/Implemented In:
Sentry Crash Report:

Flags:	kde: Wayland+ kde: X11- kde: ReviewRequest+

Attachments
Add an attachment

Note You need to log in before you can comment on or make changes to this bug.

Description Patrick Silva 2018-10-25 22:37:21 UTC

Cannot reproduce all the time, crash occurs randomly.

Thread 1 "kwin_wayland" received signal SIGSEGV, Segmentation fault.
KWayland::Server::DataSourceInterface::d_func (this=0x0) at ./src/server/datasource_interface.cpp:161
161     ./src/server/datasource_interface.cpp: No such file or directory.
(gdb) thread apply all bt

Thread 9 (Thread 5817.5842):
#0  0x00007f178e6999f3 in futex_wait_cancelable (private=<optimized out>, expected=0, 
    futex_word=0x7f178c0bbfb8 <QTWTF::pageheap_memory+57592>) at ../sysdeps/unix/sysv/linux/futex-internal.h:88
#1  __pthread_cond_wait_common (abstime=0x0, mutex=0x7f178c0bbf68 <QTWTF::pageheap_memory+57512>, 
    cond=0x7f178c0bbf90 <QTWTF::pageheap_memory+57552>) at pthread_cond_wait.c:502
#2  __pthread_cond_wait (cond=cond@entry=0x7f178c0bbf90 <QTWTF::pageheap_memory+57552>, 
    mutex=mutex@entry=0x7f178c0bbf68 <QTWTF::pageheap_memory+57512>) at pthread_cond_wait.c:655
#3  0x00007f178bdc6954 in QTWTF::TCMalloc_PageHeap::scavengerThread (this=0x7f178c0adec0 <QTWTF::pageheap_memory>)
    at ../3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:2359
#4  0x00007f178bdc6999 in QTWTF::TCMalloc_PageHeap::runScavengerThread (context=<optimized out>)
    at ../3rdparty/javascriptcore/JavaScriptCore/wtf/FastMalloc.cpp:1464
#5  0x00007f178e6936db in start_thread (arg=0x7f17509e5700) at pthread_create.c:463
#6  0x00007f178c74188f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 8 (Thread 5817.5840):
#0  0x00007f178e6999f3 in futex_wait_cancelable (private=<optimized out>, expected=0, futex_word=0x558aaffb45f0)
    at ../sysdeps/unix/sysv/linux/futex-internal.h:88
#1  __pthread_cond_wait_common (abstime=0x0, mutex=0x558aaffb45a0, cond=0x558aaffb45c8) at pthread_cond_wait.c:502
#2  __pthread_cond_wait (cond=cond@entry=0x558aaffb45c8, mutex=mutex@entry=0x558aaffb45a0) at pthread_cond_wait.c:655
#3  0x00007f178d07294b in QWaitConditionPrivate::wait (time=18446744073709551615, this=0x558aaffb45a0)
    at thread/qwaitcondition_unix.cpp:143
#4  QWaitCondition::wait (this=this@entry=0x558aaffb43e0, mutex=mutex@entry=0x558aaffb43d8, time=time@entry=18446744073709551615)
    at thread/qwaitcondition_unix.cpp:215
#5  0x00007f17521f522b in FileInfoThread::run (this=0x558aaffb43c8) at fileinfothread.cpp:227
#6  0x00007f178d071adb in QThreadPrivate::start (arg=0x558aaffb43c8) at thread/qthread_unix.cpp:367
#7  0x00007f178e6936db in start_thread (arg=0x7f17519e7700) at pthread_create.c:463
#8  0x00007f178c74188f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 7 (Thread 5817.5839):
#0  syscall () at ../sysdeps/unix/sysv/linux/x86_64/syscall.S:38
#1  0x00007f178d065594 in QtLinuxFutex::_q_futex (val3=0, addr2=0x0, val2=0, val=<optimized out>, op=0, addr=<optimized out>)
    at thread/qfutex_p.h:92
#2  QtLinuxFutex::futexWait<QBasicAtomicInteger<unsigned int> > (expectedValue=<optimized out>, futex=...) at thread/qfutex_p.h:107
