Crash when moving a fullscreen container to another workspace (ASan only)

[baltitenger]

Please fill out the following:

• Sway Version: 1.8-dev-9e879242 (Jul 30 2022, branch 'master')

• Stack Trace:

[ASan stuff]
#10 0x000055ff755e0c72 in container_get_siblings (container=0x616000103e80) at ../sway/sway/tree/container.c:1415
#11 0x000055ff7563d138 in get_deco_rect.constprop.0 (c=0x616000103e80, deco_rect=deco_rect@entry=0x7ffd4f7b0820) at ../sway/sway/ipc-json.c:461
        parent_layout = L_NONE
        siblings = <optimized out>
        tab_or_stack = <optimized out>
#12 0x000055ff75412bbc in ipc_json_describe_node (node=0x616000103e80) at ../sway/sway/ipc-json.c:693
        count = <optimized out>
        seat = 0x616000007580
        focused = <optimized out>
        name = 0x6030009dfcf0 "baltazar@pluto:~"
        focus = <optimized out>
        object = <optimized out>
#13 0x000055ff754183eb in ipc_json_describe_node_recursive (node=0x616000103e80) at ../sway/sway/ipc-json.c:730
        object = <optimized out>
        i = <optimized out>
        children = <optimized out>
#14 0x000055ff75437b52 in ipc_event_window (change=0x55ff75689a00 "fullscreen_mode", window=0x616000103e80) at ../sway/sway/ipc-server.c:332
        obj = 0x6040008819d0
        json_string = <optimized out>
#15 ipc_event_window (window=0x616000103e80, change=0x55ff75689a00 "fullscreen_mode") at ../sway/sway/ipc-server.c:324
#16 0x000055ff755dfcf4 in container_fullscreen_disable (con=0x616000103e80) at ../sway/sway/tree/container.c:1255
        __PRETTY_FUNCTION__ = "container_fullscreen_disable"
#17 0x000055ff75615858 in container_replace (container=0x616000103e80, replacement=0x616000184e80) at ../sway/sway/tree/container.c:1529
        fullscreen = FULLSCREEN_WORKSPACE
        scratchpad = false
        ws = 0x0
#18 0x000055ff75611836 in container_split (child=0x616000103e80, layout=L_TABBED) at ../sway/sway/tree/container.c:1603
        seat = 0x616000007580
        set_focus = true
        cont = 0x616000184e80
#19 0x000055ff75612c26 in workspace_add_tiling (workspace=0x612000062d40, con=0x616000103e80) at ../sway/sway/tree/workspace.c:799
#20 0x000055ff7556f69c in container_move_to_workspace (container=container@entry=0x616000103e80, workspace=0x612000062d40) at ../sway/sway/commands/move.c:220
        old_workspace = 0x612000054640
#21 0x000055ff75576b79 in cmd_move_container (argv=<optimized out>, argc=<optimized out>, no_auto_back_and_forth=<optimized out>) at ../sway/sway/commands/move.c:555
        new_output = <optimized out>
        new_workspace = <optimized out>
        node = <optimized out>
        seat = 0x616000007580
        old_parent = 0x616000104180
        old_ws = 0x612000054640
        new_output_last_ws = 0x0
        focus = 0x616000103e80
        error = <optimized out>
        workspace = <optimized out>
        container = 0x616000103e80
        old_output = 0x615000273880
        destination = 0x612000062d40
        no_auto_back_and_forth = <optimized out>
        error = <optimized out>
#22 cmd_move (argv=<optimized out>, argc=<optimized out>) at ../sway/sway/commands/move.c:1045
        no_auto_back_and_forth = <optimized out>
        error = <optimized out>
#23 cmd_move (argc=<optimized out>, argv=<optimized out>) at ../sway/sway/commands/move.c:992
        error = <optimized out>
#24 0x000055ff754295c1 in execute_command (_exec=<optimized out>, seat=0x616000007580, con=<optimized out>) at ../sway/sway/commands.c:294
        res = <optimized out>
        argv = 0x6060003bfd20
