<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Xorg server crashes with assertion failure: Xorg: ../src/evdev-mt-touchpad-tap.c:1030: tp_tap_handle_state: Assertion `tp->tap.nfingers_down >= 1' failed."
href="https://bugs.freedesktop.org/show_bug.cgi?id=105275">105275</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Xorg server crashes with assertion failure: Xorg: ../src/evdev-mt-touchpad-tap.c:1030: tp_tap_handle_state: Assertion `tp->tap.nfingers_down >= 1' failed.
</td>
</tr>
<tr>
<th>Product</th>
<td>Wayland
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86-64 (AMD64)
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux (All)
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>major
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>libinput
</td>
</tr>
<tr>
<th>Assignee</th>
<td>wayland-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>aplattner@nvidia.com
</td>
</tr></table>
<p>
<div>
<pre>I was trying to clean cat hair off of my laptop, and swiped my hand gently
across the touchpad. The X server crashed:
Xorg: ../src/evdev-mt-touchpad-tap.c:1030: tp_tap_handle_state: Assertion
`tp->tap.nfingers_down >= 1' failed.
Thread 2 "InputThread" received signal SIGABRT, Aborted.
[Switching to Thread 0x7f58e7254700 (LWP 11644)]
0x00007f58ee846860 in raise () from /usr/lib/libc.so.6
(gdb) bt
#0 0x00007f58ee846860 in raise () at /usr/lib/libc.so.6
#1 0x00007f58ee847ec9 in abort () at /usr/lib/libc.so.6
#2 0x00007f58ee83f0bc in __assert_fail_base () at /usr/lib/libc.so.6
#3 0x00007f58ee83f133 in () at /usr/lib/libc.so.6
#4 0x00007f58e7f0e2f0 in tp_tap_handle_state (tp=0x5619dd09aab0,
time=2162337668) at ../src/evdev-mt-touchpad-tap.c:1030
#5 0x00007f58e7f08d17 in tp_post_events (tp=0x5619dd09aab0, time=2162337668)
at ../src/evdev-mt-touchpad.c:1561
#6 0x00007f58e7f08e03 in tp_handle_state (tp=0x5619dd09aab0, time=2162337668)
at ../src/evdev-mt-touchpad.c:1586
#7 0x00007f58e7f08ed6 in tp_interface_process (dispatch=0x5619dd09aab0,
device=0x5619dd0976b0, e=0x7f58e7252dc0, time=2162337668) at
../src/evdev-mt-touchpad.c:1633
#8 0x00007f58e7efabe2 in evdev_process_event (device=0x5619dd0976b0,
e=0x7f58e7252dc0) at ../src/evdev.c:857
#9 0x00007f58e7efac27 in evdev_device_dispatch_one (device=0x5619dd0976b0,
ev=0x7f58e7252dc0) at ../src/evdev.c:865
#10 0x00007f58e7efae0c in evdev_device_dispatch (data=0x5619dd0976b0) at
../src/evdev.c:924
#11 0x00007f58e7ef4f3b in libinput_dispatch (libinput=0x5619dd021580) at
../src/libinput.c:1989
#12 0x00007f58e8141984 in xf86libinput_read_input (pInfo=0x5619dd040690) at
xf86libinput.c:2180
#13 0x00005619dc6e8163 in ()
#14 0x00005619dc6ea861 in ()
#15 0x00005619dc6e7fae in ()
#16 0x00007f58eebd008c in start_thread () at /usr/lib/libpthread.so.0
#17 0x00007f58ee907e7f in clone () at /usr/lib/libc.so.6
I'm using a debug build of libinput built from commit
5b29be3998d5f3670ec66147abc32e7d992ff876 with "arch-meson build
--buildtype=debug -Dtests=false -Db_lto=false".
Earlier, performing the same swiping gesture caused a crash similar to bug
105160. I rebuilt from commit 5b29be3998 to pick up the fix for that in commit
01a633b6eb, and now I'm seeing this new assert instead.
