Xorg assert failure: Xorg: ../src/evdev-mt-touchpad-tap.c:1028: tp_tap_handle_state: Assertion `tp->tap.nfingers_down >= 1' failed.

[Joel Van Boxtel]

idk

ProblemType: Crash
DistroRelease: Ubuntu 18.04
Package: xserver-xorg-core 2:1.19.6-1ubuntu2
ProcVersionSignature: Ubuntu 4.15.0-10.11-generic 4.15.3
Uname: Linux 4.15.0-10-generic x86_64
ApportVersion: 2.20.8-0ubuntu10
Architecture: amd64
AssertionMessage: Xorg: ../src/evdev-mt-touchpad-tap.c:1028: tp_tap_handle_state: Assertion `tp->tap.nfingers_down >= 1' failed.
CompizPlugins: No value set for `/apps/compiz-1/general/screen0/options/active_plugins'
CompositorRunning: None
CurrentDesktop: ubuntu:GNOME
Date: Mon Mar 5 15:19:19 2018
DistUpgraded: 2018-02-23 18:43:25,406 DEBUG failed to SystemUnLock() (E:Not locked)
DistroCodename: bionic
DistroVariant: ubuntu
ExecutablePath: /usr/lib/xorg/Xorg
GraphicsCard:
 Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Integrated Graphics Controller [8086:22b1] (rev 21) (prog-if 00 [VGA controller])
   Subsystem: Lenovo Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Integrated Graphics Controller [17aa:3902]
InstallationDate: Installed on 2018-02-21 (11 days ago)
InstallationMedia: Ubuntu 17.10 "Artful Aardvark" - Release amd64 (20180105.1)
Lsusb:
 Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
 Bus 001 Device 002: ID 5986:0671 Acer, Inc
 Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
MachineType: LENOVO 80M1
ProcCmdline: /usr/lib/xorg/Xorg vt2 -displayfd 3 -auth /run/user/1000/gdm/Xauthority -background none -noreset -keeptty -verbose 3
ProcEnviron:
 LANGUAGE=en_AU:en
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_AU.UTF-8
 SHELL=/bin/bash
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.15.0-10-generic.efi.signed root=UUID=7c316ffa-779d-4eda-a8d6-f7a20492e6bb ro quiet splash vt.handoff=1
Signal: 6
SourcePackage: xorg-server
StacktraceTop:
 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
 __GI_abort () at abort.c:79
 __assert_fail_base (fmt=0x7f844e3247d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7f844b16af75 "tp->tap.nfingers_down >= 1", file=file@entry=0x7f844b16afb8 "../src/evdev-mt-touchpad-tap.c", line=line@entry=1028, function=function@entry=0x7f844b16b2b0 "tp_tap_handle_state") at assert.c:92
 __GI___assert_fail (assertion=0x7f844b16af75 "tp->tap.nfingers_down >= 1", file=0x7f844b16afb8 "../src/evdev-mt-touchpad-tap.c", line=1028, function=0x7f844b16b2b0 "tp_tap_handle_state") at assert.c:101
 ?? () from /usr/lib/x86_64-linux-gnu/libinput.so.10
Title: Xorg assert failure: Xorg: ../src/evdev-mt-touchpad-tap.c:1028: tp_tap_handle_state: Assertion `tp->tap.nfingers_down >= 1' failed.
UpgradeStatus: Upgraded to bionic on 2018-02-23 (9 days ago)
UserGroups: adm adm cdrom cdrom dip dip lpadmin lpadmin plugdev plugdev sambashare sambashare sudo sudo
dmi.bios.date: 08/05/2016
dmi.bios.vendor: LENOVO
dmi.bios.version: C7CN31WW
dmi.board.asset.tag: No Asset Tag
dmi.board.name: Mini
dmi.board.vendor: LENOVO
dmi.board.version: SDK0J91204WIN
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Lenovo Yoga 300-11IBR
dmi.modalias: dmi:bvnLENOVO:bvrC7CN31WW:bd08/05/2016:svnLENOVO:pn80M1:pvrLenovoYoga300-11IBR:rvnLENOVO:rnMini:rvrSDK0J91204WIN:cvnLENOVO:ct10:cvrLenovoYoga300-11IBR:
dmi.product.family: IDEAPAD
dmi.product.name: 80M1
dmi.product.version: Lenovo Yoga 300-11IBR
dmi.sys.vendor: LENOVO
version.compiz: compiz N/A
version.libdrm2: libdrm2 2.4.90-1
version.libgl1-mesa-dri: libgl1-mesa-dri 18.0.0~rc4-1ubuntu3
version.libgl1-mesa-glx: libgl1-mesa-glx 18.0.0~rc4-1ubuntu3
version.xserver-xorg-core: xserver-xorg-core 2:1.19.6-1ubuntu2
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev N/A
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:7.10.0-1
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.99.917+git20171229-1
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:1.0.15-2