---Type <return> to continue, or q <return> to quit---
#3  futexSemaphoreTryAcquire_loop<false> (timeout=-1, nn=8589934593, curValue=<optimized out>, u=...) at thread/qsemaphore.cpp:221
#4  futexSemaphoreTryAcquire<false> (timeout=-1, n=n@entry=1, u=...) at thread/qsemaphore.cpp:264
#5  QSemaphore::acquire (this=this@entry=0x558ab007a638, n=n@entry=1) at thread/qsemaphore.cpp:328
#6  0x00007f1775eb099b in QtVirtualKeyboard::HunspellWorker::run (this=0x558ab007a620) at hunspellworker.cpp:293
#7  0x00007f178d071adb in QThreadPrivate::start (arg=0x558ab007a620) at thread/qthread_unix.cpp:367
#8  0x00007f178e6936db in start_thread (arg=0x7f17521e8700) at pthread_create.c:463
#9  0x00007f178c74188f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 6 (Thread 5817.5838):
#0  0x00007f178c734bf9 in __GI___poll (fds=0x7f174c004660, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007f17836c5439 in ?? () from target:/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007f17836c554c in g_main_context_iteration () from target:/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007f178d29751f in QEventDispatcherGlib::processEvents (this=0x7f174c000b20, flags=...) at kernel/qeventdispatcher_glib.cpp:422
#4  0x00007f178d23b7fa in QEventLoop::exec (this=this@entry=0x7f1753e6fd40, flags=..., flags@entry=...) at kernel/qeventloop.cpp:214
#5  0x00007f178d066bba in QThread::exec (this=this@entry=0x558aaff464a0) at thread/qthread.cpp:525
#6  0x00007f17877c04f5 in QQmlThreadPrivate::run (this=0x558aaff464a0) at qml/ftw/qqmlthread.cpp:148
#7  0x00007f178d071adb in QThreadPrivate::start (arg=0x558aaff464a0) at thread/qthread_unix.cpp:367
#8  0x00007f178e6936db in start_thread (arg=0x7f1753e70700) at pthread_create.c:463
#9  0x00007f178c74188f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 5 (Thread 5817.5837):
#0  0x00007f178c734bf9 in __GI___poll (fds=0x7f1754003ce0, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007f17836c5439 in ?? () from target:/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007f17836c554c in g_main_context_iteration () from target:/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007f178d29751f in QEventDispatcherGlib::processEvents (this=0x7f1754000b20, flags=...) at kernel/qeventdispatcher_glib.cpp:422
#4  0x00007f178d23b7fa in QEventLoop::exec (this=this@entry=0x7f17659cad40, flags=..., flags@entry=...) at kernel/qeventloop.cpp:214
#5  0x00007f178d066bba in QThread::exec (this=this@entry=0x558aafe6a220) at thread/qthread.cpp:525
#6  0x00007f17877c04f5 in QQmlThreadPrivate::run (this=0x558aafe6a220) at qml/ftw/qqmlthread.cpp:148
#7  0x00007f178d071adb in QThreadPrivate::start (arg=0x558aafe6a220) at thread/qthread_unix.cpp:367
#8  0x00007f178e6936db in start_thread (arg=0x7f17659cb700) at pthread_create.c:463
#9  0x00007f178c74188f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 4 (Thread 5817.5820):
#0  0x00007f178c734bf9 in __GI___poll (fds=0x7f17600046c0, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
---Type <return> to continue, or q <return> to quit---
