Ubuntu
mir package

Mir client crashes in google::protobuf::MessageLite::ParseFromString when the server sends an error response

Bug #1669177 reported by Michał Kuchta on 2017-03-01

This bug affects 3 people

	Status	Importance	Assigned to	Milestone
Canonical System Image	New	High	Stephen M. Webb	Canonical System Image u8c-2 "Unity8 on Classic"
Mir	New	High	Unassigned
0.26	New	High	Unassigned
mir (Ubuntu)	New	High	Unassigned

Bug Description

Mir client crash occurred during executing 01_hello_SDL (SDL_VIDEODRIVER=mir ./01_hello_SDL) program (program source is available here: http://lazyfoo.net/tutorials/SDL/01_hello_SDL/01_hello_SDL.zip ).

Stack trace:
#0 0x00007ffff00050c0 in ?? ()
#1 0x00007ffff59e796f in google::protobuf::MessageLite::ParseFromString(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) () from /usr/lib/x86_64-linux-gnu/libprotobuf-lite.so.9
#2 0x00007ffff6affb88 in mir::client::rpc::MirProtobufRpcChannel::<lambda(google::protobuf::MessageLite*)>::operator()(google::protobuf::MessageLite *) const (__closure=0x7ffff4bc9a20, result_message=0x7ffff0004f80)
    at /media/kinga/Dane/mir/mir_nowy/src/client/rpc/mir_protobuf_rpc_channel.cpp:506
#3 0x00007ffff6b00897 in std::_Function_handler<void(google::protobuf::MessageLite*), mir::client::rpc::MirProtobufRpcChannel::on_data_available()::<lambda(google::protobuf::MessageLite*)> >::_M_invoke(const std::_Any_data &, <unknown type in /usr/local/lib/libmirclient.so.9, CU 0x5376df, DIE 0x58367b>) (__functor=...,
    __args#0=<unknown type in /usr/local/lib/libmirclient.so.9, CU 0x5376df, DIE 0x58367b>)
    at /usr/include/c++/5/functional:1871
#4 0x00007ffff6afbab5 in std::function<void (google::protobuf::MessageLite*)>::operator()(google::protobuf::MessageLite*) const (this=0x7ffff4bc9a20, __args#0=0x7ffff0004f80) at /usr/include/c++/5/functional:2267
#5 0x00007ffff6afad99 in mir::client::rpc::detail::PendingCallCache::populate_message_for_result(mir::protobuf::wire::Result&, std::function<void (google::protobuf::MessageLite*)> const&) (this=0x61e990, result=...,
    populator=...) at /media/kinga/Dane/mir/mir_nowy/src/client/rpc/mir_basic_rpc_channel.cpp:74
#6 0x00007ffff6affed5 in mir::client::rpc::MirProtobufRpcChannel::on_data_available (this=0x61e960)
    at /media/kinga/Dane/mir/mir_nowy/src/client/rpc/mir_protobuf_rpc_channel.cpp:508
#7 0x00007ffff6b09c95 in mir::client::rpc::TransportObservers::<lambda(auto:1)>::operator()<std::shared_ptr<mir::client::rpc::StreamTransport::Observer> >(std::shared_ptr<mir::client::rpc::StreamTransport::Observer>) const (
    __closure=0x7ffff4bc9bd0, observer=warning: RTTI symbol not found for class 'std::_Sp_counted_deleter<mir::client::rpc::MirProtobufRpcChannel*, mir::client::rpc::MirProtobufRpcChannel::MirProtobufRpcChannel(std::unique_ptr<mir::client::rpc::StreamTransport, std::default_delete<mir::client::rpc::StreamTransport> >, std::shared_ptr<mir::client::SurfaceMap> const&, std::shared_ptr<mir::client::AsyncBufferFactory> const&, std::shared_ptr<mir::client::DisplayConfiguration> const&, std::shared_ptr<mir::input::InputDevices> const&, std::shared_ptr<mir::client::rpc::RpcReport> const&, std::shared_ptr<mir::client::AtomicCallback<MirLifecycleState> > const&, std::shared_ptr<mir::client::AtomicCallback<int> > const&, std::shared_ptr<mir::client::AtomicCallback<MirError const*> > const&, std::shared_ptr<mir::client::EventSink> const&)::NullDeleter, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>'