[Nicolas-freedesktop (nicolas-freedesktop)]

Created attachment 137615
Xorg log

Since recent updates Xorg crashes very often (4 or more times a day) with SIGABRT in libinput code.
Unfortunately I have found no reproduction scenario yet, it seems to happen randomly.

I can provide a full coredump if that helps.

Distribution: arch
Hardware: Lenovo Thinkpad X270
Packages:
  libinput 1.10.0-1
  linux 4.15.4-1
  xf86-input-libinput 0.26.0-1
  xorg-server 1.19.6+13+gd0d1a694f-1

$ libinput list-devices --version
1.10.0

$ xinput list-props "SynPS/2 Synaptics TouchPad"
Device 'SynPS/2 Synaptics TouchPad':
 Device Enabled (143): 1
 Coordinate Transformation Matrix (145): 1.000000, 0.000000, 0.000000, 0.000000, 1.000000, 0.000000, 0.000000, 0.000000, 1.000000
 libinput Tapping Enabled (280): 1
 libinput Tapping Enabled Default (281): 0
 libinput Tapping Drag Enabled (282): 1
 libinput Tapping Drag Enabled Default (283): 1
 libinput Tapping Drag Lock Enabled (284): 0
 libinput Tapping Drag Lock Enabled Default (285): 0
 libinput Tapping Button Mapping Enabled (286): 1, 0
 libinput Tapping Button Mapping Default (287): 1, 0
 libinput Natural Scrolling Enabled (288): 1
 libinput Natural Scrolling Enabled Default (289): 0
 libinput Left Handed Enabled (290): 0
 libinput Left Handed Enabled Default (291): 0
 libinput Accel Speed (292): 0.000000
 libinput Accel Speed Default (293): 0.000000
 libinput Scroll Methods Available (294): 1, 1, 0
 libinput Scroll Method Enabled (295): 1, 0, 0
 libinput Scroll Method Enabled Default (296): 1, 0, 0
 libinput Click Methods Available (297): 1, 1
 libinput Click Method Enabled (298): 1, 0
 libinput Click Method Enabled Default (299): 1, 0
 libinput Middle Emulation Enabled (300): 0
 libinput Middle Emulation Enabled Default (301): 0
 libinput Send Events Modes Available (265): 1, 1
 libinput Send Events Mode Enabled (266): 0, 0
 libinput Send Events Mode Enabled Default (267): 0, 0
 libinput Disable While Typing Enabled (302): 1
 libinput Disable While Typing Enabled Default (303): 1
 Device Node (268): "/dev/input/event17"
 Device Product ID (269): 2, 7
 libinput Drag Lock Buttons (304): <no items>
 libinput Horizontal Scroll Enabled (305): 1

[Nicolas-freedesktop (nicolas-freedesktop)]

Created attachment 137616
Systemd core dump info

[Peter Hutterer (peter-hutterer)]

install the debug info package for libinput please (whatever that's called on arch, I don't know for sure) and run:

$ eu-addr2line -e /usr/lib64/libinput.so

and provide:
libinput_event_get_pointer_event+0xec9e

That should give you the line number where it crashes, same with the few other references. This should help a bit identifying what's going on.