#1  0x00007f17836c5439 in ?? () from target:/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007f17836c554c in g_main_context_iteration () from target:/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007f178d29751f in QEventDispatcherGlib::processEvents (this=0x7f1760000b20, flags=...) at kernel/qeventdispatcher_glib.cpp:422
#4  0x00007f178d23b7fa in QEventLoop::exec (this=this@entry=0x7f176f7fdd60, flags=..., flags@entry=...) at kernel/qeventloop.cpp:214
#5  0x00007f178d066bba in QThread::exec (this=<optimized out>) at thread/qthread.cpp:525
#6  0x00007f178d071adb in QThreadPrivate::start (arg=0x558aaf5827a0) at thread/qthread_unix.cpp:367
#7  0x00007f178e6936db in start_thread (arg=0x7f176f7fe700) at pthread_create.c:463
#8  0x00007f178c74188f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 3 (Thread 5817.5819):
#0  0x00007f178c734bf9 in __GI___poll (fds=0x7f1768003ce0, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007f17836c5439 in ?? () from target:/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007f17836c554c in g_main_context_iteration () from target:/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007f178d29751f in QEventDispatcherGlib::processEvents (this=0x7f1768000b20, flags=...) at kernel/qeventdispatcher_glib.cpp:422
#4  0x00007f178d23b7fa in QEventLoop::exec (this=this@entry=0x7f176fffed60, flags=..., flags@entry=...) at kernel/qeventloop.cpp:214
#5  0x00007f178d066bba in QThread::exec (this=<optimized out>) at thread/qthread.cpp:525
#6  0x00007f178d071adb in QThreadPrivate::start (arg=0x558aaf530730) at thread/qthread_unix.cpp:367
#7  0x00007f178e6936db in start_thread (arg=0x7f176ffff700) at pthread_create.c:463
#8  0x00007f178c74188f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Thread 2 (Thread 5817.5818):
#0  0x00007f178c734bf9 in __GI___poll (fds=0x7f1770011e90, nfds=6, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007f17836c5439 in ?? () from target:/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#2  0x00007f17836c554c in g_main_context_iteration () from target:/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#3  0x00007f178d29751f in QEventDispatcherGlib::processEvents (this=0x7f1770000b20, flags=...) at kernel/qeventdispatcher_glib.cpp:422
#4  0x00007f178d23b7fa in QEventLoop::exec (this=this@entry=0x7f177514bd30, flags=..., flags@entry=...) at kernel/qeventloop.cpp:214
#5  0x00007f178d066bba in QThread::exec (
    this=this@entry=0x7f178e68ad60 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at thread/qthread.cpp:525
#6  0x00007f178e412e45 in QDBusConnectionManager::run (
    this=0x7f178e68ad60 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at qdbusconnection.cpp:178
#7  0x00007f178d071adb in QThreadPrivate::start (
    arg=0x7f178e68ad60 <(anonymous namespace)::Q_QGS__q_manager::innerFunction()::holder>) at thread/qthread_unix.cpp:367
#8  0x00007f178e6936db in start_thread (arg=0x7f177514c700) at pthread_create.c:463
#9  0x00007f178c74188f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
---Type <return> to continue, or q <return> to quit---

