sway 1.10 crashes in multiple output setup

[kiesel]

Please fill out the following:

• Sway Version:

  • sway version 1.10.1

• Stack Trace:

(gdb) bt
#0  wl_resource_get_client (resource=0x5dd6810f2e38) at ../wayland-1.23.1/src/wayland-server.c:824
#1  0x00007f6fe877c244 in surface_handle_output_bind (listener=0x5dd35c22a060, data=0x7ffddb94ac60) at ../wlroots-0.18.2/types/wlr_compositor.c:1048
#2  0x00007f6fe882947e in wl_signal_emit_mutable (signal=signal@entry=0x5dd35c011358, data=data@entry=0x7ffddb94ac60) at ../wayland-1.23.1/src/wayland-server.c:2314
#3  0x00007f6fe8764b1c in output_bind (wl_client=<optimized out>, data=0x5dd35c011250, version=<optimized out>, id=<optimized out>) at ../wlroots-0.18.2/types/output/output.c:126
#4  0x00007f6fe7e1d976 in ffi_call_unix64 () at ../src/x86/unix64.S:104
#5  0x00007f6fe7e1a12c in ffi_call_int (cif=cif@entry=0x7ffddb94ae60, fn=<optimized out>, rvalue=<optimized out>, avalue=<optimized out>, closure=closure@entry=0x0) at ../src/x86/ffi64.c:676
#6  0x00007f6fe7e1cf0e in ffi_call (cif=cif@entry=0x7ffddb94ae60, fn=<optimized out>, rvalue=rvalue@entry=0x0, avalue=avalue@entry=0x7ffddb94af30) at ../src/x86/ffi64.c:713
#7  0x00007f6fe8827e85 in wl_closure_invoke (closure=closure@entry=0x5dd35c2838c0, target=<optimized out>, target@entry=0x5dd35c21efe0, opcode=opcode@entry=0, data=<optimized out>, data@entry=0x5dd35c2484f0, flags=2)
    at ../wayland-1.23.1/src/connection.c:1228
#8  0x00007f6fe882cd22 in wl_client_connection_data (fd=<optimized out>, mask=<optimized out>, data=0x5dd35c2484f0) at ../wayland-1.23.1/src/wayland-server.c:444
#9  0x00007f6fe882b112 in wl_event_loop_dispatch (loop=0x5dd35b108b00, timeout=<optimized out>, timeout@entry=-1) at ../wayland-1.23.1/src/event-loop.c:1105
#10 0x00007f6fe882d1f7 in wl_display_run (display=0x5dd35b10e320) at ../wayland-1.23.1/src/wayland-server.c:1530
#11 0x00005dd326c7edd2 in server_run (server=<optimized out>) at ../sway/sway/server.c:501
#12 main (argc=<optimized out>, argv=<optimized out>) at ../sway/sway/main.c:374

• Description:
  Sway crashes randomly with 2 monitors attached. Same machine worked flawlessly in the past. Crashes seem to occur when a new window is created, eg. when pressing the binding for wofi. New tabs in existing windows do not have this problem.

Thank you for your work!

[Salastil]

I've been getting this as well, same issue when spawning a new window. Its definitely reproducible. The three programs I've had it happen with are kitty, mpv and a single time with discord. When mpv causes the segfault it will fullscreen the video while the other monitors will blank out and then when it ends playing and closes mpv it will return to the display manager sddm. I've just switched to sway since I just installed an AMD gpu so I haven't had much time to gather logs for this. I'm running a multi-monitor setup with the right most being rotated in a vertical fashion.

Dmesg:
[ 716.322055] sway[880]: segfault at 63e1e6ad8d5e ip 000078aa645fb0c4 sp 00007ffd4d0f1a68 error 4 in libwayland-server.so.0.23.1[78aa645f9000+8000] likely on CPU 2 (core 2, socket 0) [ 716.322076] Code: 00 00 00 00 66 90 48 8b 50 28 48 8d 42 e0 48 39 d7 74 0b 48 39 70 40 75 ed c3 0f 1f 40 00 31 c0 c3 0f 1f 44 00 00 f3 0f 1e fa <48> 8b 47 40 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 77 48 c3 0f [ 771.969025] sway[35230]: segfault at 613f52a611ae ip 000079dd9e48e0c4 sp 00007fffa4485e18 error 4 in libwayland-server.so.0.23.1[79dd9e48c000+8000] likely on CPU 0 (core 0, socket 0) [ 771.969049] Code: 00 00 00 00 66 90 48 8b 50 28 48 8d 42 e0 48 39 d7 74 0b 48 39 70 40 75 ed c3 0f 1f 40 00 31 c0 c3 0f 1f 44 00 00 f3 0f 1e fa <48> 8b 47 40 c3 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 77 48 c3 0f

[voidastro4]

At some point in the last month this started happening to me too on sway stable. amdgpu APU

The application doesn't matter but out of the 5 times I had this happen every single time was when a floating window as per sway config rules launched. Applications were random but wayland: mpv, foot(configured floating as launcher), nomacs

sway 1.10 was rock solid for months prior to this, an update to something else caused this.