warning: RTTI symbol not found for class 'std::_Sp_counted_deleter<mir::client::rpc::MirProtobufRpcChannel*, mir::client::rpc::MirProtobufRpcChannel::MirProtobufRpcChannel(std::unique_ptr<mir::client::rpc::StreamTransport, std::default_delete<mir::client::rpc::StreamTransport> >, std::shared_ptr<mir::client::SurfaceMap> const&, std::shared_ptr<mir::client::AsyncBufferFactory> const&, std::shared_ptr<mir::client::DisplayConfiguration> const&, std::shared_ptr<mir::input::InputDevices> const&, std::shared_ptr<mir::client::rpc::RpcReport> const&, std::shared_ptr<mir::client::AtomicCallback<MirLifecycleState> > const&, std::shared_ptr<mir::client::AtomicCallback<int> > const&, std::shared_ptr<mir::client::AtomicCallback<MirError const*> > const&, std::shared_ptr<mir::client::EventSink> const&)::NullDeleter, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>'
std::shared_ptr (count 3, weak 0) 0x61e970)
    at /media/kinga/Dane/mir/mir_nowy/src/client/rpc/stream_socket_transport.cpp:40
#8 0x00007ffff6b0ad2c in std::_Function_handler<void(const std::shared_ptr<mir::client::rpc::StreamTransport::Observer>&), mir::client::rpc::TransportObservers::on_data_available()::<lambda(auto:1)> >::_M_invoke(const std::_Any_data &, const std::shared_ptr<mir::client::rpc::StreamTransport::Observer> &) (__functor=..., __args#0=warning: RTTI symbol not found for class 'std::_Sp_counted_deleter<mir::client::rpc::MirProtobufRpcChannel*, mir::client::rpc::MirProtobufRpcChannel::MirProtobufRpcChannel(std::unique_ptr<mir::client::rpc::StreamTransport, std::default_delete<mir::client::rpc::StreamTransport> >, std::shared_ptr<mir::client::SurfaceMap> const&, std::shared_ptr<mir::client::AsyncBufferFactory> const&, std::shared_ptr<mir::client::DisplayConfiguration> const&, std::shared_ptr<mir::input::InputDevices> const&, std::shared_ptr<mir::client::rpc::RpcReport> const&, std::shared_ptr<mir::client::AtomicCallback<MirLifecycleState> > const&, std::shared_ptr<mir::client::AtomicCallback<int> > const&, std::shared_ptr<mir::client::AtomicCallback<MirError const*> > const&, std::shared_ptr<mir::client::EventSink> const&)::NullDeleter, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>'
warning: RTTI symbol not found for class 'std::_Sp_counted_deleter<mir::client::rpc::MirProtobufRpcChannel*, mir::client::rpc::MirProtobufRpcChannel::MirProtobufRpcChannel(std::unique_ptr<mir::client::rpc::StreamTransport, std::default_delete<mir::client::rpc::StreamTransport> >, std::shared_ptr<mir::client::SurfaceMap> const&, std::shared_ptr<mir::client::AsyncBufferFactory> const&, std::shared_ptr<mir::client::DisplayConfiguration> const&, std::shared_ptr<mir::input::InputDevices> const&, std::shared_ptr<mir::client::rpc::RpcReport> const&, std::shared_ptr<mir::client::AtomicCallback<MirLifecycleState> > const&, std::shared_ptr<mir::client::AtomicCallback<int> > const&, std::shared_ptr<mir::client::AtomicCallback<MirError const*> > const&, std::shared_ptr<mir::client::EventSink> const&)::NullDeleter, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>'

