Bug 771495 – wayland: segfault in meta_wayland_surface_get_toplevel when pressing both left and right mouse buttons in gnome-terminal

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 771495 - wayland: segfault in meta_wayland_surface_get_toplevel when pressing both left and right mouse buttons in gnome-terminal


Summary:	wayland: segfault in meta_wayland_surface_get_toplevel when pressing both lef...


Status:	RESOLVED FIXED

Product:	mutter
Classification:	Core
Component:	wayland
Version:	git master
Hardware:	Other Linux

Importance:	Normal normal
Target Milestone:	---
Assigned To:	mutter-maint
QA Contact:	mutter-maint

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2016-09-15 14:27 UTC by Olivier Fourdan
Modified:	2016-09-18 03:00 UTC

See Also:	https://bugzilla.redhat.com/show_bug.cgi?id=1376447
GNOME target:	3.22
GNOME version:	---

Attachments
WAYLAND_DEBUG=1 (16.02 KB, text/plain) 2016-09-15 14:53 UTC, Olivier Fourdan		Details
wayland: Handle parent-less popup commits (1.35 KB, patch) 2016-09-16 07:11 UTC, Jonas Ådahl	committed	Details \| Review

Description Olivier Fourdan 2016-09-15 14:27:49 UTC

Description:

mutter segfaults when the user presses left and right mouse button simultaneously in gnome-terminal under Wayland.

How reproducible:

100%

Steps to reproduce:

1. Run GNOME Wyland session
2. Start gnomet-terminal
3. presse left and right mouse buttons simultanously

Actual results:

+ Trace 236668

#0 meta_wayland_surface_get_toplevel
at wayland/meta-wayland-surface.c line 1689
#1 actor_surface_commit
at wayland/meta-wayland-surface.c line 2012
#2 shell_surface_role_surface_commit
at wayland/meta-wayland-surface.c line 2051
#3 xdg_surface_role_commit
at wayland/meta-wayland-xdg-shell.c line 1184
#4 xdg_popup_role_commit
at wayland/meta-wayland-xdg-shell.c line 835
#5 meta_wayland_surface_role_commit
at wayland/meta-wayland-surface.c line 1886
#6 apply_pending_state
at wayland/meta-wayland-surface.c line 798
#7 ffi_call_unix64
at ../src/x86/unix64.S line 76
#8 ffi_call
at ../src/x86/ffi64.c line 525
#9 wl_closure_invoke
at src/connection.c line 935
#10 wl_client_connection_data
at src/wayland-server.c line 371
#11 wl_event_loop_dispatch
at src/event-loop.c line 423
#12 wayland_event_source_dispatch
at wayland/meta-wayland.c line 79
#13 g_main_dispatch
at gmain.c line 3201
#14 g_main_context_dispatch
at gmain.c line 3854
#15 g_main_context_iterate
at gmain.c line 3927
#16 g_main_loop_run
at gmain.c line 4123
#17 meta_run
at core/main.c line 572
#18 main
at core/mutter.c line 85

Comment 1 Olivier Fourdan 2016-09-15 14:28:51 UTC

Downstream bug: https://bugzilla.redhat.com/show_bug.cgi?id=1376447

Comment 2 Olivier Fourdan 2016-09-15 14:53:52 UTC

Created attachment 335651 [details]
WAYLAND_DEBUG=1

WAYLAND_DEBUG=1 /usr/libexec/gnome-terminal-server --app-id my.foo.Terminal |& tee wayland-debug.log & sleep 3; gnome-terminal --app-id my.foo.Terminal

Comment 3 Jonas Ådahl 2016-09-16 07:11:40 UTC

Created attachment 335676 [details] [review]
wayland: Handle parent-less popup commits

A xdg_popup, when active, always has a parent surface. However, a popup
created may immediately become invalid, for example when it is not
granted a grab, in which case it won't be assigned a parent since it
will never be mapped.

This case needs to be handled elsewhere, as one cannot assume a
MetaWaylandXdgPoup that is processed (via wl_surface commit handling
etc) will not have a parent_surface.

Comment 4 Florian Müllner 2016-09-16 14:45:55 UTC

Review of attachment 335676 [details] [review]:

(In reply to Jonas Ådahl from comment #3)
> one cannot assume a MetaWaylandXdgPoup [...] will not have a parent_surface

The double negative looks wrong here - we weren't assuming that there was *no* parent surface, we were assuming that there was one. Otherwise looks good to me.

Comment 5 Jonas Ådahl 2016-09-18 03:00:37 UTC

Pushed with fixed commit message.

Attachment 335676 [details] pushed as 417757e - wayland: Handle parent-less popup commits