Bug 438010 - kwin crashes when clicking on MPV with a pen
Summary: kwin crashes when clicking on MPV with a pen
Status: RESOLVED FIXED
Alias: None
Product: kwin
Classification: Plasma
Component: input (show other bugs)
Version: 5.21.0
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: KWin default assignee
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-06-02 18:33 UTC by Alexander
Modified: 2021-09-26 23:24 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
small video for demonstration (3.35 MB, video/webm)
2021-06-02 18:33 UTC, Alexander
Details
kwin_wayland coredump (2.08 MB, application/octet-stream)
2021-06-07 10:34 UTC, Alexander
Details
fresh kwin 5.22 coredump (36 bytes, text/plain)
2021-06-12 12:32 UTC, Alexander
Details
first bt (7.73 KB, text/plain)
2021-06-15 09:37 UTC, Alexander
Details
second bt (1.74 KB, text/plain)
2021-06-15 09:37 UTC, Alexander
Details
pen input recording (34.25 KB, application/gzip)
2021-09-16 08:03 UTC, Alexander
Details
Backtrace from current git master (13.12 KB, text/plain)
2021-09-24 19:01 UTC, Ash Blake
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander 2021-06-02 18:33:49 UTC
Created attachment 138958 [details]
small video for demonstration

Clicking one of the two buttons on a Wacom pen crashes kwin instead of triggering right/left click action when hovering over MPV window.

Operating System: openSUSE Tumbleweed 20210527
KDE Plasma Version: 5.21.5
KDE Frameworks Version: 5.82.0
Qt Version: 5.15.2
Kernel Version: 5.12.4-2-default
OS Type: 64-bit
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen 7 3700X 8-Core Processor
Memory: 15.6 GiB of RAM
Graphics Processor: AMD Radeon RX 5700
Comment 1 Vlad Zahorodnii 2021-06-07 07:47:39 UTC
Can't reproduce the issue in git master. Can you please install debug symbols for kwin and check coredumps after making kwin crash?
Comment 2 Alexander 2021-06-07 10:34:17 UTC
Created attachment 139071 [details]
kwin_wayland coredump

I didn't manage to crash the entire session.
Comment 3 Alexander 2021-06-12 12:32:25 UTC
Created attachment 139253 [details]
fresh kwin 5.22 coredump
Comment 4 Alexander 2021-06-12 12:34:28 UTC
filename: kwin22.dump.tar.lzma
Comment 5 Vlad Zahorodnii 2021-06-15 06:04:05 UTC
Can you please provide the backtrace in text form? I don't think that I'll be able to get the backtrace from the coredump file as I have a different machine.
Comment 6 Vlad Zahorodnii 2021-06-15 06:05:54 UTC
you would need to run the following command in terminal

    gdb <path to executable> <path to coredump file>

and then run "bt" in gdb
Comment 7 Alexander 2021-06-15 09:37:14 UTC
Created attachment 139334 [details]
first bt

one crash created two core dumps
Comment 8 Alexander 2021-06-15 09:37:54 UTC
Created attachment 139335 [details]
second bt
Comment 9 Alexander 2021-09-16 08:03:17 UTC
Created attachment 141580 [details]
pen input recording

I recorded the input events with "libinput record", with them it should be reproducible everywhere.
two files one for each button
Comment 10 Ash Blake 2021-09-24 19:01:52 UTC
Created attachment 141879 [details]
Backtrace from current git master

I can reproduce this as well, with a Huion tablet.
I don't know how to make GDB show line numbers for functions called via std::bind, so here's the disassembly of the part around frame #1:

   ...
   0x00007f0e976df57f <+95>:	mov    %ebp,%esi
   0x00007f0e976df581 <+97>:	call   0x7f0e97625150 <_ZN14KWaylandServer21TabletToolV2Interface10sendButtonEjb@plt>
=> 0x00007f0e976df586 <+102>:	add    $0x8,%rsp
   0x00007f0e976df58a <+106>:	mov    $0x1,%eax
   0x00007f0e976df58f <+111>:	pop    %rbx
   ...

Looks like this happened in kwin/src/input.cpp:1862
Comment 11 Ash Blake 2021-09-24 19:25:25 UTC
I rebuilt libwayland with debug symbols.

Resource was a null pointer:
#0  wl_resource_post_event (resource=0x0, opcode=17) at ../wayland-1.19.0/src/wayland-server.c:248
Comment 12 Ash Blake 2021-09-24 19:58:43 UTC
I attached GDB to KWin and checked where the null pointer came from in TabletToolV2InterfacePrivate::targetResource().

m_surface was not null, but later resourceMap().value(*client) returned 0x0.
Comment 13 Ash Blake 2021-09-24 21:54:14 UTC
This happened because there was no check if the resource is valid before calling sendButton. 
I created a merge request: https://invent.kde.org/plasma/kwin/-/merge_requests/1461
Comment 14 Ash Blake 2021-09-26 23:23:31 UTC
Git commit 242de4373706324696a9bfe48b1ac9e2f7e2caa2 by Ash Blake.
Committed on 26/09/2021 at 09:02.
Pushed by apol into branch 'master'.

tablet: Check if client is supported before sending tool button

M  +3    -0    src/input.cpp

https://invent.kde.org/plasma/kwin/commit/242de4373706324696a9bfe48b1ac9e2f7e2caa2
Comment 15 Aleix Pol 2021-09-26 23:24:10 UTC
Git commit 73b826a0725d8e82a326f7ce63b247edb302618b by Aleix Pol Gonzalez, on behalf of Ash Blake.
Committed on 26/09/2021 at 23:24.
Pushed by apol into branch 'Plasma/5.23'.

tablet: Check if client is supported before sending tool button


(cherry picked from commit 242de4373706324696a9bfe48b1ac9e2f7e2caa2)

M  +3    -0    src/input.cpp

https://invent.kde.org/plasma/kwin/commit/73b826a0725d8e82a326f7ce63b247edb302618b