GitLab

I'm running:

• OS: Arch Linux
• WM: Gnome 3.38.1 (Wayland session)
• Xwayland built from the master branch
• Graphics driver: Nvidia 455.28

The crash only occurs when I built Xwayland in the release mode, I couldn't manage to make it crash in the debug mode, so unfortunately I'm unable to get more information from the backtrace. I include valgrind output which I hope will be sufficient to see what's going on.

Stack trace

                #0  0x00007f1ec18c5615 raise (libc.so.6 + 0x3d615)
                #1  0x00007f1ec18ae862 abort (libc.so.6 + 0x26862)
                #2  0x0000562777612e07 OsAbort (Xwayland + 0x1b2e07)
                #3  0x0000562777618036 AbortServer (Xwayland + 0x1b8036)
                #4  0x0000562777616945 FatalError (Xwayland + 0x1b6945)
                #5  0x00005627776122cc OsSigHandler (Xwayland + 0x1b22cc)
                #6  0x00007f1ec18c56a0 __restore_rt (libc.so.6 + 0x3d6a0)
                #7  0x00005627774a1f3c xwl_eglstream_buffer_release_callback (Xwayland + 0x41f3c)
                #8  0x00007f1ec14a2acd n/a (libffi.so.7 + 0x6acd)
                #9  0x00007f1ec14a203a n/a (libffi.so.7 + 0x603a)
                #10 0x00007f1ec1dffe92 n/a (libwayland-client.so.0 + 0x9e92)
                #11 0x00007f1ec1dfc6c1 n/a (libwayland-client.so.0 + 0x66c1)
                #12 0x00007f1ec1dfdccc wl_display_dispatch_queue_pending (libwayland-client.so.0 + >
                #13 0x0000562777493404 xwl_read_events (Xwayland + 0x33404)
                #14 0x00005627775176b7 dix_main (Xwayland + 0xb76b7)
                #15 0x00005627774a42b6 main (Xwayland + 0x442b6)
                #16 0x00007f1ec18b0152 __libc_start_main (libc.so.6 + 0x28152)
                #17 0x000056277748bade _start (Xwayland + 0x2bade)

Valgrind

==91713== Invalid read of size 8
==91713==    at 0x13BE9F: dixGetPrivateAddr.292 (privates.h:122)
==91713==    by 0x13BF87: dixGetPrivate.295 (privates.h:136)
==91713==    by 0x13BF29: dixLookupPrivate (privates.h:166)
==91713==    by 0x13BEE2: xwl_pixmap_get (xwayland-pixmap.c:57)
==91713==    by 0x149C68: xwl_eglstream_buffer_release_callback (xwayland-glamor-eglstream.c:484)
==91713==    by 0x53F4ACC: ??? (in /usr/lib/libffi.so.7.1.0)
==91713==    by 0x53F4039: ??? (in /usr/lib/libffi.so.7.1.0)
==91713==    by 0x4A97FC8: wl_closure_invoke (connection.c:1018)
==91713==    by 0x4A96268: dispatch_event (wayland-client.c:1445)
==91713==    by 0x4A95C4A: dispatch_queue (wayland-client.c:1591)
==91713==    by 0x4A95C4A: wl_display_dispatch_queue_pending (wayland-client.c:1833)
==91713==    by 0x13C89E: xwl_read_events (xwayland-screen.c:436)
==91713==    by 0x13D3B2: socket_handler (xwayland-screen.c:490)
==91713==  Address 0xa3e62d0 is 32 bytes inside a block of size 232 free'd
==91713==    at 0x483B9AB: free (vg_replace_malloc.c:538)
==91713==    by 0x1EF2F6: FreePixmap (pixmap.c:132)
==91713==    by 0x17A1DF: fbDestroyPixmap (fbpixmap.c:94)
==91713==    by 0x14D0B7: glamor_destroy_pixmap (glamor.c:267)
==91713==    by 0x149DF4: xwl_glamor_eglstream_destroy_pixmap (xwayland-glamor-eglstream.c:317)
==91713==    by 0x28030A: XvDestroyPixmap (xvmain.c:369)
==91713==    by 0x235580: damageDestroyPixmap (damage.c:1504)
==91713==    by 0x214093: compCheckRedirect (compwindow.c:181)
==91713==    by 0x2145E5: compUnrealizeWindow (compwindow.c:291)
==91713==    by 0x208E2A: UnrealizeTree (window.c:2805)
==91713==    by 0x20881F: UnmapWindow (window.c:2863)
==91713==    by 0x1C1F52: ProcUnmapWindow (dispatch.c:893)
==91713==  Block was alloc'd at
==91713==    at 0x483CB65: calloc (vg_replace_malloc.c:760)
==91713==    by 0x1EF27C: AllocatePixmap (pixmap.c:119)
==91713==    by 0x17A085: fbCreatePixmap (fbpixmap.c:54)
==91713==    by 0x14CF16: glamor_create_pixmap (glamor.c:222)
==91713==    by 0x210245: compNewPixmap (compalloc.c:537)
==91713==    by 0x2100C1: compAllocPixmap (compalloc.c:606)
==91713==    by 0x214043: compCheckRedirect (compwindow.c:174)
==91713==    by 0x214535: compRealizeWindow (compwindow.c:274)
==91713==    by 0x205932: RealizeTree (window.c:2606)
==91713==    by 0x2055BF: MapWindow (window.c:2683)
==91713==    by 0x1C1E14: ProcMapWindow (dispatch.c:859)
==91713==    by 0x1C0435: Dispatch (dispatch.c:497)