std::shared_ptr (count 3, weak 0) 0x61e970) at /usr/include/c++/5/functional:1871
#9 0x00007ffff6b0c551 in std::function<void (std::shared_ptr<mir::client::rpc::StreamTransport::Observer> const&)>::operator()(std::shared_ptr<mir::client::rpc::StreamTransport::Observer> const&) const (this=0x7ffff4bc9bd0,
    __args#0=warning: RTTI symbol not found for class 'std::_Sp_counted_deleter<mir::client::rpc::MirProtobufRpcChannel*, mir::client::rpc::MirProtobufRpcChannel::MirProtobufRpcChannel(std::unique_ptr<mir::client::rpc::StreamTransport, std::default_delete<mir::client::rpc::StreamTransport> >, std::shared_ptr<mir::client::SurfaceMap> const&, std::shared_ptr<mir::client::AsyncBufferFactory> const&, std::shared_ptr<mir::client::DisplayConfiguration> const&, std::shared_ptr<mir::input::InputDevices> const&, std::shared_ptr<mir::client::rpc::RpcReport> const&, std::shared_ptr<mir::client::AtomicCallback<MirLifecycleState> > const&, std::shared_ptr<mir::client::AtomicCallback<int> > const&, std::shared_ptr<mir::client::AtomicCallback<MirError const*> > const&, std::shared_ptr<mir::client::EventSink> const&)::NullDeleter, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>'
warning: RTTI symbol not found for class 'std::_Sp_counted_deleter<mir::client::rpc::MirProtobufRpcChannel*, mir::client::rpc::MirProtobufRpcChannel::MirProtobufRpcChannel(std::unique_ptr<mir::client::rpc::StreamTransport, std::default_delete<mir::client::rpc::StreamTransport> >, std::shared_ptr<mir::client::SurfaceMap> const&, std::shared_ptr<mir::client::AsyncBufferFactory> const&, std::shared_ptr<mir::client::DisplayConfiguration> const&, std::shared_ptr<mir::input::InputDevices> const&, std::shared_ptr<mir::client::rpc::RpcReport> const&, std::shared_ptr<mir::client::AtomicCallback<MirLifecycleState> > const&, std::shared_ptr<mir::client::AtomicCallback<int> > const&, std::shared_ptr<mir::client::AtomicCallback<MirError const*> > const&, std::shared_ptr<mir::client::EventSink> const&)::NullDeleter, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>'
std::shared_ptr (count 3, weak 0) 0x61e970) at /usr/include/c++/5/functional:2267
#10 0x00007ffff6b0b817 in mir::ThreadSafeList<std::shared_ptr<mir::client::rpc::StreamTransport::Observer> >::for_each(std::function<void (std::shared_ptr<mir::client::rpc::StreamTransport::Observer> const&)> const&) (
    this=0x61e870, f=...) at /media/kinga/Dane/mir/mir_nowy/src/include/common/mir/thread_safe_list.h:80
#11 0x00007ffff6b09ce0 in mir::client::rpc::TransportObservers::on_data_available (this=0x61e868)
    at /media/kinga/Dane/mir/mir_nowy/src/client/rpc/stream_socket_transport.cpp:40
#12 0x00007ffff6b0a8c0 in mir::client::rpc::StreamSocketTransport::dispatch (this=0x61e850, events=1)
    at /media/kinga/Dane/mir/mir_nowy/src/client/rpc/stream_socket_transport.cpp:208
#13 0x00007ffff65657fc in mir::dispatch::MultiplexingDispatchable::dispatch (this=0x61eb98, events=1)
    at /media/kinga/Dane/mir/mir_nowy/src/common/dispatch/multiplexing_dispatchable.cpp:140
#14 0x00007ffff6b00305 in mir::client::rpc::MirProtobufRpcChannel::dispatch (this=0x61e960, events=1)
    at /media/kinga/Dane/mir/mir_nowy/src/client/rpc/mir_protobuf_rpc_channel.cpp:555
#15 0x00007ffff65657fc in mir::dispatch::MultiplexingDispatchable::dispatch (this=0x61f3f0, events=1)
    at /media/kinga/Dane/mir/mir_nowy/src/common/dispatch/multiplexing_dispatchable.cpp:140
#16 0x00007ffff6568ade in (anonymous namespace)::dispatch_loop(const std::__cxx11::string &, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::Dispatchable>, const std::function<void()> &) (name="RPC Thread", thread_register=std::shared_ptr (count 4, weak 0) 0x61f2a0,
    dispatcher=std::shared_ptr (count 2, weak 0) 0x61f3f0, exception_handler=...)
    at /media/kinga/Dane/mir/mir_nowy/src/common/dispatch/threaded_dispatcher.cpp:211
---Type <return> to continue, or q <return> to quit---
llocator<char> >, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::MultiplexingDispatchable>, std::function<void ()>))(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::Dispatchable>, std::function<void ()> const&)>::_M_invoke<0ul, 1ul, 2ul, 3ul>(std::_Index_tuple<0ul, 1ul, 2ul, 3ul>) (this=0x61f4e8)
    at /usr/include/c++/5/functional:1531
#18 0x00007ffff6574374 in std::_Bind_simple<void (*(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::MultiplexingDispatchable>, std::function<void ()>))(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::Dispatchable>, std::function<void ()> const&)>::operator()() (this=0x61f4e8) at /usr/include/c++/5/functional:1520
#19 0x00007ffff6573ec6 in std::thread::_Impl<std::_Bind_simple<void (*(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::MultiplexingDispatchable>, std::function<void ()>))(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::Dispatchable>, std::function<void ()> const&)> >::_M_run() (this=0x61f4d0) at /usr/include/c++/5/thread:115
#20 0x00007ffff56fdc80 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#21 0x00007ffff6fc56ba in start_thread (arg=0x7ffff4bca700) at pthread_create.c:333
#22 0x00007ffff77ee82d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Tags:

