Skip to content
This repository has been archived by the owner on Nov 1, 2021. It is now read-only.

wlroots status #9

Closed
ddevault opened this issue Jun 6, 2017 · 36 comments
Closed

wlroots status #9

ddevault opened this issue Jun 6, 2017 · 36 comments

Comments

@ddevault
Copy link
Contributor

ddevault commented Jun 6, 2017

Planned and completed features, loosely sorted by priority:

  • Backends
    • DRM
      • Hotplugging (PLEASE TEST - THAT MEANS YOU, GITHUB ISSUE READER)
      • Legacy modesetting
      • Atomic modesetting
      • DPMS
      • Rotation
      • Hardware cursor
      • DisplayPort MST - need additional hardware - Hardware donations #171
      • Multi GPU
        • Throw pixels over the fence
        • Specify main GPU
        • Multi-GPU rendering
        • Switch main GPU at runtime
    • libinput
      • Keyboards
        • Events
        • Key maps
        • LEDs
      • Pointers
      • Touch
        • Get mapped output from udev doesn't work on my hardware
      • Tablet tool
      • Tablet pad
      • Gesture
      • Switch
    • Wayland
      • Output
        • Multiple outputs
        • Rotation
      • Input devices
    • X11
    • RDP
    • fbdev
    • headless
  • Session
    • udev
      • Multi GPU
    • logind
      • elogind
      • VT switching
      • Multi GPU
    • Direct (forking)
      • VT switching
      • fork+setuid
      • Multi GPU
  • Wayland
    • wl_output
    • wl_compositor
      • wl_surface
      • wl_region
    • wl_shm
    • wl_drm
    • wl_shell
      • wl_shell_surface
    • wl_subsurface
    • wl_seat
      • wl_keyboard
        • key repeat
      • wl_pointer
      • wl_touch
      • Multi-seat
    • Extra protocols
      • xdg-shell v6
        • surface
          • toplevel
          • popup
        • positioner
      • xdg-shell v5
      • xdg-shell
      • gamma-control (orbital)
      • screenshooter (weston)
      • server-decoration (kde)
      • layer-shell (wlroots)
      • input-inhibitor (wlroots)
      • input-method
      • pointer-constraints
      • presentation-time
      • linux-dmabuf
      • viewporter
      • xwayland-keyboard-grab
      • relative-pointer
      • xdg-foreign
      • xdg-output
      • tablet
      • idle-inhibit
      • input-timestamps
      • keyboard-shortcuts-inhibit
      • text-input
      • pointer-gestures
      • fullscreen-shell
      • idle
      • gtk-primary-clipboard
        • Sync with Xwayland
    • clipboard
    • drag and drop
  • wlroots features
    • wlr_cursor
    • wlr_xcursor
    • wlr_output_layout
      • Output rotation
      • Output mirroring
      • Output damage
  • Scaling (hidpi)
    • Integral
    • Fractional
  • Rendering
    • Primitives
      • Textured quads
      • Colored quads
      • Colored ellipses
    • Pixman
  • XWayland
    • Initialization
    • Clipboard sync
    • Drag and drop
    • Window management utilities
  • Documentation ¯\_(ツ)_/¯
@ddevault
Copy link
Contributor Author

@nyorain added support for output rotation and multihead to the WL backend. Leaving the other tasks to you for now. Thanks again, that backend is going to make things way easier for me to work on upcoming features.

@ddevault
Copy link
Contributor Author

An additional point of discussion for the wayland backend: the compositor is going to hand us a keyboard layout. Should we give a shit? Right now wlroots doesn't bother with handling keyboard layouts and leaves that up to the user, we just hand it scancodes and the user feeds them to xkb. Maybe we could have a means for a wlr_keyboard to suggest a layout? XKB is going to source from the environment variables which would almost certainly be set in any case.

@ddevault
Copy link
Contributor Author

Clarification: wayland hands entire XKB keymaps to the client. Maybe we should just move xkb code into wlroots...

@torpak
Copy link

torpak commented Jun 29, 2017

Runtime switchable layouts would be nice in the long run.

@soredake
Copy link

How about relative-pointer protocol?

@ddevault
Copy link
Contributor Author

Link?

@ascent12
Copy link
Member

@soredake Yeah, I imagine we'll get most of the extra (currently unstable) things from wayland-protocols.

@SirCmpwn https://github.com/wayland-project/wayland-protocols/blob/master/unstable/relative-pointer/relative-pointer-unstable-v1.xml

@ddevault
Copy link
Contributor Author

Yeah eventually we'll want that.

@martinetd
Copy link
Member

Xwayland init can probably be checked.
On top of the other two points, we might also want to add something about cursor as there look like we'll need some special cursor handling within our xwayland layer as well.
I'm not sure if "window management utilities" is about stuff like move/resize/full screen/focus/title, if it isn't then will need another checkbox that that and please explain briefly what this actually is :)

@ddevault
Copy link
Contributor Author

On top of the other two points, we might also want to add something about cursor as there look like we'll need some special cursor handling within our xwayland layer as well.

What do you mean?

I'm not sure if "window management utilities" is about stuff like move/resize/full screen/focus/title, if it isn't then will need another checkbox that that and please explain briefly what this actually is :)

Yes, that's what it is. Though it might make more sense for the compositor to just implement an X11 window manager themselves? Thoughts?

@martinetd
Copy link
Member

[xwayland cursor handling]

What do you mean?

Actually not 100% sure, but there is code in both weston and wlc about
cursors within their xwayland code.
It looks like they send Xwayland cursor pixel maps so it will render
it on the X side, but I do not understand yet why that is not redundant
with the wayland-side rendering, or why it is useful.

[window management utilities]

Yes, that's what it is. Though it might make more sense for the compositor to just impl
ement an X11 window manager themselves? Thoughts?

Hm. I think we should handle X11 events as close as possible to what
xdg/wl shells do.
For example, if I understand this correctly xdg_toplevel_move will be
called when an wayland client asks to move the toplevel one way or
another. sway in tiled mode will probably not care at all, since we
enforce positions; but another compositor or in floating mode we will
probably want to get notified when this happens.

That means we either need some kind of upcall vector for shells to
notify the compositor something happened, or we need to store the
request somewhere until the compositor processes the buffer in the next
frame iterating. (I don't know if there already has been a decision for
that, could be something else I guess)

I haven't given this much thought yet but at this point I would rather
have xwayland behave like another shell and just notify the compositor
something happened, so the 'xwm' would really just be something like an
x shell handler.

Does that seem to make sense?

@ddevault
Copy link
Contributor Author

Added em

@ghallberg
Copy link

Is there a subset of these points that need to be implemented before "releasing" wlroots (starting to use it for sway for example). Or are you planning to finish all of these before that?