Please also provide an evemu recording of one of the crashers, thanks.

[Nicolas-freedesktop (nicolas-freedesktop)]

Here is a new crash with an updated libinput, rebuilt without stripping symbols.

libinput version: 1.10.0+25+g3e77f2e9-1
libinput commit: 3e77f2e9f5a98fc5917642bd47ceeef89b95c858

Backtrace from Xorg log:
    [ 1580.664] (EE) Backtrace:
    [ 1580.671] (EE) 0: /usr/lib/xorg-server/Xorg (OsLookupColor+0x139) [0x55ed7d51ee99]
    [ 1580.673] (EE) 1: /usr/lib/libpthread.so.0 (funlockfile+0x50) [0x7fbf098d4e1f]
    [ 1580.677] (EE) 2: /usr/lib/libc.so.6 (gsignal+0x110) [0x7fbf09540860]
    [ 1580.679] (EE) 3: /usr/lib/libc.so.6 (abort+0x1c9) [0x7fbf09541ec9]
    [ 1580.681] (EE) 4: /usr/lib/libc.so.6 (__assert_fail_base+0x14c) [0x7fbf095390bc]
    [ 1580.683] (EE) 5: /usr/lib/libc.so.6 (__assert_fail+0x43) [0x7fbf09539133]
    [ 1580.685] (EE) 6: /usr/lib/libinput.so.10 (tp_handle_state+0x332c) [0x7fbf023396dc]
    [ 1580.686] (EE) 7: /usr/lib/libinput.so.10 (tp_interface_process+0xb8) [0x7fbf0233a438]
    [ 1580.687] (EE) 8: /usr/lib/libinput.so.10 (evdev_device_dispatch+0x3f8) [0x7fbf02326178]
    [ 1580.687] (EE) 9: /usr/lib/libinput.so.10 (libinput_dispatch+0x5f) [0x7fbf02325a5f]
    [ 1580.688] (EE) 10: /usr/lib/xorg/modules/input/libinput_drv.so (_init+0x29b9) [0x7fbf0255c5b9]
    [ 1580.689] (EE) 11: /usr/lib/xorg-server/Xorg (input_unlock+0x293) [0x55ed7d51d3d3]
    [ 1580.689] (EE) 12: /usr/lib/xorg-server/Xorg (OsCleanup+0x621) [0x55ed7d51fe01]
    [ 1580.690] (EE) 13: /usr/lib/xorg-server/Xorg (input_unlock+0xde) [0x55ed7d51cfce]
    [ 1580.691] (EE) 14: /usr/lib/libpthread.so.0 (start_thread+0xdc) [0x7fbf098ca08c]
    [ 1580.694] (EE) 15: /usr/lib/libc.so.6 (clone+0x3f) [0x7fbf09601eb8]

Line numbers:
    tp_handle_state+0x332c: ../libinput/src/evdev-mt-touchpad-gestures.c:85
    tp_interface_process+0xb8: ../libinput/src/evdev-mt-touchpad.c:1639
    evdev_device_dispatch+0x3f8: ../libinput/src/evdev.c:857
    libinput_dispatch+0x5f: ../libinput/src/libinput.c:1989

I'll try to have an evemu recording setup next.

[Nicolas-freedesktop (nicolas-freedesktop)]

Created attachment 137672
evemu recording

Here is an evemu recording for the last crash (with the exact same backtrace as the one showed previously).

I left only the last minute or so in the recording. I cannot pinpoint exactly where in that recording the crash happened, but it is close to the end as I stopped touching the touchpad as soon as I noticed the crash.