        handler = <optimized out>
        cmd = <optimized out>
        containers = 0x0
        using_criteria = false
        exec = 0x604000881090 "move container to workspace number 2"
        res_list = 0x602000bdddd0
        __PRETTY_FUNCTION__ = "execute_command"
#25 0x000055ff7555eead in seat_execute_command (seat=0x616000007580, binding=<optimized out>) at ../sway/sway/commands/bind.c:632
        con = <optimized out>
        res_list = <optimized out>
        success = <optimized out>
#26 0x000055ff754d811d in handle_key_event (keyboard=0x61a000020a80, event=0x7ffd4f7b1560) at ../sway/sway/input/keyboard.c:487
        seat = 0x616000007580
        wlr_seat = 0x61800000c880
        wlr_device = <optimized out>
        device_identifier = 0x6030009e3740 "0:0:wlr_keyboard_group"
        exact_identifier = <optimized out>
        input_inhibited = <optimized out>
        sway_inhibitor = <optimized out>
        shortcuts_inhibited = <optimized out>
        handled = <optimized out>
#27 0x00007fa8875285fe in wlr_signal_emit_safe (signal=<optimized out>, data=0x7ffd4f7b1560) at ../wlroots-git/util/signal.c:29
        pos = 0x60c000197810
        l = 0x60c000197810
        cursor = {link = {prev = 0x60c000197810, next = 0x7ffd4f7b1400}, notify = 0x7fa8875230c0 <handle_noop>}
        end = {link = {prev = 0x7ffd4f7b1420, next = 0x61500017f8b8}, notify = 0x7fa8875230c0 <handle_noop>}
#28 0x00007fa887511af5 in wlr_keyboard_notify_key (keyboard=0x61500017f780, event=0x7ffd4f7b1560) at ../wlroots-git/types/wlr_keyboard.c:103
        updated = <optimized out>
#29 0x00007fa8875285fe in wlr_signal_emit_safe (signal=<optimized out>, data=0x7ffd4f7b1560) at ../wlroots-git/util/signal.c:29
        pos = 0x60d0000e9278
        l = 0x60d0000e9278
        cursor = {link = {prev = 0x60d0000e9278, next = 0x61a0000288a8}, notify = 0x7fa8875230c0 <handle_noop>}
        end = {link = {prev = 0x61a0000288a8, next = 0x61a0000283c0}, notify = 0x7fa8875230c0 <handle_noop>}
#30 0x00007fa887511af5 in wlr_keyboard_notify_key (keyboard=0x61a000028288, event=0x7ffd4f7b1560) at ../wlroots-git/types/wlr_keyboard.c:103
        updated = <optimized out>
#31 0x00007fa8874df46c in handle_keyboard_key (kb=0x61a000028288, event=0x604000881050) at ../wlroots-git/backend/libinput/keyboard.c:54
        kbevent = 0x604000881050
        wlr_event = {time_msec = 5468660, keycode = 3, update_state = true, state = WL_KEYBOARD_KEY_STATE_PRESSED}
        state = <optimized out>
        libinput_dev = 0x61c00003f080
        dev = 0x61a000028280
        event_type = <optimized out>
        event = 0x604000881050
        backend = <optimized out>
        ret = <optimized out>
#32 handle_libinput_event (event=0x604000881050, backend=0x60f000000400) at ../wlroots-git/backend/libinput/events.c:167
        libinput_dev = 0x61c00003f080
        dev = 0x61a000028280
        event_type = <optimized out>
        event = 0x604000881050
        backend = <optimized out>
        ret = <optimized out>
#33 handle_libinput_readable (fd=<optimized out>, mask=<optimized out>, _backend=<optimized out>) at ../wlroots-git/backend/libinput/backend.c:58
        event = 0x604000881050
        backend = <optimized out>
        ret = <optimized out>
#34 handle_libinput_readable (fd=<optimized out>, mask=<optimized out>, _backend=<optimized out>) at ../wlroots-git/backend/libinput/backend.c:48
        backend = <optimized out>
        ret = <optimized out>
#35 0x00007fa88757f9e2 in wl_event_loop_dispatch (loop=0x60d000000450, timeout=timeout@entry=-1) at ../wayland-1.21.0/src/event-loop.c:1027
