wlr/backend/calloc SIGABRT

[nearffxx]

Not sure how to reproduce. Here is the backtrace.
It seems the bug is related to wlroots and its drm backend, should I make an issue in the wlr repo?

sway version 1.0-alpha.2-83-g66b93c1c (May 24 2018, branch 'master')

Reading symbols from /usr/bin/sway...done.
[New LWP 1191]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Core was generated by `sway'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007fa1e93e986b in raise () from /usr/lib/libc.so.6
gef➤  bt full
#0  0x00007fa1e93e986b in raise () at /usr/lib/libc.so.6
#1  0x00007fa1e93d440e in abort () at /usr/lib/libc.so.6
#2  0x00007fa1e942b8b8 in __libc_message () at /usr/lib/libc.so.6
#3  0x00007fa1e9431d4a in  () at /usr/lib/libc.so.6
#4  0x00007fa1e943204a in  () at /usr/lib/libc.so.6
#5  0x00007fa1e9434c10 in _int_malloc () at /usr/lib/libc.so.6
#6  0x00007fa1e9437172 in calloc () at /usr/lib/libc.so.6
#7  0x00007fa1e53b5029 in drmModeAtomicDuplicate () at /usr/lib/libdrm.so.2
#8  0x00007fa1e53b50dc in drmModeAtomicCommit () at /usr/lib/libdrm.so.2
#9  0x00007fa1e9bdf758 in atomic_commit (drm_fd=0x9, atom=0x7ffe7cc764d0, conn=0x556bd80d3310, flags=0x201, modeset=0x0) at ../backend/drm/atomic.c:52
        ret = 0x2f
#10 0x00007fa1e9bdfc28 in atomic_crtc_pageflip (drm=0x556bd79623b0, conn=0x556bd80d3310, crtc=0x556bd7973570, fb_id=0x5e, mode=0x0) at ../backend/drm/atomic.c:126
        flags = 0x201
        atom = {
          req = 0x556bd7f99e30, 
          cursor = 0x0, 
          failed = 0x0
        }
#11 0x00007fa1e9be1523 in drm_connector_swap_buffers (output=0x556bd80d3310, damage=0x7ffe7cc765b0) at ../backend/drm/drm.c:222
        conn = 0x556bd80d3310
        drm = 0x556bd79623b0
        crtc = 0x556bd7973570
        plane = 0x556bd7962e30
        bo = 0x556bd7fde080
        fb_id = 0x5e
#12 0x00007fa1e9c12d49 in wlr_output_swap_buffers (output=0x556bd80d3310, when=0x7ffe7cc766d0, damage=0x7ffe7cc766e0) at ../types/wlr_output.c:513
        width = 0x780
        height = 0x4b0
        render_damage = {
          extents = {
            x1 = 0x0, 
            y1 = 0x0, 
            x2 = 0x780, 
            y2 = 0x4b0
          }, 
          data = 0x0
        }
        transform = WL_OUTPUT_TRANSFORM_FLIPPED_180
#13 0x00007fa1e9c0fe4c in wlr_output_damage_swap_buffers (output_damage=0x556bd80d5d70, when=0x7ffe7cc766d0, damage=0x7ffe7cc766e0) at ../types/wlr_output_damage.c:145
#14 0x0000556bd688a9c7 in render_output (output=0x556bd80d4fa0, when=0x7ffe7cc766d0, damage=0x7ffe7cc766e0) at ../sway/desktop/output.c:854
        wlr_output = 0x556bd80d3310
        renderer = 0x556bd7ad6d90
        __PRETTY_FUNCTION__ = "render_output"
        workspace = 0x556bd82f6020
#15 0x0000556bd688ad37 in damage_handle_frame (listener=0x556bd80d5098, data=0x556bd80d5d70) at ../sway/desktop/output.c:947
        output = 0x556bd80d4fa0
        now = {
          tv_sec = 0x3111, 
          tv_nsec = 0x2a3252af
        }
        needs_swap = 0x1
        damage = {
          extents = {
            x1 = 0x0, 
            y1 = 0x0, 
            x2 = 0x780, 
            y2 = 0x4b0
          }, 
          data = 0x0
        }
#16 0x00007fa1e9c1d035 in wlr_signal_emit_safe (signal=0x556bd80d5dd0, data=0x556bd80d5d70) at ../util/signal.c:29
        pos = 0x556bd80d5098
        l = 0x556bd80d5098
        cursor = {
          link = {
            prev = 0x556bd80d5098, 
            next = 0x7ffe7cc76750
          }, 
          notify = 0x7fa1e9c1cf7f <handle_noop>
        }
        end = {
          link = {
            prev = 0x7ffe7cc76730, 
            next = 0x556bd80d5dd0