[Peter Hutterer (peter-hutterer)]

well, that was more effort than expected. patch series is here:
https://lists.freedesktop.org/archives/wayland-devel/2018-March/037268.html

branch for testing is here:
https://github.com/whot/libinput/tree/wip/touchpad-maybe-end-state

[Peter Hutterer (peter-hutterer)]

*** Bug 105275 has been marked as a duplicate of this bug. ***

[Nicolas-freedesktop (nicolas-freedesktop)]

Just did some tests and it seems to have fixed the crash. Thanks!

I first tried to have a near-systematic reproduction pattern by trying to reproduce the sequence you described on wayland-devel, and managed to make it crash in a few seconds every time.

Then I updated and tried again with the same pattern for a few minutes, and no crash.

Again, thanks a lot for your work.

[Peter Hutterer (peter-hutterer)]

*** Bug 105336 has been marked as a duplicate of this bug. ***

[Peter Hutterer (peter-hutterer)]

Thanks for testing, pushed to master and I'll get this into the next 1.10 release too

commit 6ccd8e934f965150173866db265ca544031c6e6b
Author: Peter Hutterer <>
Date: Wed Feb 28 12:51:27 2018 +1000

     touchpad: add a TOUCH_MAYBE_END state

[Peter Hutterer (peter-hutterer)]

*** Bug 105370 has been marked as a duplicate of this bug. ***

[Apport retracing service (apport)]

StacktraceTop:
 __GI_nl_langinfo (item=2) at nl_langinfo.c:31
 ?? ()
 ?? ()

[Aaron Plattner (aplattner)]

Thanks Peter! I built from commit 12410dfba4b903108c8926d68c64ed1c7468902d and so far, haven't been able to reproduce the problem.

[Stas T (stas-t)]

Peter, I'm afraid the issue is still there.
I had libinput 1.10.2 installed which was still crashing Xorg. Then I upgraded to commit 12410dfba4b903108c8926d68c64ed1c7468902d and rebuilt. I still was able to reproduce the issue.

Here is the bactrace:

#0 0x00007fa3f4197860 in raise () at /usr/lib/libc.so.6
#1 0x00007fa3f4198ec9 in abort () at /usr/lib/libc.so.6
#2 0x00005593d7ac0cea in ()
#3 0x00005593d799c674 in ()
#4 0x00005593d7ac67e2 in ()
#5 0x00005593d7ac7625 in ()
#6 0x00005593d7abddde in ()
#7 0x00007fa3f452bdd0 in <signal handler called> () at /usr/lib/libpthread.so.0
#8 0x00007fa3f4197860 in raise () at /usr/lib/libc.so.6
#9 0x00007fa3f4198ec9 in abort () at /usr/lib/libc.so.6
#10 0x00007fa3f41900bc in __assert_fail_base () at /usr/lib/libc.so.6
#11 0x00007fa3f4190133 in () at /usr/lib/libc.so.6
#12 0x00007fa3e6438671 in tp_tap_handle_state (time=94093507188400, tp=0x5593da14f8b0) at ../libinput/src/evdev-mt-touchpad-tap.c:1030
#13 0x00007fa3e6438671 in tp_post_events (time=94093507188400, tp=0x5593da14f8b0) at ../libinput/src/evdev-mt-touchpad.c:1650
#14 0x00007fa3e6438671 in tp_handle_state (tp=0x5593da14f8b0, time=time@entry=3849255224) at ../libinput/src/evdev-mt-touchpad.c:1673
#15 0x00007fa3e6439108 in tp_interface_process (dispatch=
    0x5593da14f8b0, device=<optimized out>, e=0x7fa3e598bd80, time=3849255224, time=<optimized out>, e=<optimized out>, dispatch=<optimized out>)
    at ../libinput/src/evdev-mt-touchpad.c:1720
#16 0x00007fa3e64243d8 in evdev_process_event (e=0x7fa3e598bd80, device=0x5593da1443e0) at ../libinput/src/evdev.c:863
#17 0x00007fa3e64243d8 in evdev_device_dispatch_one (ev=0x7fa3e598bd80, device=0x5593da1443e0) at ../libinput/src/evdev.c:871
#18 0x00007fa3e64243d8 in evdev_device_dispatch (data=0x5593da1443e0) at ../libinput/src/evdev.c:930
#19 0x00007fa3e6423cbf in libinput_dispatch (libinput=0x5593d9c9e5a0) at ../libinput/src/libinput.c:1989
#20 0x00007fa3e6658c19 in () at /usr/lib/xorg/modules/input/libinput_drv.so
#21 0x00005593d7abc163 in ()
#22 0x00005593d7abe861 in ()
#23 0x00005593d7abbfae in ()
#24 0x00007fa3f452108c in start_thread () at /usr/lib/libpthread.so.0
#25 0x00007fa3f4258e7f in clone () at /usr/lib/libc.so.6

