Instead of removing the destroy listeners in the output destroy, remove
them in the damage destroy handler. Fixes the following use after free:
==646625==ERROR: AddressSanitizer: heap-use-after-free on address 0x61200017cab8 at pc 0x0000004f8f29 bp 0x7ffdf465ad30 sp 0x7ffdf465ad20
WRITE of size 8 at 0x61200017cab8 thread T0
#0 0x4f8f28 in wl_list_remove ../common/list.c:181
#1 0x43dd24 in handle_destroy ../sway/desktop/output.c:790
(`wl_list_remove(&output->damage_destroy.link);` here, 214e3030e1dce master branch)
#2 0x7f0e573a1c93 in wlr_signal_emit_safe ../util/signal.c:29
#3 0x7f0e57390954 in wlr_output_destroy ../types/wlr_output.c:365
#4 0x7f0e5735e37f in backend_destroy ../backend/x11/backend.c:128
#5 0x7f0e57348147 in wlr_backend_destroy ../backend/backend.c:47
#6 0x7f0e57356f75 in multi_backend_destroy ../backend/multi/backend.c:54
#7 0x7f0e5735710e in handle_display_destroy ../backend/multi/backend.c:107
#8 0x7f0e573f23e4 in wl_display_destroy (/lib64/libwayland-server.so.0+0x93e4)
#9 0x42f0b2 in server_fini ../sway/server.c:177
#10 0x42dd01 in main ../sway/main.c:414
#11 0x7f0e570f7041 in __libc_start_main (/lib64/libc.so.6+0x27041)
#12 0x40e3bd in _start (/opt/wayland/bin/sway+0x40e3bd)
0x61200017cab8 is located 120 bytes inside of 320-byte region [0x61200017ca40,0x61200017cb80)
freed by thread T0 here:
#0 0x7f0e57aa9357 in __interceptor_free (/lib64/libasan.so.6+0xb0357)
#1 0x7f0e5738b877 in wlr_output_damage_destroy ../types/wlr_output_damage.c:143
#2 0x7f0e5738b2b9 in output_handle_destroy ../types/wlr_output_damage.c:13
#3 0x7f0e573a1c93 in wlr_signal_emit_safe ../util/signal.c:29
#4 0x7f0e57390954 in wlr_output_destroy ../types/wlr_output.c:365
#5 0x7f0e5735e37f in backend_destroy ../backend/x11/backend.c:128
#6 0x7f0e57348147 in wlr_backend_destroy ../backend/backend.c:47
#7 0x7f0e57356f75 in multi_backend_destroy ../backend/multi/backend.c:54
#8 0x7f0e5735710e in handle_display_destroy ../backend/multi/backend.c:107
#9 0x7f0e573f23e4 in wl_display_destroy (/lib64/libwayland-server.so.0+0x93e4)
previously allocated by thread T0 here:
#0 0x7f0e57aa9887 in __interceptor_calloc (/lib64/libasan.so.6+0xb0887)
#1 0x7f0e5738b532 in wlr_output_damage_create ../types/wlr_output_damage.c:91
#2 0x43e4a7 in handle_new_output ../sway/desktop/output.c:875
#3 0x7f0e573a1c93 in wlr_signal_emit_safe ../util/signal.c:29
#4 0x7f0e57357261 in new_output_reemit ../backend/multi/backend.c:143
#5 0x7f0e573a1c93 in wlr_signal_emit_safe ../util/signal.c:29
#6 0x7f0e5736030a in wlr_x11_output_create ../backend/x11/output.c:253
#7 0x7f0e5735e309 in backend_start ../backend/x11/backend.c:113
#8 0x7f0e573480fb in wlr_backend_start ../backend/backend.c:36
#9 0x7f0e57356e61 in multi_backend_start ../backend/multi/backend.c:31
#10 0x7f0e573480fb in wlr_backend_start ../backend/backend.c:36
#11 0x42f4ba in server_start ../sway/server.c:205
#12 0x42dbd7 in main ../sway/main.c:394
#13 0x7f0e570f7041 in __libc_start_main (/lib64/libc.so.6+0x27041)
Fixes#5158
With these changes, sway will respect positive exclusive zones of layer
surfaces anchored to one or three sides.
This matches the protocol, which states that a positive exclusive zone
should be respected, "if the surface is anchored to one edge or an
edge and both perpendicular edges". If the surfaces is "anchored to
only two perpendicular edges (a corner), anchored to only two
parallel edges or anchored to all edges a positive value will be
treated the same as zero".
apply_output_config will call output_enable if necessary.
This fixes a lone wlr_output_enable call (without a matching
wlr_output_commit call) which was a no-op.