          }, 
          notify = 0x7fa1e9c1cf7f <handle_noop>
        }
#17 0x00007fa1e9c0f948 in output_handle_frame (listener=0x556bd80d5e68, data=0x556bd80d3310) at ../types/wlr_output_damage.c:50
        output_damage = 0x556bd80d5d70
#18 0x00007fa1e9c1d035 in wlr_signal_emit_safe (signal=0x556bd80d3428, data=0x556bd80d3310) at ../util/signal.c:29
        pos = 0x556bd80d5e68
        l = 0x556bd80d5e68
        cursor = {
          link = {
            prev = 0x556bd80d5e68, 
            next = 0x7ffe7cc767f0
          }, 
          notify = 0x7fa1e9c1cf7f <handle_noop>
        }
        end = {
          link = {
            prev = 0x7ffe7cc767d0, 
            next = 0x556bd80d3428
          }, 
          notify = 0x7fa1e9c1cf7f <handle_noop>
        }
#19 0x00007fa1e9c12dd7 in wlr_output_send_frame (output=0x556bd80d3310) at ../types/wlr_output.c:527
#20 0x00007fa1e9be40c3 in page_flip_handler (fd=0x9, seq=0xb6d7b, tv_sec=0x3111, tv_usec=0xacf2a, user=0x556bd80d3310) at ../backend/drm/drm.c:925
        conn = 0x556bd80d3310
        drm = 0x556bd79623b0
#21 0x00007fa1e53b0485 in drmHandleEvent () at /usr/lib/libdrm.so.2
#22 0x00007fa1e9be4134 in handle_drm_event (fd=0x9, mask=0x1, data=0x0) at ../backend/drm/drm.c:935
        event = {
          version = 0x4, 
          vblank_handler = 0x0, 
          page_flip_handler = 0x7fa1e9be401b <page_flip_handler>, 
          page_flip_handler2 = 0x0, 
          sequence_handler = 0x0
        }
#23 0x00007fa1e9e4ea42 in wl_event_loop_dispatch () at /usr/lib/libwayland-server.so.0
#24 0x00007fa1e9e4d14c in wl_display_run () at /usr/lib/libwayland-server.so.0
#25 0x0000556bd687e177 in server_run (server=0x556bd6ac1520 <server>) at ../sway/server.c:126
#26 0x0000556bd687db49 in main (argc=0x1, argv=0x7ffe7cc770a8) at ../sway/main.c:428
        verbose = 0x0
        debug = 0x0
        validate = 0x0
        long_options = {{
            name = 0x556bd68af5c4 "help", 
            has_arg = 0x0, 
            flag = 0x0, 
            val = 0x68
          }, {
            name = 0x556bd68af5c9 "config", 
            has_arg = 0x1, 
            flag = 0x0, 
            val = 0x63
          }, {
            name = 0x556bd68af5d0 "validate", 
            has_arg = 0x0, 
            flag = 0x0, 
            val = 0x43
          }, {
            name = 0x556bd68af5d9 "debug", 
            has_arg = 0x0, 
            flag = 0x0, 
            val = 0x64
          }, {
            name = 0x556bd68af5df "version", 
            has_arg = 0x0, 
            flag = 0x0, 
            val = 0x76
          }, {
            name = 0x556bd68af5e7 "verbose", 
            has_arg = 0x0, 
            flag = 0x0, 
            val = 0x56
          }, {
            name = 0x556bd68af5ef "get-socketpath", 
            has_arg = 0x0, 
            flag = 0x0, 
            val = 0x70
          }, {
            name = 0x0, 
            has_arg = 0x0, 
            flag = 0x0, 
            val = 0x0
          }}
        config_path = 0x0
        usage = 0x556bd68af180 "Usage: sway [options] [command]\n\n  -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n  -c, --config <config>  Specify a config file.\n  -C, --validate         Check the validity of the config file, then exit.\n  -d, --debug", ' ' <repeats 12 times>, "Enables full logging, including debug information.\n  -v, --version          Show the version number and quit.\n  -V, --verbose          Enables more verbose logging.\n      --get-socketpath   Gets the IPC socket path and prints it, then exits.\n\n"
        c = 0xffffffff
        suid = 0x0
gef➤  quit

