Race with destroying of wayland object
There is race condition which produces the error:
not a valid new object id (4278190081), message data_offer(n)
use-case:
- mutli-threaded client: several threads dispatching and flushing the wayland connection
- server-side objects are used in the protocol (e.g. linux-dmabuf-unstable-v1.xml used for buffers)
- server-side objects are destroyed and created quite frequently (not mandatory for the error but will increase the reproducibility).
To understand why the error occurs we just need to take a look to the generated code of the buffer destroy event:
static inline void
wl_buffer_destroy(struct wl_buffer *wl_buffer)
{
wl_proxy_marshal((struct wl_proxy *) wl_buffer,
WL_BUFFER_DESTROY);
wl_proxy_destroy((struct wl_proxy *) wl_buffer);
}
If the thread(T1) executing the wl_buffer_destroy call will be interrupted due to the scheduling between the wl_proxy_marshal call and wl_proxy_destroy calls and another thread(T2) will flush and read/dispatch the connection,
the buffer destroy event will be send to the compositor and compositor could use the id of the destroyed object for a new one immediately and send it to client.
Then reading of the connection will produce the
not a valid new object id (4278190081), message data_offer(n)
error because server send the id for a slot in the server map which is still not NULL since wl_proxy_destroy call is still not executed, will be done by T1 it this had a change to run.
This race is quite rare but we faced this in the real project.