RDP for example feels like it's a lot of work, and not really needed for 99% of use cases.

Just asking out of curiosity, and to know where to apply any possible free time I have to spare for contributions.

@ddevault
Copy link
Contributor Author

There is a subset, yes. Work on porting Sway to wlroots will begin soon. If you're interested in contributing to wlroots, please join us in the IRC channel for direction.

@Sunderland93
Copy link

Hello. Please add this protocols: xwayland-keyboard-grub, relative-pointer, xdg-foreign and xdg-output

@ddevault
Copy link
Contributor Author

ddevault commented Oct 1, 2017

Sure.

@L-as
Copy link
Contributor

L-as commented Oct 8, 2017

Should (can) drag-and-drop be a part of wlroots?

@ddevault
Copy link
Contributor Author

ddevault commented Oct 8, 2017

Yes, and it's already in this list.

@emersion
Copy link
Member

We could add gtk-primary-selection for better clipboard support.

@Kommynct
Copy link

Kommynct commented Nov 8, 2017

Would it be appropriate to put shadows for floating windows on this list?

@emersion
Copy link
Member

emersion commented Nov 8, 2017

No.

@Kommynct
Copy link

Kommynct commented Nov 8, 2017

Okay, thank you.

@ibrokemypie
Copy link

is wayland-wall to be implemented?

@valpackett
Copy link
Contributor

Looks like surface-layers will be used instead of wayland-wall's background/dock-manager/launcher-menu/notification-area.

But wayland-wall also has window-switcher, seems like a useful one (e.g. for rofi)

@andrewwakeling

This comment has been minimized.

@bew
Copy link

bew commented Jul 22, 2018

So feature-wise it's complete, but is the API stable? (can we write language bindings without breakage)

@emersion
Copy link
Member

See #1008

@bew
Copy link

bew commented Jul 22, 2018

Perfect thanks

emersion added a commit to emersion/wlroots that referenced this issue Nov 30, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:

    ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
    READ of size 8 at 0x614000000180 thread T0
        #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
        #1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
        #2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
        swaywm#3 0x7f88e21af274  (/lib64/libinput.so.10+0x28274)
        swaywm#4 0x7f88e21aff1d  (/lib64/libinput.so.10+0x28f1d)
        swaywm#5 0x7f88e219ddac  (/lib64/libinput.so.10+0x16dac)
        swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
        swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
        swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
        swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
        swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
        swaywm#11 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)
        swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
        swaywm#13 0x559fefb52385 in main ../main.c:67
        swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
        swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)

    0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
    freed by thread T0 here:
        #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
        #1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
        #2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
        swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
        swaywm#4 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)

    previously allocated by thread T0 here:
        #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
        #1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
        #2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
        swaywm#3 0x559fefb51ea6 in main ../main.c:20
        swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
ddevault pushed a commit that referenced this issue Dec 1, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:

    ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
    READ of size 8 at 0x614000000180 thread T0
        #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
        #1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
        #2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
        #3 0x7f88e21af274  (/lib64/libinput.so.10+0x28274)
        #4 0x7f88e21aff1d  (/lib64/libinput.so.10+0x28f1d)
        #5 0x7f88e219ddac  (/lib64/libinput.so.10+0x16dac)
        #6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
        #7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
        #8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
        #9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
        #10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
        #11 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)
        #12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
        #13 0x559fefb52385 in main ../main.c:67
        #14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
        #15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)

    0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
    freed by thread T0 here:
        #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
        #1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
        #2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
        #3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
        #4 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)

    previously allocated by thread T0 here:
        #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
        #1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
        #2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
        #3 0x559fefb51ea6 in main ../main.c:20
        #4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
aiqs4 pushed a commit to aiqs4/wlroots that referenced this issue Dec 19, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:

    ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
    READ of size 8 at 0x614000000180 thread T0
        #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
        swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
        swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
        swaywm#3 0x7f88e21af274  (/lib64/libinput.so.10+0x28274)
        swaywm#4 0x7f88e21aff1d  (/lib64/libinput.so.10+0x28f1d)
        swaywm#5 0x7f88e219ddac  (/lib64/libinput.so.10+0x16dac)
        swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
        swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
        swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
        swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
        swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
        swaywm#11 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)
        swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
        swaywm#13 0x559fefb52385 in main ../main.c:67
        swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
        swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)

    0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
    freed by thread T0 here:
        #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
        swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
        swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
        swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
        swaywm#4 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)

    previously allocated by thread T0 here:
        #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
        swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
        swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
        swaywm#3 0x559fefb51ea6 in main ../main.c:20
        swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
aiqs4 pushed a commit to aiqs4/wlroots that referenced this issue Dec 19, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:

    ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
    READ of size 8 at 0x614000000180 thread T0
        #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
        swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
        swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
        swaywm#3 0x7f88e21af274  (/lib64/libinput.so.10+0x28274)
        swaywm#4 0x7f88e21aff1d  (/lib64/libinput.so.10+0x28f1d)
        swaywm#5 0x7f88e219ddac  (/lib64/libinput.so.10+0x16dac)
        swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
        swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
        swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
        swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
        swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
        swaywm#11 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)
        swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
        swaywm#13 0x559fefb52385 in main ../main.c:67
        swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
        swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)

    0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
    freed by thread T0 here:
        #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
        swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
        swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
        swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
        swaywm#4 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)

    previously allocated by thread T0 here:
        #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
        swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
        swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
        swaywm#3 0x559fefb51ea6 in main ../main.c:20
        swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
aiqs4 pushed a commit to aiqs4/wlroots that referenced this issue Dec 19, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:

    ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
    READ of size 8 at 0x614000000180 thread T0
        #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
        swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
        swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
        swaywm#3 0x7f88e21af274  (/lib64/libinput.so.10+0x28274)
        swaywm#4 0x7f88e21aff1d  (/lib64/libinput.so.10+0x28f1d)
        swaywm#5 0x7f88e219ddac  (/lib64/libinput.so.10+0x16dac)
        swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
        swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
        swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
        swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
        swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
        swaywm#11 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)
        swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
        swaywm#13 0x559fefb52385 in main ../main.c:67
        swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
        swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)

    0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
    freed by thread T0 here:
        #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
        swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
        swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
        swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
        swaywm#4 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)

    previously allocated by thread T0 here:
        #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
        swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
        swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
        swaywm#3 0x559fefb51ea6 in main ../main.c:20
        swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
aiqs4 pushed a commit to aiqs4/wlroots that referenced this issue Dec 19, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:

    ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
    READ of size 8 at 0x614000000180 thread T0
        #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
        swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
        swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
        swaywm#3 0x7f88e21af274  (/lib64/libinput.so.10+0x28274)
        swaywm#4 0x7f88e21aff1d  (/lib64/libinput.so.10+0x28f1d)
        swaywm#5 0x7f88e219ddac  (/lib64/libinput.so.10+0x16dac)
        swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
        swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
        swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
        swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
        swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
        swaywm#11 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)
        swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
        swaywm#13 0x559fefb52385 in main ../main.c:67
        swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
        swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)

    0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
    freed by thread T0 here:
        #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
        swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
        swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
        swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
        swaywm#4 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)

    previously allocated by thread T0 here:
        #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
        swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
        swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
        swaywm#3 0x559fefb51ea6 in main ../main.c:20
        swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
aiqs4 pushed a commit to aiqs4/wlroots that referenced this issue Dec 19, 2019
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:

    ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
    READ of size 8 at 0x614000000180 thread T0
        #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
        swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
        swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
        swaywm#3 0x7f88e21af274  (/lib64/libinput.so.10+0x28274)
        swaywm#4 0x7f88e21aff1d  (/lib64/libinput.so.10+0x28f1d)
        swaywm#5 0x7f88e219ddac  (/lib64/libinput.so.10+0x16dac)
        swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
        swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
        swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
        swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
        swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
        swaywm#11 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)
        swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
        swaywm#13 0x559fefb52385 in main ../main.c:67
        swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
        swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)

    0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
    freed by thread T0 here:
        #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
        swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
        swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
        swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
        swaywm#4 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)

    previously allocated by thread T0 here:
        #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
        swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
        swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
        swaywm#3 0x559fefb51ea6 in main ../main.c:20
        swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
filips pushed a commit to filips/wlroots that referenced this issue Mar 15, 2020
This fixes a heap-use-after-free when the session is destroyed before
the backend during wl_display_destroy:

    ==1085==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000000180 at pc 0x7f88e3590c2d bp 0x7ffdc4e33f90 sp 0x7ffdc4e33f80
    READ of size 8 at 0x614000000180 thread T0
        #0 0x7f88e3590c2c in find_device ../subprojects/wlroots/backend/session/session.c:192
        swaywm#1 0x7f88e3590e85 in wlr_session_close_file ../subprojects/wlroots/backend/session/session.c:204
        swaywm#2 0x7f88e357b80c in libinput_close_restricted ../subprojects/wlroots/backend/libinput/backend.c:24
        swaywm#3 0x7f88e21af274  (/lib64/libinput.so.10+0x28274)
        swaywm#4 0x7f88e21aff1d  (/lib64/libinput.so.10+0x28f1d)
        swaywm#5 0x7f88e219ddac  (/lib64/libinput.so.10+0x16dac)
        swaywm#6 0x7f88e21b415d in libinput_unref (/lib64/libinput.so.10+0x2d15d)
        swaywm#7 0x7f88e357c9d6 in backend_destroy ../subprojects/wlroots/backend/libinput/backend.c:130
        swaywm#8 0x7f88e3545a09 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:50
        swaywm#9 0x7f88e358981a in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:54
        swaywm#10 0x7f88e358a059 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:107
        swaywm#11 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)
        swaywm#12 0x7f88e314b466 in wl_display_destroy (/lib64/libwayland-server.so.0+0x9466)
        swaywm#13 0x559fefb52385 in main ../main.c:67
        swaywm#14 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
        swaywm#15 0x559fefb4297d in _start (/home/simon/src/glider/build/glider+0x2297d)

    0x614000000180 is located 320 bytes inside of 416-byte region [0x614000000040,0x6140000001e0)
    freed by thread T0 here:
        #0 0x7f88e3d0a6b0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
        swaywm#1 0x7f88e35b51fb in logind_session_destroy ../subprojects/wlroots/backend/session/logind.c:270
        swaywm#2 0x7f88e35905a4 in wlr_session_destroy ../subprojects/wlroots/backend/session/session.c:156
        swaywm#3 0x7f88e358f440 in handle_display_destroy ../subprojects/wlroots/backend/session/session.c:65
        swaywm#4 0x7f88e314acde  (/lib64/libwayland-server.so.0+0x8cde)

    previously allocated by thread T0 here:
        #0 0x7f88e3d0acd8 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:153
        swaywm#1 0x7f88e35b911c in logind_session_create ../subprojects/wlroots/backend/session/logind.c:746
        swaywm#2 0x7f88e358f6b4 in wlr_session_create ../subprojects/wlroots/backend/session/session.c:91
        swaywm#3 0x559fefb51ea6 in main ../main.c:20
        swaywm#4 0x7f88e2639152 in __libc_start_main (/lib64/libc.so.6+0x27152)
emersion added a commit that referenced this issue Jan 16, 2021
The GBM device needs to be destroyed after the EGL display.

    ==50931==ERROR: AddressSanitizer: SEGV on unknown address 0x7fe40a000049 (pc 0x7fe446121d30 bp 0x60400001bbd0 sp 0x7ffc99c774d0 T0)
    ==50931==The signal is caused by a READ memory access.
        #0 0x7fe446121d30  (/usr/lib/dri/radeonsi_dri.so+0x5f0d30)
        #1 0x7fe4474717bd  (/usr/lib/../lib/libEGL_mesa.so.0+0x177bd)
        #2 0x7fe4474677d9  (/usr/lib/../lib/libEGL_mesa.so.0+0xd7d9)
        #3 0x7fe44cca7b6f in wlr_egl_destroy ../subprojects/wlroots/render/egl.c:379
        #4 0x7fe44ccc2626 in gles2_destroy ../subprojects/wlroots/render/gles2/renderer.c:705
        #5 0x7fe44ccb5041 in wlr_renderer_destroy ../subprojects/wlroots/render/wlr_renderer.c:37
        #6 0x7fe44cd17850 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:296
        #7 0x7fe44ccca4de in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:48
        #8 0x7fe44cd11b21 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:58
        #9 0x7fe44cd125b0 in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:125
        #10 0x7fe44c315e0e  (/usr/lib/libwayland-server.so.0+0x8e0e)
        #11 0x7fe44c3165a6 in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x95a6)
        #12 0x55a2c8870683 in server_fini ../sway/server.c:203
        #13 0x55a2c886cbf2 in main ../sway/main.c:436
        #14 0x7fe44b77c151 in __libc_start_main (/usr/lib/libc.so.6+0x28151)
        #15 0x55a2c883172d in _start (/home/simon/src/sway/build/sway/sway+0x33472d)
emersion added a commit to emersion/wlroots that referenced this issue Mar 16, 2021
The original motivation is the following crash:

