Bug 474080 - Kwin crashed in KWin::ScreenCastStream::createStream
Summary: Kwin crashed in KWin::ScreenCastStream::createStream
Status: RESOLVED WORKSFORME
Alias: None
Product: kwin
Classification: Plasma
Component: screencasting (show other bugs)
Version: 5.27.7
Platform: Other Linux
: NOR crash
Target Milestone: ---
Assignee: KWin default assignee
URL:
Keywords: wayland-only
Depends on:
Blocks:
 
Reported: 2023-09-03 05:36 UTC by Eric Armbruster
Modified: 2024-07-10 03:47 UTC (History)
2 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
bt full (26.42 KB, text/plain)
2023-09-05 18:35 UTC, postix
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Eric Armbruster 2023-09-03 05:36:08 UTC
SUMMARY
#0  spa_list_insert (elem=0x55b81785b1a0, list=0x600000001)
    at ../pipewire/spa/include/spa/utils/list.h:44
Downloading source file /usr/src/debug/pipewire/build/../pipewire/spa/include/spa/utils/list.h
44              elem->next = list->next;                                                     
[Current thread is 1 (Thread 0x7fd95ae6d640 (LWP 1457))]
(gdb) bt
#0  spa_list_insert (elem=0x55b81785b1a0, list=0x600000001) at ../pipewire/spa/include/spa/utils/list.h:44
#1  create_mix (data=data@entry=0x55b81785b038, port=port@entry=0x55b817640780, mix_id=mix_id@entry=4294967295, peer_id=peer_id@entry=4294967295)
    at ../pipewire/src/modules/module-client-node/remote-node.c:189
#2  0x00007fd93208d7d5 in do_node_init (data=0x55b81785b038) at ../pipewire/src/modules/module-client-node/remote-node.c:964
#3  node_export (core=0x55b817805040, object=<optimized out>, do_free=<optimized out>, user_data_size=<optimized out>) at ../pipewire/src/modules/module-client-node/remote-node.c:1250
#4  0x00007fd960563721 in core_event_bound_props (data=0x55b817843260, id=2048, global_id=0, props=0x7fd95f83eac0 <main_arena>) at ../pipewire/src/pipewire/core.c:97
#5  0x91fb643762f94900 in  ()
#6  0x00007ffe97018260 in  ()
#7  0x000055b815f5c340 in  ()
#8  0x00007ffe97018270 in  ()
#9  0x00007ffe97018260 in  ()
#10 0x000055b8169b9eb0 in  ()
#11 0x00007ffe97018248 in  ()
#12 0x0000000000000002 in  ()
#13 0x000055b8149813b5 in KWin::ScreenCastStream::createStream() (this=0x0) at /usr/include/qt/QtCore/qarraydata.h:62
#14 0x000055b814a000c4 in KWin::ScreenCastStream::init() (this=0x55b815f5c340) at /usr/src/debug/kwin/kwin-5.27.7/src/plugins/screencast/screencaststream.cpp:340
#15 KWin::ScreencastManager::integrateStreams(KWaylandServer::ScreencastStreamV1Interface*, KWin::ScreenCastStream*) [clone .isra.0]
    (waylandStream=0x55b8173b90c0, stream=0x55b815f5c340, this=<optimized out>) at /usr/src/debug/kwin/kwin-5.27.7/src/plugins/screencast/screencastmanager.cpp:215
#16 0x00007fd9608d1637 in QtPrivate::QSlotObjectBase::call(QObject*, void**)
    (a=0x7ffe97018c70, r=<optimized out>, this=0x55b8157b3420, this=<optimized out>, r=<optimized out>, a=<optimized out>)
    at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#17 doActivate<false>(QObject*, int, void**) (sender=0x55b8157584b0, signal_index=5, argv=0x7ffe97018c70) at kernel/qobject.cpp:3925
#18 0x00007fd96219b55a in KWaylandServer::ScreencastV1Interface::windowScreencastRequested(KWaylandServer::ScreencastStreamV1Interface*, QString const&, KWaylandServer::ScreencastV1Interface::CursorMode) (this=<optimized out>, _t1=<optimized out>, _t2=<optimized out>, _t3=<optimized out>)
    at /usr/src/debug/kwin/build/src/kwin_autogen/IEXH3JLKNG/moc_screencast_v1_interface.cpp:349
#19 0x00007fd962468b16 in QtWaylandServer::zkde_screencast_unstable_v1::handle_stream_window(wl_client*, wl_resource*, unsigned int, char const*, unsigned int)
