Kitty sometimes crashes

[coaxial]

Describe the bug

I know you're not a fan of tmux, but it is part of my workflow and I'm very happy with kitty + tmux.

So I have a key to select some text with tmux and put it in the clipboard so I can paste it in a browser window for instance. But once in a while, this will crash kitty.

To Reproduce
Steps to reproduce the behavior:

1. Use tmux with the config file below
2. Enter scrollback mode (C-a for me), then select some text with v, and yank it to the system's clipboard with Y
3. press q to exit scrollback mode
4. Most of the time this will work, but sometimes it will crash kitty. It seems to be random. I'd say it crashes about 10% of the time.

Screenshots

When kitty crashes, dmesg shows:

[162056.889709] kitty[1904332]: segfault at 0 ip 0000000000000000 sp 00007ffe6a956788 error 14
[162056.889727] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.

Environment details

kitty 0.26.4 created by Kovid Goyal
Linux drakkar 5.15.0-52-generic #58~20.04.1-Ubuntu SMP Thu Oct 13 13:09:46 UTC 2022 x86_64
Linux Mint 20.3 Una drakkar /dev/tty

DISTRIB_ID=LinuxMint
DISTRIB_RELEASE=20.3
DISTRIB_CODENAME=una
DISTRIB_DESCRIPTION="Linux Mint 20.3 Una"
Running under: X11
Frozen: True
Paths:
  kitty: /home/rock/.local/kitty.app/bin/kitty
  base dir: /home/rock/.local/kitty.app/lib/kitty
  extensions dir: /home/rock/.local/kitty.app/lib/kitty-extensions
  system shell: /bin/bash
Loaded config files:
  /etc/xdg/kitty/kitty.conf
  /home/rock/.config/kitty/kitty.conf

Config options different from defaults:
bold_font             Terminus Bold
bold_italic_font      Terminus Bold Italic
enable_audio_bell     False
font_family           Terminus
font_size             10.0
italic_font           Terminus Italic
shell                 bash --login
symbol_map:
	U+e000 - U+f8ff → icons-in-terminal
	U+f000 - U+fffd → icons-in-terminal
	U+100000 - U+10fffd → icons-in-terminal
update_check_interval 0.0
visual_bell_duration  0.1
Colors:
	background            #0e1419   
	color1                #ff3333   
	color10               #e9fe83   
	color11               #fff778   
	color12               #68d4ff   
	color13               #ffa3aa   
	color14               #c7fffc   
	color2                #b8cc52   
	color3                #e6c446   
	color4                #36a3d9   
	color5                #f07078   
	color6                #95e5cb   
	color7                #ffffff   
	color8                #323232   
	color9                #ff6565   
	cursor                #f19618   
	foreground            #e5e1cf   
	selection_background  #243340   
	selection_foreground  #0e1419   

Important environment variables seen by the kitty process:
	PATH                                /home/rock/.nvm/versions/node/v16.17.1/bin:/home/rock/.serverless/bin:/usr/local/sbin:/usr/local/bin:/home/rock/bin::/home/rock/.cargo/bin:/home/rock/.nvm/versions/node/v16.17.1/bin:/home/rock/bin:/home/rock/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/home/rock/.rvm/bin:/usr/local/go/bin:/home/rock/go/bin:/home/rock/.yarn/bin:/home/rock/.config/yarn/global:/home/rock/.rvm/bin
	LANG                                en_US
	EDITOR                              /usr/bin/nvim
	SHELL                               /bin/bash
	DISPLAY                             :0
	USER                                rock
	XDG_SEAT                            seat0
	XDG_SESSION_TYPE                    x11
	XDG_SEAT_PATH                       /org/freedesktop/DisplayManager/Seat0
	LC_MONETARY                         de_CH.UTF-8
	XDG_SESSION_CLASS                   user
	XDG_SESSION_ID                      c2
	XDG_SESSION_PATH                    /org/freedesktop/DisplayManager/Session0
	LC_ADDRESS                          de_CH.UTF-8
	XDG_RUNTIME_DIR                     /run/user/1000
	LC_TELEPHONE                        de_CH.UTF-8
	XDG_CURRENT_DESKTOP                 X-Cinnamon
	XDG_SESSION_DESKTOP                 cinnamon
	XDG_GREETER_DATA_DIR                /var/lib/lightdm-data/rock
	LC_NAME                             de_CH.UTF-8
	LC_MEASUREMENT                      de_CH.UTF-8
	LC_IDENTIFICATION                   de_CH.UTF-8
	XDG_VTNR                            7
	LC_ALL                              en_US.UTF-8
	XDG_CONFIG_DIRS                     /etc/xdg/xdg-cinnamon:/etc/xdg
	XDG_DATA_DIRS                       /usr/share/cinnamon:/usr/share/gnome:/home/pierre/.local/share/flatpak/exports/share:/var/lib/flatpak/exports/share:/usr/local/share:/usr/share
	LC_NUMERIC                          de_CH.UTF-8
	LC_PAPER                            de_CH.UTF-8