Kernel version doesn't appear to matter. had this happen on 6.12 6.13 and 6.14

I too have multiple monitors with one monitor rotated to be vertical. Did not observe a crash triggered from a window on the vertical monitor yet.

Crash happens randomly on a new window usually after hours of uptime, sometimes 1-2 days.

[emersion]

Can you try re-compiling with the address sanitizer (ASan) and reproducing the crash?

You can compile with ASan by passing -Db_sanitize=address to Meson.

[Salastil]

Done, github is screwing up the paste. To build I had to use wlroots 19.0 from the git since Arch is only providing 18.2 so its present in both.

AddressSanitizer:DEADLYSIGNAL
=================================================================
==4171687==ERROR: AddressSanitizer: SEGV on unknown address 0x000000012c41 (pc 0x7753aa4e30c4 bp 0x7ffe9e013480 sp 0x7ffe9e0133d8 T0)
==4171687==The signal is caused by a READ memory access.
    #0 0x7753aa4e30c4 in wl_resource_get_client (/usr/lib/libwayland-server.so.0+0x70c4) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f)
    #1 0x7753aa4205da  (/usr/lib/libwlroots-0.19.so+0x955da) (BuildId: 3355f5997d883780db29911dd5093b8ce7651fd5)
    #2 0x7753aa4e447d in wl_signal_emit_mutable (/usr/lib/libwayland-server.so.0+0x847d) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f)
    #3 0x7753aa408a72  (/usr/lib/libwlroots-0.19.so+0x7da72) (BuildId: 3355f5997d883780db29911dd5093b8ce7651fd5)
    #4 0x7753a9818975  (/usr/lib/libffi.so.8+0x7975) (BuildId: bdcf0371d4406049ca59c4db4fb7386f55c00a82)
    #5 0x7753a981512b  (/usr/lib/libffi.so.8+0x412b) (BuildId: bdcf0371d4406049ca59c4db4fb7386f55c00a82)
    #6 0x7753a9817f0d in ffi_call (/usr/lib/libffi.so.8+0x6f0d) (BuildId: bdcf0371d4406049ca59c4db4fb7386f55c00a82)
    #7 0x7753aa4e2e84  (/usr/lib/libwayland-server.so.0+0x6e84) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f)
    #8 0x7753aa4e7d21  (/usr/lib/libwayland-server.so.0+0xbd21) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f)
    #9 0x7753aa4e6111 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa111) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f)
    #10 0x7753aa4e81f6 in wl_display_run (/usr/lib/libwayland-server.so.0+0xc1f6) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f)
    #11 0x55cfff2ade9d  (/usr/bin/sway+0x57e9d) (BuildId: fc649b34f3f9d3a8ef8a409deaad59dd310f8407)
    #12 0x7753aa0f7487  (/usr/lib/libc.so.6+0x27487) (BuildId: 0b707b217b15b106c25fe51df3724b25848310c0)
    #13 0x7753aa0f754b in __libc_start_main (/usr/lib/libc.so.6+0x2754b) (BuildId: 0b707b217b15b106c25fe51df3724b25848310c0)
    #14 0x55cfff2b09e4  (/usr/bin/sway+0x5a9e4) (BuildId: fc649b34f3f9d3a8ef8a409deaad59dd310f8407)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/usr/lib/libwayland-server.so.0+0x70c4) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f) in wl_resource_get_client
==4171687==ABORTING

[emersion]

That's a different stack trace from the one reported above, so should be reported in a separate issue. Also it seems like wlroots debug symbols are missing, can be fixed .e.g by building wlroots as a subproject:
https://github.com/swaywm/sway/wiki/Development-Setup#compiling-as-a-subproject

[Salastil]

Rebuilt wlroots as subproject rather than just installed from git.