    #0  0x00007f0ddeddeef5 in raise () at /usr/lib/libc.so.6
    #1  0x00007f0ddedc8862 in abort () at /usr/lib/libc.so.6
    #2  0x00007f0ddedc8747 in _nl_load_domain.cold () at /usr/lib/libc.so.6
    swaywm#3  0x00007f0ddedd7646 in  () at /usr/lib/libc.so.6
    swaywm#4  0x00007f0de033f8de in gles2_get_renderer_in_context (wlr_renderer=0x612000003640) at ../subprojects/wlroots/render/gles2/renderer.c:38
    swaywm#5  0x00007f0de0341675 in gles2_begin (wlr_renderer=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/gles2/renderer.c:186
    swaywm#6  0x00007f0de033b100 in wlr_renderer_begin (r=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/wlr_renderer.c:56
    swaywm#7  0x00007f0de03466ed in gles2_blit_dmabuf (wlr_renderer=0x612000003640, dst_attr=0x60b000150148, src_attr=0x7fff9f9bfde0) at ../subprojects/wlroots/render/gles2/renderer.c:591
    swaywm#8  0x00007f0de033d717 in wlr_renderer_blit_dmabuf (r=0x612000003640, dst=0x60b000150148, src=0x7fff9f9bfde0) at ../subprojects/wlroots/render/wlr_renderer.c:210
    swaywm#9  0x00007f0de04cbc3b in frame_handle_output_commit (listener=0x611000220bc8, data=0x7fff9f9c0050) at ../subprojects/wlroots/types/wlr_screencopy_v1.c:303

The GLES2 renderer assumes it'll have a wlr_buffer to render to.

Instead of accomodating for the edge-case of rendering without a
wlr_buffer, drop wlr_renderer_blit_dmabuf calls and instead use
wlr_renderer_bind_buffer just like the rest of the wlr_renderer users.
wlr_renderer_blit_dmabuf is now unused in wlroots.

The upside is that the new blit_dmabuf function in screencopy is
renderer-agnostic.
emersion added a commit that referenced this issue Mar 16, 2021
The original motivation is the following crash:

    #0  0x00007f0ddeddeef5 in raise () at /usr/lib/libc.so.6
    #1  0x00007f0ddedc8862 in abort () at /usr/lib/libc.so.6
    #2  0x00007f0ddedc8747 in _nl_load_domain.cold () at /usr/lib/libc.so.6
    #3  0x00007f0ddedd7646 in  () at /usr/lib/libc.so.6
    #4  0x00007f0de033f8de in gles2_get_renderer_in_context (wlr_renderer=0x612000003640) at ../subprojects/wlroots/render/gles2/renderer.c:38
    #5  0x00007f0de0341675 in gles2_begin (wlr_renderer=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/gles2/renderer.c:186
    #6  0x00007f0de033b100 in wlr_renderer_begin (r=0x612000003640, width=3840, height=2160) at ../subprojects/wlroots/render/wlr_renderer.c:56
    #7  0x00007f0de03466ed in gles2_blit_dmabuf (wlr_renderer=0x612000003640, dst_attr=0x60b000150148, src_attr=0x7fff9f9bfde0) at ../subprojects/wlroots/render/gles2/renderer.c:591
    #8  0x00007f0de033d717 in wlr_renderer_blit_dmabuf (r=0x612000003640, dst=0x60b000150148, src=0x7fff9f9bfde0) at ../subprojects/wlroots/render/wlr_renderer.c:210
    #9  0x00007f0de04cbc3b in frame_handle_output_commit (listener=0x611000220bc8, data=0x7fff9f9c0050) at ../subprojects/wlroots/types/wlr_screencopy_v1.c:303

The GLES2 renderer assumes it'll have a wlr_buffer to render to.

Instead of accomodating for the edge-case of rendering without a
wlr_buffer, drop wlr_renderer_blit_dmabuf calls and instead use
wlr_renderer_bind_buffer just like the rest of the wlr_renderer users.
wlr_renderer_blit_dmabuf is now unused in wlroots.

The upside is that the new blit_dmabuf function in screencopy is
renderer-agnostic.
emersion added a commit to emersion/wlroots that referenced this issue Jul 8, 2021
[1] and [2] have introduced new wl_array usage in wlroots, but
contains a mistake: wl_array_for_each iterates over pointers to
the wl_array entries, not over entries themselves.

Fix all wl_array_for_each call sites. Name the variables "ptr"
to avoid confusion.

Found via ASan:

    ==148752==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x602000214111 in thread T0
        #0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
        #1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24
        #2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51
        swaywm#3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306
        swaywm#4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57
        swaywm#5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57
        swaywm#6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124
        swaywm#7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e)
        swaywm#8 0x55cd1a77c9e5 in server_fini ../sway/server.c:218
        swaywm#9 0x55cd1a77893f in main ../sway/main.c:400
        swaywm#10 0x7f6ff04bdb24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
        swaywm#11 0x55cd1a73a7ad in _start (/home/simon/src/sway/build/sway/sway+0x33a7ad)

    0x602000214111 is located 1 bytes inside of 16-byte region [0x602000214110,0x602000214120)
    freed by thread T0 here:
        #0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
        #1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24
        #2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51
        swaywm#3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306
        swaywm#4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57
        swaywm#5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57
        swaywm#6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124
        swaywm#7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e)

    previously allocated by thread T0 here:
        #0 0x7f6ff2236279 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
        #1 0x7f6ff1066d03 in wl_array_add (/usr/lib/libwayland-server.so.0+0xdd03)

[1]: swaywm#3002
[2]: swaywm#3004
bl4ckb0ne pushed a commit that referenced this issue Jul 8, 2021
[1] and [2] have introduced new wl_array usage in wlroots, but
contains a mistake: wl_array_for_each iterates over pointers to
the wl_array entries, not over entries themselves.

Fix all wl_array_for_each call sites. Name the variables "ptr"
to avoid confusion.

