Bug 779483 – Mutter reliably crashes when closing a window while keeping Alt+Tab pressed

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 779483 - Mutter reliably crashes when closing a window while keeping Alt+Tab pressed


Summary:	Mutter reliably crashes when closing a window while keeping Alt+Tab pressed


Status:	RESOLVED FIXED

Product:	mutter
Classification:	Core
Component:	wayland
Version:	3.22.x
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	mutter-maint
QA Contact:	mutter-maint

URL:
Whiteboard:

Duplicates:	779645 (view as bug list)
Depends on:
Blocks:

Reported:	2017-03-02 17:16 UTC by André Klapper
Modified:	2017-03-06 13:15 UTC

See Also:
GNOME target:	---
GNOME version:	3.21/3.22

Attachments
clutter-clone: Unset source when source actor is destroyed (2.03 KB, patch) 2017-03-02 18:24 UTC, Rui Matos	committed	Details \| Review

Description André Klapper 2017-03-02 17:16:32 UTC

STEPS TO REPRODUCE:
1. Press Alt+Tab and keep both keys pressed
2. Use the mouse to close a window via its X in the upper right corner

ACTUAL OUTCOME:
Entire GNOME session crashes reliably.

gnome-shell-3.22.3-1.fc25.x86_64
mutter-3.22.3-1.fc25.x86_64

F25's abrt says this is https://bugzilla.redhat.com/show_bug.cgi?id=1425095

Copying stacktrace from https://bugzilla.redhat.com/attachment.cgi?id=1255708 :

[New LWP 2004]
[New LWP 2058]
[New LWP 2015]
[New LWP 2028]
[New LWP 2061]
[New LWP 2014]
[New LWP 2060]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/bin/gnome-shell'.
Program terminated with signal SIGSEGV, Segmentation fault.

+ Trace 237216

Thread 1 (Thread 0x7ff91560bfc0 (LWP 2004))

#0 meta_window_appears_focused
at core/window.c line 6745
#1 meta_window_actor_get_paint_volume
at compositor/meta-window-actor.c line 758
#2 _clutter_actor_get_paint_volume_real
at clutter-actor.c line 17427
#3 _clutter_actor_get_paint_volume_mutable
at clutter-actor.c line 17503
#4 clutter_actor_get_paint_volume
at clutter-actor.c line 17548
#5 clutter_clone_get_paint_volume
at clutter-clone.c line 218
#6 _clutter_actor_get_paint_volume_real
at clutter-actor.c line 17427
#7 _clutter_actor_get_paint_volume_mutable
at clutter-actor.c line 17503
#8 clutter_actor_get_transformed_paint_volume
at clutter-actor.c line 17591
#9 st_widget_get_paint_volume
at st/st-widget.c line 810
#10 _clutter_actor_get_paint_volume_real
at clutter-actor.c line 17427
#11 _clutter_actor_get_paint_volume_mutable
at clutter-actor.c line 17503
#12 clutter_actor_get_transformed_paint_volume
at clutter-actor.c line 17591
#13 st_widget_get_paint_volume
at st/st-widget.c line 810
#14 st_box_layout_get_paint_volume
at st/st-box-layout.c line 516
#15 _clutter_actor_get_paint_volume_real
at clutter-actor.c line 17427
#16 _clutter_actor_get_paint_volume_mutable
at clutter-actor.c line 17503
#17 clutter_actor_get_transformed_paint_volume
at clutter-actor.c line 17591
#18 st_widget_get_paint_volume
at st/st-widget.c line 810
#19 _clutter_actor_get_paint_volume_real
at clutter-actor.c line 17427
#20 _clutter_actor_get_paint_volume_mutable
at clutter-actor.c line 17503
#21 clutter_actor_get_transformed_paint_volume
at clutter-actor.c line 17591
#22 shell_generic_container_get_paint_volume
at shell-generic-container.c line 292
#23 _clutter_actor_get_paint_volume_real
at clutter-actor.c line 17427
#24 _clutter_actor_get_paint_volume_mutable
at clutter-actor.c line 17503
#25 _clutter_actor_update_last_paint_volume
at clutter-actor.c line 3490
#26 clutter_actor_paint
at clutter-actor.c line 3913
#27 clutter_actor_paint
at clutter-actor.c line 3964
#28 st_box_layout_paint
at st/st-box-layout.c line 428
#29 g_closure_invoke
at gclosure.c line 804
#30 signal_emit_unlocked_R
at gsignal.c line 3673
#31 g_signal_emit_valist
at gsignal.c line 3391
#32 g_signal_emit
at gsignal.c line 3447
#33 clutter_actor_continue_paint
at clutter-actor.c line 4018
#34 clutter_actor_paint
at clutter-actor.c line 3938
#35 clutter_actor_paint
at clutter-actor.c line 3964
#36 st_scroll_view_paint
at st/st-scroll-view.c line 283
#37 g_closure_invoke
at gclosure.c line 804
#38 signal_emit_unlocked_R
at gsignal.c line 3673
#39 g_signal_emit_valist
at gsignal.c line 3391
#40 g_signal_emit
at gsignal.c line 3447
#41 clutter_actor_continue_paint
at clutter-actor.c line 4018
#42 clutter_effect_real_paint
at clutter-effect.c line 214
#43 clutter_offscreen_effect_paint
at clutter-offscreen-effect.c line 441
#44 clutter_actor_continue_paint
at clutter-actor.c line 4061
#45 clutter_actor_paint
at clutter-actor.c line 3938
#46 clutter_actor_paint
at clutter-actor.c line 3964
#47 shell_generic_container_paint
at shell-generic-container.c line 149
#48 g_closure_invoke
at gclosure.c line 804
#49 signal_emit_unlocked_R
at gsignal.c line 3673
#50 g_signal_emit_valist
at gsignal.c line 3391
#51 g_signal_emit
at gsignal.c line 3447
#52 clutter_actor_continue_paint
at clutter-actor.c line 4018
#53 clutter_actor_paint
at clutter-actor.c line 3938
#54 clutter_actor_paint
at clutter-actor.c line 3964
#55 shell_generic_container_paint
at shell-generic-container.c line 149
#56 g_closure_invoke
at gclosure.c line 804
#57 signal_emit_unlocked_R
at gsignal.c line 3673
#58 g_signal_emit_valist
at gsignal.c line 3391
#59 g_signal_emit
at gsignal.c line 3447
#60 clutter_actor_continue_paint
at clutter-actor.c line 4018
#61 clutter_actor_paint
at clutter-actor.c line 3938
#62 clutter_actor_paint
at clutter-actor.c line 3964
#63 shell_generic_container_paint
at shell-generic-container.c line 149
#64 g_closure_invoke
at gclosure.c line 804
#65 signal_emit_unlocked_R
at gsignal.c line 3673
#66 g_signal_emit_valist
at gsignal.c line 3391
#67 g_signal_emit
at gsignal.c line 3447
#68 clutter_actor_continue_paint
at clutter-actor.c line 4018
#69 clutter_actor_paint
at clutter-actor.c line 3938
#70 clutter_actor_paint
at clutter-actor.c line 3964
#71 clutter_stage_paint
at clutter-stage.c line 710
#72 meta_stage_paint
at backends/meta-stage.c line 141
#73 g_closure_invoke
at gclosure.c line 804
#74 signal_emit_unlocked_R
at gsignal.c line 3673
#75 g_signal_emit_valist
at gsignal.c line 3391
#76 g_signal_emit
at gsignal.c line 3447
#77 clutter_actor_continue_paint
at clutter-actor.c line 4018
#78 clutter_actor_paint
at clutter-actor.c line 3938
#79 clutter_actor_paint
at clutter-actor.c line 3964
#80 clutter_stage_do_paint_view
at clutter-stage.c line 678
#81 _clutter_stage_paint_view
at clutter-stage.c line 694
#82 paint_stage
at cogl/clutter-stage-cogl.c line 422
#83 clutter_stage_cogl_redraw_view
at cogl/clutter-stage-cogl.c line 667
#84 clutter_stage_cogl_redraw
at cogl/clutter-stage-cogl.c line 783
#85 meta_stage_native_redraw
at backends/native/meta-stage-native.c line 300
#86 clutter_stage_do_redraw
at clutter-stage.c line 1120
#87 _clutter_stage_do_update
at clutter-stage.c line 1176
#88 master_clock_update_stages
at clutter-master-clock-default.c line 443
#89 clutter_clock_dispatch
at clutter-master-clock-default.c line 567
#90 g_main_dispatch
at gmain.c line 3203
#91 g_main_context_dispatch
at gmain.c line 3856
#92 g_main_context_iterate
at gmain.c line 3929
#93 g_main_loop_run
at gmain.c line 4125
#94 meta_run
at core/main.c line 572
#95 main
at main.c line 471