[Stas T (stas-t)]

Reproduction steps: open gnome-terminal and swipe inside its window with three fingers quickly left-to-right and right-to-left few times.

Apparently this assertion fails when t->state == TOUCH_END and t->was_down:
assert(tp->tap.nfingers_down >= 1);

[Stas T (stas-t)]

Some more details.

Distribution: arch
Hardware: Hewlett-Packard HP Pavilion TS Sleekbook 15/18FD
Packages:
  libinput 1.10.0+68+g12410dfb-1
  linux 4.15.7-1
  xf86-input-libinput 0.26.0-1
  xorg-server 1.19.6+13+gd0d1a694f-1

libinput list-devices --version
1.10.900

xinput list-props "SynPS/2 Synaptics TouchPad"
Device 'SynPS/2 Synaptics TouchPad':
 Device Enabled (142): 1
 Coordinate Transformation Matrix (144): 1.000000, 0.000000, 0.000000, 0.000000, 1.000000, 0.000000, 0.000000, 0.000000, 1.000000
 libinput Tapping Enabled (285): 1
 libinput Tapping Enabled Default (286): 0
 libinput Tapping Drag Enabled (287): 1
 libinput Tapping Drag Enabled Default (288): 1
 libinput Tapping Drag Lock Enabled (289): 0
 libinput Tapping Drag Lock Enabled Default (290): 0
 libinput Tapping Button Mapping Enabled (291): 1, 0
 libinput Tapping Button Mapping Default (292): 1, 0
 libinput Natural Scrolling Enabled (293): 1
 libinput Natural Scrolling Enabled Default (294): 0
 libinput Left Handed Enabled (295): 0
 libinput Left Handed Enabled Default (296): 0
 libinput Accel Speed (297): 0.010989
 libinput Accel Speed Default (298): 0.000000
 libinput Scroll Methods Available (299): 1, 1, 0
 libinput Scroll Method Enabled (300): 1, 0, 0
 libinput Scroll Method Enabled Default (301): 1, 0, 0
 libinput Send Events Modes Available (266): 1, 1
 libinput Send Events Mode Enabled (267): 0, 0
 libinput Send Events Mode Enabled Default (268): 0, 0
 libinput Disable While Typing Enabled (302): 1
 libinput Disable While Typing Enabled Default (303): 1
 Device Node (269): "/dev/input/event11"
 Device Product ID (270): 2, 7
 libinput Drag Lock Buttons (304): <no items>
 libinput Horizontal Scroll Enabled (305): 1

[Stas T (stas-t)]

Created attachment 137991
evemu-record output

These events result in Xorg crash in this context:

...
#12 0x00007f6e4d01d671 in tp_tap_handle_state (time=94242228317136, tp=0x55b67a8a9be0) at ../libinput/src/evdev-mt-touchpad-tap.c:1030
#13 0x00007f6e4d01d671 in tp_post_events (time=94242228317136, tp=0x55b67a8a9be0) at ../libinput/src/evdev-mt-touchpad.c:1650
#14 0x00007f6e4d01d671 in tp_handle_state (tp=0x55b67a8a9be0, time=time@entry=19144585374) at ../libinput/src/evdev-mt-touchpad.c:1673
...