Revision history for this message

Michał Kuchta (kuchtam) wrote on 2017-03-01:

I have found that the problem is caused by line:
result_message->ParseFromString(result->response());
in void mclr::MirProtobufRpcChannel::on_data_available()

I checked that response() return invalid data (which previously client has received from server).

I have checked server side and I have found that issue is caused by this part of code:

catch (std::exception const& x)
    {
        using namespace std::literals::string_literals;
        result_message.set_error("Error processing request: "s +
            x.what() + "\nInternal error details: " + boost::diagnostic_information(x));
        self->send_response(invocation.id(), &result_message);

in template_protobuf_message_processor.h

Where result_message type is protobuf::Void and send_response function has signature:

mfd::ProtobufResponder::send_response(
    ::google::protobuf::uint32 id,
    google::protobuf::MessageLite* response,
    FdSets const& fd_sets)

Inexplicit type conversion from protobuf::Void to protobuf::MessageLite probably causes that send_response_buffer in ProtobufResponder::send_response function is broken and contains string:

Error processing request: Invalid SurfaceId
Internal error details: /media/kinga/Dane/mir/mir_nowy/src/server/scene/application_session.cpp(176): Throw in function std::map<mir::IntWrapper<mir::frontend::detail::SessionsSurfaceIdTag>, std::shared_ptr<mir::scene::Surface> >::const_iterator mir::scene::ApplicationSession::checked_find(mir::frontend::SurfaceId) const
Dynamic exception type: boost::exception_detail::clone_impl<boost::exception_detail::error_info_injector<std::runtime_error> >
std::exception::what: Invalid SurfaceId

Revision history for this message

Michał Kuchta (kuchtam) wrote on 2017-03-01:

Download full text (13.4 KiB)

Server side stack trace:

0  0x00007ffff708a428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007ffff708c02a in __GI_abort () at abort.c:89
#2  0x00007ffff7082bd7 in __assert_fail_base (fmt=<optimized out>, assertion=assertion@entry=0x7ffff5e4ea72 "false", 
    file=file@entry=0x7ffff5e4ea28 "/media/kinga/Dane/mir/mir_nowy/src/server/frontend/protobuf_responder.cpp", line=line@entry=58, 
    function=function@entry=0x7ffff5e4ea80 <mir::frontend::detail::ProtobufResponder::send_response(unsigned int, google::protobuf::MessageLite*, std::vector<std::vector<mir::Fd, std::allocator<mir::Fd> >, std::allocator<std::vector<mir::Fd, std::allocator<mir::Fd> > > > const&)::__PRETTY_FUNCTION__> "virtual void mir::frontend::detail::ProtobufResponder::send_response(google::protobuf::uint32, google::protobuf::MessageLite*, const FdSets&)") at assert.c:92
#3  0x00007ffff7082c82 in __GI___assert_fail (assertion=0x7ffff5e4ea72 "false", file=0x7ffff5e4ea28 "/media/kinga/Dane/mir/mir_nowy/src/server/frontend/protobuf_responder.cpp", 
    line=58, 
    function=0x7ffff5e4ea80 <mir::frontend::detail::ProtobufResponder::send_response(unsigned int, google::protobuf::MessageLite*, std::vector<std::vector<mir::Fd, std::allocator<mir::Fd> >, std::allocator<std::vector<mir::Fd, std::allocator<mir::Fd> > > > const&)::__PRETTY_FUNCTION__> "virtual void mir::frontend::detail::ProtobufResponder::send_response(google::protobuf::uint32, google::protobuf::MessageLite*, const FdSets&)") at assert.c:101
#4  0x00007ffff5d2c537 in mir::frontend::detail::ProtobufResponder::send_response (this=0x7fffd8000a30, id=24, response=0x7fffdfffe2b0, 
    fd_sets=std::vector of length 0, capacity 0) at /media/kinga/Dane/mir/mir_nowy/src/server/frontend/protobuf_responder.cpp:58
#5  0x00007ffff5d1b47d in mir::frontend::detail::ProtobufMessageProcessor::send_response (this=0x7fffd8000e60, id=24, response=0x7fffdfffe2b0)
    at /media/kinga/Dane/mir/mir_nowy/src/server/frontend/protobuf_message_processor.cpp:386
#6  0x00007ffff5d22650 in mir::frontend::detail::invoke<mir::frontend::detail::ProtobufMessageProcessor, mir::frontend::detail::DisplayServer, mir::protobuf::DisplayServer, mir::protobuf::SurfaceModifications, mir::protobuf::Void> (self=0x7fffd8000e60, server=0x7fffd8000bc0, function=&virtual table offset 40, invocation=...)
    at /media/kinga/Dane/mir/mir_nowy/src/include/server/mir/frontend/template_protobuf_message_processor.h:98
#7  0x00007ffff5d1a651 in mir::frontend::detail::ProtobufMessageProcessor::dispatch (this=0x7fffd8000e60, invocation=..., side_channel_fds=std::vector of length 0, capacity 0)
    at /media/kinga/Dane/mir/mir_nowy/src/server/frontend/protobuf_message_processor.cpp:266
#8  0x00007ffff5d469cf in mir::frontend::detail::SocketConnection::on_new_message (this=0x7fffd8000ec0, error=...)
    at /media/kinga/Dane/mir/mir_nowy/src/server/frontend/socket_connection.cpp:123
#9  0x00007ffff5d465f2 in mir::frontend::detail::SocketConnection::on_read_size (this=0x7fffd8000ec0, error=...)
    at /media/kinga/Dane/mir/mir_nowy/src/server/frontend/socket_connection.cpp:82
#10 0x00007ffff5d48676 in std::_Mem_fn_base<void (mir::frontend::detail::SocketConnection::*)(boost::system::error_code const&), true>::operator()<boost::system::error_code const&, void> (this=0x7fffd8009830, __object=0x7fffd8000ec0) at /usr/include/c++/5/functional:600
#11 0x00007ffff5d482e4 in std::_Bind<std::_Mem_fn<void (mir::frontend::detail::SocketConnection::*)(boost::system::error_code const&)> (mir::frontend::detail::SocketConnection*, std::_Placeholder<1>)>::__call<void, boost::system::error_code const&, unsigned long&&, 0ul, 1ul>(std::tuple<boost::system::error_code const&, unsigned long&&>&&, std::_Index_tuple<0ul, 1ul>) (this=0x7fffd8009830, __args=<unknown type in /usr/local/lib/libmirserver.so.44, CU 0x89eff5, DIE 0x8ba2a1>) at /usr/include/c++/5/functional:1074
#12 0x00007ffff5d47e9d in std::_Bind<std::_Mem_fn<void (mir::frontend::detail::SocketConnection::*)(boost::system::error_code const&)> (mir::frontend::detail::SocketConnection*, std::_Placeholder<1>)>::operator()<boost::system::error_code const&, unsigned long, void>(boost::system::error_code const&, unsigned long&&) (this=0x7fffd8009830)
    at /usr/include/c++/5/functional:1133
#13 0x00007ffff5d479ff in std::_Function_handler<void (boost::system::error_code const&, unsigned long), std::_Bind<std::_Mem_fn<void (mir::frontend::detail::SocketConnection::*)(boost::system::error_code const&)> (mir::frontend::detail::SocketConnection*, std::_Placeholder<1>)> >::_M_invoke(std::_Any_data const&, boost::system::error_code const&, unsigned long&&) (__functor=..., __args#0=..., __args#1=<unknown type in /usr/local/lib/libmirserver.so.44, CU 0x89eff5, DIE 0x8b8b5f>) at /usr/include/c++/5/functional:1871
#14 0x00007ffff5d4f827 in std::function<void (boost::system::error_code const&, unsigned long)>::operator()(boost::system::error_code const&, unsigned long) const (
    this=0x7fffdfffec10, __args#0=..., __args#1=2) at /usr/include/c++/5/functional:2267
