compiz team mailing list archive

Thread
Date
[Bug 1750619] Re: Static CompRegion destruction causes memory corruption at compiz exit

To: compiz@xxxxxxxxxxxxxxxxxxx
From: Marco Trevisan (Treviño) <mail@xxxxxxxxx>
Date: Thu, 22 Feb 2018 17:08:08 -0000
Reply-to: Bug 1750619 <1750619@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
** Description changed:

+ [ Impact ]
+ 
+ Unity could crash when closed with some memory corruption error
+ 
+ [ Test case ]
+ 
+ Run unity, loging in and out multiple times, you should get no crash
+ report or /var/lib/crash file mentioning compiz.
+ 
+ [ Regression potential ]
+ 
+ Really none, the change could only cause compilation issues, not really
+ anything for the user changed.
+ 
+ 
+ ---------
+ 
+ 
  Valgrind is a good friend here...
  
  ==30842== Memcheck, a memory error detector
  ==30842== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
  ==30842== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
  ==30842== Command: ./test-decorations-input-mixer
  ==30842==
  Gtk-Message: 12:17:20.414: Failed to load module "canberra-gtk-module"
  Gtk-Message: 12:17:20.483: Failed to load module "unity-gtk-module"
  Gtk-Message: 12:17:22.584: Failed to load module "canberra-gtk-module"
  Gtk-Message: 12:17:22.699: Failed to load module "canberra-gtk-module"
  m_GLCtx = glXCreateContext(m_X11Display, m_X11VisualInfo, 0, GL_TRUE);
  WARN  2018-02-20 12:17:37 xim.controller XIMController.cpp:103 IBus natively supported.
  Cleaning up window 178257923
  curThreadState = 0x15b427e0
  DispatchCurrentUnref, currents are 1
  DEstroying context 0x1f2687e0
  m_GLCtx = NULL;
  ==30842== Invalid read of size 8
  ==30842==    at 0x68EA1E4: XDestroyRegion (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
  ==30842==    by 0x4130A16: CompRegion::~CompRegion() (region.cpp:113)
  ==30842==    by 0x8A8F239: __cxa_finalize (cxa_finalize.c:56)
  ==30842==    by 0x76D6B02: ??? (in /tmp/NUX_INSTALL/lib/libcompiz_core.so.0.9.13.1)
  ==30842==    by 0x4011219: _dl_fini (dl-fini.c:235)
  ==30842==    by 0x8A8EEBF: __run_exit_handlers (exit.c:83)
  ==30842==    by 0x8A8EF19: exit (exit.c:105)
  ==30842==    by 0x8A741C7: (below main) (libc-start.c:342)
  ==30842==  Address 0x15943e10 is 16 bytes inside a block of size 32 free'd
  ==30842==    at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
  ==30842==    by 0x68EA1F4: XDestroyRegion (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
  ==30842==    by 0x4130A16: CompRegion::~CompRegion() (region.cpp:113)
  ==30842==    by 0x8A8F239: __cxa_finalize (cxa_finalize.c:56)
  ==30842==    by 0x40E5432: ??? (in /tmp/NUX_INSTALL/lib/compiz/libopengl.so)
  ==30842==    by 0x4011219: _dl_fini (dl-fini.c:235)
  ==30842==    by 0x8A8EEBF: __run_exit_handlers (exit.c:83)
  ==30842==    by 0x8A8EF19: exit (exit.c:105)
  ==30842==    by 0x8A741C7: (below main) (libc-start.c:342)
  ==30842==  Block was alloc'd at
  ==30842==    at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
  ==30842==    by 0x68EA03A: XCreateRegion (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
  ==30842==    by 0x4130A2A: CompRegion::init() (region.cpp:120)
  ==30842==    by 0x41307CB: CompRegion::CompRegion() (region.cpp:56)
  ==30842==    by 0x4131E29: __static_initialization_and_destruction_0(int, int) (region.cpp:43)
  ==30842==    by 0x4131E73: _GLOBAL__sub_I_region.cpp (region.cpp:441)
  ==30842==    by 0x4010AD9: call_init.part.0 (dl-init.c:72)
  ==30842==    by 0x4010BEA: call_init (dl-init.c:30)
  ==30842==    by 0x4010BEA: _dl_init (dl-init.c:120)
  ==30842==    by 0x4000ED9: ??? (in /lib/x86_64-linux-gnu/ld-2.26.so)
  ==30842==
  ==30842== Invalid free() / delete / delete[] / realloc()
  ==30842==    at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
  ==30842==    by 0x68EA1EC: XDestroyRegion (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
  ==30842==    by 0x4130A16: CompRegion::~CompRegion() (region.cpp:113)
  ==30842==    by 0x8A8F239: __cxa_finalize (cxa_finalize.c:56)
  ==30842==    by 0x76D6B02: ??? (in /tmp/NUX_INSTALL/lib/libcompiz_core.so.0.9.13.1)
  ==30842==    by 0x4011219: _dl_fini (dl-fini.c:235)
  ==30842==    by 0x8A8EEBF: __run_exit_handlers (exit.c:83)
  ==30842==    by 0x8A8EF19: exit (exit.c:105)
  ==30842==    by 0x8A741C7: (below main) (libc-start.c:342)
  ==30842==  Address 0x15943e60 is 0 bytes inside a block of size 8 free'd
  ==30842==    at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
  ==30842==    by 0x68EA1EC: XDestroyRegion (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
  ==30842==    by 0x4130A16: CompRegion::~CompRegion() (region.cpp:113)
  ==30842==    by 0x8A8F239: __cxa_finalize (cxa_finalize.c:56)