More gdb info:
(gdb) frame 4
#4 0x00007f58e7f0e2f0 in tp_tap_handle_state (tp=0x5619dd09aab0,
time=2162337668) at ../src/evdev-mt-touchpad-tap.c:1030
1030 assert(tp->tap.nfingers_down >= 1);
(gdb) info locals
_i = 0
t = 0x5619dd09ba60
filter_motion = 0
__PRETTY_FUNCTION__ = "tp_tap_handle_state"
(gdb) p *t
$8 = {tp = 0x5619dd09aab0, index = 0, state = TOUCH_END, has_ended = true,
dirty = true, point = {x = 2960, y = 2860}, time = 2162337668, pressure = 72,
is_tool_palm = false,
major = 0, minor = 0, was_down = true, quirks = {reset_motion_history =
false}, history = {samples = {{time = 2162254619, point = {x = 2008, y =
2476}}, {time = 2162302736,
point = {x = 2960, y = 2860}}, {time = 2162337668, point = {x = 2960, y
= 2860}}, {time = 2162224450, point = {x = 1694, y = 1398}}}, index = 2, count
= 1},
hysteresis_center = {x = 2960, y = 2860}, pinned = {is_pinned = false, center
= {x = 0, y = 0}}, button = {state = BUTTON_STATE_NONE, curr = 0, timer = {
libinput = 0x5619dd021580, timer_name = 0x5619dd09b330 "event11 (1)
button", link = {prev = 0x0, next = 0x0}, expire = 0, timer_func =
0x7f58e7f0ffac <tp_button_handle_timeout>, timer_func_data =
0x5619dd09ba60}}, tap = {state = TAP_TOUCH_STATE_DEAD, initial = {x = 0, y =
0}, is_thumb = false,
is_palm = false}, scroll = {edge_state = EDGE_SCROLL_TOUCH_STATE_NONE, edge
= 0, direction = -1, timer = {libinput = 0x5619dd021580,
timer_name = 0x5619dd09c2b0 "event11 (0) edgescroll", link = {prev = 0x0,
next = 0x0}, expire = 0, timer_func = 0x7f58e7f11f47
<tp_edge_scroll_handle_timeout>,
timer_func_data = 0x5619dd09ba60}, initial = {x = 0, y = 0}}, palm =
{state = PALM_NONE, first = {x = 1473, y = 1407}, time = 0}, gesture = {initial
= {x = 0, y = 0}},
thumb = {state = THUMB_STATE_MAYBE, first_touch_time = 2162224450, initial =
{x = 0, y = 0}}, speed = {last_speed = 0, exceeded_count = 0}}
(gdb) p *tp
$9 = {base = {dispatch_type = DISPATCH_TOUCHPAD, interface = 0x7f58e8136860
<tp_interface>, sendevents = {config = {get_modes = 0x0, set_mode = 0x0,
get_mode = 0x0,
get_default_mode = 0x0}, current_mode =
LIBINPUT_CONFIG_SEND_EVENTS_ENABLED}}, device = 0x5619dd0976b0, nfingers_down =
1, old_nfingers_down = 1, slot = 0,
has_mt = true, semi_mt = false, arbitration = {in_arbitration = false,
arbitration_timer = {libinput = 0x5619dd021580, timer_name = 0x5619dd09c250
"event11 arbitration",
link = {prev = 0x0, next = 0x0}, expire = 0, timer_func = 0x7f58e7f0a342
<tp_arbitration_timeout>, timer_func_data = 0x5619dd09aab0}}, num_slots = 2,
ntouches = 5,
touches = 0x5619dd09ba60, fake_touches = 5, pressure = {use_pressure = true,
high = 30, low = 25}, touch_size = {use_touch_size = false, high = 0, low = 0,
orientation_to_angle = 0}, hysteresis = {enabled = true, margin = {x = 20,
y = 30}, other_event_count = 0, last_motion_time = 2162337668}, accel = {
x_scale_coeff = 0.96024582293067029, y_scale_coeff = 0.64541112688782754,
xy_scale_coeff = 0.67213114754098358}, gesture = {enabled = true, started =