Found via ASan:

    ==148752==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x602000214111 in thread T0
        #0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
        #1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24
        #2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51
        #3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306
        #4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57
        #5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57
        #6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124
        #7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e)
        #8 0x55cd1a77c9e5 in server_fini ../sway/server.c:218
        #9 0x55cd1a77893f in main ../sway/main.c:400
        #10 0x7f6ff04bdb24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
        #11 0x55cd1a73a7ad in _start (/home/simon/src/sway/build/sway/sway+0x33a7ad)

    0x602000214111 is located 1 bytes inside of 16-byte region [0x602000214110,0x602000214120)
    freed by thread T0 here:
        #0 0x7f6ff2235f19 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
        #1 0x7f6ff1c04004 in wlr_tablet_destroy ../subprojects/wlroots/types/wlr_tablet_tool.c:24
        #2 0x7f6ff1b8463c in wlr_input_device_destroy ../subprojects/wlroots/types/wlr_input_device.c:51
        #3 0x7f6ff1ab9941 in backend_destroy ../subprojects/wlroots/backend/wayland/backend.c:306
        #4 0x7f6ff1a68323 in wlr_backend_destroy ../subprojects/wlroots/backend/backend.c:57
        #5 0x7f6ff1ab36b4 in multi_backend_destroy ../subprojects/wlroots/backend/multi/backend.c:57
        #6 0x7f6ff1ab417c in handle_display_destroy ../subprojects/wlroots/backend/multi/backend.c:124
        #7 0x7f6ff106184e in wl_display_destroy (/usr/lib/libwayland-server.so.0+0x884e)

    previously allocated by thread T0 here:
        #0 0x7f6ff2236279 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
        #1 0x7f6ff1066d03 in wl_array_add (/usr/lib/libwayland-server.so.0+0xdd03)

[1]: #3002
[2]: #3004
Emantor added a commit to Emantor/wlroots that referenced this issue Aug 16, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:

  #0  atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
          drm = 0x1ae9c10
          output = 0x270f5c0
          crtc = 0x0
          modeset = false
          active = false
          mode_id = 43989232
          gamma_lut = 0
          prev_vrr_enabled = <optimized out>
          vrr_enabled = <optimized out>
          atom = {req = 0x270f5c0, failed = 48}
          ok = <optimized out>
  swaywm#1  0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
          __PRETTY_FUNCTION__ = "drm_crtc_commit"
          drm = <optimized out>
          crtc = 0x0
          ok = <optimized out>
  swaywm#2  0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
          conn = 0x270f5c0
          unsupported = <optimized out>
  swaywm#3  0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
          conn = 0x270f5c0
  swaywm#4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
          now = {tv_sec = 7732, tv_nsec = 623813006}
          pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
          back_buffer = 0x0
          scale_updated = <optimized out>
          geometry_updated = <optimized out>
          committed = <optimized out>
          event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
  swaywm#5  0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
          wlr_output = 0x270f5c0
          output_box = <optimized out>
  swaywm#6  0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
          current = 0x29f38f0
          name = <optimized out>
          wildcard = true
          id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
          sway_output = 0x2710720
          tmp = 0x2242030
          seat = <optimized out>
  swaywm#7  0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
          error = <optimized out>
          output = <optimized out>
          background = false
  swaywm#8  0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
          res = <optimized out>
          argc = 4
          argv = 0x2a03370
          handler = 0x479230 <handlers+560>
          cmd = <optimized out>
          matched_delim = 0 '\000'
          containers = 0x0
          using_criteria = false
          __PRETTY_FUNCTION__ = "execute_command"
          exec = 0x28f63c0 "output * dpms off"
          head = 0x0
          res_list = 0x2a2e9d0
  swaywm#9  0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
          line = <optimized out>
          res_list = <optimized out>
          json = <optimized out>
          length = <optimized out>
          __PRETTY_FUNCTION__ = "ipc_client_handle_command"
          buf = 0x2975d20 "output * dpms off"
  swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
          pending_length = <optimized out>
          pending_type = <optimized out>
          client = 0x2a6ac80
          read_available = 31
          buf = "i3-ipc\021\000\000\000\000\000\000"
          received = 14
  swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
  No locals.
  swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
          verbose = 0
          debug = 0
          validate = 0
          allow_unsupported_gpu = 0
          long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
              name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
              has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
              flag = 0x0, val = 0}}
          config_path = 0x0
          usage = 0x45b830 "Usage: sway [options] [command]\n\n  -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n  -c, --config <config>  Specify a config file.\n  -C, --validate         Check the validity of the config file, th"...
          c = <optimized out>

where the second output is not enabled:

  (gdb) frame 4
  swaywm#4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
  837	in ../types/wlr_output.c
  (gdb) p output->enabled
  $3 = false
  (gdb)

The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.

Signed-off-by: Rouven Czerwinski <rouven@czerwinskis.de>
Emantor added a commit to Emantor/wlroots that referenced this issue Aug 16, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:

  #0  atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
          drm = 0x1ae9c10
          output = 0x270f5c0
          crtc = 0x0
          modeset = false
          active = false
          mode_id = 43989232
          gamma_lut = 0
          prev_vrr_enabled = <optimized out>
          vrr_enabled = <optimized out>
          atom = {req = 0x270f5c0, failed = 48}
          ok = <optimized out>
  swaywm#1  0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
          __PRETTY_FUNCTION__ = "drm_crtc_commit"
          drm = <optimized out>
          crtc = 0x0
          ok = <optimized out>
  swaywm#2  0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
          conn = 0x270f5c0
          unsupported = <optimized out>
  swaywm#3  0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
          conn = 0x270f5c0
  swaywm#4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
          now = {tv_sec = 7732, tv_nsec = 623813006}
          pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
          back_buffer = 0x0
          scale_updated = <optimized out>
          geometry_updated = <optimized out>
          committed = <optimized out>
          event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
  swaywm#5  0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
          wlr_output = 0x270f5c0
          output_box = <optimized out>
  swaywm#6  0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
          current = 0x29f38f0
          name = <optimized out>
          wildcard = true
          id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
          sway_output = 0x2710720
          tmp = 0x2242030
          seat = <optimized out>
  swaywm#7  0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
          error = <optimized out>
          output = <optimized out>
          background = false
  swaywm#8  0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
          res = <optimized out>
          argc = 4
          argv = 0x2a03370
          handler = 0x479230 <handlers+560>
          cmd = <optimized out>
          matched_delim = 0 '\000'
          containers = 0x0
          using_criteria = false
          __PRETTY_FUNCTION__ = "execute_command"
          exec = 0x28f63c0 "output * dpms off"
          head = 0x0
          res_list = 0x2a2e9d0
  swaywm#9  0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
          line = <optimized out>
          res_list = <optimized out>
          json = <optimized out>
          length = <optimized out>
          __PRETTY_FUNCTION__ = "ipc_client_handle_command"
          buf = 0x2975d20 "output * dpms off"
  swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
          pending_length = <optimized out>
          pending_type = <optimized out>
          client = 0x2a6ac80
          read_available = 31
          buf = "i3-ipc\021\000\000\000\000\000\000"
          received = 14
  swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
  No locals.
  swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
          verbose = 0
          debug = 0
          validate = 0
          allow_unsupported_gpu = 0
          long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
              name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
              has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
              flag = 0x0, val = 0}}
          config_path = 0x0
          usage = 0x45b830 "Usage: sway [options] [command]\n\n  -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n  -c, --config <config>  Specify a config file.\n  -C, --validate         Check the validity of the config file, th"...
          c = <optimized out>

where the second output is not enabled:

  (gdb) frame 4
  swaywm#4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
  837	in ../types/wlr_output.c
  (gdb) p output->enabled
  $3 = false
  (gdb)

The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.
Emantor added a commit to Emantor/wlroots that referenced this issue Aug 16, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:

  #0  atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
          drm = 0x1ae9c10
          output = 0x270f5c0
          crtc = 0x0
          modeset = false
          active = false
          mode_id = 43989232
          gamma_lut = 0
          prev_vrr_enabled = <optimized out>
          vrr_enabled = <optimized out>
          atom = {req = 0x270f5c0, failed = 48}
          ok = <optimized out>
  swaywm#1  0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
          __PRETTY_FUNCTION__ = "drm_crtc_commit"
          drm = <optimized out>
          crtc = 0x0
          ok = <optimized out>
  swaywm#2  0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
          conn = 0x270f5c0
          unsupported = <optimized out>
  swaywm#3  0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
          conn = 0x270f5c0
  swaywm#4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
          now = {tv_sec = 7732, tv_nsec = 623813006}
          pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
          back_buffer = 0x0
          scale_updated = <optimized out>
          geometry_updated = <optimized out>
          committed = <optimized out>
          event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
  swaywm#5  0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
          wlr_output = 0x270f5c0
          output_box = <optimized out>
  swaywm#6  0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
          current = 0x29f38f0
          name = <optimized out>
          wildcard = true
          id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
          sway_output = 0x2710720
          tmp = 0x2242030
          seat = <optimized out>
  swaywm#7  0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
          error = <optimized out>
          output = <optimized out>
          background = false
  swaywm#8  0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
          res = <optimized out>
          argc = 4
          argv = 0x2a03370
          handler = 0x479230 <handlers+560>
          cmd = <optimized out>
          matched_delim = 0 '\000'
          containers = 0x0
          using_criteria = false
          __PRETTY_FUNCTION__ = "execute_command"
          exec = 0x28f63c0 "output * dpms off"
          head = 0x0
          res_list = 0x2a2e9d0
  swaywm#9  0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
          line = <optimized out>
          res_list = <optimized out>
          json = <optimized out>
          length = <optimized out>
          __PRETTY_FUNCTION__ = "ipc_client_handle_command"
          buf = 0x2975d20 "output * dpms off"
  swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
          pending_length = <optimized out>
          pending_type = <optimized out>
          client = 0x2a6ac80
          read_available = 31
          buf = "i3-ipc\021\000\000\000\000\000\000"
          received = 14
  swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
  No locals.
  swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
          verbose = 0
          debug = 0
          validate = 0
          allow_unsupported_gpu = 0
          long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
              name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
              has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
              flag = 0x0, val = 0}}
          config_path = 0x0
          usage = 0x45b830 "Usage: sway [options] [command]\n\n  -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n  -c, --config <config>  Specify a config file.\n  -C, --validate         Check the validity of the config file, th"...
          c = <optimized out>

where the second output is not enabled:

  (gdb) frame 4
  swaywm#4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
  837	in ../types/wlr_output.c
  (gdb) p output->enabled
  $3 = false
  (gdb)

The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.
Emantor added a commit to Emantor/wlroots that referenced this issue Aug 16, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:

  #0  atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
          drm = 0x1ae9c10
          output = 0x270f5c0
          crtc = 0x0
          modeset = false
          active = false
          mode_id = 43989232
          gamma_lut = 0
          prev_vrr_enabled = <optimized out>
          vrr_enabled = <optimized out>
          atom = {req = 0x270f5c0, failed = 48}
          ok = <optimized out>
  swaywm#1  0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
          __PRETTY_FUNCTION__ = "drm_crtc_commit"
          drm = <optimized out>
          crtc = 0x0
          ok = <optimized out>
  swaywm#2  0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
          conn = 0x270f5c0
          unsupported = <optimized out>
  swaywm#3  0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
          conn = 0x270f5c0
  swaywm#4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
          now = {tv_sec = 7732, tv_nsec = 623813006}
          pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
          back_buffer = 0x0
          scale_updated = <optimized out>
          geometry_updated = <optimized out>
          committed = <optimized out>
          event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
  swaywm#5  0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
          wlr_output = 0x270f5c0
          output_box = <optimized out>
  swaywm#6  0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
          current = 0x29f38f0
          name = <optimized out>
          wildcard = true
          id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
          sway_output = 0x2710720
          tmp = 0x2242030
          seat = <optimized out>
  swaywm#7  0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
          error = <optimized out>
          output = <optimized out>
          background = false
  swaywm#8  0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
          res = <optimized out>
          argc = 4
          argv = 0x2a03370
          handler = 0x479230 <handlers+560>
          cmd = <optimized out>
          matched_delim = 0 '\000'
          containers = 0x0
          using_criteria = false
          __PRETTY_FUNCTION__ = "execute_command"
          exec = 0x28f63c0 "output * dpms off"
          head = 0x0
          res_list = 0x2a2e9d0
  swaywm#9  0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
          line = <optimized out>
          res_list = <optimized out>
          json = <optimized out>
          length = <optimized out>
          __PRETTY_FUNCTION__ = "ipc_client_handle_command"
          buf = 0x2975d20 "output * dpms off"
  swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
          pending_length = <optimized out>
          pending_type = <optimized out>
          client = 0x2a6ac80
          read_available = 31
          buf = "i3-ipc\021\000\000\000\000\000\000"
          received = 14
  swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
  No locals.
  swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
          verbose = 0
          debug = 0
          validate = 0
          allow_unsupported_gpu = 0
          long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
              name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
              has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
              flag = 0x0, val = 0}}
          config_path = 0x0
          usage = 0x45b830 "Usage: sway [options] [command]\n\n  -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n  -c, --config <config>  Specify a config file.\n  -C, --validate         Check the validity of the config file, th"...
          c = <optimized out>

where the second output is not enabled:

  (gdb) frame 4
  swaywm#4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
  837	in ../types/wlr_output.c
  (gdb) p output->enabled
  $3 = false
  (gdb)

The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.
Emantor added a commit to Emantor/wlroots that referenced this issue Aug 17, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:

  #0  atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
          drm = 0x1ae9c10
          output = 0x270f5c0
          crtc = 0x0
          modeset = false
          active = false
          mode_id = 43989232
          gamma_lut = 0
          prev_vrr_enabled = <optimized out>
          vrr_enabled = <optimized out>
          atom = {req = 0x270f5c0, failed = 48}
          ok = <optimized out>
  swaywm#1  0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
          __PRETTY_FUNCTION__ = "drm_crtc_commit"
          drm = <optimized out>
          crtc = 0x0
          ok = <optimized out>
  swaywm#2  0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
          conn = 0x270f5c0
          unsupported = <optimized out>
  swaywm#3  0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
          conn = 0x270f5c0
  swaywm#4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
          now = {tv_sec = 7732, tv_nsec = 623813006}
          pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
          back_buffer = 0x0
          scale_updated = <optimized out>
          geometry_updated = <optimized out>
          committed = <optimized out>
          event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
  swaywm#5  0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
          wlr_output = 0x270f5c0
          output_box = <optimized out>
  swaywm#6  0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
          current = 0x29f38f0
          name = <optimized out>
          wildcard = true
          id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
          sway_output = 0x2710720
          tmp = 0x2242030
          seat = <optimized out>
  swaywm#7  0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
          error = <optimized out>
          output = <optimized out>
          background = false
  swaywm#8  0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
          res = <optimized out>
          argc = 4
          argv = 0x2a03370
          handler = 0x479230 <handlers+560>
          cmd = <optimized out>
          matched_delim = 0 '\000'
          containers = 0x0
          using_criteria = false
          __PRETTY_FUNCTION__ = "execute_command"
          exec = 0x28f63c0 "output * dpms off"
          head = 0x0
          res_list = 0x2a2e9d0
  swaywm#9  0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
          line = <optimized out>
          res_list = <optimized out>
          json = <optimized out>
          length = <optimized out>
          __PRETTY_FUNCTION__ = "ipc_client_handle_command"
          buf = 0x2975d20 "output * dpms off"
  swaywm#10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
          pending_length = <optimized out>
          pending_type = <optimized out>
          client = 0x2a6ac80
          read_available = 31
          buf = "i3-ipc\021\000\000\000\000\000\000"
          received = 14
  swaywm#11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  swaywm#12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  swaywm#13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
  No locals.
  swaywm#14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
          verbose = 0
          debug = 0
          validate = 0
          allow_unsupported_gpu = 0
          long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
              name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
              has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
              flag = 0x0, val = 0}}
          config_path = 0x0
          usage = 0x45b830 "Usage: sway [options] [command]\n\n  -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n  -c, --config <config>  Specify a config file.\n  -C, --validate         Check the validity of the config file, th"...
          c = <optimized out>

where the second output is not enabled:

  (gdb) frame 4
  swaywm#4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
  837	in ../types/wlr_output.c
  (gdb) p output->enabled
  $3 = false
  (gdb)

The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.
emersion pushed a commit that referenced this issue Aug 17, 2021
This should fix the following backtrace, seen on my desktop with one
output disabled:

  #0  atomic_crtc_commit (conn=0x270f5c0, state=0x270f6d0, flags=0, test_only=<optimized out>) at ../backend/drm/atomic.c:178
          drm = 0x1ae9c10
          output = 0x270f5c0
          crtc = 0x0
          modeset = false
          active = false
          mode_id = 43989232
          gamma_lut = 0
          prev_vrr_enabled = <optimized out>
          vrr_enabled = <optimized out>
          atom = {req = 0x270f5c0, failed = 48}
          ok = <optimized out>
  #1  0x00007f1104f33128 in drm_crtc_commit (conn=conn@entry=0x270f5c0, state=state@entry=0x270f6d0, flags=flags@entry=0, test_only=test_only@entry=true) at ../backend/drm/drm.c:339
          __PRETTY_FUNCTION__ = "drm_crtc_commit"
          drm = <optimized out>
          crtc = 0x0
          ok = <optimized out>
  #2  0x00007f1104f34e6c in drm_connector_test (output=output@entry=0x270f5c0) at ../backend/drm/drm.c:488
          conn = 0x270f5c0
          unsupported = <optimized out>
  #3  0x00007f1104f35424 in drm_connector_commit (output=0x270f5c0) at ../backend/drm/drm.c:578
          conn = 0x270f5c0
  #4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
          now = {tv_sec = 7732, tv_nsec = 623813006}
          pre_event = {output = 0x270f5c0, when = 0x7ffecc1be570}
          back_buffer = 0x0
          scale_updated = <optimized out>
          geometry_updated = <optimized out>
          committed = <optimized out>
          event = {output = 0x0, committed = 4401048, when = 0x29f38f0}
  #5  0x0000000000433047 in apply_output_config (oc=oc@entry=0x29f38f0, output=output@entry=0x2710720) at ../sway/config/output.c:431
          wlr_output = 0x270f5c0
          output_box = <optimized out>
  #6  0x0000000000433aaf in apply_output_config_to_outputs (oc=0x2308400) at ../sway/config/output.c:649
          current = 0x29f38f0
          name = <optimized out>
          wildcard = true
          id = "Dell Inc. DELL U2410 F525M9AK0MML\000\060\060\060ACD7\000\000\000\000\000\000\000\220\063\240\002\000\000\000\000L5C\000\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\377\377\377\377\000\000\000\000\355\240E\000\000\000\000\000\377\377\377\377\000\000\000\000@\206+\002\000\000\000\000`\260.\002\000\000\000"
          sway_output = 0x2710720
          tmp = 0x2242030
          seat = <optimized out>
  #7  0x000000000043df6b in cmd_output (argc=<optimized out>, argv=0x2a03390) at ../sway/commands/output.c:108
          error = <optimized out>
          output = <optimized out>
          background = false
  #8  0x0000000000410304 in execute_command (_exec=_exec@entry=0x2975d20 "output * dpms off", seat=0x22a3280, seat@entry=0x0, con=con@entry=0x0) at ../sway/commands.c:291
          res = <optimized out>
          argc = 4
          argv = 0x2a03370
          handler = 0x479230 <handlers+560>
          cmd = <optimized out>
          matched_delim = 0 '\000'
          containers = 0x0
          using_criteria = false
          __PRETTY_FUNCTION__ = "execute_command"
          exec = 0x28f63c0 "output * dpms off"
          head = 0x0
          res_list = 0x2a2e9d0
  #9  0x0000000000418b65 in ipc_client_handle_command (client=client@entry=0x2a6ac80, payload_length=<optimized out>, payload_type=IPC_COMMAND) at ../sway/ipc-server.c:645
          line = <optimized out>
          res_list = <optimized out>
          json = <optimized out>
          length = <optimized out>
          __PRETTY_FUNCTION__ = "ipc_client_handle_command"
          buf = 0x2975d20 "output * dpms off"
  #10 0x000000000041964c in ipc_client_handle_readable (client_fd=<optimized out>, mask=<optimized out>, data=0x2a6ac80) at ../sway/ipc-server.c:267
          pending_length = <optimized out>
          pending_type = <optimized out>
          client = 0x2a6ac80
          read_available = 31
          buf = "i3-ipc\021\000\000\000\000\000\000"
          received = 14
  #11 0x00007f1104fc3492 in wl_event_loop_dispatch () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  #12 0x00007f1104fc1135 in wl_display_run () from /nix/store/ridk7k2ka6dbk4ly7qqjgmc523s4fj89-wayland-1.19.0/lib/libwayland-server.so.0
  No symbol table info available.
  #13 0x000000000041ac10 in server_run (server=server@entry=0x47b0c0 <server>) at ../sway/server.c:261
  No locals.
  #14 0x000000000041a3fc in main (argc=<optimized out>, argv=0x7ffecc1bec68) at ../sway/main.c:395
          verbose = 0
          debug = 0
          validate = 0
          allow_unsupported_gpu = 0
          long_options = {{name = 0x45b516 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x45ee69 "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x45b51b "validate", has_arg = 0, flag = 0x0, val = 67}, {
              name = 0x45b524 "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x45b3ac "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x45a55c "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x45b52a "get-socketpath",
              has_arg = 0, flag = 0x0, val = 112}, {name = 0x45b539 "unsupported-gpu", has_arg = 0, flag = 0x0, val = 117}, {name = 0x45b549 "my-next-gpu-wont-be-nvidia", has_arg = 0, flag = 0x0, val = 117}, {name = 0x0, has_arg = 0,
              flag = 0x0, val = 0}}
          config_path = 0x0
          usage = 0x45b830 "Usage: sway [options] [command]\n\n  -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n  -c, --config <config>  Specify a config file.\n  -C, --validate         Check the validity of the config file, th"...
          c = <optimized out>

