[BNR] Compiz crash in movementWindowOnScreen (caused by fix 755842)

Bug #1015151 reported by Alan Pope 🍺🐧🐱 πŸ¦„
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Compiz
Fix Released
High
Sam Spilsbury
Compiz Main Plugins
Fix Committed
High
Sam Spilsbury
compiz (Ubuntu)
Fix Released
High
Unassigned
Precise
Won't Fix
Undecided
Unassigned
compiz-plugins-main (Ubuntu)
In Progress
High
Unassigned
Precise
Fix Released
Undecided
Unassigned

Bug Description

[Impact]

A crash after fix to bug #755842.

[Test case]

Use super+W rapidly a few times.

[Regression Potential]

Should be low, correct usage of the vector variable. Test wall plugin's offset movement functionality in general.

TESTCASE:

ctest -D ExperimentalMemCheck
(this option was only added on 20 June 2012)

ORIGINAL DESCRIPTION:
Running compiz 1:0.9.8+bzr3249-0ubuntu1 got a crash in movementWindowOnScreen after doing super+W a few times.

valgrind says:

==3648== Invalid read of size 2
==3648== at 0x806092A: compiz::wall::movementWindowOnScreen(CompRect const&, CompRegion const&) (rect.h:178)
==3648== by 0x44BCEC7: ???
==3648== Address 0x44bd026 is 14 bytes inside a block of size 20 free'd
==3648== at 0x402ACFC: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==3648== by 0x8060965: compiz::wall::movementWindowOnScreen(CompRect const&, CompRegion const&) (new_allocator.h:98)
==3648== by 0x44BCEC7: ???

The classic case of iterating a temporary vector that goes out of scope while iterating. Annoying.

Revision history for this message
Alan Pope 🍺🐧🐱 πŸ¦„ (popey) wrote :
Changed in compiz:
milestone: none → 0.9.8.0
assignee: nobody → Sam Spilsbury (smspillaz)
importance: Undecided → High
status: New → In Progress
description: updated
Changed in compiz-core:
importance: Undecided → High
milestone: none → 0.9.7.10
Revision history for this message
Daniel van Vugt (vanvugt) wrote :

Note: This bug was never in precise. But the fix does need to be backported to lp:compiz-plugins-main before maintenance release 0.9.7.4 of that project.

affects: compiz-core → compiz-plugins-main
Changed in compiz-plugins-main:
milestone: 0.9.7.10 → none
milestone: none → 0.9.7.4
description: updated
Changed in compiz:
status: In Progress → Fix Committed
Revision history for this message
Daniel van Vugt (vanvugt) wrote :

Fix committed into lp:compiz at revision 3255

summary: - Compiz crash in movementWindowOnScreen
+ [BNR] Compiz crash in movementWindowOnScreen
Revision history for this message
Daniel van Vugt (vanvugt) wrote : Re: [BNR] Compiz crash in movementWindowOnScreen

BNR = bug never released.

Revision history for this message
Daniel van Vugt (vanvugt) wrote :

This regression is caused by the fix for bug 755842, which is already committed for the next maintenance release: compiz-plugins-main 0.9.7.4. Make sure this fix gets backported too!

summary: - [BNR] Compiz crash in movementWindowOnScreen
+ [BNR] Compiz crash in movementWindowOnScreen (caused by fix 755842)
affects: compiz (Ubuntu) → compiz-plugins-main (Ubuntu)
no longer affects: compiz-plugins-main (Ubuntu)
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (7.6 KiB)