    (client=<optimized out>, resource=<optimized out>, stream=35, window_uuid=0x55b817821970 "{060e3038-c1b5-4131-ba85-d0f57096b645}", pointer=1)
    at /usr/src/debug/kwin/build/src/wayland/qwayland-server-zkde-screencast-unstable-v1.cpp:262
#20 0x00007fd95dd644f6 in ffi_call_unix64 () at ../src/x86/unix64.S:104
#21 0x00007fd95dd60f5e in ffi_call_int (cif=cif@entry=0x7ffe97018ec0, fn=<optimized out>, rvalue=<optimized out>, avalue=<optimized out>, closure=closure@entry=0x0)
    at ../src/x86/ffi64.c:673
#22 0x00007fd95dd63b73 in ffi_call (cif=cif@entry=0x7ffe97018ec0, fn=<optimized out>, rvalue=rvalue@entry=0x0, avalue=avalue@entry=0x7ffe97018f90) at ../src/x86/ffi64.c:710
#23 0x00007fd95f32aada in wl_closure_invoke (closure=closure@entry=0x55b817821890, target=<optimized out>, target@entry=0x55b8178290f0, opcode=opcode@entry=1, data=<optimized out>, 
    data@entry=0x55b8165d2fc0, flags=2) at ../wayland-1.22.0/src/connection.c:1025
#24 0x00007fd95f32f180 in wl_client_connection_data (fd=<optimized out>, mask=<optimized out>, data=<optimized out>) at ../wayland-1.22.0/src/wayland-server.c:438
#25 0x00007fd95f32dae2 in wl_event_loop_dispatch (loop=0x55b8152cd230, timeout=<optimized out>) at ../wayland-1.22.0/src/event-loop.c:1027
#26 0x00007fd9623c55c7 in KWaylandServer::Display::dispatchEvents() (this=<optimized out>) at /usr/src/debug/kwin/kwin-5.27.7/src/wayland/display.cpp:114
#27 0x00007fd9608d1637 in QtPrivate::QSlotObjectBase::call(QObject*, void**)
    (a=0x7ffe97019590, r=<optimized out>, this=0x55b8156d3cc0, this=<optimized out>, r=<optimized out>, a=<optimized out>)
    at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#28 doActivate<false>(QObject*, int, void**) (sender=0x55b8158334f0, signal_index=3, argv=0x7ffe97019590) at kernel/qobject.cpp:3925
#29 0x00007fd9608d2e34 in QSocketNotifier::activated(QSocketDescriptor, QSocketNotifier::Type, QSocketNotifier::QPrivateSignal)
    (this=this@entry=0x55b8158334f0, _t1=..., _t2=<optimized out>, _t3=...) at .moc/moc_qsocketnotifier.cpp:178
#30 0x00007fd9608d2f78 in QSocketNotifier::event(QEvent*) (this=0x55b8158334f0, e=<optimized out>) at kernel/qsocketnotifier.cpp:302
--Type <RET> for more, q to quit, c to continue without paging--c
#31 0x00007fd95ff7893f in QApplicationPrivate::notify_helper(QObject*, QEvent*) (this=<optimized out>, receiver=0x55b8158334f0, e=0x7ffe970196b0) at kernel/qapplication.cpp:3640
#32 0x00007fd96089c6f8 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (receiver=0x55b8158334f0, event=0x7ffe970196b0) at kernel/qcoreapplication.cpp:1064
#33 0x00007fd9608ea0dc in QEventDispatcherUNIXPrivate::activateSocketNotifiers() (this=this@entry=0x55b8152990c0) at kernel/qeventdispatcher_unix.cpp:304
#34 0x00007fd9608eb2a9 in QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=<optimized out>, flags=...) at kernel/qeventdispatcher_unix.cpp:511
#35 0x000055b814a35ba2 in QUnixEventDispatcherQPA::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
#36 0x00007fd96089b404 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (this=this@entry=0x7ffe97019840, flags=..., flags@entry=...)
    at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#37 0x00007fd96089c8a3 in QCoreApplication::exec() () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#38 0x00007fd960d3bef2 in QGuiApplication::exec() () at kernel/qguiapplication.cpp:1870
#39 0x00007fd95ff76cda in QApplication::exec() () at kernel/qapplication.cpp:2832
#40 0x000055b8149512fb in main(int, char**) (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/kwin/kwin-5.27.7/src/main_wayland.cpp:628


STEPS TO REPRODUCE
1. I clicked on an icon in the task manager IIRC
2. Not reproducible so far.