        ep = {{events = 1, data = {ptr = 0x606000190340, fd = 1639232, u32 = 1639232, u64 = 105965434766144}}, {events = 25232, data = {ptr = 0x6290003c1208, fd = 3936776, u32 = 3936776, u64 = 108370618749448}}, {events = 1974974976, data = {ptr = 0x3c0200c2ad50f6, fd = -1028828938, u32 = 3266138358, u64 = 16890700892033270}}, {events = 25232, data = {ptr = 0x34, fd = 52, u32 = 52, u64 = 52}}, {events = 3932672, data = {ptr = 0x4f7b16b000006290, fd = 25232, u32 = 25232, u64 = 5727196296301798032}}, {events = 32765, data = {ptr = 0x6290003c3218, fd = 3944984, u32 = 3944984, u64 = 108370618757656}}, {events = 3936776, data = {ptr = 0x4f7b16f000006290, fd = 25232, u32 = 25232, u64 = 5727196571179704976}}, {events = 32765, data = {ptr = 0x7fa88757c500 <wl_connection_flush+304>, fd = -2024291072, u32 = 2270676224, u64 = 140361801909504}}, {events = 683736, data = {ptr = 0x3400006110, fd = 24848, u32 = 24848, u64 = 223338324240}}, {events = 0, data = {ptr = 0x7ffd4f7b1710, fd = 1333466896, u32 = 1333466896, u64 = 140725936920336}}, {events = 9785240, data = {ptr = 0xbcc, fd = 3020, u32 = 3020, u64 = 3020}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0x602000954f90, fd = 9785232, u32 = 9785232, u64 = 105690565005200}}, {events = 3939796, data = {ptr = 0x3400006290, fd = 25232, u32 = 25232, u64 = 223338324624}}, {events = 0, data = {ptr = 0x6290003bc208, fd = 3916296, u32 = 3916296, u64 = 108370618728968}}, {events = 256, data = {ptr = 0x1400000000, fd = 0, u32 = 0, u64 = 85899345920}}, {events = 0, data = {ptr = 0x100000001, fd = 1, u32 = 1, u64 = 4294967297}}, {events = 105, data = {ptr = 0x75b7ba00000055ff, fd = 22015, u32 = 22015, u64 = 8482452932338406911}}, {events = 3266138358, data = {ptr = 0x7ffd4f7b1700, fd = 1333466880, u32 = 1333466880, u64 = 140725936920320}}, {events = 16256, data = {ptr = 0x7566092000006170, fd = 24944, u32 = 24944, u64 = 8459458983105683824}}, {events = 22015, data = {ptr = 0x131, fd = 305, u32 = 305, u64 = 305}}, {events = 84144, data = {ptr = 0x6020, fd = 24608, u32 = 24608, u64 = 24608}}, {events = 0, data = {ptr = 0x7fa8875230c0 <handle_noop>, fd = -2024656704, u32 = 2270310592, u64 = 140361801543872}}, {events = 115500207, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}, {events = 0, data = {ptr = 0xc2ad50f675b7ba00, fd = 1974974976, u32 = 1974974976, u64 = 14027957433796114944}}, {events = 2270310592, data = {ptr = 0x375c000007fa8, fd = 32680, u32 = 32680, u64 = 973892424335272}}, {events = 24880, data = {ptr = 0xabfeeb57f58, fd = -290095272, u32 = 4004872024, u64 = 11819459903320}}, {events = 1974974976, data = {ptr = 0x7566ebc0c2ad50f6, fd = -1028828938, u32 = 3266138358, u64 = 8459708163194441974}}, {events = 22015, data = {ptr = 0x6100003a3640, fd = 3814976, u32 = 3814976, u64 = 106652631709248}}}
        source = <optimized out>
        i = 0
        count = <optimized out>
        has_timers = <optimized out>
#36 0x00007fa887580197 in wl_display_run (display=0x611000000f40) at ../wayland-1.21.0/src/wayland-server.c:1431
#37 0x000055ff754075bd in server_run (server=<optimized out>) at ../sway/sway/server.c:307
        config_path = 0x0
        c = <optimized out>
        validate = false
        debug = false
        allow_unsupported_gpu = false
        verbose = false
#38 main (argc=<optimized out>, argv=<optimized out>) at ../sway/sway/main.c:415
        config_path = 0x0
        c = <optimized out>
        validate = false
        debug = false
        allow_unsupported_gpu = false
        verbose = false