Comment 1 Rui Matos 2017-03-02 18:24:40 UTC

Created attachment 347091 [details] [review]
clutter-clone: Unset source when source actor is destroyed

Otherwise we might be holding on to a source actor that's no longer
fully functioning and cause crashes if for example we try to paint it.

--

I do wonder why this was never a problem in clutter before...

Comment 2 Emmanuele Bassi (:ebassi) 2017-03-02 18:45:48 UTC

Review of attachment 347091 [details] [review]:

Oh, nice catch.

Comment 3 André Klapper 2017-03-02 19:09:18 UTC

Thanks! (I'll cross my fingers that this will get backported & shipped in F25.)

Comment 4 André Klapper 2017-03-03 12:05:56 UTC

To elaborate a bit:
I have the "Alternatetab" extension in gnome-tweak-tool enabled to not group windows by application.
I'm switching windows via Alt+Shift (keeping Alt pressed). If I send an email at the same time in Evolution, the mail composer window closes when that email has been sent, and then the entire session crashes. This is pretty common.

Comment 5 bugzilla-gnome.somor@spamgourmet.com 2017-03-03 12:58:28 UTC

I am also using AlternateTab so that windows are not grouped by application. I have disabled AlternateTab and can confirm that the bug no longer occurs with AlternateTab disabled.

Comment 6 Rui Matos 2017-03-06 13:05:12 UTC

*** Bug 779645 has been marked as a duplicate of this bug. ***

Comment 7 Rui Matos 2017-03-06 13:15:21 UTC

Attachment 347091 [details] pushed as 542ed1d - clutter-clone: Unset source when
source actor is destroyed

BTW, I believe this crash only started happening lately because we
changed gnome-shell to clone MetaWindowActors[1] instead of just the
underlying texture and that class assumes (reasonably) that it can use
the corresponding MetaWindow instance when painting.

[1] https://git.gnome.org/browse/gnome-shell/commit/?id=7746f1a5c43e94bef1470c69f491eff0ba6531b6