where the second output is not enabled:

  (gdb) frame 4
  #4  0x00007f1104f600b7 in wlr_output_commit (output=output@entry=0x270f5c0) at ../types/wlr_output.c:837
  837	in ../types/wlr_output.c
  (gdb) p output->enabled
  $3 = false
  (gdb)

The culprit being that since 604674d we
always try to perform a commit, even on a disabled output.
emersion added a commit to emersion/wlroots that referenced this issue Oct 29, 2021
Variables on the stack are released when the parent block is closed.
Here, `now` is used outside of the `if` block, causing the following
crash when starting Sway with the headless backend:

    ==49606==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fff94645f90 at pc 0x5558aeae9e29 bp 0x7fff94645df0 sp 0x7fff94645de0
    READ of size 16 at 0x7fff94645f90 thread T0
        #0 0x5558aeae9e28 in handle_present ../sway/desktop/output.c:834
        #1 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
        #2 0x7fdc8d54f77f in wlr_output_send_present ../subprojects/wlroots/types/output/output.c:766
        swaywm#3 0x7fdc8d524a28 in output_commit ../subprojects/wlroots/backend/headless/output.c:71
        swaywm#4 0x7fdc8d54d2db in wlr_output_commit ../subprojects/wlroots/types/output/output.c:629
        swaywm#5 0x5558aeb013cb in output_render ../sway/desktop/render.c:1157
        swaywm#6 0x5558aeae549e in output_repaint_timer_handler ../sway/desktop/output.c:544
        swaywm#7 0x5558aeae5f8a in damage_handle_frame ../sway/desktop/output.c:606
        swaywm#8 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
        swaywm#9 0x7fdc8d6007d5 in output_handle_frame ../subprojects/wlroots/types/wlr_output_damage.c:44
        swaywm#10 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
        swaywm#11 0x7fdc8d54ee84 in wlr_output_send_frame ../subprojects/wlroots/types/output/output.c:720
        swaywm#12 0x7fdc8d54efc3 in schedule_frame_handle_idle_timer ../subprojects/wlroots/types/output/output.c:728
        swaywm#13 0x7fdc8c9dcf5a in wl_event_loop_dispatch_idle (/usr/lib/libwayland-server.so.0+0xaf5a)
        swaywm#14 0x7fdc8c9dcfb4 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xafb4)
        swaywm#15 0x7fdc8c9dabc6 in wl_display_run (/usr/lib/libwayland-server.so.0+0x8bc6)
        swaywm#16 0x5558aeac8e30 in server_run ../sway/server.c:285
        swaywm#17 0x5558aeac3c7d in main ../sway/main.c:396
        swaywm#18 0x7fdc8be35b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
        swaywm#19 0x5558aea8686d in _start (/home/simon/src/sway/build/sway/sway+0x33f86d)
vyivel pushed a commit that referenced this issue Oct 29, 2021
Variables on the stack are released when the parent block is closed.
Here, `now` is used outside of the `if` block, causing the following
crash when starting Sway with the headless backend:

    ==49606==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7fff94645f90 at pc 0x5558aeae9e29 bp 0x7fff94645df0 sp 0x7fff94645de0
    READ of size 16 at 0x7fff94645f90 thread T0
        #0 0x5558aeae9e28 in handle_present ../sway/desktop/output.c:834
        #1 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
        #2 0x7fdc8d54f77f in wlr_output_send_present ../subprojects/wlroots/types/output/output.c:766
        #3 0x7fdc8d524a28 in output_commit ../subprojects/wlroots/backend/headless/output.c:71
        #4 0x7fdc8d54d2db in wlr_output_commit ../subprojects/wlroots/types/output/output.c:629
        #5 0x5558aeb013cb in output_render ../sway/desktop/render.c:1157
        #6 0x5558aeae549e in output_repaint_timer_handler ../sway/desktop/output.c:544
        #7 0x5558aeae5f8a in damage_handle_frame ../sway/desktop/output.c:606
        #8 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
        #9 0x7fdc8d6007d5 in output_handle_frame ../subprojects/wlroots/types/wlr_output_damage.c:44
        #10 0x7fdc8d6792fb in wlr_signal_emit_safe ../subprojects/wlroots/util/signal.c:29
        #11 0x7fdc8d54ee84 in wlr_output_send_frame ../subprojects/wlroots/types/output/output.c:720
        #12 0x7fdc8d54efc3 in schedule_frame_handle_idle_timer ../subprojects/wlroots/types/output/output.c:728
        #13 0x7fdc8c9dcf5a in wl_event_loop_dispatch_idle (/usr/lib/libwayland-server.so.0+0xaf5a)
        #14 0x7fdc8c9dcfb4 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xafb4)
        #15 0x7fdc8c9dabc6 in wl_display_run (/usr/lib/libwayland-server.so.0+0x8bc6)
        #16 0x5558aeac8e30 in server_run ../sway/server.c:285
        #17 0x5558aeac3c7d in main ../sway/main.c:396
        #18 0x7fdc8be35b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
        #19 0x5558aea8686d in _start (/home/simon/src/sway/build/sway/sway+0x33f86d)
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Development

No branches or pull requests