[X11] Winit 0.29.11 panics or SIGSEGVs when the main thread is busy

[kjarosh]

When the main thread is busy doing work and a lot of X11 events are generated, winit crashes. It is either a panic or a SIGSEGV.

That's a regression, as 0.29.10 worked fine.

Reproduction:

1. Move the cursor fiercely when the main thread is busy

thread 'main' panicked at ~/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/event_processor.rs:1185:21:
attempt to multiply with overflow
stack backtrace:
   0:     0x556d9184abd6 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::hcbaeac7247bf8173
   1:     0x556d9187c4f0 - core::fmt::write::h8b490acb5bdc50a9
   2:     0x556d9184595d - std::io::Write::write_fmt::h07de2b72e411632a
   3:     0x556d9184a965 - std::sys_common::backtrace::print::h9a3eb2b838be2212
   4:     0x556d9184c5d3 - std::panicking::default_hook::{{closure}}::h2166f617792c0284
   5:     0x556d9184c314 - std::panicking::default_hook::h4952bb7ccb53c0a3
   6:     0x556d8d281bf3 - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::h03f0c2ba38a2e2e2
                               at /builddir/build/BUILD/rustc-1.76.0-src/library/alloc/src/boxed.rs:2029:9
   7:     0x556d8d2a7db2 - ruffle_desktop::init::{{closure}}::hde0a232abe05077b
                               at ~/repos/ruffle/desktop/src/main.rs:65:9
   8:     0x556d9184cc7b - std::panicking::rust_panic_with_hook::h9cb4b30448d9f73f
   9:     0x556d9184c9b9 - std::panicking::begin_panic_handler::{{closure}}::h4adc3510d10f90a2
  10:     0x556d9184b0b6 - std::sys_common::backtrace::__rust_end_short_backtrace::h22be74f3163fbf67
  11:     0x556d9184c770 - rust_begin_unwind
  12:     0x556d8d1f4ac5 - core::panicking::panic_fmt::hdc52888f3f8c7b11
  13:     0x556d8d1f4b83 - core::panicking::panic::hbc18712d7482c722
  14:     0x556d8d36831d - winit::platform_impl::platform::x11::event_processor::EventProcessor<T>::xinput2_mouse_motion::h38e442750a486d04
                               at ~/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/event_processor.rs:1185:21
  15:     0x556d8d35b450 - winit::platform_impl::platform::x11::event_processor::EventProcessor<T>::process_xevent::hb35306ba36879798
                               at ~/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/event_processor.rs:219:25
  16:     0x556d8d356ad3 - winit::platform_impl::platform::x11::event_processor::EventProcessor<T>::process_event::h2073e83de05294d8
                               at ~/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/event_processor.rs:79:9
  17:     0x556d8d286d6b - winit::platform_impl::platform::x11::EventLoop<T>::drain_events::h5418ecd6a272664f
                               at ~/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/mod.rs:623:13
  18:     0x556d8d28767b - winit::platform_impl::platform::x11::EventLoop<T>::single_iteration::h29b7fe2f02326a40
                               at ~/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/mod.rs:554:9
  19:     0x556d8d288fa5 - winit::platform_impl::platform::x11::EventLoop<T>::poll_events_with_timeout::h60682279f6460a7d
                               at ~/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/mod.rs:538:9
  20:     0x556d8d286a6f - winit::platform_impl::platform::x11::EventLoop<T>::pump_events::h27d596a93ee2b08d
                               at ~/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/mod.rs:444:13
  21:     0x556d8d287245 - winit::platform_impl::platform::x11::EventLoop<T>::run_on_demand::hc16ad0c2d648fb76
                               at ~/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/mod.rs:405:19
  22:     0x556d8d3a41fe - winit::platform_impl::platform::EventLoop<T>::run_on_demand::h958628deee6046ee
                               at ~/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/mod.rs:829:56
  23:     0x556d8d3a4a76 - winit::platform_impl::platform::EventLoop<T>::run::hf846a3237d4ee0e7
                               at ~/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/mod.rs:822:9
  24:     0x556d8d39bfb7 - winit::event_loop::EventLoop<T>::run::h67d14f59f28796d5
                               at ~/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/event_loop.rs:249:9

