Details
-
Bug
-
Resolution: Unresolved
-
P1: Critical
-
None
-
6.6.2
-
None
-
NixOS unstable (44d0940ea560dee511026a53f0e2e2cde489b4d4)
Hyprland Compositor
Description
QtWayland is attaching buffers to wayland surfaces before they have been configured, causing protocol errors and crashes as a result.
The simplest case I can find is changing window geometry and hiding a window in the same frame. Then when the window is shown again the buffer will be attached before the wayland surface is ready. Attached is a qml demo which will crash under qtwayland.
Note that this also bypasses `isExposed` in custom qtwayland shell integrations, causing the same crash.
When running the attached sample with `WAYLAND_DEBUG=1 qml crash.qml`, you will get a crash similar to the following
[3627303.019] -> zwp_linux_dmabuf_feedback_v1@34.destroy()
[3627303.141] -> wl_surface@46.frame(new id wl_callback@48)
[3627303.345] -> zwp_linux_dmabuf_v1@35.create_params(new id zwp_linux_buffer_params_v1@56)
[3627303.368] -> zwp_linux_buffer_params_v1@56.add(fd 23, 0, 0, 1024, 33554432, 412531459)
[3627303.377] -> zwp_linux_buffer_params_v1@56.add(fd 24, 1, 524288, 1024, 33554432, 412531459)
[3627303.381] -> zwp_linux_buffer_params_v1@56.create_immed(new id wl_buffer@39, 501, 500, 909199186, 0)
[3627303.385] -> zwp_linux_buffer_params_v1@56.destroy()
[3627303.389] -> wl_surface@46.attach(wl_buffer@39, 0, 0)
[3627303.393] -> wl_surface@46.damage(0, 0, 2147483647, 2147483647)
[3627303.396] -> wl_surface@46.commit()
[3627303.399] -> wl_display@1.sync(new id wl_callback@54)
[3627303.451] wl_keyboard@23.leave(10352, nil)
[3627303.462] wl_pointer@24.leave(10356, nil)
[3627303.469] wl_pointer@24.frame()
[3627303.474] wl_callback@49.done(10360)
[3627303.485] -> zwp_primary_selection_offer_v1@4278190081.destroy()
[3627303.500] wp_fractional_scale_v1@43.preferred_scale(120)
[3627303.508] xdg_toplevel@51.configure(0, 0, array[0])
[3627303.514] zxdg_toplevel_decoration_v1@52.configure(2)
[3627303.520] xdg_surface@50.configure(10361)
[3627303.531] -> wp_viewport@53.set_destination(501, 500)
[3627303.549] -> xdg_surface@50.set_window_geometry(0, 0, 501, 500)
[3627303.559] -> xdg_surface@50.ack_configure(10361)
[3627304.233] wl_display@1.delete_id(47)
[3627304.241] wl_display@1.delete_id(44)
[3627304.244] wl_display@1.delete_id(34)
[3627304.248] wl_display@1.delete_id(56)
[3627304.251] wl_display@1.error(xdg_surface@50, 3, "xdg_surface has never been configured")
Note the buffer attachment before the configure event, which is in violation of the xdg-shell protocol.
https://wayland.app/protocols/xdg-shell#xdg_surface
Creating an xdg_surface from a wl_surface which has a buffer attached or committed is a client error, and any attempts by a client to attach or manipulate a buffer prior to the first xdg_surface.configure call must also be treated as errors.