[BUG] X.Org 1.14.6 with touchscreens

[Filippo Sironi]

I applied this patch: http://patchwork.freedesktop.org/patch/16209/ after going
through this http://lists.x.org/pipermail/xorg/2013-November/056209.html mail.
It did hide the issue within the Xi/exevents.c file, however, I'm seeing
random segfaults like the following when using the touchscreen:

(gdb) bt
#0  0x00068174 in GetTouchEvents (events=0x408b1008, dev=0x46ded8, ddx_touchid=0, type=19, flags=0,
    mask_in=0x46f220) at getevents.c:1890
#1  0x0006810c in QueueTouchEvents (device=0x46ded8, type=19, ddx_touchid=0, flags=0, mask=0x46f220)
    at getevents.c:1864
#2  0x000c5e48 in xf86PostTouchEvent (dev=0x46ded8, touchid=0, type=19, flags=0, mask=0x46f220)
    at xf86Xinput.c:1469
#3  0x40b7ffec in EvdevPostQueuedEvents (pInfo=0x4471a0, num_v=0, first_v=0, v=0xbed454d4)
    at evdev.c:984
#4  0x40b800d0 in EvdevProcessSyncEvent (pInfo=0x4471a0, ev=0xbed455c4) at evdev.c:1013
#5  0x40b80238 in EvdevProcessEvent (pInfo=0x4471a0, ev=0xbed455c4) at evdev.c:1053
#6  0x40b804ec in EvdevReadInput (pInfo=0x4471a0) at evdev.c:1129
#7  0x000abcd0 in xf86SigioReadInput (fd=25, closure=0x4471a0) at xf86Events.c:300
#8  0x000eb1e0 in xf86SIGIO (sig=29) at ./../shared/sigio.c:110
#9  <signal handler called>
#10 0x00023678 in calloc () at malloc.c:3129
#11 0x00054c58 in InitializeSprite (pDev=0x46ded8, pWin=0x302aa8) at events.c:3215
#12 0x000361b8 in AttachDevice (client=0x0, dev=0x46ded8, master=0x0) at devices.c:2617
#13 0x000507a4 in DetachFromMaster (dev=0x46ded8) at events.c:1438
#14 0x00050f68 in ActivateKeyboardGrab (keybd=0x46ded8, grab=0x48cca8, time=..., passive=0)
    at events.c:1626
#15 0x0005aa28 in GrabDevice (client=0x475e08, dev=0x46ded8, pointer_mode=1, keyboard_mode=1,
    grabWindow=6291461, ownerEvents=1, ctime=1908041411, mask=0xbed45b88, grabtype=3, curs=0,
    confineToWin=0, status=0xbed45b8f "") at events.c:5149
#16 0x001bb9a8 in ProcXIGrabDevice (client=0x475e08) at xigrabdev.c:105
#17 0x001aa330 in ProcIDispatch (client=0x475e08) at extinit.c:409
#18 0x00037334 in Dispatch () at dispatch.c:432
#19 0x00024c78 in main (argc=2, argv=0xbed45db4, envp=0xbed45dc0) at main.c:298
(gdb)
(gdb) p dev
$1 = (DeviceIntPtr) 0x46ded8
(gdb) p dev->spriteInfo
$2 = (SpriteInfoPtr) 0x46e178
(gdb) p dev->spriteInfo->sprite
$3 = (SpritePtr) 0x0

dev->spriteInfo->sprite is dereferenced in the first line (1890) of
dix/getevents.c :

ScreenPtr scr = dev->spriteInfo->sprite->hotPhys.pScreen;

Cheers,
Filippo

On giu/06/2014, at 10:36, Filippo Sironi <filippo.sironi at gmail.com> wrote:

> I'm running X.Org 1.14.6 on a touchscreen device and I'm getting a bunch of BUG
> messages on my console:
> 
> BUG: triggered 'if (ti->listeners[0].type != LISTENER_GRAB && ti->listeners[0].type != LISTENER_POINTER_GRAB)'
> BUG: Xi/exevents.c:1044 in ActivateEarlyAccept()
> 
> Whenever the first of this messages appears, I enter an "endless" loop if I
> continue using the touchscreen. I can only get out of it by using a mouse to
> somehow undo what the touchscreen started.
> 
> The backtrace is the following:
> 
> (gdb) bt
> #0  ActivateEarlyAccept (dev=0x30bfc8, ti=0xd3c664) at exevents.c:1045
> #1  0x001a68d0 in DeliverTouchBeginEvent (dev=0x30bfc8, ti=0xd3c664, ev=0xbe98df78,
>    listener=0x6258f8, client=0x34a1a8, win=0x471720, grab=0x0, xi2mask=0x0) at exevents.c:1851
> #2  0x001a6da8 in DeliverTouchEvent (dev=0x30bfc8, ti=0xd3c664, ev=0xbe98df78, listener=0x6258f8,
>    client=0x34a1a8, win=0x471720, grab=0x0, xi2mask=0x0) at exevents.c:1973
> #3  0x001a6ffc in DeliverTouchEvents (dev=0x30bfc8, ti=0xd3c664, ev=0xbe98df78, resource=0)
>    at exevents.c:2028
> #4  0x001a5fc8 in ProcessTouchEvent (ev=0xbe98df78, dev=0x30bfc8) at exevents.c:1617
> #5  0x001a67b4 in ProcessOtherEvent (ev=0xbe98df78, device=0x30bfc8) at exevents.c:1814
> #6  0x001ec9a8 in ProcessPointerEvent (ev=0xbe98df78, mouse=0x30bfc8) at xkbAccessX.c:751
> #7  0x00234c5c in mieqProcessDeviceEvent (dev=0x459dc8, event=0x2b4008 <event.17119>,
>    screen=0x2ec6c0) at mieq.c:565
> #8  0x00234f08 in mieqProcessInputEvents () at mieq.c:627
> #9  0x000ab59c in ProcessInputEvents () at xf86Events.c:165
> #10 0x00037088 in Dispatch () at dispatch.c:357
> #11 0x00024c78 in main (argc=3, argv=0xbe98eda4, envp=0xbe98edb4) at main.c:298
> 
> The condition, which is not met, that triggers the BUG is 'ti->listeners[0].type != LISTENER_POINTER_GRAB' .
> 
> Apparently, this BUG has been discussed previously on this list but no changes
> landed inside the 1.14 branch (which I'm forced to use since I have a
> binary driver that is compiled for X.Org 1.14).
> 
> Any help?
> 
> Cheers,
> Filippo
>