On Sun, 8 Jul 2007 21:48:55 -0700 "Stefan O'Rear" wrote:

On Mon, Jul 09, 2007 at 12:06:55AM -0400, Geoffrey Alan Washburn wrote:

...

After pulling in a few recent patches I've been having problems with xmonad crashing when I close windows from Thunderbird. I haven't extensively tested whether there are other applications that this happens with. xmonad dies with the following information. I'm compiling with ghc 6.6 on Linux. Let me know if there is some additional information that I can provide.

Very interesting! Auditing the uses of XFree in xmonad/X11-extras, I see some very fishy code...

queryTree :: Display -> Window -> IO (Window, Window, [Window]) queryTree d w = alloca $ \root_return -> alloca $ \parent_return -> alloca $ \children_return -> alloca $ \nchildren_return -> do xQueryTree d w root_return parent_return children_return nchildren_return p <- peek children_return n <- fmap fromIntegral $ peek nchildren_return ws <- peekArray n p xFree p liftM3 (,,) (peek root_return) (peek parent_return) (return ws)

This specifically looks like the culprit - there's no check for xQueryTree succeeding, so if things race wrong (quite plausable if you're closing windows!) the pointer will be freed without being initialized. Due to subtleties of the GHC storage manager, uninitialized alloca'd memory almost certainly contains pointers into the Haskell heap - which is where your "invalid pointer" points.

If you change that code in X11-extras (Graphics/X11/Xlib/Extras.hsc) to:

queryTree :: Display -> Window -> IO (Window, Window, [Window]) queryTree d w = alloca $ \root_return -> alloca $ \parent_return -> alloca $ \children_return -> alloca $ \nchildren_return -> do status <- xQueryTree d w root_return parent_return children_return nchildren_return if status == 0 then return (none, none, []) -- we ought to throw an -- exception here... else do p <- peek children_return n <- fmap fromIntegral $ peek nchildren_return ws <- peekArray n p xFree p liftM3 (,,) (peek root_return) (peek parent_return) (return ws)

can you still reproduce it?

Stefan

queryTree is only run once, at start up. It seems unlikely that this is causing the described issue. Cheers, Spencer Janssen

On Tue, Jul 10, 2007 at 09:49:28AM -0400, Geoffrey Alan Washburn wrote:

Spencer Janssen wrote:

...

queryTree is only run once, at start up. It seems unlikely that this is causing the described issue.

Indeed, further testing indicates that it only occurs when I am using the Tabbed layout.

I cannot reproduce it here. Can you give me instructions to reproduce it with Tabbed and Thuderbird? I tried closing secondary windows, but XMonad never crashes. Thanks Andrea

On Tue, Jul 10, 2007 at 01:33:20PM -0400, Geoffrey Alan Washburn wrote:

Upon logging in via gdm, I (1) hit "Alt-p" to open dmenu, (2) type in "thunderbird", (3) once Thunderbird is open, double click on the first message in my inbox (and made sure to send myself mail beforehand if it were to be empty). This opens up a second window, (4) hit "Alt-Shift-c" And the session dies returning me to gdm.

With only 2 differences: I do not have the fonts you are using for Tabs and I do not run gdm. Anyway, I cannot reproduce with these steps: XMoban keeps on running. These steps always lead to a crash of the X server? It could be related to something else? The log doesn't tell anything, unluckily.

Before running the above test I made sure I had pulled all the latest xmonad and xmonadcontrib patches. I'm building with GHC 6.6 installed on Ubuntu Linux through the package system.

running 6.6.1 but I hardly believe this is the issue. Hope someone comes up with a way to reproduce it regularly. For the time being there's very little I can do. (Anyway I don't see where a bug that could make X crash can be hidden in Tabbed.hs. I've been able to make X die quite a few time when hacking that code, so I should have a bit of experience...;-) All the best, Andrea

Andrea Rossato writes: Hi Andrea,

...

Indeed, further testing indicates that it only occurs when I am using the Tabbed layout.

I think it's the same here, but I'm not exactly sure.

I cannot reproduce it here. Can you give me instructions to reproduce it with Tabbed and Thuderbird?

It's really hard to reproduce. Yesterday xmonad crashed about 4 or 5 times, today (with a new checkout made this morning (CEST)) it crashed only once. It always happened after I closed a conkeror frame, but now that I'm creating and deleting frames like mad, it stays alive without problems. Bye, Tassilo -- People say that if you play Microsoft CD's backwards, you hear satanic things, but that's nothing, because if you play them forwards, they install Windows.

