segfault on mouseDown on macOS

[ensconced]

Steps for reproduction

• On macOS, clone this repo: https://github.com/ensconced/minifb_segfault
• cargo run
• Click on the screen titled "Screen A"
• The program segfaults

---

Crash report:

Crashed Thread:        0  main  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000020
Exception Codes:       0x0000000000000001, 0x0000000000000020

Termination Reason:    Namespace SIGNAL, Code 11 Segmentation fault: 11
Terminating Process:   exc handler [36850]

VM Region Info: 0x20 is not in any region.  Bytes before following region: 4343218144
      REGION TYPE                    START - END         [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      UNUSED SPACE AT START
--->  
      __TEXT                      102e04000-102e54000    [  320K] r-x/r-x SM=COW  ...nifb_segfault

Thread 0 Crashed:: main Dispatch queue: com.apple.main-thread
0   minifb_segfault               	       0x102e0ef50 -[OSXWindowFrameView mouseDown:] + 64
1   AppKit                        	       0x191721830 forwardMethod + 252
2   AppKit                        	       0x191721830 forwardMethod + 252
3   AppKit                        	       0x1917272d0 -[NSWindow(NSEventRouting) _handleMouseDownEvent:isDelayedEvent:] + 3472
4   AppKit                        	       0x1916b279c -[NSWindow(NSEventRouting) _reallySendEvent:isDelayedEvent:] + 364
5   AppKit                        	       0x1916b245c -[NSWindow(NSEventRouting) sendEvent:] + 284
6   AppKit                        	       0x191d5f9f4 -[NSApplication(NSEventRouting) sendEvent:] + 1604
7   minifb_segfault               	       0x102e0d050 update_events + 160
8   minifb_segfault               	       0x102e0c5ac generic_update + 104
9   minifb_segfault               	       0x102e0c7ac mfb_update_with_buffer + 296
10  minifb_segfault               	       0x102e0a4c8 minifb::os::macos::Window::update_with_buffer_stride::h721e019db8f5d562 + 236
11  minifb_segfault               	       0x102e05c50 minifb::Window::update_with_buffer::h8777ae1fd5020148 + 96 (lib.rs:348)
12  minifb_segfault               	       0x102e0716c minifb_segfault::main::h8a19901770ec2902 + 672 (main.rs:28)
13  minifb_segfault               	       0x102e0729c core::ops::function::FnOnce::call_once::hdada3a27c4e01f41 + 20 (function.rs:250)
14  minifb_segfault               	       0x102e05d18 std::sys_common::backtrace::__rust_begin_short_backtrace::h5c7f79f19069600e + 24 (backtrace.rs:154)
15  minifb_segfault               	       0x102e05dac std::rt::lang_start::_$u7b$$u7b$closure$u7d$$u7d$::hc0d8a27245d36cb2 + 28 (rt.rs:167)
16  minifb_segfault               	       0x102e239e4 std::rt::lang_start_internal::h5b246d44f1526226 + 648
17  minifb_segfault               	       0x102e05d78 std::rt::lang_start::h1282ab7f8fd77c21 + 84 (rt.rs:166)
18  minifb_segfault               	       0x102e071e4 main + 36
19  dyld                          	       0x18d94d0e0 start + 2360

Thread 1:
0   libsystem_pthread.dylib       	       0x18dcc8e28 start_wqthread + 0

Thread 2:
0   libsystem_pthread.dylib       	       0x18dcc8e28 start_wqthread + 0

Thread 3:
0   libsystem_pthread.dylib       	       0x18dcc8e28 start_wqthread + 0

Thread 4:: CVDisplayLink
0   libsystem_kernel.dylib        	       0x18dc9106c __psynch_cvwait + 8
1   libsystem_pthread.dylib       	       0x18dcce628 _pthread_cond_wait + 1272
2   CoreVideo                     	       0x196695528 CVDisplayLink::waitUntil(unsigned long long) + 328
3   CoreVideo                     	       0x1966945f4 CVDisplayLink::runIOThread() + 504
4   libsystem_pthread.dylib       	       0x18dcce034 _pthread_start + 136
5   libsystem_pthread.dylib       	       0x18dcc8e3c thread_start + 8

Thread 5:: CVDisplayLink
0   libsystem_kernel.dylib        	       0x18dc9106c __psynch_cvwait + 8
1   libsystem_pthread.dylib       	       0x18dcce628 _pthread_cond_wait + 1272
2   CoreVideo                     	       0x196695528 CVDisplayLink::waitUntil(unsigned long long) + 328
3   CoreVideo                     	       0x1966945f4 CVDisplayLink::runIOThread() + 504
4   libsystem_pthread.dylib       	       0x18dcce034 _pthread_start + 136
5   libsystem_pthread.dylib       	       0x18dcc8e3c thread_start + 8

Thread 6:: com.apple.NSEventThread
0   libsystem_kernel.dylib        	       0x18dc8d874 mach_msg2_trap + 8
1   libsystem_kernel.dylib        	       0x18dc9fcf0 mach_msg2_internal + 80
2   libsystem_kernel.dylib        	       0x18dc964b0 mach_msg_overwrite + 476
3   libsystem_kernel.dylib        	       0x18dc8dbf8 mach_msg + 24
4   CoreFoundation                	       0x18ddabbf4 __CFRunLoopServiceMachPort + 160
5   CoreFoundation                	       0x18ddaa4bc __CFRunLoopRun + 1208
6   CoreFoundation                	       0x18dda99ac CFRunLoopRunSpecific + 608
7   AppKit                        	       0x1916b0510 _NSEventThread + 144
8   libsystem_pthread.dylib       	       0x18dcce034 _pthread_start + 136
9   libsystem_pthread.dylib       	       0x18dcc8e3c thread_start + 8