• ASan output:

../sway/sway/tree/container.c:1415:6: runtime error: member access within null pointer of type 'struct sway_workspace'
AddressSanitizer:DEADLYSIGNAL
=================================================================
==440==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000b0 (pc 0x5634ed812c72 bp 0x0000000000b0 sp 0x7ffed056a8a0 T0)
==440==The signal is caused by a READ memory access.
==440==Hint: address points to the zero page.
    #0 0x5634ed812c72 in container_get_siblings ../sway/sway/tree/container.c:1415
    #1 0x5634ed86f137 in get_deco_rect.constprop.0 ../sway/sway/ipc-json.c:461
    #2 0x5634ed644bbb in ipc_json_describe_node ../sway/sway/ipc-json.c:693
    #3 0x5634ed64a3ea in ipc_json_describe_node_recursive ../sway/sway/ipc-json.c:730
    #4 0x5634ed669b51 in ipc_event_window ../sway/sway/ipc-server.c:332
    #5 0x5634ed669b51 in ipc_event_window ../sway/sway/ipc-server.c:324
    #6 0x5634ed811cf3 in container_fullscreen_disable ../sway/sway/tree/container.c:1255
    #7 0x5634ed847857 in container_replace ../sway/sway/tree/container.c:1529
    #8 0x5634ed843835 in container_split ../sway/sway/tree/container.c:1603
    #9 0x5634ed844c25 in workspace_add_tiling ../sway/sway/tree/workspace.c:799
    #10 0x5634ed7a169b in container_move_to_workspace ../sway/sway/commands/move.c:220
    #11 0x5634ed7a8b78 in cmd_move_container ../sway/sway/commands/move.c:555
    #12 0x5634ed7a8b78 in cmd_move ../sway/sway/commands/move.c:1045
    #13 0x5634ed7a8b78 in cmd_move ../sway/sway/commands/move.c:992
    #14 0x5634ed65b5c0 in execute_command ../sway/sway/commands.c:294
    #15 0x5634ed790eac in seat_execute_command ../sway/sway/commands/bind.c:632
    #16 0x5634ed70a11c in handle_key_event ../sway/sway/input/keyboard.c:487
    #17 0x7f8acdb165fd in wlr_signal_emit_safe ../wlroots-git/util/signal.c:29
    #18 0x7f8acdaffaf4 in wlr_keyboard_notify_key ../wlroots-git/types/wlr_keyboard.c:103
    #19 0x7f8acdb165fd in wlr_signal_emit_safe ../wlroots-git/util/signal.c:29
    #20 0x7f8acdaffaf4 in wlr_keyboard_notify_key ../wlroots-git/types/wlr_keyboard.c:103
    #21 0x7f8acdacd46b in handle_keyboard_key ../wlroots-git/backend/libinput/keyboard.c:54
    #22 0x7f8acdacd46b in handle_libinput_event ../wlroots-git/backend/libinput/events.c:167
    #23 0x7f8acdacd46b in handle_libinput_readable ../wlroots-git/backend/libinput/backend.c:58
    #24 0x7f8acdacd46b in handle_libinput_readable ../wlroots-git/backend/libinput/backend.c:48
    #25 0x7f8acdb6d9e1 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xb9e1)
    #26 0x7f8acdb6e196 in wl_display_run (/usr/lib/libwayland-server.so.0+0xc196)
    #27 0x5634ed6395bc in server_run ../sway/sway/server.c:307
    #28 0x5634ed6395bc in main ../sway/sway/main.c:415
    #29 0x7f8acce2928f  (/usr/lib/libc.so.6+0x2928f)
    #30 0x7f8acce29349 in __libc_start_main (/usr/lib/libc.so.6+0x29349)
    #31 0x5634ed63d5f4  (/usr/bin/sway+0x3af5f4)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../sway/sway/tree/container.c:1415 in container_get_siblings
==440==ABORTING

In container_get_siblings, apparently container->pending.workspace is NULL.

• Description:
  Just make any window fullscreen and try to move it to another workspace. Note that this crash only happens when compiled with -fsanitize=address.

[emersion]

Regression from #7113