[dryya]

I've been having this intermittent crash as well that seems related - if I'm making a mistake and it's not I can file a separate issue. Here is a backtrace:

coredumpctl gdb 15295
           PID: 15295 (sway)
           UID: 1000 (gmend)
           GID: 1000 (gmend)
        Signal: 6 (ABRT)
     Timestamp: Fri 2018-05-25 15:54:37 CDT (3min 26s ago)
  Command Line: sway -d
    Executable: /usr/bin/sway
 Control Group: /user.slice/user-1000.slice/session-c4.scope
          Unit: session-c4.scope
         Slice: user-1000.slice
       Session: c4
     Owner UID: 1000 (gmend)
       Boot ID: 5f1d9f2727284360b873a11f27443d96
    Machine ID: 9abc13d0191f400db2d10e00a47913e8
      Hostname: spectre
       Storage: /var/lib/systemd/coredump/core.sway.1000.5f1d9f2727284360b873a11f27443d96.15295.1527281677000000.lz4
       Message: Process 15295 (sway) of user 1000 dumped core.
                
                Stack trace of thread 15295:
                #0  0x00007f691440286b raise (libc.so.6)
                #1  0x00007f69143ed40e abort (libc.so.6)
                #2  0x00007f69144448b8 __libc_message (libc.so.6)
                #3  0x00007f691444ad4a malloc_printerr (libc.so.6)
                #4  0x00007f691444b2a4 munmap_chunk (libc.so.6)
                #5  0x000055cfa5050a69 _container_destroy (sway)
                #6  0x000055cfa5051522 container_destroy (sway)
                #7  0x000055cfa505573c view_unmap (sway)
                #8  0x00007f6914c1f3be wlr_signal_emit_safe (libwlroots.so.0)
                #9  0x00007f6914bef7b4 xsurface_unmap (libwlroots.so.0)
                #10 0x00007f6914c1f3be wlr_signal_emit_safe (libwlroots.so.0)
                #11 0x00007f6914c1ba9a surface_handle_resource_destroy (libwlroots.so.0)
                #12 0x00007f6914e4cb5f n/a (libwayland-server.so.0)
                #13 0x00007f6914e4cbcf wl_resource_destroy (libwayland-server.so.0)
                #14 0x00007f6914c1f3be wlr_signal_emit_safe (libwlroots.so.0)
                #15 0x00007f6914c04091 wlr_renderer_destroy (libwlroots.so.0)
                #16 0x00007f6914bf6d33 finish_drm_renderer (libwlroots.so.0)
                #17 0x00007f6914bf3be5 backend_destroy (libwlroots.so.0)
                #18 0x00007f6914bfb099 multi_backend_destroy (libwlroots.so.0)
                #19 0x00007f6914e4cad2 n/a (libwayland-server.so.0)
                #20 0x00007f6914e4d217 wl_display_destroy (libwayland-server.so.0)
                #21 0x000055cfa50339d3 main (sway)
                #22 0x00007f69143ef06b __libc_start_main (libc.so.6)
                #23 0x000055cfa5033bfa _start (sway)
                
                Stack trace of thread 15296:
                #0  0x00007f69141baffc pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
                #1  0x00007f690c391094 n/a (i965_dri.so)
                #2  0x00007f690c390d88 n/a (i965_dri.so)
                #3  0x00007f69141b5075 start_thread (libpthread.so.0)
                #4  0x00007f69144c453f __clone (libc.so.6)

