app_server crash

[humdinger]

This is hrev50574.

Had app_server crash, see the syslog snippet below. Next time I'll try to get a core file... (Please, someone add the important keyword from this syslog to the summary of the ticket. I don't know what's significant. Also close the ticket, if the info is too vague to be of help...)

KERN: 808: DEBUGGER: _numAvailable <= _numBlocks
KERN: debug_server: Thread 808 entered the debugger: Debugger call: `_numAvailable <= _numBlocks'
KERN: vm_soft_fault: va 0x1d020000 not covered by area in address space
KERN: vm_page_fault: vm_soft_fault returned error 'Bad address' on fault at 0x1d020000, ip 0x18998d4, write 1, user 1, thread 0x3e97
KERN: vm_page_fault: thread "w:902:offscreen" (16023) in team "app_server" (673) tried to write address 0x1d020000, ip 0x18998d4 ("app_server_seg0ro" +0x1178d4)
KERN: stack trace, current PC 0x618f4114  commpage_syscall + 0x4:
KERN:   (0x70cf7f20)  0x25ab6cd  __assert_fail + 0x51
KERN:   (0x70cf7f50)  0x2623694  isValid__Q28BPrivate10superblock + 0x60
KERN:   (0x70cf7f80)  0x262198d  malloc__Q28BPrivate10threadHeapUl + 0x199
KERN:   (0x70cf7fe0)  0x26224d6  malloc + 0x17a
KERN:   (0x70cf8010)  0x262327c  realloc + 0x110
KERN:   (0x70cf8040)  0xf83297  _SetSize__7BRegionl + 0x9b
KERN:   (0x70cf8070)  0xf83a70  miRegionOp__Q27BRegion7SupportP7BRegionPC7BRegionT2PFP7BRegionP13clipping_rectP13clipping_rectP13clipping_rectP13clipping_rectii_iPFP7BRegionP13clipping_rectP13clipping_rectii_iT5 + 0x64
KERN:   (0x70cf80c0)  0xf838aa  XIntersectRegion__Q27BRegion7SupportPC7BRegionT1P7BRegion + 0x66
KERN:   (0x70cf8100)  0xf83072  IntersectWith__7BRegionPC7BRegion + 0x32
KERN:   (0x70cf8160)  0x1848295  VisibleContentRegion__6Window + 0x41
KERN:   (0x70cf81a0)  0x1849883  InvalidateView__6WindowP4ViewR7BRegion + 0x22f
KERN:   (0x70cf8268)  0x1838fa1  _DispatchViewMessage__12ServerWindowlRQ28BPrivate12LinkReceiver + 0x3099
KERN:   (0x70cf85a8)  0x1835e16  _DispatchMessage__12ServerWindowlRQ28BPrivate12LinkReceiver + 0x12ce
KERN:   (0x70cf86d8)  0x1840f60  _MessageLooper__12ServerWindow + 0x258
KERN:   (0x70cf8758)  0x181542c  _message_thread__13MessageLooperPv + 0x28
KERN:   (0x70cf8788)  0x25a3383  thread_entry + 0x23
KERN: 761: DEBUGGER: _numAvailable <= _numBlocks
KERN: vm_soft_fault: va 0x75676000 not covered by area in address space
KERN: vm_page_fault: vm_soft_fault returned error 'Bad address' on fault at 0x75676572, ip 0x185efab, write 0, user 1, thread 0x23b2
KERN: vm_page_fault: thread "a:9135:x-vnd.Ink-Vision" (9138) in team "app_server" (673) tried to read address 0x75676572, ip 0x185efab ("app_server_seg0ro" +0xdcfab)

[jua]

This is a heap corruption issue, so unfortunately, the backtrace alone is not sufficient to debug it any further. I'll close this ticket, as you said, but if you see it again and can create a core file, please reopen it.

p.s. I think we need another ticket status for cases like this, something like "can't reproduce". Marking it "invalid" doesn't seem quite right here...