#15 0x00007ffff5d4ef63 in boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >::operator()(boost::system::error_code const&, unsigned long, int) (this=0x7fffdfffebe0, ec=..., bytes_transferred=2, start=0) at /usr/include/boost/asio/impl/read.hpp:282
#16 0x00007ffff5d51602 in boost::asio::detail::binder2<boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >, boost::system::error_code, unsigned long>::operator()() (this=0x7fffdfffebe0) at /usr/include/boost/asio/detail/bind_handler.hpp:127
#17 0x00007ffff5d515cf in boost::asio::asio_handler_invoke<boost::asio::detail::binder2<boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >, boost::system::error_code, unsigned long> >(boost::asio::detail::binder2<boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >, boost::system::error_code, unsigned long>&, ...) (function=...)
    at /usr/include/boost/asio/handler_invoke_hook.hpp:69
#18 0x00007ffff5d51564 in boost_asio_handler_invoke_helpers::invoke<boost::asio::detail::binder2<boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >, boost::system::error_code, unsigned long>, std::function<void (boost::system::error_code const&, unsigned long)> >(boost::asio::detail::binder2<boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >, boost::system::error_code, unsigned long>&, std::function<void (boost::system::error_code const&, unsigned long)>&) (function=..., context=...)
    at /usr/include/boost/asio/detail/handler_invoke_helpers.hpp:37
---Type <return> to continue, or q <return> to quit---
#19 0x00007ffff5d51445 in boost::asio::detail::asio_handler_invoke<boost::asio::detail::binder2<boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >, boost::system::error_code, unsigned long>, boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >(boost::asio::detail::binder2<boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >, boost::system::error_code, unsigned long>&, boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >*) (function=..., this_handler=0x7fffdfffebe0) at /usr/include/boost/asio/impl/read.hpp:502
#20 0x00007ffff5d511d2 in boost_asio_handler_invoke_helpers::invoke<boost::asio::detail::binder2<boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >, boost::system::error_code, unsigned long>, boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> > >(boost::asio::detail::binder2<boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >, boost::system::error_code, unsigned long>&, boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> >&) (function=..., context=...) at /usr/include/boost/asio/detail/handler_invoke_helpers.hpp:37
#21 0x00007ffff5d50e42 in boost::asio::detail::reactive_socket_recv_op<boost::asio::mutable_buffers_1, boost::asio::detail::read_op<boost::asio::basic_stream_socket<boost::asio::local::stream_protocol, boost::asio::stream_socket_service<boost::asio::local::stream_protocol> >, boost::asio::mutable_buffers_1, boost::asio::detail::transfer_exactly_t, std::function<void (boost::system::error_code const&, unsigned long)> > >::do_complete(boost::asio::detail::task_io_service*, boost::asio::detail::task_io_service_operation*, boost::system::error_code const&, unsigned long) (owner=0xa76420, base=0x7fffd8000f90) at /usr/include/boost/asio/detail/reactive_socket_recv_op.hpp:110
#22 0x00007ffff5d3543a in boost::asio::detail::task_io_service_operation::complete (this=0x7fffd8000f90, owner=..., ec=..., bytes_transferred=0)
    at /usr/include/boost/asio/detail/task_io_service_operation.hpp:38
#23 0x00007ffff5d37e63 in boost::asio::detail::task_io_service::do_run_one (this=0xa76420, lock=..., this_thread=..., ec=...)
    at /usr/include/boost/asio/detail/impl/task_io_service.ipp:372
#24 0x00007ffff5d37887 in boost::asio::detail::task_io_service::run (this=0xa76420, ec=...) at /usr/include/boost/asio/detail/impl/task_io_service.ipp:149
#25 0x00007ffff5d3817a in boost::asio::io_service::run (this=0xa76348) at /usr/include/boost/asio/impl/io_service.ipp:59
#26 0x00007ffff5d31d18 in mir::frontend::BasicConnector::<lambda()>::operator()(void) const (__closure=0x9d9648)
    at /media/kinga/Dane/mir/mir_nowy/src/server/frontend/published_socket_connector.cpp:162
#27 0x00007ffff5d34792 in std::_Bind_simple<mir::frontend::BasicConnector::start()::<lambda()>()>::_M_invoke<>(std::_Index_tuple<>) (this=0x9d9648)
    at /usr/include/c++/5/functional:1531
#28 0x00007ffff5d346e8 in std::_Bind_simple<mir::frontend::BasicConnector::start()::<lambda()>()>::operator()(void) (this=0x9d9648) at /usr/include/c++/5/functional:1520
#29 0x00007ffff5d34678 in std::thread::_Impl<std::_Bind_simple<mir::frontend::BasicConnector::start()::<lambda()>()> >::_M_run(void) (this=0x9d9630)
    at /usr/include/c++/5/thread:115
#30 0x00007ffff7909c80 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#31 0x00007ffff74256ba in start_thread (arg=0x7fffdffff700) at pthread_create.c:333
#32 0x00007ffff715b82d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Revision history for this message

