[BNR] Compiz crash in movementWindowOnScreen (caused by fix 755842)

Bug Description

[Impact]

A crash after fix to bug #755842.

[Test case]

Use super+W rapidly a few times.

[Regression Potential]

Should be low, correct usage of the vector variable. Test wall plugin's offset movement functionality in general.

TESTCASE:

ctest -D ExperimentalMemCheck
(this option was only added on 20 June 2012)

ORIGINAL DESCRIPTION:
Running compiz 1:0.9.8+bzr3249-0ubuntu1 got a crash in movementWindowOnScreen after doing super+W a few times.

valgrind says:

==3648== Invalid read of size 2
==3648== at 0x806092A: compiz::wall::movementWindowOnScreen(CompRect const&, CompRegion const&) (rect.h:178)
==3648== by 0x44BCEC7: ???
==3648== Address 0x44bd026 is 14 bytes inside a block of size 20 free'd
==3648== at 0x402ACFC: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==3648== by 0x8060965: compiz::wall::movementWindowOnScreen(CompRect const&, CompRegion const&) (new_allocator.h:98)
==3648== by 0x44BCEC7: ???

The classic case of iterating a temporary vector that goes out of scope while iterating. Annoying.

Note: This bug was never in precise. But the fix does need to be backported to lp:compiz-plugins-main before maintenance release 0.9.7.4 of that project.

Fix committed into lp:compiz at revision 3255

BNR = bug never released.

This regression is caused by the fix for bug 755842, which is already committed for the next maintenance release: compiz-plugins-main 0.9.7.4. Make sure this fix gets backported too!

This bug was fixed in the package compiz - 1:0.9.8+bzr3249-0ubuntu1

---------------
compiz (1:0.9.8+bzr3249-0ubuntu1) quantal-proposed; urgency=low

* New upstream snapshot.
- Fall back to a refresh rate that is more likely to look correct; 60Hz.
(LP: #1009338)
- Benchmark plugin should consume its key binding, and not pass the key to
the underlying window. (LP: #1009320)
- Avoid needless STL operations leading to expensive heap operations.
(LP: #1006335)
- Fix a typo that was causing (LP: #1002606)
(widthIncBorders/heightIncBorders)
- Check if the window is decorated before trying to change its event window
states (which won't exist if not decorated) (LP: #1007754)
- Use the XDamage extension more efficiently (the way it was designed to be
used). This dramatically reduces CPU usage, reduces wakeups, and
increases frame rates. It also solves at least one observed performance
bug (LP: #1007299) and probably several more.
- Avoid constructing and destructing lots of strings on every single event,
which was wasting lots of CPU (LP: #1005569)
- md LINGUAS doesn't exist, it's mnk (Mandinka in ISO 639-3)
- Move grid plugin to google test and don't depend on the plugin for the
test (LP: #1005009)
- Don't read plugin.Initialized and test the value. (LP: #1004848)
- libcompizconfig's install () commands were still using the old includedir
and libdir variables rather than their libcompizconfig_* variants.
(LP: #1005176)
- Execute the cmake files separately to ensure that DESTDIR is respected.
(LP: #1005177)
- Don't set_target_properties on a target that might not exist
(LP: #1005008)
- Don't allow windows which we weren't even tracking as decoratable to
become decorated if they try and change their hints. (LP: #963794)
- Change the mouse pointer while dragging windows in expo. Just like the
ubuntu branches do. (LP: #987647)
- Fix uninitialized memory use (LP: #1004338)
- Fix uninitialized variable (LP: #1004335)
- Delay unbinding of pixmaps until then next rebind (LP: #729979)
(LP: #1002602)
- Don't drop plugins from the list to try and load before you've even tried
to load them. Doing so makes missing plugins silently ignored instead of
an error message (LP: #1002715). It also means valid plugins in more
unusual, but real locations in LD_LIBRARY_PATH will never get loaded
(LP: #1002721).
- If running test cases under a real X server, we don't care if Xvfb is
missing (LP: #994841)
- Don't assume pkg_check_modules always sets _PREFIX (LP: #993608)
- Don't clear selections in ~PrivateScreen because it causes a race between
the existing and the new compiz instances, breaking --replace and
non-replace behaviour. (LP: #988684) (LP: #989545)
- Always paint with infiniteRegion as the clip region if the window is
transformed and always use the supplied region if painting with offset or
on transformed screen. (LP: #987639)
- Add synchronization primitives to the decoration protocol so that there
isn't a r...

BNR means bug-never-released. So the "release" of this fix is not really relevant to users.

Fix committed to lp:compiz-plugins-main/0.9.7 at revision 35, scheduled for release in Compiz Main Plugins 0.9.7.4

Hello Alan, or anyone else affected,

Accepted compiz-plugins-main into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/compiz-plugins-main/1:0.9.7.0~bzr19-0ubuntu10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

This seems to be fixed since I can't reproduce the crash using the proposed packages. Tried on 2 machines with different vga cards.

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

This bug was fixed in the package compiz-plugins-main - 1:0.9.7.0~bzr19-0ubuntu10.1

---------------
compiz-plugins-main (1:0.9.7.0~bzr19-0ubuntu10.1) precise; urgency=low

* debian/patches/fix_755842.patch:
Fix non-maximized windows which sit on the border of a workspace move
when called (LP: #755842)
* debian/patches/fix_1015151.patch:
Fix a crash related to the above fix (LP: #1015151)
-- Timo Jyrinki <email address hidden> 2013年2月25日 10:56:33 +0200

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release