[torokati44]

Here's a backtrace from when a SIGSEGV happens instead:

Thread 1 "ruffle_desktop" received signal SIGSEGV, Segmentation fault.
0x0000555557e7c414 in x11_dl::xinput2::XIMaskIsSet (mask=..., event=0) at src/xinput2.rs:21
21          (mask[mask_byte(event)] & (1 << (event & 7))) != 0
(gdb) bt
#0  0x0000555557e7c414 in x11_dl::xinput2::XIMaskIsSet (mask=..., event=0) at src/xinput2.rs:21
#1  0x0000555556afd8dd in winit::platform_impl::platform::x11::event_processor::EventProcessor<ruffle_desktop::custom_event::RuffleEvent>::xinput2_mouse_motion<ruffle_desktop::custom_event::RuffleEvent, &mut &mut winit::platform_impl::platform::x11::{impl#4}::drain_events::{closure_env#0}<ruffle_desktop::custom_event::RuffleEvent, &mut &mut ruffle_desktop::app::{impl#0}::run::{closure_env#0}>> (self=0x7fffffff8938, event=0x55555c684920, callback=0x7fffffff6b40)
    at /home/attila/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/event_processor.rs:1186
#2  0x0000555556aefd50 in winit::platform_impl::platform::x11::event_processor::EventProcessor<ruffle_desktop::custom_event::RuffleEvent>::process_xevent<ruffle_desktop::custom_event::RuffleEvent, &mut winit::platform_impl::platform::x11::{impl#4}::drain_events::{closure_env#0}<ruffle_desktop::custom_event::RuffleEvent, &mut &mut ruffle_desktop::app::{impl#0}::run::{closure_env#0}>> (self=0x7fffffff8938, xev=0x7fffffff7388, callback=0x7fffffff6dd8)
    at /home/attila/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/event_processor.rs:219
#3  0x0000555556aebae3 in winit::platform_impl::platform::x11::event_processor::EventProcessor<ruffle_desktop::custom_event::RuffleEvent>::process_event<ruffle_desktop::custom_event::RuffleEvent, winit::platform_impl::platform::x11::{impl#4}::drain_events::{closure_env#0}<ruffle_desktop::custom_event::RuffleEvent, &mut &mut ruffle_desktop::app::{impl#0}::run::{closure_env#0}>> (self=0x7fffffff8938, xev=0x7fffffff7388, callback=...)
    at /home/attila/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/event_processor.rs:79
#4  0x0000555556bc2aab in winit::platform_impl::platform::x11::EventLoop<ruffle_desktop::custom_event::RuffleEvent>::drain_events<ruffle_desktop::custom_event::RuffleEvent, &mut &mut ruffle_desktop::app::{impl#0}::run::{closure_env#0}> (self=0x7fffffff8938, callback=0x7fffffff8310)
    at /home/attila/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/mod.rs:623
#5  0x0000555556bc32fb in winit::platform_impl::platform::x11::EventLoop<ruffle_desktop::custom_event::RuffleEvent>::single_iteration<ruffle_desktop::custom_event::RuffleEvent, &mut &mut ruffle_desktop::app::{impl#0}::run::{closure_env#0}> (self=0x7fffffff8938, callback=0x7fffffff8310, cause=...)
    at /home/attila/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/mod.rs:554
#6  0x0000555556bc4c25 in winit::platform_impl::platform::x11::EventLoop<ruffle_desktop::custom_event::RuffleEvent>::poll_events_with_timeout<ruffle_desktop::custom_event::RuffleEvent, &mut &mut ruffle_desktop::app::{impl#0}::run::{closure_env#0}> (self=0x7fffffff8938, timeout=..., callback=0x7fffffff8538)
    at /home/attila/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/mod.rs:538
#7  0x0000555556bc26ef in winit::platform_impl::platform::x11::EventLoop<ruffle_desktop::custom_event::RuffleEvent>::pump_events<ruffle_desktop::custom_event::RuffleEvent, &mut ruffle_desktop::app::{impl#0}::run::{closure_env#0}> (self=0x7fffffff8938, timeout=..., callback=0x7fffffffa2d8)
