GNOME Bugzilla – Bug 461648
GdkWindowQueueItem::serial overflow
Last modified: 2007-09-10 17:43:43 UTC
Steps to reproduce: 1. Create a application which keeps on trigger expose event at a high rate(eg, 1000 expose event/second) 2. Run the application in any version of gtk+ environment for more than an hour 3. The application will crash with segv. Stack trace:
+ Trace 151486
1046 } 1047 else 1048 { 1049 queue_delete_link (display_x11->translate_queue, 1050 display_x11->translate_queue->head); 1051 queue_item_free (item); 1052 } 1053 } 1054 } 1055 (gdb) p *(GdkWindowQueueItem *)tmp_list->data $31 = {window = 0x9bbcc28, serial = 341, type = GDK_WINDOW_QUEUE_ANTIEXPOSE, u = {translate = { dx = 163135504, dy = 46399540}, antiexpose = {area = 0x9b94010}}} (gdb) p *(GdkWindowQueueItem *)tmp_list->prev->data <= overflow $32 = {window = 0x9a35d88, serial = 57, type = GDK_WINDOW_QUEUE_ANTIEXPOSE, u = {translate = { dx = 161749920, dy = 16}, antiexpose = {area = 0x9a41ba0}}} (gdb) p *(GdkWindowQueueItem *)tmp_list->prev->prev->data <=here, serial value is near the max ulong $33 = {window = 0x9a36010, serial = 4294967176, type = GDK_WINDOW_QUEUE_ANTIEXPOSE, u = {translate = { dx = 161771960, dy = 52}, antiexpose = {area = 0x9a471b8}}} (gdb) p *(GdkWindowQueueItem *)tmp_list->prev->prev->prev->data $34 = {window = 0x9a36010, serial = 4294966893, type = GDK_WINDOW_QUEUE_ANTIEXPOSE, u = {translate = { dx = 161807208, dy = 16}, antiexpose = {area = 0x9a4fb68}}} Other information: The application will always crash after the internal gdk variable GdkWindowQueueItem::serial exceeds its max value, which will cause the application to remove some very old already-handled window in _gdk_window_process_expose function(gdk/x11/gdkgeometry-x11.c), and then segv happened, application crashed.
Created attachment 92667 [details] Sample application to reprocude the bug
Created attachment 92669 [details] [review] gdkgeometry-x11.c.patch A patch is created to work around this issue
(In reply to comment #2) > Created an attachment (id=92669) [edit] > gdkgeometry-x11.c.patch > > A patch is created to work around this issue please create patches with diff -up in the future, so readers don't need to re-diff. in any case, you're right that the serial comparison is buggy, however the segfault is more due to lack of referential integrity in the node removal branch.
Created attachment 94188 [details] [review] fix serial and node handling Hui, please check if this patch fixes the crashers for you. Bratsche, Tbf, can you please apply, test the test case and commit if this works?
Running the sample program on my machine now. Let's if and when it crashes.
Thanks for the patch, I am also running the sample application, i will update the result after the serial overflows.
The sample program survived several overflows now.
This has caused a regression btw. Bug 474897.