Daniel van Vugt (vanvugt) wrote on 2017-03-02:

Nice work, thanks.

summary:	- Mir Server’s internal error causes client crash. + Mir client crashes in google::protobuf::MessageLite::ParseFromString + when the server sends an error response
Changed in mir:
importance:	Undecided → High
milestone:	none → 1.0.0

Daniel van Vugt (vanvugt) on 2017-03-08

Changed in canonical-devices-system-image:
importance:	Undecided → High
milestone:	none → u8c-1
tags:	added: unity8-desktop
Changed in canonical-devices-system-image:
assignee:	nobody → Stephen M. Webb (bregma)

Revision history for this message

Michał Kuchta (kuchtam) wrote on 2017-03-14:

I added additional logs to figure out what happened and here is the output:

…
mir_window_spec_set_pointer_confinement
XXXXX MirProtobufRpcChannel::call_method [sending...] method_name:modify_surface
XXXXX PendingCallCache::save_completion_details [sending...] id: 23 address: 140737219953968
XXXXX MirProtobufRpcChannel::call_method [sending...] method_name:release_surface
XXXXX PendingCallCache::save_completion_details [sending...] id: 24 address: 6416816
XXXXX PendingCallCache::populate_message_for_result [receiving...] id: 22 address: 140737219953968
XXXXX PendingCallCache::populate_message_for_result [receiving...] id: 23 address: 140737219953968
mir_window_spec_set_pointer_confinement
XXXXX MirProtobufRpcChannel::call_method [sending...] method_name:modify_surface
XXXXX PendingCallCache::save_completion_details [sending...] id: 25 address: 140737219953968
XXXXX PendingCallCache::populate_message_for_result [receiving...] id: 24 address: 6416816
XXXXX MirProtobufRpcChannel::call_method [sending...] method_name:disconnect
XXXXX PendingCallCache::save_completion_details [sending...] id: 26 address: 6417056
XXXXX PendingCallCache::populate_message_for_result [receiving...] id: 25 address: 140737219953968