    at /home/attila/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/mod.rs:444
#8  0x0000555556bc2ec5 in winit::platform_impl::platform::x11::EventLoop<ruffle_desktop::custom_event::RuffleEvent>::run_on_demand<ruffle_desktop::custom_event::RuffleEvent, ruffle_desktop::app::{impl#0}::run::{closure_env#0}> (self=0x7fffffff8938, event_handler=...)
    at /home/attila/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/x11/mod.rs:405
#9  0x0000555556c24e4e in winit::platform_impl::platform::EventLoop<ruffle_desktop::custom_event::RuffleEvent>::run_on_demand<ruffle_desktop::custom_event::RuffleEvent, ruffle_desktop::app::{impl#0}::run::{closure_env#0}> (self=0x7fffffff8938, callback=...)
    at /home/attila/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/mod.rs:829
#10 0x0000555556c256c6 in winit::platform_impl::platform::EventLoop<ruffle_desktop::custom_event::RuffleEvent>::run<ruffle_desktop::custom_event::RuffleEvent, ruffle_desktop::app::{impl#0--Type <RET> for more, q to quit, c to continue without paging--
}::run::{closure_env#0}> (self=<error reading variable: Cannot access memory at address 0x8>, callback=<error reading variable: Cannot access memory at address 0x60>)
    at /home/attila/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/platform_impl/linux/mod.rs:822
#11 0x0000555556c4e6f7 in winit::event_loop::EventLoop<ruffle_desktop::custom_event::RuffleEvent>::run<ruffle_desktop::custom_event::RuffleEvent, ruffle_desktop::app::{impl#0}::run::{closure_env#0}> (self=..., event_handler=...) at /home/attila/.cargo/registry/src/index.crates.io-6f17d22bba15001f/winit-0.29.11/src/event_loop.rs:249
#12 0x0000555556b3a569 in ruffle_desktop::app::App::run (self=...) at desktop/src/app.rs:104
#13 0x0000555556c447b6 in ruffle_desktop::main::{closure#0} (app=<error reading variable: Cannot access memory at address 0x60>) at desktop/src/main.rs:162
#14 0x0000555556b9bf58 in core::result::Result<ruffle_desktop::app::App, anyhow::Error>::and_then<ruffle_desktop::app::App, anyhow::Error, (), ruffle_desktop::main::{closure_env#0}> (
    self=..., op=...) at /rustc/07dca489ac2d933c78d3c5158e3f43beefeb02ce/library/core/src/result.rs:1316
#15 0x0000555556ba03ff in ruffle_desktop::main () at desktop/src/main.rs:162

[torokati44]

The panicking multiplication was introduced in #3471.

[torokati44]

For a more concrete reproducer:

git clone https://github.com/ruffle-rs/ruffle
cd ruffle
# install dependencies as needed and documented
WAYLAND_DISPLAY="" cargo run https://z0r.de/L/z0r-de_7000.swf
# and move the mouse around while the little white spinner is visible in the beginning

I tried to reproduce with some of the winit examples, to make your lives easier, but wasn't able to. Not even after adding some "business" into the main event loop - either with sleeping or bogus processing.

[notgull]

Reproduced this error on my Xubuntu machine.

[notgull]

I'm seeing errors in valgrind like this. Perhaps our new Xinput2 event processing code isn't sound?

[kchibisov]

The code is exactly the same as before though, so should likely it was unsound before as well.

[kchibisov]

The panicking multiplication was introduced in #3471.

That code was line by line before.

[torokati44]

That code was line by line before.

Oh, I see. I just parrotted what git blame showed me, haven't investigated the diff in detail. Should have said "last touched by" instead.

EDIT: But, for the record, I also wasn't able to reproduce with 0.29.10, so... I dunno.

[kchibisov]

Ok, I think I know which stupid code is unsound here.