Thread 1 (Thread 5817.5817):
#0  KWayland::Server::DataSourceInterface::d_func (this=0x0) at ./src/server/datasource_interface.cpp:161
#1  0x00007f178e90c702 in KWayland::Server::DataSourceInterface::requestData (this=<optimized out>, mimeType=..., fd=fd@entry=116)
    at ./src/server/datasource_interface.cpp:130
#2  0x00007f178e90ba95 in KWayland::Server::DataOfferInterface::Private::receive (fd=116, mimeType=..., this=<optimized out>)
    at ./src/server/dataoffer_interface.cpp:72
#3  KWayland::Server::DataOfferInterface::Private::receiveCallback (client=<optimized out>, resource=<optimized out>, 
    mimeType=0x558ab01e40cc "text/uri-list", fd=116) at ./src/server/dataoffer_interface.cpp:67
#4  0x00007f177ecabdae in ffi_call_unix64 () from target:/usr/lib/x86_64-linux-gnu/libffi.so.6
#5  0x00007f177ecab71f in ffi_call () from target:/usr/lib/x86_64-linux-gnu/libffi.so.6
#6  0x00007f17858594bb in ?? () from target:/usr/lib/x86_64-linux-gnu/libwayland-server.so.0
#7  0x00007f1785855cff in ?? () from target:/usr/lib/x86_64-linux-gnu/libwayland-server.so.0
#8  0x00007f1785857692 in wl_event_loop_dispatch () from target:/usr/lib/x86_64-linux-gnu/libwayland-server.so.0
#9  0x00007f178e90d46e in KWayland::Server::Display::Private::dispatch (this=<optimized out>) at ./src/server/display.cpp:142
#10 0x00007f178d26c67f in QtPrivate::QSlotObjectBase::call (a=0x7ffc90a172c0, r=0x558aaf576af0, this=0x558aaf576d10)
    at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:376
#11 QMetaObject::activate (sender=sender@entry=0x558aaf576cf0, signalOffset=<optimized out>, 
    local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x7ffc90a172c0) at kernel/qobject.cpp:3754
#12 0x00007f178d26cc37 in QMetaObject::activate (sender=sender@entry=0x558aaf576cf0, 
    m=m@entry=0x7f178d6c1c60 <QSocketNotifier::staticMetaObject>, local_signal_index=local_signal_index@entry=0, 
    argv=argv@entry=0x7ffc90a172c0) at kernel/qobject.cpp:3633
#13 0x00007f178d278d58 in QSocketNotifier::activated (this=this@entry=0x558aaf576cf0, _t1=<optimized out>, _t2=...)
    at .moc/moc_qsocketnotifier.cpp:136
#14 0x00007f178d279112 in QSocketNotifier::event (this=0x558aaf576cf0, e=0x7ffc90a17530) at kernel/qsocketnotifier.cpp:266
#15 0x00007f178d824e1c in QApplicationPrivate::notify_helper (this=this@entry=0x558aaf5211c0, receiver=receiver@entry=0x558aaf576cf0, 
    e=e@entry=0x7ffc90a17530) at kernel/qapplication.cpp:3727
#16 0x00007f178d82c3ef in QApplication::notify (this=0x7ffc90a17920, receiver=0x558aaf576cf0, e=0x7ffc90a17530)
    at kernel/qapplication.cpp:3486
#17 0x00007f178d23d4d8 in QCoreApplication::notifyInternal2 (receiver=receiver@entry=0x558aaf576cf0, event=event@entry=0x7ffc90a17530)
    at kernel/qcoreapplication.cpp:1048
#18 0x00007f178d2945f8 in QCoreApplication::sendEvent (event=0x7ffc90a17530, receiver=<optimized out>)
    at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:234
#19 QEventDispatcherUNIXPrivate::activateSocketNotifiers (this=this@entry=0x558aaf534cd0) at kernel/qeventdispatcher_unix.cpp:304
---Type <return> to continue, or q <return> to quit---
#20 0x00007f178d294c78 in QEventDispatcherUNIX::processEvents (this=<optimized out>, flags=...)
    at kernel/qeventdispatcher_unix.cpp:509
#21 0x00007f1778108fed in QUnixEventDispatcherQPA::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from target:/usr/lib/x86_64-linux-gnu/qt5/plugins/platforms/KWinQpaPlugin.so
#22 0x00007f178d23b7fa in QEventLoop::exec (this=this@entry=0x7ffc90a176e0, flags=..., flags@entry=...) at kernel/qeventloop.cpp:214
#23 0x00007f178d2449c0 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1336
#24 0x0000558aae53d897 in main (argc=<optimized out>, argv=<optimized out>) at ./main_wayland.cpp:807

