Crash when opening scrollback buffer

[travankor]

On kitty 0.19.1 on Linux I can sometimes reproduce a crash when opening the scrollback buffer and there is a secondary shell like gdb opened (not really sure about the last part). I have also noticed that when kitty does not crash, the scrollback buffer usually has garbage characters in its output. I am on python3.9 if this matters, too.

Steps to reproduce the behavior:
1. Open gdb
2. Open scrollback buffer
3. Crashes or corrupted scrollback buffer

Expected behavior
No crashes. Scrollback buffer is not corrupted.

Backtrace:

Details

#0  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:262
262     ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S: No such file or directory.
[Current thread is 1 (Thread 0x7f66564a3740 (LWP 12780))]
(gdb) bt full
#0  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:262
No locals.
#1  0x00007f66556ac236 in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>, __dest=<optimized out>, __src=<optimized out>, __len=<optimized out>) at /usr/include/bits/string_fortified.h:34
No locals.
#2  pagerhist_as_bytes (self=<optimized out>, args=<optimized out>) at kitty/history.c:432
        ph = 0x7f6654c5d990
        l = <optimized out>
        sz = 12298
        ans = 0x55f2fdf408d0
        buf = 0x55f2fdf408f0 "\351\367\204\002\362U"
        copied = 12298
#3  0x00007f66556ac32a in pagerhist_as_text (self=<optimized out>, args=<optimized out>) at kitty/history.c:441
        ans = 0x0
        bytes = <optimized out>
#4  0x00007f665688b7f2 in ?? () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#5  0x00007f6656847453 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#6  0x00007f6656942aff in ?? () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#7  0x00007f6656881b7a in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#8  0x00007f6656846dee in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#9  0x00007f6656942aff in ?? () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#10 0x00007f6656881b7a in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#11 0x00007f6656884798 in ?? () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#12 0x00007f66568471e7 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#13 0x00007f6656942aff in ?? () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#14 0x00007f6656881b7a in _PyFunction_Vectorcall () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#15 0x00007f665688482c in ?? () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#16 0x00007f66568818be in PyVectorcall_Call () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#17 0x00007f665684589f in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#18 0x00007f66568409bb in ?? () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#19 0x00007f6656847453 in _PyEval_EvalFrameDefault () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#20 0x00007f66568409bb in ?? () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#21 0x00007f6656884704 in ?? () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#22 0x00007f6656882a7e in ?? () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#23 0x00007f6656883391 in _PyObject_CallMethod_SizeT () from /usr/lib/libpython3.9.so.1.0
No symbol table info available.
#24 0x00007f66556b9410 in on_key_input (ev=<optimized out>) at kitty/keys.c:173
        ret = <optimized out>
        w = 0x55f2fdf1b9b0
        action = 1
        key = 72
        screen = 0x7f6650526010
--Type <RET> for more, q to quit, c to continue without paging--
        has_text = false
        native_key = <optimized out>
        mods = <optimized out>
        text = 0x7f6654b995a0 ""
        ok_to_send = <optimized out>
        w = <optimized out>
        action = <optimized out>
        native_key = <optimized out>
        key = <optimized out>
        mods = <optimized out>
        text = <optimized out>
        screen = <optimized out>
        has_text = <optimized out>
        ok_to_send = <optimized out>
        cret_ = <optimized out>
        ret = <optimized out>
        consumed = <optimized out>
#25 key_callback (w=<optimized out>, ev=<optimized out>) at kitty/glfw.c:268
        key_modifier = <optimized out>
        key_modifier = <optimized out>
#26 key_callback (w=<optimized out>, ev=<optimized out>) at kitty/glfw.c:253
        key_modifier = <optimized out>
#27 0x00007f6654b3f538 in ?? ()
No symbol table info available.
#28 0x00007ffcc6d2c060 in ?? ()
No symbol table info available.
#29 0x0000000000000000 in ?? ()
No symbol table info available.
(gdb) quit

dmesg:

[42370.910368] kitty[12780]: segfault at 0 ip 00007f665677940f sp 00007ffcc6d2b0a8 error 4 in libc-2.30.so[7f665663d000+149000]
[42370.910387] Code: 17 e0 c5 f8 77 c3 48 3b 15 8e 0c 06 00 0f 83 25 01 00 00 48 39 f7 72 0f 74 12 4c 8d 0c 16 4c 39 cf 0f 82 c5 01 00 00 48 89 d1 <f3> a4 c3 80 fa 10 73 17 80 fa 08 73 27 80 fa 04 73 33 80 fa 01 77

[kovidgoyal]

Run kitty as

kitty --dump-bytes dump.bin --config NONE -o scrollback_pager-history_size=whatever

reproduce the crash with as few steps as possible and post dump.bin

[travankor]

I'm not sure I can easily reproduce this one although I have been sporadically running into this crash.

