Crash in xdg_shell.c/is_transient_for

[David96]

• Sway Version:

  • master (30d27b5)

• Wlroots Version:

  • master (c1a2c09a)

• Stack Trace:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  is_transient_for (child=0x5597d3526ff0, ancestor=0x5597d3526ff0) at ../sway/desktop/xdg_shell.c:226
226		struct wlr_xdg_toplevel *toplevel = child->wlr_xdg_surface->toplevel;
[Current thread is 1 (Thread 0x7fdab24b7980 (LWP 3786))]
(gdb) bt full
#0  is_transient_for (child=0x5597d3526ff0, ancestor=0x5597d3526ff0) at ../sway/desktop/xdg_shell.c:226
        toplevel = 0x2000000020
#1  0x00005597d16e64fc in view_is_transient_for (child=0x5597d3526ff0, ancestor=0x5597d3526ff0) at ../sway/tree/view.c:1428
#2  0x00005597d16e01be in container_is_transient_for (child=0x5597d3520050, ancestor=0x5597d3520050) at ../sway/tree/container.c:1622
#3  0x00005597d169eea9 in output_render (output=0x5597d2ed0930, when=0x7ffd0737e290, damage=0x7ffd0737e2a0) at ../sway/desktop/render.c:1088
        floater = 0x5597d3520050
        i = 0
        clear_color = {0, 0, 0, 1}
        nrects = 2
        rects = 0x5597d34cf340
        wlr_output = 0x5597d2ef3910
        renderer = 0x5597d24858b0
        workspace = 0x5597d3030210
        fullscreen_con = 0x5597d3520050
        seat = 0x7ffd073ae9fa <clock_gettime+90>
        focus = 0x5597d34db850
        width = 121103008
        height = 32765
        frame_damage = {extents = {x1 = 2, y1 = 32765, x2 = 121103632, y2 = 32765}, data = 0x0}
        transform = 32730
#4  0x00005597d169a325 in output_repaint_timer_handler (data=0x5597d2ed0930) at ../sway/desktop/output.c:545
        now = {tv_sec = 2082, tv_nsec = 6772452}
        output = 0x5597d2ed0930
        workspace = 0x5597d3030210
        fullscreen_con = 0x5597d3520050
        needs_frame = true
        damage = {extents = {x1 = 0, y1 = 0, x2 = 1920, y2 = 1057}, data = 0x5597d34cf330}
#5  0x00005597d169a4f6 in damage_handle_frame (listener=0x5597d2ed0ab0, user_data=0x5597d2ee6b60) at ../sway/desktop/output.c:607
        output = 0x5597d2ed0930
        msec_until_refresh = 0
        delay = 0
        data = {when = {tv_sec = 0, tv_nsec = 94110572800736}, msec_until_refresh = 0}
#6  0x00007fdab3d42bd7 in wlr_signal_emit_safe (signal=0x5597d2ee6bc8, data=0x5597d2ee6b60) at ../subprojects/wlroots/util/signal.c:29
        pos = 0x5597d2ed0ab0
        l = 0x5597d2ed0ab0
        cursor = {link = {prev = 0x5597d2ed0ab0, next = 0x7ffd0737e390}, notify = 0x7fdab3d42b21 <handle_noop>}
        end = {link = {prev = 0x7ffd0737e370, next = 0x5597d2ee6bc8}, notify = 0x7fdab3d42b21 <handle_noop>}
#7  0x00007fdab3d28931 in output_handle_frame (listener=0x5597d2ee6c48, data=0x5597d2ef3910) at ../subprojects/wlroots/types/wlr_output_damage.c:44
        output_damage = 0x5597d2ee6b60
#8  0x00007fdab3d42bd7 in wlr_signal_emit_safe (signal=0x5597d2ef3a90, data=0x5597d2ef3910) at ../subprojects/wlroots/util/signal.c:29
        pos = 0x5597d2ee6c48
        l = 0x5597d2ee6c48
        cursor = {link = {prev = 0x5597d2ee6c48, next = 0x7ffd0737e430}, notify = 0x7fdab3d42b21 <handle_noop>}
        end = {link = {prev = 0x7ffd0737e410, next = 0x5597d2ef3a90}, notify = 0x7fdab3d42b21 <handle_noop>}
#9  0x00007fdab3cfe091 in wlr_output_send_frame (output=0x5597d2ef3910) at ../subprojects/wlroots/types/output/output.c:788
#10 0x00007fdab3cfe0d5 in schedule_frame_handle_idle_timer (data=0x5597d2ef3910) at ../subprojects/wlroots/types/output/output.c:796
        output = 0x5597d2ef3910
#11 0x00007fdab36090db in wl_event_loop_dispatch_idle () at /usr/lib/libwayland-server.so.0
#12 0x00007fdab3609239 in wl_event_loop_dispatch () at /usr/lib/libwayland-server.so.0
--Type <RET> for more, q to quit, c to continue without paging--
#13 0x00007fdab3606d37 in wl_display_run () at /usr/lib/libwayland-server.so.0
#14 0x00005597d16958c5 in server_run (server=0x5597d17136c0 <server>) at ../sway/server.c:307
#15 0x00005597d1694abe in main (argc=1, argv=0x7ffd0737e878) at ../sway/main.c:431

(gdb) p child->wlr_xdg_surface
$1 = (struct wlr_xdg_surface *) 0x0

To reproduce:

• Open a video in Firefox using the picture-in-picture feature (opens video in separate window)
• Fullscreen that window on a 2nd output
• close the tab with the running video while the video is still fullscreen

Edit:
as one might have guessed, the output that is being rendered is the one with the picture in picture window on and fullscreen_con is the firefox picture in picture window.

[emersion]

cc @vyivel, I think child->wlr_xdg_surface is NULL or free'd here?

[vyivel]

I think child->wlr_xdg_surface is NULL or free'd here?

From the stack trace:

(gdb) p child->wlr_xdg_surface
$1 = (struct wlr_xdg_surface *) 0x0

I can't reproduce this. Maybe #6822 will fix it.

[David96]

I can't reproduce this on newest master either so I guess your changes fixed it.