GNOME Bugzilla – Bug 696946
error when using radiomenuitems
Last modified: 2013-04-06 14:52:32 UTC
When I use the application window example in gtk3-demo, open preferences -> color and select one of the items, I see an error message: unknown object (40), message leave(uo) And all gtk3-demo windows disappear.
Could be a weston bug: ==29142== Invalid read of size 8 ==29142== at 0x57630F6: find_resource_for_surface (wayland-server.c:626) ==29142== by 0x5763807: wl_pointer_set_focus (wayland-server.c:840) ==29142== by 0x5762E19: default_grab_focus (wayland-server.c:511) ==29142== by 0x5763BCF: wl_pointer_end_grab (wayland-server.c:945) ==29142== by 0xB04F968: remove_popup_grab (shell.c:2030) ==29142== by 0xB04FAFF: destroy_shell_surface (shell.c:2090) ==29142== by 0xB04FBEF: shell_destroy_shell_surface (shell.c:2119) ==29142== by 0x5762BA3: destroy_resource (wayland-server.c:420) ==29142== by 0x5762BD8: wl_resource_destroy (wayland-server.c:430) ==29142== by 0xB04FC2E: shell_handle_surface_destroy (shell.c:2130) ==29142== by 0x5761CF5: wl_signal_emit (wayland-server.h:181) ==29142== by 0x5762B85: destroy_resource (wayland-server.c:417) ==29142== Address 0xaa85f60 is 64 bytes inside a block of size 856 free'd ==29142== at 0x4C297A6: free (vg_replace_malloc.c:446) ==29142== by 0x40A04F: destroy_surface (compositor.c:1041) ==29142== by 0x5762BA3: destroy_resource (wayland-server.c:420) ==29142== by 0x5762BD8: wl_resource_destroy (wayland-server.c:430) ==29142== by 0x40AD53: surface_destroy (compositor.c:1358) ==29142== by 0x383F205ED7: ffi_call_unix64 (in /usr/lib64/libffi.so.5.0.10) ==29142== by 0x383F2058DF: ffi_call (in /usr/lib64/libffi.so.5.0.10) ==29142== by 0x5769298: wl_closure_invoke (connection.c:887) ==29142== by 0x57627B0: wl_client_connection_data (wayland-server.c:280) ==29142== by 0x5766707: wl_event_source_fd_dispatch (event-loop.c:86) ==29142== by 0x57670C4: wl_event_loop_dispatch (event-loop.c:421) ==29142== by 0x57643E5: wl_display_run (wayland-server.c:1194) ==29142== ==29142== Invalid read of size 8 ==29142== at 0x57630F6: find_resource_for_surface (wayland-server.c:626) ==29142== by 0x576386B: wl_pointer_set_focus (wayland-server.c:847) ==29142== by 0x5762E19: default_grab_focus (wayland-server.c:511) ==29142== by 0x5763BCF: wl_pointer_end_grab (wayland-server.c:945) ==29142== by 0xB04F968: remove_popup_grab (shell.c:2030) ==29142== by 0xB04FAFF: destroy_shell_surface (shell.c:2090) ==29142== by 0xB04FBEF: shell_destroy_shell_surface (shell.c:2119) ==29142== by 0x5762BA3: destroy_resource (wayland-server.c:420) ==29142== by 0x5762BD8: wl_resource_destroy (wayland-server.c:430) ==29142== by 0xB04FC2E: shell_handle_surface_destroy (shell.c:2130) ==29142== by 0x5761CF5: wl_signal_emit (wayland-server.h:181) ==29142== by 0x5762B85: destroy_resource (wayland-server.c:417) ==29142== Address 0xaa85f60 is 64 bytes inside a block of size 856 free'd ==29142== at 0x4C297A6: free (vg_replace_malloc.c:446) ==29142== by 0x40A04F: destroy_surface (compositor.c:1041) ==29142== by 0x5762BA3: destroy_resource (wayland-server.c:420) ==29142== by 0x5762BD8: wl_resource_destroy (wayland-server.c:430) ==29142== by 0x40AD53: surface_destroy (compositor.c:1358) ==29142== by 0x383F205ED7: ffi_call_unix64 (in /usr/lib64/libffi.so.5.0.10) ==29142== by 0x383F2058DF: ffi_call (in /usr/lib64/libffi.so.5.0.10) ==29142== by 0x5769298: wl_closure_invoke (connection.c:887) ==29142== by 0x57627B0: wl_client_connection_data (wayland-server.c:280) ==29142== by 0x5766707: wl_event_source_fd_dispatch (event-loop.c:86) ==29142== by 0x57670C4: wl_event_loop_dispatch (event-loop.c:421) ==29142== by 0x57643E5: wl_display_run (wayland-server.c:1194) ==29142== ==29142== Invalid read of size 4 ==29142== at 