A.M.Gimblett:

On Tue, Jul 10, 2007 at 08:11:02PM +0200, Tassilo Horn wrote:

...

...

...

Indeed, further testing indicates that it only occurs when I am using the Tabbed layout.

I think it's the same here, but I'm not exactly sure.

I'd like to add my voice and report that I've been experiencing intermittent crashing too, as of the last few days (perhaps since the weekend?). I'll investigate further later and try to pin it down a bit more but roughly:

- ghc 6.6, latest everything from darcs

- Tabbed layout

- xdm not gdm

- gajim and jpilot both seem particularly keen culprits. Often/sometimes when closing a window belonging to either of these apps using Shift-Mod-C I get kicked out. I might only be seeing it with these apps because in other apps (eg xterm), I tend not to close/kill the window from xmonad, but rather exit the app from within itself (eg Ctrl-D in an xterm, File/Quit in Firefox, etc.); it does _seem_ to be related to killing from xmonad.

- .xsession-errors contains similar errors to those reported just earlier ("such-and-such app lost connection to X server", though I note that "such-and-such app" in these cases is not the one which crashed, but other ones which were running - IIRC).

Don't have time to go any deeper right now (and not at the crashing computer), but will try to find out more later.

Cheers,

Ok, noted. We'll follow this up. -- Don

alec:

Andy Gimblett on 2007-07-11 10:39:44 +0100:

...

On Tue, Jul 10, 2007 at 08:11:02PM +0200, Tassilo Horn wrote:

...

...

...

Indeed, further testing indicates that it only occurs when I am using the Tabbed layout.

I think it's the same here, but I'm not exactly sure.

I'd like to add my voice and report that I've been experiencing intermittent crashing too, as of the last few days (perhaps since the weekend?).

I updated for the first time in several days and can reliably crash xmonad by running glxgears. I haven't run glxgears in a while, but I have run it in the past few weeks with xmonad and neither crashed.

I am seeing a slightly different error, though; instead of an error on free() as in the original report, xmonad dies on a munmap_chunk:

*** glibc detected *** xmonad: munmap_chunk(): invalid pointer: 0x000000000045b9c0 *** ======= Backtrace: ========= /lib/libc.so.6(cfree+0x1b6)[0x2ac3f68fe816] /usr/lib/libX11.so.6(XFree+0x9)[0x2ac3f5fee4d9] xmonad[0x478498]

Additionally, this error happens if I run glxgears, not if I try to close it, as some of the others have reported. When running with dwm, I don't see the same crash.

So just: $ glxgears ? Can anyone else reproduce this? -- Don

Spencer Janssen on 2007-07-11 19:11:25 -0500:

On Wednesday 11 July 2007 18:39:48 Alec Berryman wrote:

...

I updated for the first time in several days and can reliably crash xmonad by running glxgears. I haven't run glxgears in a while, but I have run it in the past few weeks with xmonad and neither crashed.

I am seeing a slightly different error, though; instead of an error on free() as in the original report, xmonad dies on a munmap_chunk:

*** glibc detected *** xmonad: munmap_chunk(): invalid pointer: 0x000000000045b9c0 *** ======= Backtrace: ========= /lib/libc.so.6(cfree+0x1b6)[0x2ac3f68fe816] /usr/lib/libX11.so.6(XFree+0x9)[0x2ac3f5fee4d9] xmonad[0x478498]

Additionally, this error happens if I run glxgears, not if I try to close it, as some of the others have reported. When running with dwm, I don't see the same crash.

For which layouts does this occur? Just Tabbed? Every layout? We must have a double or otherwise invalid free somewhere.

Just tabbed; I can't reproduce it using the tiled layout. To answer Don's question, yes, just fire up glxgears - you can almost see the gears before everything crashes. Works every time. I haven't seen anything similar happen with any other programs, but I don't run much besides iceweasel, urxvt, and emacs. I have reproduced this both on an amd64 with Xinerama and on an i386 without. In both cases I'm running Debian testing with ghc-6.6.1. For some reason the i386 doesn't show a message in ~/.xsession-errors like the one above from the amd64.

Tassilo Horn wrote:

Spencer Janssen writes:

Hi Spencer,

...

Everyone that has experienced this crash, please reply whether the fix works for you.

I didn't have any crashes since the last update, even with glxgears runing.

Same here. No crashing with Thunderbird when closing windows, and no crashing with glxgears -- though I didn't test it before I applied the patches and rebuilt xmonad. Thanks!