This bug was fixed in the package compiz - 1:0.9.8+bzr3249-0ubuntu1

---------------
compiz (1:0.9.8+bzr3249-0ubuntu1) quantal-proposed; urgency=low

  * New upstream snapshot.
    - Fall back to a refresh rate that is more likely to look correct; 60Hz.
      (LP: #1009338)
    - Benchmark plugin should consume its key binding, and not pass the key to
      the underlying window. (LP: #1009320)
    - Avoid needless STL operations leading to expensive heap operations.
      (LP: #1006335)
    - Fix a typo that was causing (LP: #1002606)
      (widthIncBorders/heightIncBorders)
    - Check if the window is decorated before trying to change its event window
      states (which won't exist if not decorated) (LP: #1007754)
    - Use the XDamage extension more efficiently (the way it was designed to be
      used). This dramatically reduces CPU usage, reduces wakeups, and
      increases frame rates. It also solves at least one observed performance
      bug (LP: #1007299) and probably several more.
    - Avoid constructing and destructing lots of strings on every single event,
      which was wasting lots of CPU (LP: #1005569)
    - md LINGUAS doesn't exist, it's mnk (Mandinka in ISO 639-3)
    - Move grid plugin to google test and don't depend on the plugin for the
      test (LP: #1005009)
    - Don't read plugin.Initialized and test the value. (LP: #1004848)
    - libcompizconfig's install () commands were still using the old includedir
      and libdir variables rather than their libcompizconfig_* variants.
      (LP: #1005176)
    - Execute the cmake files separately to ensure that DESTDIR is respected.
      (LP: #1005177)
    - Don't set_target_properties on a target that might not exist
      (LP: #1005008)
    - Don't allow windows which we weren't even tracking as decoratable to
      become decorated if they try and change their hints. (LP: #963794)
    - Change the mouse pointer while dragging windows in expo. Just like the
      ubuntu branches do. (LP: #987647)
    - Fix uninitialized memory use (LP: #1004338)
    - Fix uninitialized variable (LP: #1004335)
    - Delay unbinding of pixmaps until then next rebind (LP: #729979)
      (LP: #1002602)
    - Don't drop plugins from the list to try and load before you've even tried
      to load them. Doing so makes missing plugins silently ignored instead of
      an error message (LP: #1002715). It also means valid plugins in more
      unusual, but real locations in LD_LIBRARY_PATH will never get loaded
      (LP: #1002721).
    - If running test cases under a real X server, we don't care if Xvfb is
      missing (LP: #994841)
    - Don't assume pkg_check_modules always sets _PREFIX (LP: #993608)
    - Don't clear selections in ~PrivateScreen because it causes a race between
      the existing and the new compiz instances, breaking --replace and
      non-replace behaviour. (LP: #988684) (LP: #989545)
    - Always paint with infiniteRegion as the clip region if the window is
      transformed and always use the supplied region if painting with offset or
      on transformed screen. (LP: #987639)
    - Add synchronization primitives to the decoration protocol so that there
      isn't a r...

Read more...

Changed in compiz (Ubuntu):
status: New → Fix Released
Revision history for this message
Daniel van Vugt (vanvugt) wrote :

BNR means bug-never-released. So the "release" of this fix is not really relevant to users.

Changed in compiz:
status: Fix Committed → Fix Released
Revision history for this message
Daniel van Vugt (vanvugt) wrote :

Fix committed to lp:compiz-plugins-main/0.9.7 at revision 35, scheduled for release in Compiz Main Plugins 0.9.7.4

Changed in compiz-plugins-main:
status: New → Fix Committed
assignee: nobody → Sam Spilsbury (smspillaz)
Changed in compiz-plugins-main (Ubuntu):
status: New → Triaged
Changed in compiz (Ubuntu):
importance: Undecided → High
Changed in compiz-plugins-main (Ubuntu):
importance: Undecided → High
description: updated
Changed in compiz-plugins-main (Ubuntu):
status: Triaged → In Progress
Revision history for this message
Steve Langasek (vorlon) wrote : Please test proposed package

Hello Alan, or anyone else affected,

Accepted compiz-plugins-main into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/compiz-plugins-main/1:0.9.7.0~bzr19-0ubuntu10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in compiz-plugins-main (Ubuntu Precise):
status: New → Fix Committed
tags: added: verification-needed
Revision history for this message
Miklos Juhasz (mjuhasz) wrote :

This seems to be fixed since I can't reproduce the crash using the proposed packages. Tried on 2 machines with different vga cards.

tags: added: verification-done
removed: verification-needed
Revision history for this message
Colin Watson (cjwatson) wrote : Update Released

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package compiz-plugins-main - 1:0.9.7.0~bzr19-0ubuntu10.1

---------------
compiz-plugins-main (1:0.9.7.0~bzr19-0ubuntu10.1) precise; urgency=low

  * debian/patches/fix_755842.patch:
    Fix non-maximized windows which sit on the border of a workspace move
    when called (LP: #755842)
  * debian/patches/fix_1015151.patch:
    Fix a crash related to the above fix (LP: #1015151)
 -- Timo Jyrinki <email address hidden> Mon, 25 Feb 2013 10:56:33 +0200

Changed in compiz-plugins-main (Ubuntu Precise):
status: Fix Committed → Fix Released
Revision history for this message
Steve Langasek (vorlon) wrote :

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release

Changed in compiz (Ubuntu Precise):
status: New → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Bug attachments

Remote bug watches

Bug watches keep track of this bug in other bug trackers.