OBSERVED RESULT
Crash

EXPECTED RESULT
No Crash

SOFTWARE/OS VERSIONS
Operating System: Arch Linux 
KDE Plasma Version: 5.27.7
KDE Frameworks Version: 5.109.0
Qt Version: 5.15.10
Kernel Version: 6.4.12-arch1-1 (64-bit)
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen 7 5700U with Radeon Graphics
Memory: 38.0 GiB of RAM
Graphics Processor: AMD Radeon Graphics
Manufacturer: LENOVO
Product Name: 20Y7CTO1WW
System Version: ThinkPad E14 Gen 3

ADDITIONAL INFORMATION
pipewire 0.3.79-1

Not sure if the problem is in kwin or pipewire
Comment 1 postix 2023-09-05 18:35:58 UTC
Created attachment 161420 [details]
bt full

```
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
#1  0x00007fb1434d2d8d in spa_pod_builder_string (str=0x19000000cd <error: Cannot access memory at address 0x19000000cd>, builder=<optimized out>) at ../spa/include/spa/pod/builder.h:286
#2  push_item (item=0x5624df47e250, b=<optimized out>) at ../src/modules/module-client-node/protocol-native.c:29
#3  client_node_marshal_port_update (object=0x5624df29a7c0, direction=<optimized out>, port_id=<optimized out>, change_mask=<optimized out>, n_params=<optimized out>,
    params=<optimized out>, info=0x7ffe881fe640) at ../src/modules/module-client-node/protocol-native.c:269
#4  0x00007fb1434e1fb6 in add_port_update.isra.0 (data=<optimized out>, port=0x5624df47e170, change_mask=<optimized out>) at ../src/modules/module-client-node/remote-node.c:353
#5  0x00007fb1434c9620 in do_node_init (data=0x5624df29a838) at ../src/modules/module-client-node/remote-node.c:967
#6  node_export (core=<optimized out>, object=<optimized out>, do_free=<optimized out>, user_data_size=<optimized out>) at ../src/modules/module-client-node/remote-node.c:1250
#7  0x00007fb18ed67a69 in core_event_bound_props (data=0x5624df47dc10, id=0, global_id=3741685968, props=0x7fb18edc2259) at ../src/pipewire/map.h:197
#8  0x00007fb18edacf2e in pw_stream_connect (stream=0x7fb18edc2259, direction=SPA_DIRECTION_INPUT, target_id=<optimized out>, flags=<optimized out>, params=<optimized out>,
    n_params=<optimized out>) at ../src/pipewire/stream.c:2040
#9  0x00005624dc5cd4d6 in KWin::ScreenCastStream::createStream (this=0x5624df3f25d0) at /usr/include/qt5/QtCore/qarraydata.h:62
#10 0x00005624dc64d930 in KWin::ScreenCastStream::init (this=0x5624df3f25d0) at /usr/src/debug/kwin-5.27.7-1.fc38.x86_64/src/plugins/screencast/screencaststream.cpp:340
#11 KWin::ScreencastManager::integrateStreams(KWaylandServer::ScreencastStreamV1Interface*, KWin::ScreenCastStream*) [clone .isra.0] (waylandStream=0x5624df5246f0, stream=0x5624df3f25d0,
    this=<optimized out>) at /usr/src/debug/kwin-5.27.7-1.fc38.x86_64/src/plugins/screencast/screencastmanager.cpp:215
#12 0x00007fb18f8e8481 in QtPrivate::QSlotObjectBase::call (a=0x7ffe88200280, r=<optimized out>, this=0x5624dddd5180)
    at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#13 doActivate<false> (sender=0x5624dd8341b0, signal_index=5, argv=0x7ffe88200280) at kernel/qobject.cpp:3925
#14 0x00007fb18f8e33a7 in QMetaObject::activate (sender=<optimized out>, m=m@entry=0x7fb1915f8d00 <KWaylandServer::ScreencastV1Interface::staticMetaObject>,
    local_signal_index=local_signal_index@entry=2, argv=argv@entry=0x7ffe88200280) at kernel/qobject.cpp:3985
#15 0x00007fb1911d0533 in KWaylandServer::ScreencastV1Interface::windowScreencastRequested (this=<optimized out>, _t1=<optimized out>, _t2=..., _t3=<optimized out>)
    at /usr/src/debug/kwin-5.27.7-1.fc38.x86_64/redhat-linux-build/src/kwin_autogen/IEXH3JLKNG/moc_screencast_v1_interface.cpp:349