[kovidgoyal]

it's possible there is a bug in the new ring buffer implementation that
was done for supporting hyperlinks in the scrollback buffer, but it's
not obvious to me where it is.

[travankor]

Can ASAN help pinpoint this crash?

[kovidgoyal]

It might, but that also requires a way to reproduce. You can build and
run kitty with ASAN by doing

make asan

[kovidgoyal]

I did find one memory related potential bug in this area: 792a3e7

[ssoriche]

I have the Apple Crash report if that would help? Has happened to me once per day over the past three days when trying to access the scrollback.

[kovidgoyal]

the apple crash report is the same as a backtrace. You need to either build with asan and post the error report from that, or find a way to reproduce and post the dump as described above.

https://sw.kovidgoyal.net/kitty/build.html

[hatzel]

Yeah, I ran into the same bug. I have not been able to reproduce it. It does happen probably around once a week though.

What I tried was dumping huge amounts of data into kitty cat /dev/urandom | base64 and than open the scrollback buffer. I was not able to reproduce it that way.

I also run kitty with -1 usually so maybe it could be related to that as well.

Will probably mess around with this some more, hopefully we can find out what's causing this.

[kovidgoyal]

I suggest building and running with asan as I described above, that might give us a more illuminating traceback

[kovidgoyal]

Note that since I cannot reproduce I have no way of confirming the fix, so please test.

[refractalize]

This happens pretty frequently for me, although I can't reproduce it in a controlled manner. It happens almost without fail when I've been working for a few hours already and I want to see the scrollback. So it's perhaps something to do with either the size of the scrollback, or some kind of encoding or control chars used in the contents of the scrollback. I can't reproduce it at will tho.

I'm using Macos 11.2. I've seen it seg fault on both 19.3 and from recent HEAD builds. My config:

scrollback_pager less --ignore-case --chop-long-lines --RAW-CONTROL-CHARS +INPUT_LINE_NUMBER
scrollback_pager_history_size 4096
map cmd+f show_scrollback

I also see seg faults when using launch with @screen_scrollback:

map cmd+shift+f launch --cwd=current --stdin-source=@screen_scrollback --type=overlay /usr/local/bin/nvim -R -

I'd like to help get this fixed because it's really preventing me from using scrollback seriously (tho when it does work it's sublime - I'm a recovering tmux user). I've tried to build using make asan but I'm seeing this:

{master} (11:54:43 +0.128) kitty λ make asan             
python3 setup.py build  --debug --sanitize
CC: clang (12, 0)
[12/59] Compiling kitty/shaders.c ... done
Compiling kitty/unicode-data.c ...
clang -MMD -DDEBUG -DPRIMARY_VERSION=4000 -DSECONDARY_VERSION=19 -DGL_SILENCE_DEPRECATION -Wextra -Wfloat-conversion -Wno-missing-field-initializers -Wall -Wstrict-prototypes -std=c11 -pedantic-errors -Werror -g3 -Og -fsanitize=address -fsanitize=undefined -fno-omit-frame-pointer -fwrapv -fstack-protector-strong -pipe -fvisibility=hidden -D_FORTIFY_SOURCE=2 -DKITTY_DEBUG_BUILD -pthread -I/usr/local/Cellar/libpng/1.6.37/include/libpng16 -I/usr/local/Cellar/little-cms2/2.11/include -I/usr/local/Cellar/harfbuzz/2.7.4/include/harfbuzz -I/usr/local/opt/freetype/include/freetype2 -I/usr/local/Cellar/graphite2/1.3.14/include -I/usr/local/Cellar/glib/2.66.6/include/glib-2.0 -I/usr/local/Cellar/glib/2.66.6/lib/glib-2.0/include -I/usr/local/opt/gettext/include -I/usr/local/Cellar/pcre/8.44/include -I/usr/local/Cellar/python@3.9/3.9.1_8/Frameworks/Python.framework/Versions/3.9/include/python3.9 -c kitty/unicode-data.c -o build/fast_data_types-unicode-data.c.o
In file included from <built-in>:369:
<command line>:5:9: error: '_FORTIFY_SOURCE' macro redefined [-Werror,-Wmacro-redefined]
#define _FORTIFY_SOURCE 2
        ^
<built-in>:355:9: note: previous definition is here
#define _FORTIFY_SOURCE 0
        ^
1 error generated.
make: *** [asan] Error 1

Any ideas?