Segfault at gl_compoe while closing an application (usually some gnome app)

[asafalg]

Platform

Pop OS 20.04

GPU, drivers, and screen setup

Single screen, laptop, using intel drivers
name of display: :0.0
display: :0 screen: 0
direct rendering: Yes
Extended renderer info (GLX_MESA_query_renderer):
Vendor: Intel (0x8086)
Device: Mesa Intel(R) UHD Graphics 620 (WHL GT2) (0x3ea0)
Version: 20.0.4
Accelerated: yes
Video memory: 3072MB
Unified memory: yes
Preferred profile: core (0x1)
Max core profile version: 4.6
Max compat profile version: 4.6
Max GLES1 profile version: 1.1
Max GLES[23] profile version: 3.2
OpenGL vendor string: Intel
OpenGL renderer string: Mesa Intel(R) UHD Graphics 620 (WHL GT2)
OpenGL core profile version string: 4.6 (Core Profile) Mesa 20.0.4
OpenGL core profile shading language version string: 4.60
OpenGL core profile context flags: (none)
OpenGL core profile profile mask: core profile

OpenGL version string: 4.6 (Compatibility Profile) Mesa 20.0.4
OpenGL shading language version string: 4.60
OpenGL context flags: (none)
OpenGL profile mask: compatibility profile

OpenGL ES profile version string: OpenGL ES 3.2 Mesa 20.0.4
OpenGL ES profile shading language version string: OpenGL ES GLSL ES 3.20

Environment

Using xfce4, since it is popos, i have gnome apps installed, they cause most of the problems

picom version

[ 12/06/20 12:27:44.150 atom_getter DEBUG ] Atom _NET_WM_WINDOW_OPACITY is 442
[ 12/06/20 12:27:44.150 atom_getter DEBUG ] Atom _NET_FRAME_EXTENTS is 352
[ 12/06/20 12:27:44.150 atom_getter DEBUG ] Atom WM_STATE is 457
[ 12/06/20 12:27:44.150 atom_getter DEBUG ] Atom _NET_WM_NAME is 358
[ 12/06/20 12:27:44.150 atom_getter DEBUG ] Atom _NET_WM_PID is 359
[ 12/06/20 12:27:44.151 atom_getter DEBUG ] Atom WM_NAME is 39
[ 12/06/20 12:27:44.151 atom_getter DEBUG ] Atom WM_CLASS is 67
[ 12/06/20 12:27:44.151 atom_getter DEBUG ] Atom WM_TRANSIENT_FOR is 68
[ 12/06/20 12:27:44.151 atom_getter DEBUG ] Atom WM_WINDOW_ROLE is 349
[ 12/06/20 12:27:44.151 atom_getter DEBUG ] Atom WM_CLIENT_LEADER is 344
[ 12/06/20 12:27:44.151 atom_getter DEBUG ] Atom _NET_ACTIVE_WINDOW is 350
[ 12/06/20 12:27:44.151 atom_getter DEBUG ] Atom _COMPTON_SHADOW is 524
[ 12/06/20 12:27:44.151 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE is 374
[ 12/06/20 12:27:44.151 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_DESKTOP is 448
[ 12/06/20 12:27:44.153 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_DOCK is 449
[ 12/06/20 12:27:44.153 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_TOOLBAR is 451
[ 12/06/20 12:27:44.153 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_MENU is 379
[ 12/06/20 12:27:44.153 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_UTILITY is 383
[ 12/06/20 12:27:44.153 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_SPLASH is 450
[ 12/06/20 12:27:44.153 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_DIALOG is 376
[ 12/06/20 12:27:44.154 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_NORMAL is 380
[ 12/06/20 12:27:44.154 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_DROPDOWN_MENU is 378
[ 12/06/20 12:27:44.154 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_POPUP_MENU is 381
[ 12/06/20 12:27:44.154 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_TOOLTIP is 382
[ 12/06/20 12:27:44.154 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_NOTIFICATION is 452
[ 12/06/20 12:27:44.154 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_COMBO is 375
[ 12/06/20 12:27:44.154 atom_getter DEBUG ] Atom _NET_WM_WINDOW_TYPE_DND is 377
[ 12/06/20 12:27:44.154 atom_getter DEBUG ] Atom _NET_WM_STATE is 361
[ 12/06/20 12:27:44.155 atom_getter DEBUG ] Atom _NET_WM_STATE_FULLSCREEN is 364
[ 12/06/20 12:27:44.155 atom_getter DEBUG ] Atom _NET_WM_BYPASS_COMPOSITOR is 437
[ 12/06/20 12:27:44.155 atom_getter DEBUG ] Atom _GTK_FRAME_EXTENTS is 404
[ 12/06/20 12:27:44.158 atom_getter DEBUG ] Atom COMPTON_VERSION is 526
[ 12/06/20 12:27:44.159 atom_getter DEBUG ] Atom _NET_WM_CM_S0 is 354
[ 12/06/20 12:27:44.177 init_overlay DEBUG ] overlay = 0x000000b4
[ 12/06/20 12:27:44.233 glx_has_extension INFO ] Found GLX extension GLX_SGI_video_sync.
[ 12/06/20 12:27:44.233 glx_has_extension INFO ] Found GLX extension GLX_SGI_swap_control.
[ 12/06/20 12:27:44.233 glx_has_extension INFO ] Found GLX extension GLX_OML_sync_control.
[ 12/06/20 12:27:44.233 glx_has_extension INFO ] Found GLX extension GLX_MESA_swap_control.
[ 12/06/20 12:27:44.233 glx_has_extension INFO ] Missing GLX extension GLX_EXT_swap_control.
[ 12/06/20 12:27:44.233 glx_has_extension INFO ] Found GLX extension GLX_EXT_texture_from_pixmap.
[ 12/06/20 12:27:44.233 glx_has_extension INFO ] Found GLX extension GLX_ARB_create_context.
[ 12/06/20 12:27:44.233 glx_has_extension INFO ] Found GLX extension GLX_EXT_buffer_age.
[ 12/06/20 12:27:44.258 gl_create_shader TRACE ] ===
#version 110
uniform float offset_x;
uniform float offset_y;
uniform float factor_center;
uniform sampler2D tex_scr;

