433905 – kwin crashes inKWin::DrmGpu::~DrmGpu() with chrome (wayland support) when creating new window

Bug 433905 - kwin crashes inKWin::DrmGpu::~DrmGpu() with chrome (wayland support) when creating new window

Summary: kwin crashes inKWin::DrmGpu::~DrmGpu() with chrome (wayland support) when cre...

Status:	RESOLVED FIXED

Alias:	None

Product:	kwin
Classification:	Plasma
Component:	wayland-generic (other bugs)
Version First Reported In:	5.21.2
Platform:	Neon Linux

Importance:	NOR normal
Target Milestone:	---
Assignee:	KWin default assignee

URL:
Keywords:

Depends on:
Blocks:

Reported:	2021-03-03 12:03 UTC by Russ Hay
Modified:	2021-04-27 07:58 UTC (History)
CC List:	3 users (show)

See Also:
Latest Commit:
Version Fixed/Implemented In:
Sentry Crash Report:

Attachments
kwin_wayland backtrace (6.51 KB, text/plain) 2021-03-03 12:03 UTC, Russ Hay	Details
backtrace with 'break exit' in gdb (15.13 KB, text/plain) 2021-03-16 16:31 UTC, Russ Hay	Details
View All Add an attachment

Note You need to log in before you can comment on or make changes to this bug.

Description Russ Hay 2021-03-03 12:03:27 UTC

Created attachment 136341 [details]
kwin_wayland backtrace

SUMMARY
using chrome when choosing 'new window' or new incognito window, kwin will crash


STEPS TO REPRODUCE
1. start chrome (brave, chrome, chromium) with ozone support;
e.g. chromium-browser --enable-features=UseOzonePlatform --ozone-platform=wayland 

2. from chrome menu 'new private window' or 'new incognito window' - will crash 70% of the time.


OBSERVED RESULT
kwin crashes

EXPECTED RESULT
a new window opens for chrome

SOFTWARE/OS VERSIONS
Windows: 
macOS: 
Linux/KDE Plasma: Linux russ-surfacepro3 5.10.17-surface #1 SMP Sat Feb 20 23:29:14 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

(available in About System)
KDE Plasma Version: 5.21.2
KDE Frameworks Version: 5.80.0
Qt Version: 5.15.2

ADDITIONAL INFORMATION

backtrace attached

Comment 1 Nate Graham 2021-03-03 18:22:16 UTC

Thread 1 (Thread 0x7f5dcd3768c0 (LWP 67795)):
#0  unlink_chunk (p=p@entry=0x56321fae5220, av=0x7f5dd278ab80 <main_arena>) at malloc.c:1459
#1  0x00007f5dd263900b in _int_free (av=0x7f5dd278ab80 <main_arena>, p=0x56321fae5160, have_lock=<optimised out>) at malloc.c:4342
#2  0x00007f5dcbe25bad in  () at /lib/x86_64-linux-gnu/libgbm.so.1
#3  0x00007f5dcbe9ce79 in KWin::DrmGpu::~DrmGpu() (this=0x56321f97a2b0, __in_chrg=<optimised out>) at ./plugins/platforms/drm/drm_gpu.cpp:89
#4  0x00007f5dcbe9d10d in KWin::DrmGpu::~DrmGpu() (this=0x56321f97a2b0, __in_chrg=<optimised out>) at ./plugins/platforms/drm/drm_gpu.cpp:82
#5  0x00007f5dcbe87c1e in qDeleteAll<KWin::DrmGpu* const*>(KWin::DrmGpu* const*, KWin::DrmGpu* const*) (end=0x56321f9858b0, begin=0x56321f9858a8) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qalgorithms.h:319
#6  qDeleteAll<QVector<KWin::DrmGpu*> >(QVector<KWin::DrmGpu*> const&) (c=...) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qalgorithms.h:328
#7  KWin::DrmBackend::~DrmBackend() (this=0x56321f7d58f0, __in_chrg=<optimised out>) at ./plugins/platforms/drm/drm_backend.cpp:81
#8  0x00007f5dcbe87d7d in KWin::DrmBackend::~DrmBackend() (this=0x56321f7d58f0, __in_chrg=<optimised out>) at ./plugins/platforms/drm/drm_backend.cpp:74
#9  0x00007f5dd41170b1 in QLibraryPrivate::unload(QLibraryPrivate::UnloadFlag) (this=0x56321f7dcd30, flag=QLibraryPrivate::NoUnloadSys) at /usr/include/c++/9/bits/atomic_base.h:413
#10 0x00007f5dd411b31d in QLibraryStore::cleanup() () at plugin/qlibrary.cpp:416
#11 0x00007f5dd411866d in qlibraryCleanup () at plugin/qlibrary.cpp:442
#12 (anonymous namespace)::qlibraryCleanup_dtor_class_::~qlibraryCleanup_dtor_class_() (this=<optimised out>, __in_chrg=<optimised out>) at plugin/qlibrary.cpp:442
#13 0x00007f5dd25e915e in __cxa_finalize (d=0x7f5dd43be9e0) at cxa_finalize.c:83
#14 0x00007f5dd3f1f0e7 in __do_global_dtors_aux () at thread/qthread.cpp:1033
#15 0x00007fffed548800 in  ()