This fixes the following crash:
#0 0x00007f7daac3af25 in raise () at /usr/lib/libc.so.6
#1 0x00007f7daac24897 in abort () at /usr/lib/libc.so.6
#2 0x00007f7daac24767 in _nl_load_domain.cold () at /usr/lib/libc.so.6
#3 0x00007f7daac33526 in () at /usr/lib/libc.so.6
#4 0x0000555bfbc35029 in seat_set_focus_layer (seat=0x555bfd76d860, layer=0x555bfdda2ff0)
at ../sway/input/seat.c:1164
__PRETTY_FUNCTION__ = "seat_set_focus_layer"
__PRETTY_FUNCTION__ = "seat_set_focus_layer"
#5 0x0000555bfbc35029 in seat_set_focus_layer (seat=seat@entry=0x555bfd76d860, layer=0x555bfdda2ff0)
at ../sway/input/seat.c:1164
__PRETTY_FUNCTION__ = "seat_set_focus_layer"
#6 0x0000555bfbc25899 in handle_output_destroy (listener=0x555bfdb90688, data=<optimized out>)
at ../sway/desktop/layer_shell.c:263
layer = 0x555bfdd6b040
sway_layer = 0x555bfdb90610
seat = 0x555bfd76d860
client = 0x555bfdb76d70
set_focus = <optimized out>
#7 0x0000555bfbc5b669 in wl_signal_emit (data=0x555bfd795930, signal=0x555bfd795ae0)
at /usr/include/wayland-server-core.h:472
l = <optimized out>
next = 0x555bfdb6a3e8
__PRETTY_FUNCTION__ = "output_disable"
index = <optimized out>
#8 0x0000555bfbc5b669 in output_disable (output=output@entry=0x555bfd795930)
at ../sway/tree/output.c:263
__PRETTY_FUNCTION__ = "output_disable"
index = <optimized out>
#9 0x0000555bfbc3b890 in apply_output_config (oc=0x555bfd7d73d0, output=output@entry=0x555bfd795930)
at ../sway/config/output.c:321
wlr_output = 0x555bfd7afaf0
scale = <optimized out>
output_box = <optimized out>
#10 0x0000555bfbc28309 in handle_output_manager_apply
(listener=0x555bfbc7f148 <server+488>, data=0x555bfdca6eb0) at ../sway/desktop/output.c:936
wlr_output = <optimized out>
output = 0x555bfd795930
oc = <optimized out>
server = 0x555bfbc7ef60 <server>
config = 0x555bfdca6eb0
config_head = 0x555bfdb79350
ok = true
#11 0x00007f7dab4fbf7c in wlr_signal_emit_safe (signal=<optimized out>, data=0x555bfdca6eb0)
at ../subprojects/wlroots/util/signal.c:29
pos = 0x555bfbc7f148 <server+488>
l = 0x555bfbc7f148 <server+488>
cursor =
{link = {prev = 0x555bfbc7f148 <server+488>, next = 0x7fff238a8390}, notify = 0x7f7dab4fbef0 <handle_noop>}
end =
{link = {prev = 0x7fff238a8370, next = 0x555bfd7419f8}, notify = 0x7f7dab4fbef0 <handle_noop>}
#12 0x00007f7daa45469a in ffi_call_unix64 () at /usr/lib/libffi.so.6
#13 0x00007f7daa453fb6 in ffi_call () at /usr/lib/libffi.so.6
#14 0x00007f7daae6f82f in () at /usr/lib/libwayland-server.so.0
#15 0x00007f7daae6c193 in () at /usr/lib/libwayland-server.so.0
#16 0x00007f7daae6d7f2 in wl_event_loop_dispatch () at /usr/lib/libwayland-server.so.0
#17 0x00007f7daae6c39c in wl_display_run () at /usr/lib/libwayland-server.so.0
This crash happens because focus can only be set on mapped surfaces.
This fixes a memory leak of oc (the output config) in handle_new_output.
Output configs returned from find_output_config are not stored and need
to be freed after use.
Two changes were made:
- Bind the texture before glTexParameteri
- Set the scaling filter before each wlr_render_texture_with_matrix call
Logging in wlroots allows to check that the scaling filter is properly
set prior to rendering.
Fixes: 6968fb3123 ("add scale_filter output config option")
Closes: https://github.com/swaywm/sway/issues/4798
This adds a check to make it so the indicator is only rendered on views
with a parent, which floating views do not. Since floating views do not
have a parent, the workspace layout was being incorrectly used to
determine whether to show the split indicator previously. This has no
impact on floating containers and a view within a floating container
will still have indicators rendered appropriately.
In case xcb-iccm is not installed on the system, size_hints will be
null. Handle this as if the get_constraints functions was not
implemented and return the defaults.
Fixes#4870
When arranging layer-shell layers, verify that the currently focused
layer, if any, for each seat is still keyboard interactive. If the layer
is no longer keyboard interactive and there is not a keyboard
interactive overlay or top layer to change the focus to, refocus the
focus inactive node for the seat.