Additional context

# tmux.conf
unbind Y
bind -T copy-mode-vi Y send-keys -X copy-pipe "xclip -sel clip -i"

[kovidgoyal]

Does not crash for me with those steps, after 17 repetitions. So either
come up with a more reliable reproducer or at least post a backtrace.
Otherwise I have no way to help.

Also, from your tmux config, you seem to be using xclip for copy paste, dont
do that, use osc 52, it will even work over ssh. And given you are using
xclip, I don't see how copying to clipboard would crash kitty at all,
since the terminal is not involved. So most likely its something else.

If you provide more info/reproducer, I will take another look, closing
as not reproducable for the nonce.

[Racle]

@kovidgoyal this seems to be happening to me also for quite a while now.

[ 1905.523429] x-terminal-emul[10795]: segfault at 0 ip 0000000000000000 sp 00007ffd4ad20fb8 error 14 in kitty[560b53400000+23000] likely on CPU 14 (core 28, socket 0)
[ 1905.523437] Code: Unable to access opcode bytes at 0xffffffffffffffd6.

I'm using tmux + neovim + pop_os 22.04. (https://github.com/Racle/dotfiles)
This happens very rarely (zero to two times a day when I'm coding), but it seems to be happening when I yank with yy.
I even updated to latest kitty (0.27.1) and it still happens.

I can repeat that with my config with just spamming y.

With tmux is easy to resume my session, but still little annoying.

[kovidgoyal]

I still need a reproducer or a backtrace.

[Racle]

I still need a reproducer or a backtrace.

@kovidgoyal you got my dotfiles above, using those and neovim inside tmux should do the trick.

I can also provide more logs if you have some guide how to generate those.
Currently dmesg is showing only those two lines, so that's not so helpful for debugging..

[Racle]

@kovidgoyal quick update, seems that clean neovim doesn't break kitty.

I removed ojroques/vim-oscyank which uses OSC52 and seems that after removing this plugin I cannot reproduce kitty crashing anymore.

So something how that plugin works (+ combination of my config) breaks kitty.
Using only that plugin (and clean tmux) doesn't break kitty.

Plugin config (if this helps):

" automatic yank after pressing y
autocmd TextYankPost * if v:event.operator is 'y' && v:event.regname is '' | execute 'OSCYankReg "' | endif

" don't echo yanks
let g:oscyank_silent = v:true

[kovidgoyal]

I'm afraid a whole set of dotfiles is too large a reproducer. If you can
narrow it down to a minimal set I will try with that.

If you want to produce a crash dump build kitty from source with

make asan

see https://sw.kovidgoyal.net/kitty/build/

then when you reproduce it you should get a nice dump printed to the
terminal in which you ran kitty.

[kovidgoyal]

Also IIRC neovim unlike vim supports OSC 52 out of the box you shouldnt need a plugin for that. Another simple thing you can try is running kitty from another terminal and seeing if anything is printed to its stderr before it crashes.