Comment 2 Alois Wohlschlager 2021-03-04 17:45:17 UTC

Perhaps more interesting is why kwin exits in the first place. Can you please execute "break exit" in gdb and check whether you get the same backtrace as me? Ideally with more debug symbols than I have (sorry for that).

Thread 1 "kwin_wayland" hit Breakpoint 1, 0x00007ff75adf7e80 in exit () from /lib64/libc.so.6
(gdb) bt
#0  0x00007ff75adf7e80 in exit () at /lib64/libc.so.6
#1  0x00007ff74e1448b6 in  () at /usr/lib64/dri/i965_dri.so
#2  0x00007ff74e13590c in  () at /usr/lib64/dri/i965_dri.so
#3  0x00007ff74e369579 in  () at /usr/lib64/dri/i965_dri.so
#4  0x00007ff75c0e28b4 in KWin::GLVertexBuffer::endOfFrame() () at /usr/lib64/libkwinglutils.so.13
#5  0x00007ff75454449e in KWin::SceneOpenGL::paint(int, QRegion const&, QList<KWin::Toplevel*> const&, KWin::RenderLoop*) ()
    at /usr/lib64/qt5/plugins/org.kde.kwin.scenes/KWinSceneOpenGL.so
#6  0x00007ff75c34d421 in KWin::Compositor::handleFrameRequested(KWin::RenderLoop*) () at /usr/lib64/libkwin.so.5
#7  0x00007ff75c889946 in QtPrivate::QSlotObjectBase::call(QObject*, void**) (a=0x7ffe18a79fa0, r=0x560cc0a5b190, this=0x560cc0a412c0)
    at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#8  doActivate<false>(QObject*, int, void**) (sender=0x560cc0a2d910, signal_index=5, argv=0x7ffe18a79fa0) at kernel/qobject.cpp:3886
#9  0x00007ff75c311ea2 in KWin::RenderLoop::frameRequested(KWin::RenderLoop*) () at /usr/lib64/libkwin.so.5
#10 0x00007ff75c3d7ce3 in KWin::RenderLoopPrivate::dispatch() () at /usr/lib64/libkwin.so.5
#11 0x00007ff75c889946 in QtPrivate::QSlotObjectBase::call(QObject*, void**) (a=0x7ffe18a7a0d0, r=0x560cc0a2d910, this=0x560cc0a2d930)
    at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#12 doActivate<false>(QObject*, int, void**) (sender=0x560cc0a3ede8, signal_index=3, argv=argv@entry=0x7ffe18a7a0d0) at kernel/qobject.cpp:3886
#13 0x00007ff75c882c60 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**)
    (sender=<optimized out>, m=m@entry=0x7ff75cb37ba0, local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x7ffe18a7a0d0)
    at kernel/qobject.cpp:3946
#14 0x00007ff75c88d85a in QTimer::timeout(QTimer::QPrivateSignal) (this=<optimized out>, _t1=...) at .moc/moc_qtimer.cpp:205
#15 0x00007ff75c87f28f in QObject::event(QEvent*) (this=0x560cc0a3ede8, e=0x7ffe18a7a240) at kernel/qobject.cpp:1336
#16 0x00007ff75b8884ff in QApplicationPrivate::notify_helper(QObject*, QEvent*)
    (this=<optimized out>, receiver=0x560cc0a3ede8, e=0x7ffe18a7a240) at kernel/qapplication.cpp:3632
#17 0x00007ff75c85332a in QCoreApplication::notifyInternal2(QObject*, QEvent*) (receiver=0x560cc0a3ede8, event=0x7ffe18a7a240)
    at kernel/qcoreapplication.cpp:1063
#18 0x00007ff75c8a9c83 in QTimerInfoList::activateTimers() (this=this@entry=0x560cc08df9a8) at kernel/qtimerinfo_unix.cpp:643
#19 0x00007ff75c8a73bc in QEventDispatcherUNIXPrivate::activateTimers() (this=this@entry=0x560cc08df920)
    at kernel/qeventdispatcher_unix.cpp:249
#20 0x00007ff75c8a8117 in QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=<optimized out>, flags=...)
    at kernel/qeventdispatcher_unix.cpp:516
#21 0x0000560cbed0de3d in  ()
#22 0x00007ff75c851ceb in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (this=this@entry=0x7ffe18a7a3e0, flags=..., flags@entry=...)
    at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#23 0x00007ff75c859f60 in QCoreApplication::exec() () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#24 0x0000560cbecbb55c in  ()
#25 0x00007ff75addfb25 in __libc_start_main () at /lib64/libc.so.6
#26 0x0000560cbecbbbae in _start ()