void main() {
vec4 sum = vec4(0.0, 0.0, 0.0, 0.0);
sum += float(1) * texture2D(tex_scr, vec2(gl_TexCoord[0].x + offset_x * float(-1), gl_TexCoord[0].y + offset_y * float(-1)));
sum += float(1) * texture2D(tex_scr, vec2(gl_TexCoord[0].x + offset_x * float(0), gl_TexCoord[0].y + offset_y * float(-1)));
sum += float(1) * texture2D(tex_scr, vec2(gl_TexCoord[0].x + offset_x * float(1), gl_TexCoord[0].y + offset_y * float(-1)));
sum += float(1) * texture2D(tex_scr, vec2(gl_TexCoord[0].x + offset_x * float(-1), gl_TexCoord[0].y + offset_y * float(0)));
sum += float(1) * texture2D(tex_scr, vec2(gl_TexCoord[0].x + offset_x * float(1), gl_TexCoord[0].y + offset_y * float(0)));
sum += float(1) * texture2D(tex_scr, vec2(gl_TexCoord[0].x + offset_x * float(-1), gl_TexCoord[0].y + offset_y * float(1)));
sum += float(1) * texture2D(tex_scr, vec2(gl_TexCoord[0].x + offset_x * float(0), gl_TexCoord[0].y + offset_y * float(1)));
sum += float(1) * texture2D(tex_scr, vec2(gl_TexCoord[0].x + offset_x * float(1), gl_TexCoord[0].y + offset_y * float(1)));
sum += texture2D(tex_scr, vec2(gl_TexCoord[0].x, gl_TexCoord[0].y)) * factor_center;
gl_FragColor = sum / (factor_center + float(8));
}

===
Version: vgit-0b377

Extensions:

• Shape: Yes
• XRandR: Yes
• Present: Present

Misc:

• Use Overlay: Yes* Config file used: /home/asaf/.config/picom/picom.conf

Drivers (inaccurate):

modesetting

Config

picom.conf.tar.gz

used experimental backends

Steps of reproduction

1. start some application (gnome apps are faster, for example nautilus, also happens for plank and many other random applications)
2. close using the close button
3. picom crashes

Expected behavior

picom should not crash

Stack trace

core.tar.gz

The issue is in the function gl_compose
x_rect_to_coords(nrects, rects, dst_x, dst_y, img->inner->height, gd->height, img->inner->y_inverted, coord, indices); _gl_compose(base, img, gd->back_fbo, coord, indices, nrects);

the variable img is null for some reason and is dereferencing it causes the segfault.
that variable is checked in the function _gl_compose before attempting to access it, but the same check is nowhere to be found in gl_compose before using it.

To simply fix the crash add a check to img before accessing it in gl_compose before accessing it.