After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 699777 - window: Eliminate a potential race condition with _NET_WM_MOVERESIZE
window: Eliminate a potential race condition with _NET_WM_MOVERESIZE
Status: RESOLVED FIXED
Product: mutter
Classification: Core
Component: general
unspecified
Other All
: Normal normal
: ---
Assigned To: mutter-maint
mutter-maint
Depends on:
Blocks:
 
 
Reported: 2013-05-06 20:04 UTC by Jasper St. Pierre (not reading bugmail)
Modified: 2013-05-14 18:46 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
window: Split out some code querying the state of buttons (3.36 KB, patch)
2013-05-06 20:04 UTC, Jasper St. Pierre (not reading bugmail)
needs-work Details | Review
window: Eliminate a potential race condition with _NET_WM_MOVERESIZE (2.66 KB, patch)
2013-05-06 20:04 UTC, Jasper St. Pierre (not reading bugmail)
reviewed Details | Review
window: Eliminate a potential race condition with _NET_WM_MOVERESIZE (6.58 KB, patch)
2013-05-14 18:41 UTC, Jasper St. Pierre (not reading bugmail)
committed Details | Review

Description Jasper St. Pierre (not reading bugmail) 2013-05-06 20:04:24 UTC
See patches. This happens most often for me with the Steam client,
but I've also seen it when playing around with GTK+3 CSD windows.
Comment 1 Jasper St. Pierre (not reading bugmail) 2013-05-06 20:04:26 UTC
Created attachment 243411 [details] [review]
window: Split out some code querying the state of buttons

This will be used to actually check that the button is being pressed down,
and significantly cut down on the amount of code introduced in the next
commit.
Comment 2 Jasper St. Pierre (not reading bugmail) 2013-05-06 20:04:29 UTC
Created attachment 243412 [details] [review]
window: Eliminate a potential race condition with _NET_WM_MOVERESIZE

Clients using _NET_WM_MOVERESIZE to start a drag operation may encounter
a race condition if the user presses and releases a mouse button very
fast, getting "stuck" in a grab state. While this is easily fixed with
the user pressing the button or hitting Escape as the EWMH spec suggests,
its's still a bit of annoyance for users.

After starting a grab operation, check that the button is actually pressed
by the client, and if not, cancel the grab operation. This prevents the
stuck grab in a race-free way, although it requires an extra round-trip
to the server.

With client-side decorations becoming more popular, the use of
_NET_WM_MOVERESIZE is on the rise, thus this bug is seen more frequently
than before.
Comment 3 Owen Taylor 2013-05-14 18:32:12 UTC
Review of attachment 243411 [details] [review]:

::: src/core/window.c
@@ +6627,3 @@
 #define _NET_WM_MOVERESIZE_CANCEL           11
 
+static int

We always use uint for masks

@@ +6638,3 @@
+
+  meta_error_trap_push (window->display);
+  XIQueryPointer (window->display->xdisplay,

XIQueryPointer has no reliable return value that indicates whether it succeeded or an error occurred:

    if (!_XReply(dpy, (xReply *)&rep,
                 (sizeof(xXIQueryPointerReply) - sizeof(xReply))/4, xFalse)) {
        UnlockDisplay(dpy);
        SyncHandle();
        return False;
    }

[...]

    UnlockDisplay(dpy);
    SyncHandle();
    return rep.same_screen;

So with the error trap pushed, buttons might be uninitialized, and free(button.mask) might segfault. So you need to meta_error_trap_push_with_return(). To avoid having to do the XQueryPointer twice, in the next patch you probably should move the button == 0 case *inside* the grab, and fix up display->grab_button after you decide which one it was. (You an decide whether you still want the helper in that case... it might still increase readability even if it is only called once.)
Comment 4 Owen Taylor 2013-05-14 18:33:25 UTC
Review of attachment 243412 [details] [review]:

Looks OK, but see comments on the other patch.
Comment 5 Jasper St. Pierre (not reading bugmail) 2013-05-14 18:41:48 UTC
Created attachment 244228 [details] [review]
window: Eliminate a potential race condition with _NET_WM_MOVERESIZE

Clients using _NET_WM_MOVERESIZE to start a drag operation may encounter
a race condition if the user presses and releases a mouse button very
fast, getting "stuck" in a grab state. While this is easily fixed with
the user pressing the button or hitting Escape as the EWMH spec suggests,
its's still a bit of annoyance for users.

After starting a grab operation, check that the button is actually pressed
by the client, and if not, cancel the grab operation. This prevents the
stuck grab in a race-free way, although it requires an extra round-trip
to the server.

With client-side decorations becoming more popular, the use of
_NET_WM_MOVERESIZE is on the rise, thus this bug is seen more frequently
than before.
Comment 6 Owen Taylor 2013-05-14 18:45:07 UTC
Review of attachment 244228 [details] [review]:

Looks good to me
Comment 7 Jasper St. Pierre (not reading bugmail) 2013-05-14 18:46:32 UTC
Attachment 244228 [details] pushed as a487d4d - window: Eliminate a potential race condition with _NET_WM_MOVERESIZE