[kovidgoyal]

And another thing you can try. Run

kitty --dump-bytes /tmp/dump

and cause it to crash. Then attach /tmp/dump here. Hopefully that should reproduce the issue for me.

[Racle]

@kovidgoyal Got this error on terminal

=================================================================
==323445==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 164247 byte(s) in 126 object(s) allocated from:
    #0 0x7ff5fe8b4867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7ff5fe337f07  (/lib/x86_64-linux-gnu/libpython3.10.so.1.0+0x137f07)

Direct leak of 160 byte(s) in 5 object(s) allocated from:
    #0 0x7ff5fe8b4867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7ff5fe422bd9 in PyThread_allocate_lock (/lib/x86_64-linux-gnu/libpython3.10.so.1.0+0x222bd9)

Indirect leak of 52918 byte(s) in 53 object(s) allocated from:
    #0 0x7ff5fe8b4867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x7ff5fe337f07  (/lib/x86_64-linux-gnu/libpython3.10.so.1.0+0x137f07)

Indirect leak of 664 byte(s) in 1 object(s) allocated from:

    #0 0x7ff5fe8b4c18 in __interceptor_realloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:164
    #1 0x7ff5fe42b238 in _PyObject_GC_Resize (/lib/x86_64-linux-gnu/libpython3.10.so.1.0+0x22b238)

SUMMARY: AddressSanitizer: 217989 byte(s) leaked in 185 allocation(s).

Full log here: log.zip (I did clean up some usernames/folder names, but everything else is as they were dumped)

[kovidgoyal]

That's a null pointer dereference. Sadly ASAN isnt providing a useful
stack trace. Try running it under gdb:

gdb kitty -ex r

run till it crashes then run the bt command at the gdb prompt to get a
trace

Unfortunately your dump doesnt crash for me.

[Racle]

@kovidgoyal

Here you go:

Type "apropos word" to search for commands related to "word"...
Reading symbols from ./kitty/launcher/kitty...
Starting program: /tmp/kitty/kitty/launcher/kitty 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[Detaching after fork from child process 462315]
[New Thread 0x7fffe3e7e640 (LWP 462316)]
[New Thread 0x7fffe367d640 (LWP 462317)]
[New Thread 0x7fffe2e6d640 (LWP 462318)]
[New Thread 0x7fffe264f640 (LWP 462319)]
[New Thread 0x7fffe1e31640 (LWP 462320)]
[New Thread 0x7fffe1613640 (LWP 462321)]
[New Thread 0x7fffe0df5640 (LWP 462322)]
[New Thread 0x7fffe05d7640 (LWP 462323)]
[New Thread 0x7fffdfdb9640 (LWP 462324)]
[New Thread 0x7fffdf59b640 (LWP 462325)]
[New Thread 0x7fffded7d640 (LWP 462326)]
[New Thread 0x7fffde55f640 (LWP 462327)]
[New Thread 0x7fffddd41640 (LWP 462328)]
[New Thread 0x7fffdd523640 (LWP 462329)]
[New Thread 0x7fffdcd05640 (LWP 462330)]
[New Thread 0x7fffdc4e7640 (LWP 462331)]
[New Thread 0x7fffdbcc9640 (LWP 462332)]
[New Thread 0x7fffdb4ab640 (LWP 462333)]
[New Thread 0x7fffdac8d640 (LWP 462334)]
[New Thread 0x7fffda378640 (LWP 462335)]
[New Thread 0x7fffd9564640 (LWP 462336)]
[Thread 0x7fffda378640 (LWP 462335) exited]
[New Thread 0x7fffda378640 (LWP 462338)]
[Detaching after fork from child process 462339]
[066 10:02:43.996418] Application escape mode is not supported, the extended keyboard protocol should be used instead
[066 10:02:43.996446] Application escape mode is not supported, the extended keyboard protocol should be used instead