false,
finger_count = 1, finger_count_pending = 0, finger_count_switch_timer =
{libinput = 0x5619dd021580, timer_name = 0x5619dd09c350 "event11 gestures",
link = {prev = 0x0,
next = 0x0}, expire = 0, timer_func = 0x7f58e7f14814
<tp_gesture_finger_count_switch_timeout>, timer_func_data = 0x5619dd09aab0},
state = GESTURE_STATE_NONE,
touches = {0x0, 0x0}, initial_time = 0, initial_distance = 0, prev_scale =
0, angle = 0, center = {x = 0, y = 0}}, buttons = {is_clickpad = false,
has_topbuttons = false,
use_clickfinger = false, click_pending = false, state = 0, old_state = 0,
motion_dist = {x_scale_coeff = 0.024390243902439025, y_scale_coeff =
0.016393442622950821},
active = 0, active_is_topbutton = false, bottom_area = {top_edge =
2147483647, rightbutton_left_edge = 0, middlebutton_left_edge = 0}, top_area =
{
bottom_edge = -2147483648, rightbutton_left_edge = 0,
leftbutton_right_edge = 0}, trackpoint = 0x0, click_method =
LIBINPUT_CONFIG_CLICK_METHOD_NONE, config_method = {
get_methods = 0x7f58e7f10471 <tp_button_config_click_get_methods>,
set_method = 0x7f58e7f10534 <tp_button_config_click_set_method>, get_method =
0x7f58e7f10582 <tp_button_config_click_get_method>, get_default_method =
0x7f58e7f10635 <tp_button_config_click_get_default_method>}}, scroll =
{config_method = {
get_methods = 0x7f58e7f0a971
<tp_scroll_config_scroll_method_get_methods>, set_method = 0x7f58e7f0a9aa
<tp_scroll_config_scroll_method_set_method>, get_method =
0x7f58e7f0aa40 <tp_scroll_config_scroll_method_get_method>,
get_default_method = 0x7f58e7f0aae1
<tp_scroll_config_scroll_method_get_default_method>, set_button = 0x0,
get_button = 0x0, get_default_button = 0x0}, method =
LIBINPUT_CONFIG_SCROLL_2FG, right_edge = 5369, bottom_edge = 4301}, queued =
(TOUCHPAD_EVENT_MOTION | TOUCHPAD_EVENT_OTHERAXIS), tap = {config = {count
= 0x7f58e7f0e72b <tp_tap_config_count>, set_enabled =
0x7f58e7f0e775 <tp_tap_config_set_enabled>, get_enabled = 0x7f58e7f0e7eb
<tp_tap_config_is_enabled>, get_default = 0x7f58e7f0e869
<tp_tap_config_get_default>, set_map =
0x7f58e7f0e893 <tp_tap_config_set_map>, get_map = 0x7f58e7f0e8e9
<tp_tap_config_get_map>, get_default_map = 0x7f58e7f0e928
<tp_tap_config_get_default_map>,
set_drag_enabled = 0x7f58e7f0e937 <tp_tap_config_set_drag_enabled>,
get_drag_enabled = 0x7f58e7f0e985 <tp_tap_config_get_drag_enabled>,
get_default_drag_enabled =
0x7f58e7f0e9d7 <tp_tap_config_get_default_drag_enabled>,
set_draglock_enabled = 0x7f58e7f0ea01 <tp_tap_config_set_draglock_enabled>,
get_draglock_enabled =
0x7f58e7f0ea4f <tp_tap_config_get_draglock_enabled>,
get_default_draglock_enabled = 0x7f58e7f0eaa1
<tp_tap_config_get_default_draglock_enabled>}, enabled = true,
suspended = false, timer = {libinput = 0x5619dd021580, timer_name =
0x5619dd09aa20 "event11 tap", link = {prev = 0x0, next = 0x0}, expire = 0,
timer_func =
0x7f58e7f0e57f <tp_tap_handle_timeout>, timer_func_data = 0x5619dd09aab0},
state = TAP_STATE_IDLE, buttons_pressed = 0, saved_press_time = 2162224450,
