On 16/06/2013 22:48, Matt D. wrote:
>   > I've applied a fix to address the immediate problem of not checking
>   > for the failure, and I've uploaded a snapshot at [1]. Perhaps you
>   > could try that and see if it fixes the issue for you?
> 
> Yes, this solves the crash problem (thank you!).
> 
>   > I would also be interested to know how the icon for the window which
>   > was causing this issue appears.
> 
> I've attached some screenshots of the taskbar and titlebar icons for Eclipse
> 4.2 using your XWin.exe build running with an without nx.
> 
> The titlebar icon does NOT appear when running Eclipse with vanilla X. The
> taskbar icon also uses full colors; I do not know if it's a different icon or
> if nx is using some kind of compression.
> 
> The second set of images (eclipse-4_2-nx_2 and eclipse-4_2-nonx_2) indicate
> the time of crash. When Eclipse starts up is displays a splash image which
> initially does not have an icon in its titlebar. Notably, a window border only
> appears when running Eclipse with nx. Despite not having a border, the icon is
> still relevant because it is the same one used to display in the taskbar.
> 
> The crash occurs when the icon is being loaded onto the splash window. To
> reiterate, the window is NOT created with this icon. It is loaded sometime
> later while Eclipse is initializing.

Ah.  I was hoping you could use xprop to examine the _NET_WM_ICON property of
the window, but if it's a transient state that may not be practical.

I would guess that the difference in appearance between the nx and non-nx
cases is due to nx not transporting some window appearance hints.

>   > Hmm... this seems to indicate that icon was of size -1x-1, which
>   > doesn't seem right...
> 
> Perhaps it has to do with the icon being applied after the window has already
> been created?
> 
>   > From the backtrace, it looks like the crash is occurring due to a
>   > failure when converting the X11 icon to a Windows icon, and then not
>   > checking properly for that failure.
> 
> It looked to me like the crash was occurring at line 264 of icon_convert.c; a
> memcpy to DIB_pixels which I believe was uninitialized. Regardless, the memcpy
> is one without verifying DIB_pixels or checking the return value of CreateBitmap.
> 
> This is what I has planned to look into.. if I ever get XWin.exe to compile.

I did a bit more testing and managed to craft some malformed _NET_WM_ICON
properties which could crash the multiwindow mode WM in different ways (small
test case attached), so I've added another patch to do more validation of
_NET_WM_ICON data before it is used.


-- 
Jon TURNEY
Volunteer Cygwin/X X Server maintainer