Thread 1 "kitty" received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007fffef2e0142 in get_clipboard_data (cd=cd@entry=0x7fffef420158 <_glfw+1240>, mime=<optimized out>, data=data@entry=0x7fffffff7f00) at glfw/x11_window.c:722
#2  0x00007fffef2e5af9 in writeTargetToProperty (request=request@entry=0x7fffffff87e0) at glfw/x11_window.c:878
#3  0x00007fffef2e5ef6 in handleSelectionRequest (event=event@entry=0x7fffffff87e0) at glfw/x11_window.c:915
#4  0x00007fffef2f24db in processEvent (event=event@entry=0x7fffffff87e0) at glfw/x11_window.c:1188
#5  0x00007fffef2f7a1c in dispatch_x11_queued_events (num_events=0) at glfw/x11_window.c:2662
#6  0x00007fffef2f7cde in _glfwDispatchX11Events () at glfw/x11_window.c:2676
#7  0x00007fffef2f814f in handleEvents (timeout=-1) at glfw/x11_window.c:74
#8  0x00007fffef2f81b0 in _glfwPlatformWaitEvents () at glfw/x11_window.c:2729
#9  0x00007fffef2d4fb7 in _glfwPlatformRunMainLoop (tick_callback=tick_callback@entry=0x7ffff0bb82fa <process_global_state>, data=data@entry=0x7ffff65aa830) at glfw/main_loop.h:30
#10 0x00007fffef2b3091 in glfwRunMainLoop (callback=0x7ffff0bb82fa <process_global_state>, data=0x7ffff65aa830) at glfw/init.c:355
#11 0x00007ffff0c7159b in run_main_loop (cb=cb@entry=0x7ffff0bb82fa <process_global_state>, cb_data=cb_data@entry=0x7ffff65aa830) at kitty/glfw.c:1697
#12 0x00007ffff0ba3a35 in main_loop (self=0x7ffff65aa830, a=<optimized out>) at kitty/child-monitor.c:1207
#13 0x00007ffff6ef08ba in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#14 0x00007ffff6e79eee in _PyEval_EvalFrameDefault () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#15 0x00007ffff6fc681f in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#16 0x00007ffff6e7862e in _PyEval_EvalFrameDefault () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#17 0x00007ffff6fc681f in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#18 0x00007ffff6ee6e37 in _PyObject_FastCallDictTstate () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#19 0x00007ffff6ee7050 in _PyObject_Call_Prepend () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#20 0x00007ffff6f51c89 in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#21 0x00007ffff6ee61ac in _PyObject_MakeTpCall () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#22 0x00007ffff6e7c27a in _PyEval_EvalFrameDefault () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#23 0x00007ffff6fc681f in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#24 0x00007ffff6e7862e in _PyEval_EvalFrameDefault () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#25 0x00007ffff6fc681f in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#26 0x00007ffff6e7862e in _PyEval_EvalFrameDefault () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#27 0x00007ffff6fc681f in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#28 0x00007ffff6e7862e in _PyEval_EvalFrameDefault () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#29 0x00007ffff6fc681f in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#30 0x00007ffff6fc194e in PyEval_EvalCode () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#31 0x00007ffff6fc1edd in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#32 0x00007ffff6f2eb13 in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#33 0x00007ffff6e7862e in _PyEval_EvalFrameDefault () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#34 0x00007ffff6fc681f in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#35 0x00007ffff6e7862e in _PyEval_EvalFrameDefault () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#36 0x00007ffff6fc681f in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#37 0x00007ffff702c919 in ?? () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#38 0x00007ffff702d5e4 in Py_RunMain () from /lib/x86_64-linux-gnu/libpython3.10.so.1.0
#39 0x000055555555ae25 in run_embedded (run_data=0x7fffffffa480) at kitty/launcher/main.c:203
#40 0x000055555555c7d4 in main (argc=1, argv=0x7fffffffd968, envp=0x7fffffffd978) at kitty/launcher/main.c:367