saved_release_time = 2162302736, map = LIBINPUT_CONFIG_TAP_MAP_LRM,
want_map = LIBINPUT_CONFIG_TAP_MAP_LRM, drag_enabled = true, drag_lock_enabled
= false,
nfingers_down = 0}, palm = {right_edge = 5328, left_edge = 1612, upper_edge
= 1308, trackpoint_active = false, trackpoint_listener = {link = {prev = 0x0,
next = 0x0},
notify_func = 0x0, notify_func_data = 0x0}, trackpoint_timer = {libinput
= 0x5619dd021580, timer_name = 0x5619dd09c270 "event11 trackpoint", link =
{prev = 0x0,
next = 0x0}, expire = 0, timer_func = 0x7f58e7f09545
<tp_trackpoint_timeout>, timer_func_data = 0x5619dd09aab0},
trackpoint_last_event_time = 0,
trackpoint_event_count = 0, monitor_trackpoint = true, use_mt_tool = false,
use_pressure = true, pressure_threshold = 130, use_size = false, size_threshold
= 0},
sendevents = {config = {get_modes = 0x7f58e7f0be7e <tp_sendevents_get_modes>,
set_mode = 0x7f58e7f0bf48 <tp_sendevents_set_mode>, get_mode =
0x7f58e7f0c012 <tp_sendevents_get_mode>, get_default_mode = 0x7f58e7f0c049
<tp_sendevents_get_default_mode>}, current_mode =
LIBINPUT_CONFIG_SEND_EVENTS_ENABLED}, dwt = {
config = {is_available = 0x7f58e7f0abef <tp_dwt_config_is_available>,
set_enabled = 0x7f58e7f0abfe <tp_dwt_config_set>, get_enabled = 0x7f58e7f0ac54
<tp_dwt_config_get>,
get_default_enabled = 0x7f58e7f0ac9e <tp_dwt_config_get_default>},
dwt_enabled = true, paired_keyboard = {{device = 0x5619dd087580, listener =
{link = {
prev = 0x5619dd0875a0, next = 0x5619dd0875a0}, notify_func =
0x7f58e7f097b7 <tp_keyboard_event>, notify_func_data = 0x5619dd09aab0}},
{device = 0x0, listener = {
link = {prev = 0x0, next = 0x0}, notify_func = 0x0, notify_func_data
= 0x0}}, {device = 0x0, listener = {link = {prev = 0x0, next = 0x0},
notify_func = 0x0,
notify_func_data = 0x0}}}, key_mask = {0 <repeats 12 times>},
mod_mask = {0 <repeats 12 times>}, keyboard_active = false, keyboard_timer = {
libinput = 0x5619dd021580, timer_name = 0x5619dd09c290 "event11
keyboard", link = {prev = 0x0, next = 0x0}, expire = 0, timer_func =
0x7f58e7f0964f <tp_keyboard_timeout>, timer_func_data = 0x5619dd09aab0},
keyboard_last_press_time = 0}, thumb = {detect_thumbs = false, threshold = 0,
upper_thumb_line = 0, lower_thumb_line = 0}, quirks =
{nonmotion_event_count = 0}, lid_switch = {listener = {link = {prev = 0x0, next
= 0x0}, notify_func = 0x0,
notify_func_data = 0x0}, lid_switch = 0x0}, tablet_mode_switch =
{listener = {link = {prev = 0x0, next = 0x0}, notify_func = 0x0,
notify_func_data = 0x0},
tablet_mode_switch = 0x0}}
# ./libinput list-devices
Device: Power Button
Kernel: /dev/input/event3
Group: 1
Seat: seat0, default
Capabilities: keyboard
Tap-to-click: n/a
Tap-and-drag: n/a
Tap drag lock: n/a
Left-handed: n/a
Nat.scrolling: n/a
Middle emulation: n/a
Calibration: n/a
Scroll methods: none
Click methods: none
Disable-w-typing: n/a
Accel profiles: n/a
Rotation: n/a
Device: Video Bus
Kernel: /dev/input/event4
Group: 2
Seat: seat0, default
Capabilities: keyboard
Tap-to-click: n/a