Comment 3 Vlad Zahorodnii 2021-03-05 12:22:28 UTC

@Alois can you please install debug symbols for kwin? but yeah, it's odd that kwin quits when a new chrome window is opened. fwiw, I can't reproduce this bug. I have an amd video card.

Comment 4 Alois Wohlschlager 2021-03-05 13:54:14 UTC

Here you go, with debug symbols for kwin and i965 driver. I have an Intel integrated GPU, and I can reproduce the issue only with i965 driver, not with iris. Distribution is openSUSE Tumbleweed 20210302.

Thread 1 "kwin_wayland" hit Breakpoint 1, 0x00007f55ea7f9e80 in exit () from /lib64/libc.so.6
(gdb) bt
#0  0x00007f55ea7f9e80 in exit () at /lib64/libc.so.6
#1  0x00007f55ddfb08b6 in submit_batch (out_fence_fd=0x0, in_fence_fd=<optimized out>, brw=0x7f55dc095040)
    at ../src/mesa/drivers/dri/i965/intel_batchbuffer.c:845
#2  _intel_batchbuffer_flush_fence(brw_context*, int, int*, char const*, int)
    (brw=0x7f55dc095040, in_fence_fd=<optimized out>, out_fence_fd=0x0, file=<optimized out>, line=<optimized out>)
    at ../src/mesa/drivers/dri/i965/intel_batchbuffer.c:898
#3  0x00007f55ddfa190c in _intel_batchbuffer_flush_fence
    (line=152, file=0x7f55de853b60 "../src/mesa/drivers/dri/i965/brw_sync.c", out_fence_fd=0x0, in_fence_fd=-1, brw=0x7f55dc095040)
    at ../src/mesa/drivers/dri/i965/intel_batchbuffer.c:865
#4  brw_fence_insert_locked(brw_context*, brw_fence*) (brw=0x7f55dc095040, fence=0x55ca23cdadf0) at ../src/mesa/drivers/dri/i965/brw_sync.c:152
#5  0x00007f55de1d5579 in fence_sync(gl_context*, GLenum, GLbitfield) (ctx=0x7f55dc095040, condition=37143, flags=0)
    at ../src/mesa/main/syncobj.c:293
#6  0x00007f55ebae48b4 in KWin::GLVertexBuffer::endOfFrame() (this=0x55ca228a78b0)
    at /usr/src/debug/kwin5-5.21.1-1.1.x86_64/libkwineffects/kwinglutils.cpp:2233
#7  0x00007f55ded1149e in KWin::SceneOpenGL::paint(int, QRegion const&, QList<KWin::Toplevel*> const&, KWin::RenderLoop*)
    (renderLoop=0x55ca223d5a30, toplevels=<optimized out>, damage=<optimized out>, screenId=0, this=0x55ca22936980)
    at /usr/src/debug/kwin5-5.21.1-1.1.x86_64/plugins/scenes/opengl/scene_opengl.cpp:666
#8  KWin::SceneOpenGL::paint(int, QRegion const&, QList<KWin::Toplevel*> const&, KWin::RenderLoop*)
    (this=0x55ca22936980, screenId=0, damage=<optimized out>, toplevels=<optimized out>, renderLoop=0x55ca223d5a30)
    at /usr/src/debug/kwin5-5.21.1-1.1.x86_64/plugins/scenes/opengl/scene_opengl.cpp:605
#9  0x00007f55ebd4f421 in KWin::Compositor::handleFrameRequested(KWin::RenderLoop*) (renderLoop=0x55ca223d5a30, this=<optimized out>)
    at /usr/src/debug/kwin5-5.21.1-1.1.x86_64/composite.cpp:665
#10 KWin::Compositor::handleFrameRequested(KWin::RenderLoop*) (this=<optimized out>, renderLoop=0x55ca223d5a30)
    at /usr/src/debug/kwin5-5.21.1-1.1.x86_64/composite.cpp:589
#11 0x00007f55ec28b946 in QtPrivate::QSlotObjectBase::call(QObject*, void**) (a=0x7ffc192bdc10, r=0x55ca223cf1e0, this=0x55ca222c0350)
    at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#12 doActivate<false>(QObject*, int, void**) (sender=0x55ca223d5a30, signal_index=5, argv=argv@entry=0x7ffc192bdc10) at kernel/qobject.cpp:3886
#13 0x00007f55ec284c60 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**)
