Opening multitasking view while app closes makes gala crash

[Felipe Escoto]

Steps to reproduce:
1. Open more than one window in a workspace
2. Click the close button
3. During the closing animation, open the multitasking view, via hot corners or win + s
4. Gala will either soft crash (auto-restarts) or a hard crash and take you back to the login screen, loosing all your work

[Felipe Escoto (philip.scott)]

After using gdb, i was able to get this information from the crash:

Thread 1 "gala" received signal SIGSEGV, Segmentation fault.
0x00007ffff75c62d4 in meta_window_get_monitor () from /usr/lib/libmutter.so.0
(gdb) Exception ignored in: <gdb.GdbOutputFile object at 0x7f4d4ee18358>
Traceback (most recent call last):
  File "/usr/share/gdb/python/gdb/__init__.py", line 43, in flush
    def flush(self):
KeyboardInterrupt

[Santiago (santileortiz)]

This is the top of the stack for me after making it crash:

#0 0x00007ffff75c62d4 in meta_window_get_monitor () from /usr/lib/libmutter.so.0
#1 0x0000000000439e6b in gala_multitasking_view_toggle (self=0xbdbe30) at /home/santiago/keyboard_layout_editor/handle-hotcorners/src/Widgets/MultitaskingView.vala:513
#2 0x000000000042b9fd in gala_window_manager_gala_real_perform_action (base=0x690260, type=<optimized out>)
    at /home/santiago/keyboard_layout_editor/handle-hotcorners/src/WindowManager.vala:689
#3 0x0000000000426964 in ___lambda53_ (_data4_=0x981b40) at /home/santiago/keyboard_layout_editor/handle-hotcorners/src/WindowManager.vala:348
#4 ____lambda53__clutter_actor_enter_event (_sender=<optimized out>, event=<optimized out>, self=0x981b40) at WindowManager.c:2591

It seems like line MultitaskingView.vala:513 is where it crashes. I seem to recall Gala crashing in the same line when using Multitasking View after closing a tab on Chrome and after using Alt+tab but I haven't been able to reproduce these consistently.

[Felipe Escoto (philip.scott)]

Starting program: /usr/bin/gala --replace --display :0
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffe5585700 (LWP 29049)]
[New Thread 0x7fffdeb01700 (LWP 29052)]
[New Thread 0x7fffde300700 (LWP 29054)]
[New Thread 0x7fffddaff700 (LWP 29055)]
[New Thread 0x7fffcd59b700 (LWP 29058)]
[New Thread 0x7fffc01cd700 (LWP 29059)]
[Thread 0x7fffde300700 (LWP 29054) exited]
[Thread 0x7fffcd59b700 (LWP 29058) exited]
[New Thread 0x7fffcd59b700 (LWP 29226)]
[New Thread 0x7fffcd59b700 (LWP 29227)]
[Thread 0x7fffcd59b700 (LWP 29226) exited]
[Thread 0x7fffcd59b700 (LWP 29227) exited]
[New Thread 0x7fffcd59b700 (LWP 29228)]
[Thread 0x7fffcd59b700 (LWP 29228) exited]
[New Thread 0x7fffcd59b700 (LWP 29229)]
[Thread 0x7fffcd59b700 (LWP 29229) exited]
[New Thread 0x7fffcd59b700 (LWP 29230)]
[New Thread 0x7fffcd59b700 (LWP 29231)]
[Thread 0x7fffcd59b700 (LWP 29230) exited]
[Thread 0x7fffcd59b700 (LWP 29231) exited]
[New Thread 0x7fffcd59b700 (LWP 29232)]
[Thread 0x7fffcd59b700 (LWP 29232) exited]
[New Thread 0x7fffcd59b700 (LWP 29233)]
[Thread 0x7fffcd59b700 (LWP 29233) exited]
[New Thread 0x7fffcd59b700 (LWP 29234)]
[New Thread 0x7fffcd59b700 (LWP 29235)]
[Thread 0x7fffcd59b700 (LWP 29234) exited]
[Thread 0x7fffcd59b700 (LWP 29235) exited]
[New Thread 0x7fffcd59b700 (LWP 29239)]
[Thread 0x7fffcd59b700 (LWP 29239) exited]
[New Thread 0x7fffcd59b700 (LWP 29240)]
[Thread 0x7fffcd59b700 (LWP 29240) exited]
Thread 1 "gala" received signal SIGSEGV, Segmentation fault.
0x00007ffff75c62d4 in meta_window_get_monitor () from /usr/lib/libmutter.so.0
The history is empty.
No symbol "crash" in current context.
Tracepoint 1 at 0x7ffff75c62d4
#0 0x00007ffff75c62d4 in meta_window_get_monitor () from /usr/lib/libmutter.so.0
#1 0x0000000000439e2b in gala_multitasking_view_toggle (self=0xd4f2c0)
    at /build/gala-1TWkn2/gala-0.3.0~r521+pkg35~daily~ubuntu0.4.1/src/Widgets/MultitaskingView.vala:513
#2 0x000000000042b9bd in gala_window_manager_gala_real_perform_action (base=0x68f260,
    type=<optimized out>)
    at /build/gala-1TWkn2/gala-0.3.0~r521+pkg35~daily~ubuntu0.4.1/src/WindowManager.vala:685
#3 0x0000000000426964 in ___lambda53_ (
    _data4_=0xa23a80)
    at /build/gala-1TWkn2/gala-0.3.0~r521+pkg35~daily~ubuntu0.4.1/src/WindowManager.vala:348
#4 ____lambda53__clutter_actor_enter_event
    (_sender=<optimized out>,
    event=<optimized out>, self=0xa23a80)
    at WindowManager.c:2591
#5 0x00007ffff72e14dc in ?? ()
   from /usr/lib/x86_64-linux-gnu/libclutter-1.0.so.0
#6 0x00007ffff4a69fa5 in g_closure_invoke
    ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#7 0x00007ffff4a7bfc1 in ?? ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#8 0x00007ffff4a847f9 in g_signal_emit_valist ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#9 0x00007ffff4a8508f in g_signal_emit ()
   from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#10 0x00007ffff7243d1c in clutter_actor_event ()
   from /usr/lib/x86_64-linux-gnu/libclutter-1.0.so.0
#11 0x00007ffff7249180 in ?? ()
   from /usr/lib/x86_64-linux-gnu/libclutter-1.0.so.0
#12 0x00007ffff728281c in ?? ()
   from ...

[Santiago (santileortiz)]

The problem is the C structure member window.monitor, should be a pointer to a monitor, but after closing the window Mutter's event handler calls meta_window_unmanage() which sets window.monitor=NULL, then we try to dereference it because window.get_monitor() just tries to return window->monitor->number without checking that window.monitor!=NULL.

The only thing we need is to check if window is being unmanaged and skip it, but I don't know how to do this because window.monitor is private and there is no way of accessing it through libmutter.vapi. The unmanaged() signal on the Meta.Window class is emmited on Mutter by meta_window_unmanage() at the end, so I don't think this will work either but I haven't tried it. Any ideas on how can we solve this?.