When many surfaces are created, sway can run out of file descriptors,
making wl_event_loop_add_timer (which creates a timerfd) fail and
return NULL. This patch posts a "no memory" error when that is the case,
and only removes the timer if it was created.
(Why "no memory"? It is not easy to distinguish between failures due to
running out of memory and failures due to running out of file
descriptors. Also, using the newer `wl_client_post_implementation_error`
function would lead to an increased version requirement for the
libwayland-server dependency.)
If a layer is focused by any seat, it needs to be unfocused on unmap. If
the unmap was due to an output being disabled, there would not be a
sway_output and unmap would do an early return. This results in a
use-after-free if the layer was focused by any seat prior to being
unmapped. This change just moves the refocusing code above the early
returns.
Repaint scheduling delays output render and frame done events from
output frame events, and block idle frame events from being scheduled in
between output frame done and output render in this period of time.
If a surface is committed after its frame done event, but before output
render, idle frame requests will be blocked, and the surface relies on
the upcoming render to schedule a frame.
If when the repaint timer expires, output render is deemed unnecessary,
no frame will be scheduled. This can lead to surfaces never having their
frame callbacks fire.
To fix this, we store that a surface has requested a frame in
surface_needs_frame. When the repaint expires, if no render is deemed
necessary, we check this flag and schedule an idle frame.
Fixes#4768
max_render_time can be set on output, view, or both. However, if only
applied to the output, send_frame_done_iterator would erroneously send
frame_done immediately, ignoring the output max_render_time. As
damage_handle_frame processed max_render_time correctly, idle frames
would be blocked in anticipation of the delay that was meant to happen.
Without the delay, frame events would be dispatched during the idle
frame block, and some clients would never receive the frame done events
they had requested, at least not until something else actively drove
another render.
Respecting both view and output max_render_time in
send_frame_done_iterator ensures that the frame events are always
correctly delayed.
Fixes#4756
It's possible for the output to be disconnected in just the right moment
for wlr_output to be NULL in the repaint handler, causing a crash. This
check fixes that crash.
Previously, Xwayland windows did not have size_constraints implemented,
resulting in the window being resizable. This implements the constraints
through the X11 size hints supplied by the window itself.
Calling wlr_output_manager_v1_set_configuration with an enabled output
and a NULL mode is incorrect if the output doesn't support modes.
When DPMS'ing an output, wlr_output_enable(output, false) is called.
This de-allocates the CRTC and sets wlr_output.current_mode to NULL.
Because we mark DPMS'ed outputs as enabled, we also need to provide a
correct output mode. Add a field to sway_output to hold the current
mode.
Closes: https://github.com/swaywm/wlroots/issues/1867
When applying config, value mode->refresh is mHz; convert it to Hz before
assigning it to the temporary output config. oc->refresh_rate will
be converted back to mHz in set_mode function.
Fix debug log printing GHz instead of Hz.
When changing a surface from managed to unmanaged in handle_map(), the
call to handle_destroy(.., view) causes the sway_xwayland_view pointed
to by the untyped wlr_xwayland_surface.data field to become invalid
garbage, yet the untyped wlr_xwayland_surface.data continues to point
at it. In particular: view_get_*(view_from_wlr_surface(..)), even
with appropriate NULL checking, will crash sway when this codepath is
exercised (reliable test case: drop-down menus in Google Earth).
Popups are positioned relative to local surface coordinates of the
parent surface. There's no need to consider values set with
xdg_surface.set_window_geometry for parent surfaces.
Sometimes when using direct scan-out, some flickering between the
fullscreen app and the regular desktop could be seen.
This happened because we called wlr_output_attach_render and then
wlr_output_attach_buffer for direct scan-out. wlr_output_attach_render
makes the OpenGL context current but also attaches the OpenGL buffer to
the primary plane apparently (all of this happens inside
eglMakeCurrent).
This patch moves the scan-out logic outside of output_render, before
wlr_output_attach_render. This lines it up with rootston's
implementation. This also makes more sense since no rendering is
involved when using direct scan-out.
Sorry about that, I should've tested this with more clients. The new
code has been tested with mpv and a GLFW demo.
Focused layers are not cleared when destroyed, they are cleared on unmap.
Giving focus to an unmapped layer surface is (1) incorrect and (2) triggers a
use-after-free.
Closes: https://github.com/swaywm/sway/issues/4517
David96
Rouven Czerwinski
Simon Ser
Leon Plickat
Tadeo Kondrak
Brian Ashworth
Manuel Stoeckl
Kenny Levinsen
Ronan Pigott
Jason
Ivan Molodetskikh
Danilo Spinella
A. M. Joseph
Drew DeVault
Sebastian Krzyszkowiak
asdfjkluiop
Dark