  ==30842==    by 0x40E5432: ??? (in /tmp/NUX_INSTALL/lib/compiz/libopengl.so)
  ==30842==    by 0x4011219: _dl_fini (dl-fini.c:235)
  ==30842==    by 0x8A8EEBF: __run_exit_handlers (exit.c:83)
  ==30842==    by 0x8A8EF19: exit (exit.c:105)
  ==30842==    by 0x8A741C7: (below main) (libc-start.c:342)
  ==30842==  Block was alloc'd at
  ==30842==    at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
  ==30842==    by 0x68EA04C: XCreateRegion (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
  ==30842==    by 0x4130A2A: CompRegion::init() (region.cpp:120)
  ==30842==    by 0x41307CB: CompRegion::CompRegion() (region.cpp:56)
  ==30842==    by 0x4131E29: __static_initialization_and_destruction_0(int, int) (region.cpp:43)
  ==30842==    by 0x4131E73: _GLOBAL__sub_I_region.cpp (region.cpp:441)
  ==30842==    by 0x4010AD9: call_init.part.0 (dl-init.c:72)
  ==30842==    by 0x4010BEA: call_init (dl-init.c:30)
  ==30842==    by 0x4010BEA: _dl_init (dl-init.c:120)
  ==30842==    by 0x4000ED9: ??? (in /lib/x86_64-linux-gnu/ld-2.26.so)
  ==30842==
  ==30842== Invalid free() / delete / delete[] / realloc()
  ==30842==    at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
  ==30842==    by 0x68EA1F4: XDestroyRegion (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
  ==30842==    by 0x4130A16: CompRegion::~CompRegion() (region.cpp:113)
  ==30842==    by 0x8A8F239: __cxa_finalize (cxa_finalize.c:56)
  ==30842==    by 0x76D6B02: ??? (in /tmp/NUX_INSTALL/lib/libcompiz_core.so.0.9.13.1)
  ==30842==    by 0x4011219: _dl_fini (dl-fini.c:235)
  ==30842==    by 0x8A8EEBF: __run_exit_handlers (exit.c:83)
  ==30842==    by 0x8A8EF19: exit (exit.c:105)
  ==30842==    by 0x8A741C7: (below main) (libc-start.c:342)
  ==30842==  Address 0x15943e00 is 0 bytes inside a block of size 32 free'd
  ==30842==    at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
  ==30842==    by 0x68EA1F4: XDestroyRegion (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
  ==30842==    by 0x4130A16: CompRegion::~CompRegion() (region.cpp:113)
  ==30842==    by 0x8A8F239: __cxa_finalize (cxa_finalize.c:56)
  ==30842==    by 0x40E5432: ??? (in /tmp/NUX_INSTALL/lib/compiz/libopengl.so)
  ==30842==    by 0x4011219: _dl_fini (dl-fini.c:235)
  ==30842==    by 0x8A8EEBF: __run_exit_handlers (exit.c:83)
  ==30842==    by 0x8A8EF19: exit (exit.c:105)
  ==30842==    by 0x8A741C7: (below main) (libc-start.c:342)
  ==30842==  Block was alloc'd at
  ==30842==    at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
  ==30842==    by 0x68EA03A: XCreateRegion (in /usr/lib/x86_64-linux-gnu/libX11.so.6.3.0)
  ==30842==    by 0x4130A2A: CompRegion::init() (region.cpp:120)
  ==30842==    by 0x41307CB: CompRegion::CompRegion() (region.cpp:56)
  ==30842==    by 0x4131E29: __static_initialization_and_destruction_0(int, int) (region.cpp:43)
  ==30842==    by 0x4131E73: _GLOBAL__sub_I_region.cpp (region.cpp:441)
  ==30842==    by 0x4010AD9: call_init.part.0 (dl-init.c:72)
  ==30842==    by 0x4010BEA: call_init (dl-init.c:30)
  ==30842==    by 0x4010BEA: _dl_init (dl-init.c:120)
  ==30842==    by 0x4000ED9: ??? (in /lib/x86_64-linux-gnu/ld-2.26.so)
  ==30842==
  current theadd at destroy table 0
  ==30842==
  ==30842== HEAP SUMMARY:
  ==30842==     in use at exit: 1,443,511 bytes in 16,537 blocks
  ==30842==   total heap usage: 190,069 allocs, 173,536 frees, 62,998,214 bytes allocated
  ==30842==
  ==30842== LEAK SUMMARY:
  ==30842==    definitely lost: 6,255 bytes in 263 blocks
  ==30842==    indirectly lost: 898 bytes in 45 blocks
  ==30842==      possibly lost: 3,794 bytes in 28 blocks
  ==30842==    still reachable: 1,362,788 bytes in 15,635 blocks
  ==30842==                       of which reachable via heuristic:
  ==30842==                         length64           : 3,176 bytes in 59 blocks
  ==30842==                         newarray           : 2,064 bytes in 49 blocks
  ==30842==         suppressed: 0 bytes in 0 blocks
  ==30842== Rerun with --leak-check=full to see details of leaked memory
  ==30842==
  ==30842== For counts of detected and suppressed errors, rerun with: -v
  ==30842== ERROR SUMMARY: 6 errors from 3 contexts (suppressed: 0 from 0)

-- 
You received this bug notification because you are a member of compiz
packagers, which is subscribed to compiz in Ubuntu.
https://bugs.launchpad.net/bugs/1750619

Title:
  Static CompRegion destruction causes memory corruption at compiz exit

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/compiz/+bug/1750619/+subscriptions
References

[Bug 1750619] [NEW] Static CompRegion destruction causes memory corruption at compiz exit
From: Treviño, 2018-02-20