#16 0x00007fb1914a0844 in QtWaylandServer::zkde_screencast_unstable_v1::handle_stream_window (client=<optimized out>, resource=<optimized out>, stream=211,
    window_uuid=0x5624df3e5b80 "{dbffcdd6-91c8-484e-84d4-f9acd8b725bc}", pointer=1)
    at /usr/src/debug/kwin-5.27.7-1.fc38.x86_64/redhat-linux-build/src/wayland/qwayland-server-zkde-screencast-unstable-v1.cpp:262
#17 0x00007fb18cb1ebe6 in ffi_call_unix64 () at ../src/x86/unix64.S:104
#18 0x00007fb18cb1b4bf in ffi_call_int (cif=cif@entry=0x7ffe882004e0, fn=<optimized out>, rvalue=<optimized out>, avalue=<optimized out>, closure=closure@entry=0x0)
    at ../src/x86/ffi64.c:673
#19 0x00007fb18cb1e18e in ffi_call (cif=cif@entry=0x7ffe882004e0, fn=<optimized out>, rvalue=rvalue@entry=0x0, avalue=avalue@entry=0x7ffe882005b0) at ../src/x86/ffi64.c:710
#20 0x00007fb18e10c843 in wl_closure_invoke (closure=closure@entry=0x5624df3e5aa0, target=<optimized out>, target@entry=0x5624ded45920, opcode=opcode@entry=1, data=<optimized out>,
    data@entry=0x5624de9cef00, flags=2) at ../src/connection.c:1025
#21 0x00007fb18e1110b4 in wl_client_connection_data (fd=<optimized out>, mask=<optimized out>, data=0x5624de9cef00) at ../src/wayland-server.c:438
#22 0x00007fb18e10f8e2 in wl_event_loop_dispatch (loop=0x5624dd8573a0, timeout=<optimized out>) at ../src/event-loop.c:1027
#23 0x00007fb1913f9329 in KWaylandServer::Display::dispatchEvents (this=<optimized out>) at /usr/src/debug/kwin-5.27.7-1.fc38.x86_64/src/wayland/display.cpp:114
#24 0x00007fb18f8e8481 in QtPrivate::QSlotObjectBase::call (a=0x7ffe88200be0, r=<optimized out>, this=0x5624ddef1440)
    at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#25 doActivate<false> (sender=0x5624ddd2f940, signal_index=3, argv=0x7ffe88200be0) at kernel/qobject.cpp:3925
#26 0x00007fb18f8e33a7 in QMetaObject::activate (sender=sender@entry=0x5624ddd2f940, m=m@entry=0x7fb18fb66420 <QSocketNotifier::staticMetaObject>,
    local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x7ffe88200be0) at kernel/qobject.cpp:3985
#27 0x00007fb18f8eae8d in QSocketNotifier::activated (this=this@entry=0x5624ddd2f940, _t1=..., _t2=<optimized out>, _t3=...) at .moc/moc_qsocketnotifier.cpp:178
#28 0x00007fb18f8eb6fb in QSocketNotifier::event (this=0x5624ddd2f940, e=<optimized out>) at kernel/qsocketnotifier.cpp:302
#29 0x00007fb18efaeb75 in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x5624ddd2f940, e=0x7ffe88200cf0) at kernel/qapplication.cpp:3640
--Type <RET> for more, q to quit, c to continue without paging--c
#30 0x00007fb18f8b41a8 in QCoreApplication::notifyInternal2 (receiver=0x5624ddd2f940, event=0x7ffe88200cf0) at kernel/qcoreapplication.cpp:1064
#31 0x00007fb18f8b43c2 in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>) at kernel/qcoreapplication.cpp:1462
#32 0x00007fb18f9037ff in QEventDispatcherUNIXPrivate::activateSocketNotifiers (this=this@entry=0x5624dd8206c0) at kernel/qeventdispatcher_unix.cpp:304
#33 0x00007fb18f903b80 in QEventDispatcherUNIX::processEvents (this=<optimized out>, flags=...) at kernel/qeventdispatcher_unix.cpp:511
#34 0x00005624dc683802 in QUnixEventDispatcherQPA::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
#35 0x00007fb18f8b2b6b in QEventLoop::exec (this=this@entry=0x7ffe88200e90, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#36 0x00007fb18f8badfb in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#37 0x00007fb18fd60e9d in QGuiApplication::exec () at kernel/qguiapplication.cpp:1863
#38 0x00007fb18efaeae9 in QApplication::exec () at kernel/qapplication.cpp:2832
#39 0x00005624dc59ce44 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/kwin-5.27.7-1.fc38.x86_64/src/main_wayland.cpp:628
```