[humdinger]

I've added a status "not reproducible". Let's try it out...

[luroh]

gcc2h, hrev53475

1. Press <Alt>+<A> in /boot/system/packages.
2. Right click any package and select 'Get info' (a lot of InfoWindows will open).
3. Repeat steps 1 & 2 above a second time.

If you then try to move an InfoWindow:

318: DEBUGGER: active_span->state == SPAN_STATE_ACTIVE
debug_server: Thread 318 entered the debugger: Debugger call: `active_span->state == SPAN_STATE_ACTIVE'
stack trace, current PC 0x61f6a114  commpage_syscall + 0x4:
  (0x71544948)  0xdb0f7a  __assert_fail + 0x6e
  (0x71544988)  0xe26929  _memory_allocate_from_heap_fallback__Q28BPrivate8rpmallocPQ38BPrivate8rpmalloc6heap_tUi + 0x51
  (0x715449c8)  0xe26b0a  _memory_allocate_small__Q28BPrivate8rpmallocPQ38BPrivate8rpmalloc6heap_tUl + 0x36
  (0x715449f8)  0xe26ce2  _memory_allocate__Q28BPrivate8rpmallocPQ38BPrivate8rpmalloc6heap_tUl + 0x2a
  (0x71544a28)  0xe27500  _memory_reallocate__Q28BPrivate8rpmallocPvUlUlUi + 0x250
  (0x71544a68)  0xe280c0  rprealloc__Q28BPrivate8rpmallocPvUl + 0x24
  (0x71544a98)  0xe2876e  realloc + 0x42
  (0x71544ac8)  0x1735617  _SetSize__7BRegionl + 0x9b
  (0x71544af8)  0x1735df0  miRegionOp__Q27BRegion7SupportP7BRegionPC7BRegionT2PFP7BRegionP13clipping_rectP13clipping_rectP13clipping_rectP13clipping_rectii_iPFP7BRegionP13clipping_rectP13clipping_rectii_iT5 + 0x64
  (0x71544b48)  0x1735c2a  XIntersectRegion__Q27BRegion7SupportPC7BRegionT1P7BRegion + 0x66
  (0x71544b88)  0x17353f2  IntersectWith__7BRegionPC7BRegion + 0x32
  (0x71544be8)  0x1de5925  SetClipping__6WindowP7BRegion + 0x35
  (0x71544c28)  0x1da1fea  _RebuildClippingForAllWindows__7DesktopR7BRegion + 0x5e
  (0x71544c68)  0x1d9cc8d  MoveWindowBy__7DesktopP6Windowffl + 0x2fd
  (0x71544d38)  0x1df62da  MouseMovedAction__Q222DefaultWindowBehaviour9DragStateR6BPointx + 0x9e
  (0x71544da8)  0x1df6135  MouseMoved__Q222DefaultWindowBehaviour18MouseTrackingStateP8BMessageG6BPointb + 0xfd
  (0x71544de8)  0x1df52a4  MouseMoved__22DefaultWindowBehaviourP8BMessageG6BPointb + 0x4c
  (0x71544e28)  0x1de7422  MouseMoved__6WindowP8BMessageG6BPointPlbT4 + 0x76
  (0x71544e68)  0x1d99299  Filter__11MouseFilterP8BMessagePP11EventTargetPlT1 + 0x371
  (0x71544ee8)  0x1dacf66  _EventLoop__15EventDispatcher + 0x29e
  (0x71544f78)  0x1dad6f7  _event_looper__15EventDispatcherPv + 0x1f
  (0x71544fa8)  0xda72f5  thread_entry + 0x29

[luroh]

History range of possible fixes: ​https://gitlab.freedesktop.org/xorg/lib/libx11/commits/master/src/Region.c

[luroh]

Perhaps my crash is related to something other than heap corruption, in which case I apologize for reopening this ticket based on unrelated information.

[waddlesplash]

Not reproducible anymore with that mechanism either.