Compositor crashes when switching tty

[adlo]

On Thu, 2019-05-30 at 13:39 +0300, Pekka Paalanen wrote:
> On Thu, 30 May 2019 00:50:32 +0100
> adlo <adloconwy at gmail.com> wrote:
> 
> > Also, there are lots of "Invalid writes of size 8", but a lot of
> > them
> > don't seem to originate from functions in my program, but from the
> > Wayland libraries themselves. What is going on there?
> 
> Hi,
> 
> as always, look at the very first problem reported. Other problems
> may be fallout from the first one, so fix the first one, and repeat.
> 
> It is quite easy to corrupt a list based on struct wl_list, which
> will then result in more errors all over the place.
> 

The first problem is this:

==13998== Invalid write of size 8
==13998==    at 0x4884ADB: wl_list_remove (in /usr/lib64/libwayland-
server.so.0.1.0)
==13998==    by 0x48A2585: weston_view_set_output (in
/usr/lib64/libweston-6.so.0.0.0)
==13998==    by 0x48A41AD: weston_view_unmap (in /usr/lib64/libweston-
6.so.0.0.0)
==13998==    by 0x48A5587: weston_view_destroy (in
/usr/lib64/libweston-6.so.0.0.0)
==13998==    by 0x48A5664: weston_surface_destroy (in
/usr/lib64/libweston-6.so.0.0.0)
==13998==    by 0x4880927: ??? (in /usr/lib64/libwayland-
server.so.0.1.0)
==13998==    by 0x4884A7F: ??? (in /usr/lib64/libwayland-
server.so.0.1.0)
==13998==    by 0x4884FC3: ??? (in /usr/lib64/libwayland-
server.so.0.1.0)
==13998==    by 0x4880AA1: wl_client_destroy (in /usr/lib64/libwayland-
server.so.0.1.0)
==13998==    by 0x4880EDD: wl_display_flush_clients (in
/usr/lib64/libwayland-server.so.0.1.0)
==13998==    by 0x4880F17: wl_display_run (in /usr/lib64/libwayland-
server.so.0.1.0)
==13998==    by 0x403A57: main (main-wayland.c:625)
==13998==  Address 0x9fcda10 is 96 bytes inside a block of size 120
free'd
==13998==    at 0x4839A0C: free (vg_replace_malloc.c:540)
==13998==    by 0x48DD073: ??? (in /usr/lib64/libweston-desktop-
6.so.0.0.0)
==13998==    by 0x48D8E53: ??? (in /usr/lib64/libweston-desktop-
6.so.0.0.0)
==13998==    by 0x4880927: ??? (in /usr/lib64/libwayland-
server.so.0.1.0)
==13998==    by 0x4880993: wl_resource_destroy (in
/usr/lib64/libwayland-server.so.0.1.0)
==13998==    by 0x5984B27: ffi_call_unix64 (in
/usr/lib64/libffi.so.6.0.2)
==13998==    by 0x5984338: ffi_call (in /usr/lib64/libffi.so.6.0.2)
==13998==    by 0x48841B6: ??? (in /usr/lib64/libwayland-
server.so.0.1.0)
==13998==    by 0x4880D31: ??? (in /usr/lib64/libwayland-
server.so.0.1.0)
==13998==    by 0x4882369: wl_event_loop_dispatch (in
/usr/lib64/libwayland-server.so.0.1.0)
==13998==    by 0x4880F24: wl_display_run (in /usr/lib64/libwayland-
server.so.0.1.0)
==13998==    by 0x403A57: main (main-wayland.c:625)

However, this doesn't seem to call back into my compositor's code at
any point. I see a call to weston_surface_destroy (), which suggests a
surface was destroyed. However, if a surface was destroyed, I would
expect to see a call to surface_removed () in src/shell.c. How do I
interpret this?

Trying a different tack, it seems that the errors disappear if I remove
the call to free () in surface_removed ():

void surface_removed (struct weston_desktop_surface *desktop_surface,
                      void                   *user_data)
{
  DisplayInfo *server = user_data;

  CWindowWayland *self = weston_desktop_surface_get_user_data
(desktop_surface);

  if (!self)
    return;

  wl_signal_emit (&self->destroy_signal, self);

  weston_desktop_surface_unlink_view (self->view);
  weston_view_destroy (self->view);
  weston_desktop_surface_set_user_data (desktop_surface, NULL);
  free (self); //errors go away if I remove this
}

How can I fix this?

Regards

adlo