Comment 1 Patrick Silva 2018-10-25 22:40:07 UTC

KDE neon Developer Edition
KDE Plasma: 5.14.80
Qt: 5.11.2
KDE Frameworks: 5.52.0

Comment 2 David Edmundson 2018-10-25 23:57:16 UTC

Made a fix that should prevent kwin crashing, though I think kinfocenter is crashing, so we'll probably have a bug to fix there afterwards.

Comment 3 Patrick Silva 2018-10-27 20:42:28 UTC

Same crash on Arch Linux.

Operating System: Arch Linux 
KDE Plasma Version: 5.14.2
Qt Version: 5.12.0 beta3
KDE Frameworks Version: 5.51.0

Thread 1 "kwin_wayland" received signal SIGSEGV, Segmentation fault.
KWayland::Server::DataSourceInterface::d_func (this=0x0)
    at /usr/src/debug/kwayland-5.51.0/src/server/datasource_interface.cpp:161
161	/usr/src/debug/kwayland-5.51.0/src/server/datasource_interface.cpp: Arquivo ou diretório inexistente.
(gdb) set logging on
Copying output to gdb.txt.
(gdb) thread apply all bt

Thread 7 (Thread 525.547):
#0  0x00007fd90b1fbafc in pthread_cond_wait@@GLIBC_2.3.2 () from target:/usr/lib/libpthread.so.0
#1  0x00007fd909f8a25c in ?? () from target:/usr/lib/libQt5Script.so.5
#2  0x00007fd909f8a279 in ?? () from target:/usr/lib/libQt5Script.so.5
#3  0x00007fd90b1f5a9d in start_thread () from target:/usr/lib/libpthread.so.0
#4  0x00007fd90a2eab23 in clone () from target:/usr/lib/libc.so.6

Thread 6 (Thread 525.544):
#0  0x00007fd90a2dfc21 in poll () from target:/usr/lib/libc.so.6
#1  0x00007fd907441ee0 in g_main_context_poll (priority=<optimized out>, n_fds=1, fds=0x7fd8dc003ce0, 
    timeout=<optimized out>, context=0x7fd8dc000bf0) at ../glib/glib/gmain.c:4221
#2  g_main_context_iterate (context=context@entry=0x7fd8dc000bf0, block=block@entry=1, 
    dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:3915
#3  0x00007fd907441fce in g_main_context_iteration (context=0x7fd8dc000bf0, may_block=1)
    at ../glib/glib/gmain.c:3981
#4  0x00007fd90a83e5e9 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from target:/usr/lib/libQt5Core.so.5
#5  0x00007fd90a7e75fc in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) ()
   from target:/usr/lib/libQt5Core.so.5
#6  0x00007fd90a62b5c9 in QThread::exec() () from target:/usr/lib/libQt5Core.so.5
#7  0x00007fd908a74c39 in ?? () from target:/usr/lib/libQt5Qml.so.5
#8  0x00007fd90a62c9cc in ?? () from target:/usr/lib/libQt5Core.so.5
#9  0x00007fd90b1f5a9d in start_thread () from target:/usr/lib/libpthread.so.0
--Type <RET> for more, q to quit, c to continue without paging--c
#10 0x00007fd90a2eab23 in clone () from target:/usr/lib/libc.so.6

Thread 5 (Thread 525.529):
#0  0x00007fd90b1fbafc in pthread_cond_wait@@GLIBC_2.3.2 () from target:/usr/lib/libpthread.so.0
#1  0x00007fd8fd2b61ac in cnd_wait (mtx=0x5607365543b8, cond=0x5607365543e0) at ../mesa-18.2.3/src/../include/c11/threads_posix.h:155
#2  util_queue_thread_func (input=input@entry=0x560736630a10) at ../mesa-18.2.3/src/util/u_queue.c:256
#3  0x00007fd8fd2b5ee8 in impl_thrd_routine (p=<optimized out>) at ../mesa-18.2.3/src/../include/c11/threads_posix.h:87
#4  0x00007fd90b1f5a9d in start_thread () from target:/usr/lib/libpthread.so.0
#5  0x00007fd90a2eab23 in clone () from target:/usr/lib/libc.so.6