From logs I see such flow of communication client-server:
       client server
    ...
   | modify_surface id:23 |
          |----------------------------->|
          | release_surface id:24 |
    |----------------------------->|
          |populate_messag(RES for id:23)|
          |<-----------------------------|
          | (release_surface with id:24 processing)
          | (Cleanup internal server's resources for surface)
          | modify_surface id:25 |
          |----------------------------->|
          |populate_messag(RES for id:24)|
          |<-----------------------------|
   | (modify_surface with id:25 processing)
          | (Server create resp with error code)
          | |
(release_surface with id:24 processing) |
(Cleanup internal client's resources for surface)
(But PendingCallCache map is not cleaned)
(PendingCallCache[25] still contains pointer to deleted structure)
          | |
          |populate_messag(RES for id:25)|
          |<-----------------------------|
  (PendingCallCache[25]->ParseFromString())
  (Client crash!)

I added additional logs to figure out what happened and here is the output:

From logs I see such flow of  communication client-server:
       client 				server
	   ...
	  |	modify_surface id:23	 |
          |----------------------------->|
          |     release_surface id:24    |
 	  |----------------------------->|
          |populate_messag(RES for id:23)|
          |<-----------------------------|
          |              (release_surface with id:24 processing)
          |            (Cleanup internal server's resources for surface)
          |	modify_surface id:25	 |
          |----------------------------->|   
          |populate_messag(RES for id:24)|
          |<-----------------------------|
	  |		  (modify_surface with id:25 processing)
          |               (Server create resp with error code)
          |                              |
 (release_surface with id:24 processing) |
 (Cleanup internal client's resources for surface)
 (But PendingCallCache map is not cleaned)
 (PendingCallCache[25] still contains pointer to deleted structure)
          |                              |
          |populate_messag(RES for id:25)|
          |<-----------------------------|
  (PendingCallCache[25]->ParseFromString())
  (Client crash!)

Brandon Schaefer (brandontschaefer) on 2017-03-16

Changed in canonical-devices-system-image:
status:	New → Confirmed
Changed in mir:
status:	New → Confirmed

Revision history for this message

Brandon Schaefer (brandontschaefer) wrote on 2017-03-20:

a mir::protobuf::Void extends from the MessageLite.

The overall issue seems to be a threaded one. Right now in the SDL mir port when we get an event it normally just adds and event to its own internal queue (need to double check that as well though really).

The issue is with pointer confinement now when we get a window focus event we set the keyboard focused which ends up asking the window to grab the pointer. This happens on the event callback thread. At the sametime its asking the surface to modify its contents its being released during a mir_connection_release_sync. Hence the corrupted looking state, it actually throws the error message that it cannot find the surface while trying to modify a surface during a connection release.

The fix is in SDL2. Though not sure if Mir could handle this error better.

Changed in mir:
status:	Confirmed → Invalid

Revision history for this message

Brandon Schaefer (brandontschaefer) wrote on 2017-03-20:

To test you can comment out either the SetKeyboadFocus in SDL_mirevents.c or avoid setting pointer confinement in SDL_mirwindow.c.

Ill ask RAOF about is FD event reader, as would be best to move to that API then using an internal event queue with mutex/cond. Will try to get a fix soon!

Revision history for this message

Daniel van Vugt (vanvugt) wrote on 2017-03-20:

Duplicate of bug 1194384 then?

Pat McGowan (pat-mcgowan) on 2017-03-28

Changed in canonical-devices-system-image:
status:	Confirmed → Incomplete
milestone:	u8c-1 → u8c-2

Stephen M. Webb (bregma) on 2017-03-29

Changed in mir:
milestone:	1.0.0 → none

Revision history for this message

Daniel van Vugt (vanvugt) wrote on 2017-03-29:

Not invalid for Mir. On second thoughts I'm not convinced that any SDL toolkit bug should ever be able to crash in Mir like this. Mir should stop such crashes from occurring regardless.

Changed in mir:
status:	Invalid → New
Changed in canonical-devices-system-image:
status:	Incomplete → New

Revision history for this message

Michał Sawicz (saviq) wrote on 2017-11-03:

Syncing task from Mir.

Changed in mir (Ubuntu):
importance:	Undecided → High

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntumir package

Mir client crashes in google::protobuf::MessageLite::ParseFromString when the server sends an error response

Bug Description

Other bug subscribers

Remote bug watches

Ubuntu
mir package