    (sender=<optimized out>, m=m@entry=0x7f55ebf68f40 <KWin::RenderLoop::staticMetaObject>, local_signal_index=local_signal_index@entry=2, argv=argv@entry=0x7ffc192bdc10) at kernel/qobject.cpp:3946
#14 0x00007f55ebd13ea2 in KWin::RenderLoop::frameRequested(KWin::RenderLoop*) (this=<optimized out>, _t1=<optimized out>)
    at /usr/src/debug/kwin5-5.21.1-1.1.x86_64/build/kwin_autogen/EWIEGA46WW/moc_renderloop.cpp:193
#15 0x00007f55ebdd9ce3 in KWin::RenderLoopPrivate::dispatch() (this=0x55ca223bb800)
    at /usr/src/debug/kwin5-5.21.1-1.1.x86_64/renderloop.cpp:143
#16 0x00007f55ec28b946 in QtPrivate::QSlotObjectBase::call(QObject*, void**) (a=0x7ffc192bdd40, r=0x55ca223d5a30, this=0x55ca223d5a50)
    at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#17 doActivate<false>(QObject*, int, void**) (sender=0x55ca223bb818, signal_index=3, argv=argv@entry=0x7ffc192bdd40) at kernel/qobject.cpp:3886
#18 0x00007f55ec284c60 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**)
    (sender=<optimized out>, m=m@entry=0x7f55ec539ba0, local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x7ffc192bdd40)
    at kernel/qobject.cpp:3946
#19 0x00007f55ec28f85a in QTimer::timeout(QTimer::QPrivateSignal) (this=<optimized out>, _t1=...) at .moc/moc_qtimer.cpp:205
#20 0x00007f55ec28128f in QObject::event(QEvent*) (this=0x55ca223bb818, e=0x7ffc192bdeb0) at kernel/qobject.cpp:1336
#21 0x00007f55eb28a4ff in QApplicationPrivate::notify_helper(QObject*, QEvent*)
    (this=<optimized out>, receiver=0x55ca223bb818, e=0x7ffc192bdeb0) at kernel/qapplication.cpp:3632
#22 0x00007f55ec25532a in QCoreApplication::notifyInternal2(QObject*, QEvent*) (receiver=0x55ca223bb818, event=0x7ffc192bdeb0)
    at kernel/qcoreapplication.cpp:1063
#23 0x00007f55ec2abc83 in QTimerInfoList::activateTimers() (this=this@entry=0x55ca222779a8) at kernel/qtimerinfo_unix.cpp:643
#24 0x00007f55ec2a93bc in QEventDispatcherUNIXPrivate::activateTimers() (this=this@entry=0x55ca22277920)
    at kernel/qeventdispatcher_unix.cpp:249
#25 0x00007f55ec2aa117 in QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=<optimized out>, flags=...)
    at kernel/qeventdispatcher_unix.cpp:516
#26 0x000055ca21396e3d in QUnixEventDispatcherQPA::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=<optimized out>, flags=...)
    at qunixeventdispatcher.cpp:63
#27 0x00007f55ec253ceb in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (this=this@entry=0x7ffc192be050, flags=..., flags@entry=...)
    at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#28 0x00007f55ec25bf60 in QCoreApplication::exec() () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#29 0x000055ca2134455c in main(int, char**) (argc=<optimized out>, argv=0x7ffc192be290)
    at /usr/src/debug/kwin5-5.21.1-1.1.x86_64/main_wayland.cpp:789

Comment 5 Russ Hay 2021-03-16 16:31:39 UTC

Created attachment 136743 [details]
backtrace with 'break exit' in gdb

Comment 6 Russ Hay 2021-03-16 16:32:52 UTC

I've attached the backtrace with break exit that Alois wanted. Thanks for the offline advice on running it..

Comment 7 Russ Hay 2021-04-27 07:58:37 UTC

Latest updates (KDE NEON) seem to have resolved this. I can no longer reproduce on my system.