Thread 4 (Thread 525.528):
#0  0x00007fd90a2dfc21 in poll () from target:/usr/lib/libc.so.6
#1  0x00007fd907441ee0 in g_main_context_poll (priority=<optimized out>, n_fds=2, fds=0x7fd8f40046c0, timeout=<optimized out>, context=0x7fd8f4000bf0) at ../glib/glib/gmain.c:4221
#2  g_main_context_iterate (context=context@entry=0x7fd8f4000bf0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:3915
#3  0x00007fd907441fce in g_main_context_iteration (context=0x7fd8f4000bf0, may_block=1) at ../glib/glib/gmain.c:3981
#4  0x00007fd90a83e5e9 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from target:/usr/lib/libQt5Core.so.5
#5  0x00007fd90a7e75fc in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from target:/usr/lib/libQt5Core.so.5
#6  0x00007fd90a62b5c9 in QThread::exec() () from target:/usr/lib/libQt5Core.so.5
#7  0x00007fd90a62c9cc in ?? () from target:/usr/lib/libQt5Core.so.5
#8  0x00007fd90b1f5a9d in start_thread () from target:/usr/lib/libpthread.so.0
#9  0x00007fd90a2eab23 in clone () from target:/usr/lib/libc.so.6

Thread 3 (Thread 525.527):
#0  0x00007fd90a2dfc21 in poll () from target:/usr/lib/libc.so.6
#1  0x00007fd907441ee0 in g_main_context_poll (priority=<optimized out>, n_fds=2, fds=0x7fd8f0003ce0, timeout=<optimized out>, context=0x7fd8f0000bf0) at ../glib/glib/gmain.c:4221
#2  g_main_context_iterate (context=context@entry=0x7fd8f0000bf0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:3915
#3  0x00007fd907441fce in g_main_context_iteration (context=0x7fd8f0000bf0, may_block=1) at ../glib/glib/gmain.c:3981
#4  0x00007fd90a83e5e9 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from target:/usr/lib/libQt5Core.so.5
#5  0x00007fd90a7e75fc in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from target:/usr/lib/libQt5Core.so.5
#6  0x00007fd90a62b5c9 in QThread::exec() () from target:/usr/lib/libQt5Core.so.5
#7  0x00007fd90a62c9cc in ?? () from target:/usr/lib/libQt5Core.so.5
#8  0x00007fd90b1f5a9d in start_thread () from target:/usr/lib/libpthread.so.0
#9  0x00007fd90a2eab23 in clone () from target:/usr/lib/libc.so.6

Thread 2 (Thread 525.526):
#0  0x00007fd90a2dfc21 in poll () from target:/usr/lib/libc.so.6
#1  0x00007fd907441ee0 in g_main_context_poll (priority=<optimized out>, n_fds=4, fds=0x7fd8f8015b60, timeout=<optimized out>, context=0x7fd8f8001cb0) at ../glib/glib/gmain.c:4221
#2  g_main_context_iterate (context=context@entry=0x7fd8f8001cb0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:3915
#3  0x00007fd907441fce in g_main_context_iteration (context=0x7fd8f8001cb0, may_block=1) at ../glib/glib/gmain.c:3981
#4  0x00007fd90a83e5e9 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from target:/usr/lib/libQt5Core.so.5
#5  0x00007fd90a7e75fc in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from target:/usr/lib/libQt5Core.so.5
#6  0x00007fd90a62b5c9 in QThread::exec() () from target:/usr/lib/libQt5Core.so.5
#7  0x00007fd90b321ba6 in ?? () from target:/usr/lib/libQt5DBus.so.5
#8  0x00007fd90a62c9cc in ?? () from target:/usr/lib/libQt5Core.so.5
#9  0x00007fd90b1f5a9d in start_thread () from target:/usr/lib/libpthread.so.0
#10 0x00007fd90a2eab23 in clone () from target:/usr/lib/libc.so.6

