One more note on the failure mode: the same non-NULL assumption appears at 
three layers, and
one of them masks the crash in debug builds.

1. Producer. The pad event constructors in gdk/wayland/gdkseat-wayland.c pass
   seat->keyboard_focus as the event surface, even though 
tablet_pad_handle_enter()
   receives the pad's own focus surface from the compositor and discards it.

2. Dispatcher. _gdk_event_emit() (gdk/gdkevents.c:491) hands every event to
   gdk_surface_handle_event(), although gdk_event_get_surface() is documented as
   nullable in the public API.

3. Debug sanity check. check_event_sanity() in the same file, compiled only 
under
   G_ENABLE_DEBUG, calls gdk_surface_get_display (event->surface) without a 
NULL check.
   That trips a g_return_val_if_fail, returns NULL, logs "mismatched device 
display" and
   drops the event before it reaches the deref.

So a GTK built with debug enabled survives this, and only shipped release builds
segfault - which is why the crash is invisible to anyone testing a development 
build.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172827

Title:
  gtk4 4.22.4: SIGSEGV in gdk_surface_handle_event() on a tablet-pad
  event carrying no surface (GDK_PAD_GROUP_MODE) after USB re-
  enumeration

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gtk4/+bug/2172827/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to