0x57694C5: serialize_closure (connection.c:955) ==29142== by 0x5769734: wl_closure_send (connection.c:1016) ==29142== by 0x57621CB: wl_resource_post_event (wayland-server.c:130) ==29142== by 0x5761E1E: wl_pointer_send_enter (wayland-server-protocol.h:1430) ==29142== by 0x57638D0: wl_pointer_set_focus (wayland-server.c:858) ==29142== by 0x5762E19: default_grab_focus (wayland-server.c:511) ==29142== by 0x5763BCF: wl_pointer_end_grab (wayland-server.c:945) ==29142== by 0xB04F968: remove_popup_grab (shell.c:2030) ==29142== by 0xB04FAFF: destroy_shell_surface (shell.c:2090) ==29142== by 0xB04FBEF: shell_destroy_shell_surface (shell.c:2119) ==29142== by 0x5762BA3: destroy_resource (wayland-server.c:420) ==29142== by 0x5762BD8: wl_resource_destroy (wayland-server.c:430) ==29142== Address 0xaa85f30 is 16 bytes inside a block of size 856 free'd ==29142== at 0x4C297A6: free (vg_replace_malloc.c:446) ==29142== by 0x40A04F: destroy_surface (compositor.c:1041) ==29142== by 0x5762BA3: destroy_resource (wayland-server.c:420) ==29142== by 0x5762BD8: wl_resource_destroy (wayland-server.c:430) ==29142== by 0x40AD53: surface_destroy (compositor.c:1358) ==29142== by 0x383F205ED7: ffi_call_unix64 (in /usr/lib64/libffi.so.5.0.10) ==29142== by 0x383F2058DF: ffi_call (in /usr/lib64/libffi.so.5.0.10) ==29142== by 0x5769298: wl_closure_invoke (connection.c:887) ==29142== by 0x57627B0: wl_client_connection_data (wayland-server.c:280) ==29142== by 0x5766707: wl_event_source_fd_dispatch (event-loop.c:86) ==29142== by 0x57670C4: wl_event_loop_dispatch (event-loop.c:421) ==29142== by 0x57643E5: wl_display_run (wayland-server.c:1194) ==29142== ==29142== Invalid read of size 8 ==29142== at 0xB04E1AF: handle_pointer_focus (shell.c:1371) ==29142== by 0x5761CF5: wl_signal_emit (wayland-server.h:181) ==29142== by 0x5763930: wl_pointer_set_focus (wayland-server.c:868) ==29142== by 0x5762E19: default_grab_focus (wayland-server.c:511) ==29142== by 0x5763BCF: wl_pointer_end_grab (wayland-server.c:945) ==29142== by 0xB04F968: remove_popup_grab (shell.c:2030) ==29142== by 0xB04FAFF: destroy_shell_surface (shell.c:2090) ==29142== by 0xB04FBEF: shell_destroy_shell_surface (shell.c:2119) ==29142== by 0x5762BA3: destroy_resource (wayland-server.c:420) ==29142== by 0x5762BD8: wl_resource_destroy (wayland-server.c:430) ==29142== by 0xB04FC2E: shell_handle_surface_destroy (shell.c:2130) ==29142== by 0x5761CF5: wl_signal_emit (wayland-server.h:181) ==29142== Address 0xaa85f70 is 80 bytes inside a block of size 856 free'd ==29142== at 0x4C297A6: free (vg_replace_malloc.c:446) ==29142== by 0x40A04F: destroy_surface (compositor.c:1041) ==29142== by 0x5762BA3: destroy_resource (wayland-server.c:420) ==29142== by 0x5762BD8: wl_resource_destroy (wayland-server.c:430) ==29142== by 0x40AD53: surface_destroy (compositor.c:1358) ==29142== by 0x383F205ED7: ffi_call_unix64 (in /usr/lib64/libffi.so.5.0.10) ==29142== by 0x383F2058DF: ffi_call (in /usr/lib64/libffi.so.5.0.10) ==29142== by 0x5769298: wl_closure_invoke (connection.c:887) ==29142== by 0x57627B0: wl_client_connection_data (wayland-server.c:280) ==29142== by 0x5766707: wl_event_source_fd_dispatch (event-loop.c:86) ==29142== by 0x57670C4: wl_event_loop_dispatch (event-loop.c:421) ==29142== by 0x57643E5: wl_display_run (wayland-server.c:1194) ==29142== ==29142== Invalid read of size 8 ==29142== at 0xB04FC62: get_shell_surface (shell.c:2144) ==29142== by 0xB04E1C2: handle_pointer_focus (shell.c:1372) ==29142== by 0x5761CF5: wl_signal_emit (wayland-server.h:181) ==29142== by 0x5763930: wl_pointer_set_focus (wayland-server.c:868) ==29142== by 0x5762E19: default_grab_focus (wayland-server.c:511) ==29142== by 0x5763BCF: wl_pointer_end_grab (wayland-server.c:945) ==29142== by 0xB04F968: remove_popup_grab (shell.c:2030) ==29142== by 0xB04FAFF: destroy_shell_surface (shell.c:2090) ==29142== by 0xB04FBEF: shell_destroy_shell_surface (shell.c:2119) ==29142== by 0x5762BA3: destroy_resource (wayland-server.c:420) ==29142== by 0x5762BD8: wl_resource_destroy (wayland-server.c:430) ==29142== by 0xB04FC2E: shell_handle_surface_destroy (shell.c:2130) ==29142== Address 0xaa86268 is 840 bytes inside a block of size 856 free'd ==29142== at 0x4C297A6: free (vg_replace_malloc.c:446) ==29142== by 0x40A04F: destroy_surface (compositor.c:1041) ==29142== by 0x5762BA3: destroy_resource (wayland-server.c:420) ==29142== by 0x5762BD8: wl_resource_destroy (wayland-server.c:430) ==29142== by 0x40AD53: surface_destroy (compositor.c:1358) ==29142== by 0x383F205ED7: ffi_call_unix64 (in /usr/lib64/libffi.so.5.0.10) ==29142== by 0x383F2058DF: ffi_call (in /usr/lib64/libffi.so.5.0.10) ==29142== by 0x5769298: wl_closure_invoke (connection.c:887) ==29142== by 0x57627B0: wl_client_connection_data (wayland-server.c:280) ==29142== by 0x5766707: wl_event_source_fd_dispatch (event-loop.c:86) ==29142== by 0x57670C4: wl_event_loop_dispatch (event-loop.c:421) ==29142== by 0x57643E5: wl_display_run (wayland-server.c:1194) ==29142== ==29142== Invalid read of size 8 ==29142== at 0xB04FC62: get_shell_surface (shell.c:2144) ==29142== by 0xB04E06B: ping_handler (shell.c:1331) ==29142== by 0xB04E214: handle_pointer_focus (shell.c:1378) ==29142== by 0x5761CF5: wl_signal_emit (wayland-server.h:181) ==29142== by 0x5763930: wl_pointer_set_focus (wayland-server.c:868) ==29142== by 0x5762E19: default_grab_focus (wayland-server.c:511) ==29142== by 0x5763BCF: wl_pointer_end_grab (wayland-server.c:945) ==29142== by 0xB04F968: remove_popup_grab (shell.c:2030) ==29142== by 0xB04FAFF: destroy_shell_surface (shell.c:2090) ==29142== by 0xB04FBEF: shell_destroy_shell_surface (shell.c:2119) ==29142== by 0x5762BA3: destroy_resource (wayland-server.c:420) ==29142== by 0x5762BD8: wl_resource_destroy (wayland-server.c:430) ==29142== Address 0xaa86268 is 840 bytes inside a block of size 856 free'd ==29142== at 0x4C297A6: free (vg_replace_malloc.c:446) ==29142== by 0x40A04F: destroy_surface (compositor.c:1041) ==29142== by 0x5762BA3: destroy_resource (wayland-server.c:420) ==29142== by 0x5762BD8: wl_resource_destroy (wayland-server.c:430) ==29142== by 0x40AD53: surface_destroy (compositor.c:1358) ==29142== by 0x383F205ED7: ffi_call_unix64 (in /usr/lib64/libffi.so.5.0.10) ==29142== by 0x383F2058DF: ffi_call (in /usr/lib64/libffi.so.5.0.10) ==29142== by 0x5769298: wl_closure_invoke (connection.c:887) ==29142== by 0x57627B0: wl_client_connection_data (wayland-server.c:280) ==29142== by 0x5766707: wl_event_source_fd_dispatch (event-loop.c:86) ==29142== by 0x57670C4: wl_event_loop_dispatch (event-loop.c:421) ==29142== by 0x57643E5: wl_display_run (wayland-server.c:1194) ==29142==
This is a weston bug. What happens is that the client destroys the wl_surface, which then cancels the popup grab. When we end the grab we go back the the default grab and calls the focus callback with wl_pointer.current (see wl_pointer_end_grab). Current is the surface that currently contains the pointer, regardless of pointer focus and grabs etc and lets the default grab set focus back to that surface without picking again. When clicking in a menu, wl_pointer.current is the menu surface, which we then destroy. The default grab will then try to send an enter event for a destroyed surface. We need a destroy listener for the current surface as well, so we can NULL wl_pointer.current.
I posted patches to the wayland list to try and resolve this issue! I didn't see your comment here, Kristian, until after i'd written the commit messages!
sweet, working menus !