Thread 1 (Thread 525.525):
#0  KWayland::Server::DataSourceInterface::d_func (this=0x0) at /usr/src/debug/kwayland-5.51.0/src/server/datasource_interface.cpp:161
#1  0x00007fd90b274423 in KWayland::Server::DataSourceInterface::requestData (this=<optimized out>, mimeType=..., fd=fd@entry=119) at /usr/src/debug/kwayland-5.51.0/src/server/datasource_interface.cpp:130
#2  0x00007fd90b27384e in KWayland::Server::DataOfferInterface::Private::receive (fd=119, mimeType=..., this=0x560736f3d260) at /usr/src/debug/kwayland-5.51.0/src/server/dataoffer_interface.cpp:72
#3  KWayland::Server::DataOfferInterface::Private::receiveCallback (client=<optimized out>, resource=<optimized out>, mimeType=0x560736f95fac "text/uri-list", fd=119) at /usr/src/debug/kwayland-5.51.0/src/server/dataoffer_interface.cpp:67
#4  0x00007fd9053691c8 in ffi_call_unix64 () from target:/usr/lib/libffi.so.6
#5  0x00007fd905368c2a in ffi_call () from target:/usr/lib/libffi.so.6
#6  0x00007fd907e476ff in wl_closure_invoke (closure=0x560736f95ed0, flags=2, target=<optimized out>, opcode=1, data=<optimized out>) at src/connection.c:1006
#7  0x00007fd907e440a3 in wl_client_connection_data (fd=<optimized out>, mask=<optimized out>, data=0x560736c385c0) at src/wayland-server.c:420
#8  0x00007fd907e45702 in wl_event_loop_dispatch (loop=0x5607364b4490, timeout=timeout@entry=0) at src/event-loop.c:641
#9  0x00007fd90b27531f in KWayland::Server::Display::Private::dispatch (this=<optimized out>) at /usr/src/debug/kwayland-5.51.0/src/server/display.cpp:142
#10 0x00007fd90a813430 in QMetaObject::activate(QObject*, int, int, void**) () from target:/usr/lib/libQt5Core.so.5
#11 0x00007fd90a81ef3a in QSocketNotifier::activated(int, QSocketNotifier::QPrivateSignal) () from target:/usr/lib/libQt5Core.so.5
#12 0x00007fd90a81f292 in QSocketNotifier::event(QEvent*) () from target:/usr/lib/libQt5Core.so.5
#13 0x00007fd90abf3e34 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from target:/usr/lib/libQt5Widgets.so.5
#14 0x00007fd90abfb671 in QApplication::notify(QObject*, QEvent*) () from target:/usr/lib/libQt5Widgets.so.5
#15 0x00007fd90a7e8969 in QCoreApplication::notifyInternal2(QObject*, QEvent*) () from target:/usr/lib/libQt5Core.so.5
#16 0x00007fd90a83b750 in QEventDispatcherUNIXPrivate::activateSocketNotifiers() () from target:/usr/lib/libQt5Core.so.5
#17 0x00007fd90a83ba59 in QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from target:/usr/lib/libQt5Core.so.5
#18 0x00007fd901034a5e in QUnixEventDispatcherQPA::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from target:/usr/lib/qt/plugins/platforms/KWinQpaPlugin.so
#19 0x00007fd90a7e75fc in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from target:/usr/lib/libQt5Core.so.5
#20 0x00007fd90a7ef906 in QCoreApplication::exec() () from target:/usr/lib/libQt5Core.so.5
#21 0x000056073599ed77 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/kwin-5.14.2/main_wayland.cpp:807

Comment 4 David Edmundson 2018-10-29 10:09:56 UTC

Git commit 8fe4a2756cdb6b71d7e7b0d346ad84ffa9051ee9 by David Edmundson.
Committed on 29/10/2018 at 10:09.
Pushed by davidedmundson into branch 'master'.

Guard data source being deleted before processing dataoffer receive event

Summary:
A data source can disappear at any moment, it's plausible a client could
have requested data whilst the client was alive and we are processing it
afterwards.

The accept and finish callback guard against the source being deleted,
but recieve did not.

Test Plan: Could still copy/paste as before

Reviewers: #kwin, romangg

Reviewed By: #kwin, romangg

Subscribers: kde-frameworks-devel

Tags: #frameworks

Differential Revision: https://phabricator.kde.org/D16431

M  +6    -0    src/server/dataoffer_interface.cpp

https://commits.kde.org/kwayland/8fe4a2756cdb6b71d7e7b0d346ad84ffa9051ee9