Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-123866

Wayland protocol errors due to premature buffer attachment

    XMLWordPrintable

Details

    • Bug
    • Resolution: Unresolved
    • P1: Critical
    • None
    • 6.6.2
    • QPA: Wayland
    • None
    • NixOS unstable (44d0940ea560dee511026a53f0e2e2cde489b4d4)
      Hyprland Compositor
    • Linux/Wayland

    Description

      QtWayland is attaching buffers to wayland surfaces before they have been configured, causing protocol errors and crashes as a result.

      The simplest case I can find is changing window geometry and hiding a window in the same frame. Then when the window is shown again the buffer will be attached before the wayland surface is ready. Attached is a qml demo which will crash under qtwayland.

      Note that this also bypasses `isExposed` in custom qtwayland shell integrations, causing the same crash.

      When running the attached sample with `WAYLAND_DEBUG=1 qml crash.qml`, you will get a crash similar to the following

      [3627303.019] -> zwp_linux_dmabuf_feedback_v1@34.destroy()
      [3627303.141] -> wl_surface@46.frame(new id wl_callback@48)
      [3627303.345] -> zwp_linux_dmabuf_v1@35.create_params(new id zwp_linux_buffer_params_v1@56)
      [3627303.368] -> zwp_linux_buffer_params_v1@56.add(fd 23, 0, 0, 1024, 33554432, 412531459)
      [3627303.377] -> zwp_linux_buffer_params_v1@56.add(fd 24, 1, 524288, 1024, 33554432, 412531459)
      [3627303.381] -> zwp_linux_buffer_params_v1@56.create_immed(new id wl_buffer@39, 501, 500, 909199186, 0)
      [3627303.385] -> zwp_linux_buffer_params_v1@56.destroy()
      [3627303.389] -> wl_surface@46.attach(wl_buffer@39, 0, 0)
      [3627303.393] -> wl_surface@46.damage(0, 0, 2147483647, 2147483647)
      [3627303.396] -> wl_surface@46.commit()
      [3627303.399] -> wl_display@1.sync(new id wl_callback@54)
      [3627303.451] wl_keyboard@23.leave(10352, nil)
      [3627303.462] wl_pointer@24.leave(10356, nil)
      [3627303.469] wl_pointer@24.frame()
      [3627303.474] wl_callback@49.done(10360)
      [3627303.485] -> zwp_primary_selection_offer_v1@4278190081.destroy()
      [3627303.500] wp_fractional_scale_v1@43.preferred_scale(120)
      [3627303.508] xdg_toplevel@51.configure(0, 0, array[0])
      [3627303.514] zxdg_toplevel_decoration_v1@52.configure(2)
      [3627303.520] xdg_surface@50.configure(10361)
      [3627303.531] -> wp_viewport@53.set_destination(501, 500)
      [3627303.549] -> xdg_surface@50.set_window_geometry(0, 0, 501, 500)
      [3627303.559] -> xdg_surface@50.ack_configure(10361)
      [3627304.233] wl_display@1.delete_id(47)
      [3627304.241] wl_display@1.delete_id(44)
      [3627304.244] wl_display@1.delete_id(34)
      [3627304.248] wl_display@1.delete_id(56)
      [3627304.251] wl_display@1.error(xdg_surface@50, 3, "xdg_surface has never been configured")

      Note the buffer attachment before the configure event, which is in violation of the xdg-shell protocol.
      https://wayland.app/protocols/xdg-shell#xdg_surface

      Creating an xdg_surface from a wl_surface which has a buffer attached or committed is a client error, and any attempts by a client to attach or manipulate a buffer prior to the first xdg_surface.configure call must also be treated as errors.

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            davidedmundson David Edmundson
            outfoxxed outfoxxed -
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:

              Gerrit Reviews

                There are no open Gerrit changes