==78506==ERROR: AddressSanitizer: heap-use-after-free on address 0x51900019cd80 at pc 0x7c58a9c47d9a bp 0x7ffd5f182cc0 
sp 0x7ffd5f182cb0
READ of size 8 at 0x51900019cd80 thread T0
    #0 0x7c58a9c47d99 in surface_handle_output_bind ../subprojects/wlroots/types/wlr_compositor.c:1068
    #1 0x7c58a94aa47d in wl_signal_emit_mutable (/usr/lib/libwayland-server.so.0+0x847d) (BuildId: 2e487f08f7f64aa6e49c
21f76a244c230d6c141f)
    #2 0x7c58a9becdcd in output_bind ../subprojects/wlroots/types/output/output.c:126
    #3 0x7c58a8764975  (/usr/lib/libffi.so.8+0x7975) (BuildId: bdcf0371d4406049ca59c4db4fb7386f55c00a82)
    #4 0x7c58a876112b  (/usr/lib/libffi.so.8+0x412b) (BuildId: bdcf0371d4406049ca59c4db4fb7386f55c00a82)
    #5 0x7c58a8763f0d in ffi_call (/usr/lib/libffi.so.8+0x6f0d) (BuildId: bdcf0371d4406049ca59c4db4fb7386f55c00a82)
    #6 0x7c58a94a8e84  (/usr/lib/libwayland-server.so.0+0x6e84) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f)
    #7 0x7c58a94add21  (/usr/lib/libwayland-server.so.0+0xbd21) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f)
    #8 0x7c58a94ac111 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa111) (BuildId: 2e487f08f7f64aa6e49c
21f76a244c230d6c141f)
    #9 0x7c58a94ae1f6 in wl_display_run (/usr/lib/libwayland-server.so.0+0xc1f6) (BuildId: 2e487f08f7f64aa6e49c21f76a24
4c230d6c141f)
    #10 0x60b471477df4 in server_run ../sway/server.c:517
    #11 0x60b471473aea in main ../sway/main.c:389
    #12 0x7c58a9245487  (/usr/lib/libc.so.6+0x27487) (BuildId: 0b707b217b15b106c25fe51df3724b25848310c0)
    #13 0x7c58a924554b in __libc_start_main (/usr/lib/libc.so.6+0x2754b) (BuildId: 0b707b217b15b106c25fe51df3724b258483
10c0)
    #14 0x60b47144ee04 in _start (/home/mega/git/sway/build/sway/sway+0x57e04) (BuildId: d7bd3bb298a6b175b02dde4f670275
173f3b4180)

0x51900019cd80 is located 0 bytes inside of 968-byte region [0x51900019cd80,0x51900019d148)
freed by thread T0 here:
    #0 0x7c58aa0fc102 in free /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 0x7c58a9c45ccb in surface_handle_resource_destroy ../subprojects/wlroots/types/wlr_compositor.c:765
    #2 0x7c58a94acbba  (/usr/lib/libwayland-server.so.0+0xabba) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f)
    #3 0x7c58a94acdd1 in wl_client_destroy (/usr/lib/libwayland-server.so.0+0xadd1) (BuildId: 2e487f08f7f64aa6e49c21f76
a244c230d6c141f)
    #4 0x7c58a94acfd9  (/usr/lib/libwayland-server.so.0+0xafd9) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f)
    #5 0x7c58a94ac111 in wl_event_loop_dispatch (/usr/lib/libwayland-server.so.0+0xa111) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f)
    #6 0x7c58a94ae1f6 in wl_display_run (/usr/lib/libwayland-server.so.0+0xc1f6) (BuildId: 2e487f08f7f64aa6e49c21f76a244c230d6c141f)
    #7 0x60b471477df4 in server_run ../sway/server.c:517
    #8 0x60b471473aea in main ../sway/main.c:389
    #9 0x7c58a9245487  (/usr/lib/libc.so.6+0x27487) (BuildId: 0b707b217b15b106c25fe51df3724b25848310c0)
    #10 0x7c58a924554b in __libc_start_main (/usr/lib/libc.so.6+0x2754b) (BuildId: 0b707b217b15b106c25fe51df3724b25848310c0)
    #11 0x60b47144ee04 in _start (/home/mega/git/sway/build/sway/sway+0x57e04) (BuildId: d7bd3bb298a6b175b02dde4f670275173f3b4180)

previously allocated by thread T0 here:
    #0 0x7c58aa0fd02a in calloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:77
    #1 0x7c58a9c45cf3 in surface_create ../subprojects/wlroots/types/wlr_compositor.c:770
    #2 0x7c58a9c4a348 in compositor_create_surface ../subprojects/wlroots/types/wlr_compositor.c:1317
    #3 0x7c58a8764975  (/usr/lib/libffi.so.8+0x7975) (BuildId: bdcf0371d4406049ca59c4db4fb7386f55c00a82)

SUMMARY: AddressSanitizer: heap-use-after-free ../subprojects/wlroots/types/wlr_compositor.c:1068 in surface_handle_output_bind
Shadow bytes around the buggy address:
  0x51900019cb00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x51900019cb80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x51900019cc00: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x51900019cc80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x51900019cd00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x51900019cd80:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x51900019ce00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x51900019ce80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x51900019cf00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x51900019cf80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x51900019d000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==78506==ABORTING

[emersion]

Oh that's helpful, thanks!