[Peter Hutterer (peter-hutterer)]

*** Bug 105437 has been marked as a duplicate of this bug. ***

[Peter Hutterer (peter-hutterer)]

*** Bug 105407 has been marked as a duplicate of this bug. ***

[Peter Hutterer (peter-hutterer)]

*** Bug 105443 has been marked as a duplicate of this bug. ***

[Peter Hutterer (peter-hutterer)]

*** Bug 105439 has been marked as a duplicate of this bug. ***

[Peter Hutterer (peter-hutterer)]

Thanks for the evemu, that helped a lot. Caused by a corner-case where a fake finger touch ended up hovering and was never terminated on the input event sequence. On the next real touch with high-enough pressure it was continued and caused a miscount of tapping fingers.

commit d8db6b5927f61460b2991479a85056256c819485
Author: Peter Hutterer <>
Date: Mon Mar 12 10:33:21 2018 +1000

     touchpad: end hovering touches in maybe_end_touch

[Joel Van Boxtel (jeol13)]

Touch Screen issue

[Peter Hutterer (peter-hutterer)]

*** Bug 105459 has been marked as a duplicate of this bug. ***

[Daniel van Vugt (vanvugt)]

In progress (fix coming in 1.10.3)

[赵煜 (silencly07)]

It better if change summary to something new, the "1.10-branch" make me thought it was a old bug on libinput version 1.10.0

[Daniel van Vugt (vanvugt)]

Done. It's the same assertion, just line 1030 in master and line 1028 in 1.10-branch.

[justasug (mrblooter)]

Created attachment 138073
coredump info

I am still getting crashes with 1.10.2.

I tried to provide more information by following the instructions in comment #2, but I'm afraid I don't quite understand how to. I am also experiencing the crashes on Arch Linux.

I rebuilt the libinput package specifying --builtype debug. Then I triggered another crash and got a coredump (attached info).

I will attach an evemu recording shortly.

There is nothing in my Xorg log, apart from this line:
[ 1149.033] (II) Axis 0x1 value 5120 is outside expected range [1237, 4990]

I also ran "eu-addr2line -e /usr/lib64/libinput.so", but I don't know what I'm supposed to do with it since there was no output.
Can someone help me to provide more information?

[justasug (mrblooter)]

Created attachment 138074
evemu-record of touchpad

evemu-record of my SynPS/2 Synaptics TouchPad on a Thinkpad T410.

[Peter Hutterer (peter-hutterer)]

regarding addr2line: https://who-t.blogspot.com.au/2014/02/making-sense-of-backtraces-with.html

see comment #20, this bug is fixed on master, and I cannot reproduce it with the recording (but I can with the commit before d8db6b59).

[justasug (mrblooter)]

Thank you. I have tested it with 1.10.3 and it's fixed.
I got confused for a bit, because the bug tracker on the distribution said it was fixed in 1.10.2, but they meant the first bug in this report.

[Joel Van Boxtel (jeol13)]

hey, can you add the ability to close the on-screen keyboard?

[Daniel van Vugt (vanvugt)]

Joel, that feature already exists: Use the button with the down arrow (looks like a 'V').

Also that has nothing to do with this bug. If you have any issues then please open a new bug.

[Daniel van Vugt (vanvugt)]

libinput (1.10.3-2) unstable; urgency=medium

  [ Jeremy Bicha ]
  * control: Update VCS urls.
  * control: Add more packages to libinput-dev Depends as a workaround for
    buggy meson/pkg-config. (Closes: #893067)

 -- Timo Aaltonen <email address hidden> Sun, 18 Mar 2018 15:39:44 +0200

[Peter Hutterer (peter-hutterer)]

*** Bug 105791 has been marked as a duplicate of this bug. ***

[postadelmaga (postadelmaga)]

I confirm running libinput 1.10.900 it solved the issue for me