Thread 0 crashed with ARM Thread State (64-bit):
    x0: 0x00000001246110b0   x1: 0x0000000124750ab0   x2: 0x00006000012e0e40   x3: 0x00006000012e0e40
    x4: 0x0000000000000010   x5: 0x00000000000002b0   x6: 0x0000000000000029   x7: 0x000000018df24ce5
    x8: 0x0000000000000001   x9: 0x0000000000000000  x10: 0x90806000003f8487  x11: 0x00000000aa000001
   x12: 0x00006000025e81b0  x13: 0x00000001250da990  x14: 0x1000000102e58e55  x15: 0x0000000102e58e50
   x16: 0x000000018d905820  x17: 0x00000001e5d71c80  x18: 0x0000000000000000  x19: 0x00006000012e0e40
   x20: 0x0000000124750500  x21: 0x0000000000000000  x22: 0x00000001dd0b796d  x23: 0x0000000000000000
   x24: 0x0000000124750ab0  x25: 0x0000000000000000  x26: 0x0000000000000000  x27: 0x00000001e44fe9e0
   x28: 0x000000012461117c   fp: 0x000000016cff6ca0   lr: 0xf841000102e0ef34
    sp: 0x000000016cff6c80   pc: 0x0000000102e0ef50 cpsr: 0x60001000
   far: 0x0000000000000020  esr: 0x92000046 (Data Abort) byte write Translation fault

Binary Images:
       0x103274000 -        0x10327ffff libobjc-trampolines.dylib (*) <7778e0d7-361a-378d-9438-3b2bb48c2154> /usr/lib/libobjc-trampolines.dylib
       0x102e04000 -        0x102e53fff minifb_segfault (*) <1bed0566-2d50-3f39-9160-c6dccacc72e3> /Users/USER/*/minifb_segfault
       0x19154d000 -        0x192867fff com.apple.AppKit (6.9) <f3527312-e426-3f7c-b77b-2bf49d1b7c04> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
       0x18d947000 -        0x18d9db347 dyld (*) <324e4ad9-e01f-3183-b09f-3e20b326643a> /usr/lib/dyld
               0x0 - 0xffffffffffffffff ??? (*) <00000000-0000-0000-0000-000000000000> ???
       0x18dd2e000 -        0x18e205fff com.apple.CoreFoundation (6.9) <47e4ec09-8f6e-30a8-99d0-34024d4f8122> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
       0x18d8f8000 -        0x18d946fe0 libobjc.A.dylib (*) <9bab9556-7a2a-30a8-acde-010ba8e2367d> /usr/lib/libobjc.A.dylib
       0x18dcc7000 -        0x18dcd3ff3 libsystem_pthread.dylib (*) <a7d94c96-7b1f-3229-9bea-048d037c3292> /usr/lib/system/libsystem_pthread.dylib
       0x18dc8c000 -        0x18dcc6fff libsystem_kernel.dylib (*) <ca94fc21-bc40-3b43-b65d-b87ece9e1d48> /usr/lib/system/libsystem_kernel.dylib
       0x196692000 -        0x1966effff com.apple.CoreVideo (1.8) <0bd999bf-c672-3dad-84f7-6eb32330d37f> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo

External Modification Summary:
  Calls made by other processes targeting this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by all processes on this machine:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0

VM Region Summary:
ReadOnly portion of Libraries: Total=1.2G resident=0K(0%) swapped_out_or_unallocated=1.2G(100%)
Writable regions: Total=1.5G written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=1.5G(100%)

                                VIRTUAL   REGION 
REGION TYPE                        SIZE    COUNT (non-coalesced) 
===========                     =======  ======= 
Accelerate framework               128K        1 
Activity Tracing                   256K        1 
CG image                            96K        4 
ColorSync                          544K       26 
CoreAnimation                      336K       21 
CoreGraphics                        32K        2 
CoreUI image data                 1280K        9 
Foundation                          16K        1 
Kernel Alloc Once                   32K        1 
MALLOC                             1.5G       48 
MALLOC guard page                  192K       12 
STACK GUARD                         96K        6 
Stack                             11.2M        7 
Stack Guard                       56.0M        1 
VM_ALLOCATE                        320K       13 
__AUTH                             915K      199 
__AUTH_CONST                      14.9M      360 
__CTF                               824        1 
__DATA                            3670K      346 
__DATA_CONST                      18.0M      363 
__DATA_DIRTY                       916K      114 
__FONT_DATA                          4K        1 
__LINKEDIT                       891.5M        3 
__OBJC_RO                         71.1M        1 
__OBJC_RW                         2168K        1 
__TEXT                           292.3M      378 
dyld private memory                272K        2 
mapped file                      175.2M       22 
shared memory                      864K       14 
===========                     =======  ======= 
TOTAL                              3.0G     1958 

Macbook details:

MacBook Pro 14-inch, 2021
Chip: Apple M1 Pro
Memory: 16 GB
Startup disk: Macintosh HD
macOS: 14.2.1

[emoon]

Oh, this sounds bad.

Thanks for a great report. I will have a look at it after work today.

[emoon]

I had a quick look at the code and I think I know what the issue is.

If you change your loop to something like this

    while screen_b.is_open() && !screen_b.is_key_down(Key::Escape) {
        screen_b
            .update_with_buffer(&buffer, SCREEN_B_WIDTH, SCREEN_B_HEIGHT)
            .unwrap();
        if screen_a.is_open() {
           screen_a.update();
       }
    }

It should not crash anymore.

[ensconced]

That does indeed fix it

[emoon]

Alright. I will have a look at why it crashes, but update or update_with_bufffer needs to be called on all active windows. That being said it shouldn't crash if an update isn't called.