GNU gdb (GDB) 8.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/bin/sway...done.
[New LWP 15295]
[New LWP 15296]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Core was generated by `sway -d'.
Program terminated with signal SIGABRT, Aborted.
#0  0x00007f691440286b in raise () from /usr/lib/libc.so.6
[Current thread is 1 (Thread 0x7f6916e369c0 (LWP 15295))]
(gdb) bt full
#0  0x00007f691440286b in raise () at /usr/lib/libc.so.6
#1  0x00007f69143ed40e in abort () at /usr/lib/libc.so.6
#2  0x00007f69144448b8 in __libc_message () at /usr/lib/libc.so.6
#3  0x00007f691444ad4a in  () at /usr/lib/libc.so.6
#4  0x00007f691444b2a4 in  () at /usr/lib/libc.so.6
#5  0x000055cfa5050a69 in _container_destroy (cont=0x55cfa5f687c0) at ../sway/sway/tree/container.c:166
        parent = <optimized out>#6  0x000055cfa5051522 in container_destroy (con=0x55cfa5f687c0) at ../sway/sway/tree/container.c:347
        parent = 0x0
#7  0x000055cfa505573c in view_unmap (view=0x55cfa5f7f080) at ../sway/sway/tree/view.c:502
        parent = <optimized out>
        view = 0x55cfa5f7f080
        __PRETTY_FUNCTION__ = "view_unmap"
        __PRETTY_FUNCTION__ = "view_unmap"
#8  0x00007f6914c1f3be in wlr_signal_emit_safe (signal=signal@entry=0x55cfa5f67360, data=data@entry=0x55cfa5f67200) at ../util/signal.c:29
        pos = 0x55cfa5f7f240
        l = 0x55cfa5f7f240
        cursor = {link = {prev = 0x55cfa5f7f240, next = 0x7fff60ab6530}, notify = 0x7f6914c1f330 <handle_noop>}
        end = {link = {prev = 0x7fff60ab6510, next = 0x55cfa5f67360}, notify = 0x7f6914c1f330 <handle_noop>}
#9  0x00007f6914bef7b4 in xsurface_unmap (surface=0x55cfa5f67200) at ../xwayland/xwm.c:677
#10 0x00007f6914c1f3be in wlr_signal_emit_safe (signal=signal@entry=0x55cfa5f7f518, data=data@entry=0x55cfa5f7f480) at ../util/signal.c:29
        pos = 0x55cfa5f673d0
        l = 0x55cfa5f673d0
        cursor = {link = {prev = 0x55cfa5f673d0, next = 0x7fff60ab65b0}, notify = 0x7f6914c1f330 <handle_noop>}
        end = {link = {prev = 0x7fff60ab6590, next = 0x55cfa5f7f518}, notify = 0x7f6914c1f330 <handle_noop>}
#11 0x00007f6914c1ba9a in surface_handle_resource_destroy (resource=<optimized out>) at ../types/wlr_surface.c:633
        surface = 0x55cfa5f7f480
#12 0x00007f6914e4cb5f in  () at /usr/lib/libwayland-server.so.0
#13 0x00007f6914e4cbcf in wl_resource_destroy () at /usr/lib/libwayland-server.so.0
#14 0x00007f6914c1f3be in wlr_signal_emit_safe (signal=signal@entry=0x55cfa5b90b28, data=data@entry=0x55cfa5b90b20) at ../util/signal.c:29
        pos = 0x55cfa5f7f558
        l = 0x55cfa5f7f558
        cursor = {link = {prev = 0x55cfa5f7f558, next = 0x55cfa5dbb7b8}, notify = 0x7f6914c1f330 <handle_noop>}
        end = {link = {prev = 0x55cfa5dbb7b8, next = 0x55cfa5b90b28}, notify = 0x7f6914c1f330 <handle_noop>}
#15 0x00007f6914c04091 in wlr_renderer_destroy (r=0x55cfa5b90b20) at ../render/wlr_renderer.c:28
#16 0x00007f6914bf6d33 in finish_drm_renderer (renderer=0x55cfa5a0ee38) at ../backend/drm/renderer.c:54
#17 0x00007f6914bf3be5 in backend_destroy (backend=0x55cfa5a0ed30) at ../backend/drm/backend.c:45
        drm = 0x55cfa5a0ed30
        conn = <optimized out>
        next = <optimized out>
#18 0x00007f6914bfb099 in multi_backend_destroy (wlr_backend=0x55cfa5a04d70) at ../backend/multi/backend.c:47
        backend = 0x55cfa5a04d70
        sub = <optimized out>
        next = 0x55cfa5a0d0e0
#19 0x00007f6914e4cad2 in  () at /usr/lib/libwayland-server.so.0
#20 0x00007f6914e4d217 in wl_display_destroy () at /usr/lib/libwayland-server.so.0
#21 0x000055cfa50339d3 in main (argc=<optimized out>, argv=<optimized out>) at ../sway/sway/main.c:433
        verbose = 0
        debug = 1
        validate = 0
        long_options = 
            {{name = 0x55cfa5059b5d "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x55cfa505e01f "config", has_arg = 1, flag = 0x0, val = 99}, {name = 0x55cfa5059b62 "validate", has_arg = 0, flag = 0x0, val = 67}, {name = 0x55cfa5059b6b "debug", has_arg = 0, flag = 0x0, val = 100}, {name = 0x55cfa5059aa8 "version", has_arg = 0, flag = 0x0, val = 118}, {name = 0x55cfa5059b71 "verbose", has_arg = 0, flag = 0x0, val = 86}, {name = 0x55cfa5059b79 "get-socketpath", has_arg = 0, flag = 0x0, val = 112}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}}
        config_path = <optimized out>
        usage = 0x55cfa5059d70 "Usage: sway [options] [command]\n\n  -h, --help", ' ' <repeats 13 times>, "Show help message and quit.\n  -c, --config <config>  Specify a config file.\n  -C, --validate         Check the validity of the config file, th"...
        c = <optimized out>
        suid = false
(gdb) quit

(I built sway and wlroots with --buildtype debug but am still getting <optimized out> - what can I do to avoid this?)

At times this error seems to be reproducible for me consistently when opening certain sites, like flightaware.com or netflix.com, but after a reboot the sites will be fine and load normally, until they suddenly will start consistently crashing again. So it's reproducible under certain conditions, but I don't know what those conditions are. I can't seem to find anything in the sway debug logs that would indicate a cause, however.

[nearffxx]

From what I understand, it must be caused by a heap overflow somewhere. I'm trying to debug it with valgrind.

[ianyfan]

Is this still an issue on 1.0? If so, can you provide steps to reproduce?