SYSTEM
Operating System: Fedora 38
KDE Plasma Version: 5.27.7
KDE Frameworks Version: 5.109.0
Qt Version: 5.15.10
Kernel Version: 6.4.12-200.fc38.x86_64 (64-bit)
Graphics Platform: Wayland
Processors: AMD Ryzen 7 PRO 5850U with Radeon Graphics
Pipewire 0.3.79
Comment 2 postix 2023-09-05 18:39:04 UTC
From the full bt: pipewire `error: Cannot access memory at address 0xcd`:

```
#8  0x00007fb18edacf2e in pw_stream_connect (stream=0x7fb18edc2259, direction=SPA_DIRECTION_INPUT, target_id=<optimized out>, flags=<optimized out>, params=<optimized out>,
    n_params=<optimized out>) at ../src/pipewire/stream.c:2040
        impl = <optimized out>
        factory = <optimized out>
        props = 0x0
        str = 0xcd <error: Cannot access memory at address 0xcd>
        match = {stream = 0x5624df373a60, count = 0}
        i = <optimized out>
        res = <optimized out>
        __func__ = "stener\000\000\000\000\000\000\000\000\000\000pw"
#9  0x00005624dc5cd4d6 in KWin::ScreenCastStream::createStream (this=0x5624df3f25d0) at /usr/include/qt5/QtCore/qarraydata.h:62
        objname = {d = 0x5624de78f270}
        format = <optimized out>
        drmFormat = <optimized out>
        buffer = "8\001\000\000\017\000\000\000\003\000\004\000\003\000\000\000\001\000\000\000\000\000\000\000\004\000\000\000\003\000\000\000\002\000\000\000\000\000\000\000\002\000\000\000\000\000\000\000\004\000\000\000\003\000\000\000\001\000\000\000\000\000\000\000\003\000\002\000\000\000\000\000\b\000\000\000\n\000\000\000\000\006\000\000w\003\000\000\004\000\002\000\000\000\000\000\b\000\000\000\v\000\000\000\000\000\000\000\001\000\000\000\005\000\002\000\000\000\000\000(\000\000\000\023\000\000\000\001\000\000\000\000\000\000\000\b\000\000\000\v\000\000\000;\000\000\000\001\000\000\000\001\000\000\000\001\000\000\000;\000\000\000\001\000\000\000\001\000\002\000\000\000\000\000\034\000\000\000\023\000\000\000\003\000\000\000\000\000\000\000\004\000\000\000\003\000\000\000"...
        params = {d = 0x5624dddf2c20}
        flags = (PW_STREAM_FLAG_DRIVER | PW_STREAM_FLAG_ALLOC_BUFFERS)
#10 0x00005624dc64d930 in KWin::ScreenCastStream::init (this=0x5624df3f25d0) at /usr/src/debug/kwin-5.27.7-1.fc38.x86_64/src/plugins/screencast/screencaststream.cpp:340
```
Comment 3 Vlad Zahorodnii 2024-06-10 11:53:27 UTC
Is the crash still reproducible in 6.0.5 or 6.1 beta?
Comment 4 Bug Janitor Service 2024-06-25 03:47:29 UTC
Dear Bug Submitter,

This bug has been in NEEDSINFO status with no change for at least
15 days. Please provide the requested information as soon as
possible and set the bug status as REPORTED. Due to regular bug
tracker maintenance, if the bug is still in NEEDSINFO status with
no change in 30 days the bug will be closed as RESOLVED > WORKSFORME
due to lack of needed information.

For more information about our bug triaging procedures please read the
wiki located here:
https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging

If you have already provided the requested information, please
mark the bug as REPORTED so that the KDE team knows that the bug is
ready to be confirmed.

Thank you for helping us make KDE software even better for everyone!
Comment 5 Bug Janitor Service 2024-07-10 03:47:18 UTC
This bug has been in NEEDSINFO status with no change for at least
30 days. The bug is now closed as RESOLVED > WORKSFORME
due to lack of needed information.

For more information about our bug triaging procedures please read the
wiki located here:
https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging

Thank you for helping us make KDE software even better for everyone!