[kennylevinsen]

Can you try https://gitlab.freedesktop.org/wlroots/wlroots/-/merge_requests/5035?

[Salastil]

Can you try https://gitlab.freedesktop.org/wlroots/wlroots/-/merge_requests/5035?

On the surface it seems to have resolved the crashing of sway, but this behavior was always random, sometimes impossible to do anything it was so common and other times days before a crash so its hard to be certain. Its introduced new errors though -- waybar will crash when I right click icons in the system tray or hover over the date which spawns a small window with a calendar on it. The error log for that is:
Gdk-Message: 16:59:40.505: Error 71 (Protocol error) dispatching to Wayland display.

Nothing shows up in sway.log in debug mode regarding this crashing behavior in waybar introduced by the commit. Before you made that commit I downgraded to wlroot 17.3-2 and had zero crashes from sway so its something that was changed between that and wlroots 18.2-1 that is in Arch's repo.

[kennylevinsen]

waybar will crash when I right click icons in the system tray or hover over the date which spawns a small window with a calendar on it. The error log for that is:
Gdk-Message: 16:59:40.505: Error 71 (Protocol error) dispatching to Wayland display.

That seems unrelated to this issue and its fix, but likely related to the issue fixed by https://gitlab.freedesktop.org/wlroots/wlroots/-/merge_requests/5038

Running waybar with WAYLAND_DEBUG=1 while reproducing should reveal the protocol error.

[Salastil]

Running waybar with WAYLAND_DEBUG=1 while reproducing should reveal the protocol error.

[ 958580.320] {Default Queue} wl_pointer#29.button(417, 7318886, 273, 1)
[ 958580.372] {Default Queue} wl_pointer#29.frame()
[ 958580.566] {Default Queue}  -> wl_compositor#5.create_surface(new id wl_surface#57)
[ 958580.689] {Default Queue}  -> wp_cursor_shape_device_v1#9.set_shape(416, 1)
[ 958601.861] {Default Queue}  -> wl_compositor#5.create_surface(new id wl_surface#46)
[ 958601.951] {Default Queue}  -> wl_surface#46.set_buffer_scale(1)
[ 958602.161] {Default Queue}  -> wl_surface#46.set_buffer_scale(1)
[ 958612.947] {Default Queue}  -> wl_surface#46.attach(nil, 0, 0)
[ 958612.975] {Default Queue}  -> xdg_wm_base#44.create_positioner(new id xdg_positioner#61)
[ 958612.987] {Default Queue}  -> xdg_positioner#61.set_size(181, 166)
[ 958612.995] {Default Queue}  -> xdg_positioner#61.set_anchor_rect(1900, 16, 1, 1)
[ 958613.002] {Default Queue}  -> xdg_positioner#61.set_offset(0, 0)
[ 958613.011] {Default Queue}  -> xdg_positioner#61.set_anchor(8)
[ 958613.018] {Default Queue}  -> xdg_positioner#61.set_gravity(8)
[ 958613.025] {Default Queue}  -> xdg_positioner#61.set_constraint_adjustment(63)
[ 958613.032] {Default Queue}  -> xdg_wm_base#44.get_xdg_surface(new id xdg_surface#60, wl_surface#46)
[ 958613.041] {Default Queue}  -> xdg_surface#60.get_popup(new id xdg_popup#56, nil, xdg_positioner#61)
[ 958613.050] {Default Queue}  -> zwlr_layer_surface_v1#54.get_popup(xdg_popup#56)
[ 958613.061] {Default Queue}  -> xdg_positioner#61.destroy()
[ 958613.100] {Default Queue}  -> xdg_popup#56.grab(wl_seat#30, 417)
[ 958613.111] {Default Queue}  -> xdg_surface#60.set_window_geometry(17, 16, 181, 166)
[ 958613.119] {Default Queue}  -> wl_surface#46.commit()
[ 958613.127] {Default Queue}  -> wl_display#1.sync(new id wl_callback#49)
[ 958613.406] {Display Queue} wl_display#1.delete_id(61)
[ 958613.428] {Display Queue} wl_display#1.error(xdg_surface#60, 5, "the effective window geometry is empty")
Gdk-Message: 18:58:27.515: Error 71 (Protocol error) dispatching to Wayland display.