Tap-and-drag: n/a
Tap drag lock: n/a
Left-handed: n/a
Nat.scrolling: n/a
Middle emulation: n/a
Calibration: n/a
Scroll methods: none
Click methods: none
Disable-w-typing: n/a
Accel profiles: n/a
Rotation: n/a
Device: Power Button
Kernel: /dev/input/event0
Group: 3
Seat: seat0, default
Capabilities: keyboard
Tap-to-click: n/a
Tap-and-drag: n/a
Tap drag lock: n/a
Left-handed: n/a
Nat.scrolling: n/a
Middle emulation: n/a
Calibration: n/a
Scroll methods: none
Click methods: none
Disable-w-typing: n/a
Accel profiles: n/a
Rotation: n/a
Device: Lid Switch
Kernel: /dev/input/event2
Group: 4
Seat: seat0, default
Capabilities: switch
Tap-to-click: n/a
Tap-and-drag: n/a
Tap drag lock: n/a
Left-handed: n/a
Nat.scrolling: n/a
Middle emulation: n/a
Calibration: n/a
Scroll methods: none
Click methods: none
Disable-w-typing: n/a
Accel profiles: n/a
Rotation: n/a
Device: Sleep Button
Kernel: /dev/input/event1
Group: 5
Seat: seat0, default
Capabilities: keyboard
Tap-to-click: n/a
Tap-and-drag: n/a
Tap drag lock: n/a
Left-handed: n/a
Nat.scrolling: n/a
Middle emulation: n/a
Calibration: n/a
Scroll methods: none
Click methods: none
Disable-w-typing: n/a
Accel profiles: n/a
Rotation: n/a
Device: Chicony USB 2.0 Camera: Chicony
Kernel: /dev/input/event7
Group: 6
Seat: seat0, default
Capabilities: keyboard
Tap-to-click: n/a
Tap-and-drag: n/a
Tap drag lock: n/a
Left-handed: n/a
Nat.scrolling: n/a
Middle emulation: n/a
Calibration: n/a
Scroll methods: none
Click methods: none
Disable-w-typing: n/a
Accel profiles: n/a
Rotation: n/a
Device: HDA Intel PCH Mic
Kernel: /dev/input/event9
Group: 7
Seat: seat0, default
Capabilities:
Tap-to-click: n/a
Tap-and-drag: n/a
Tap drag lock: n/a
Left-handed: n/a
Nat.scrolling: n/a
Middle emulation: n/a
Calibration: n/a
Scroll methods: none
Click methods: none
Disable-w-typing: n/a
Accel profiles: n/a
Rotation: n/a
Device: HDA Intel PCH Line Out
Kernel: /dev/input/event10
Group: 7
Seat: seat0, default
Capabilities:
Tap-to-click: n/a
Tap-and-drag: n/a
Tap drag lock: n/a
Left-handed: n/a
Nat.scrolling: n/a
Middle emulation: n/a
Calibration: n/a
Scroll methods: none
Click methods: none
Disable-w-typing: n/a
Accel profiles: n/a
Rotation: n/a
Device: AT Translated Set 2 keyboard
Kernel: /dev/input/event5
Group: 8
Seat: seat0, default
Capabilities: keyboard
Tap-to-click: n/a
Tap-and-drag: n/a
Tap drag lock: n/a
Left-handed: n/a
Nat.scrolling: n/a
Middle emulation: n/a
Calibration: n/a
Scroll methods: none
Click methods: none
Disable-w-typing: n/a
Accel profiles: n/a
Rotation: n/a
Device: SynPS/2 Synaptics TouchPad
Kernel: /dev/input/event11
Group: 9
Seat: seat0, default
Size: 107x59mm
Capabilities: pointer gesture
Tap-to-click: disabled
Tap-and-drag: enabled
Tap drag lock: disabled
Left-handed: disabled
Nat.scrolling: disabled
Middle emulation: n/a
Calibration: n/a
Scroll methods: *two-finger edge
Click methods: none
Disable-w-typing: enabled
Accel profiles: none
Rotation: n/a</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>