X server crash when resizing windows in KDE

[Christian]

I'm using KDE 4.8.5 on Precise on a box with a AMD Radeon HD 7560D graphics card. Desktop effects are enabled. When resizing windows and (more rarely) also during various other activities (such as closing a window), X crashes. This isn't completely deterministic, but if I open a handful of windows and resize them, I can reliably produce an X crash with return to the login screen in far less than a minute.

I'm not 100% sure I'm reporting the right module. I guess the question is whether the Radeon driver or libpixman, but I'm sure we'll figure that out soon... I'd be glad for any pointers, this is obviously really annoying.

$ lsb_release -rd
Description: Ubuntu 12.04.2 LTS
Release: 12.04

$ fglrxinfo
display: :4 screen: 0
OpenGL vendor string: Advanced Micro Devices, Inc.
OpenGL renderer string: AMD Radeon HD 7560D
OpenGL version string: 4.2.11903 Compatibility Profile Context

$ apt-cache policy fglrx-updates
fglrx-updates:
  Installed: 2:9.000-0ubuntu0.3
  Candidate: 2:9.000-0ubuntu0.3
  Version table:
 *** 2:9.000-0ubuntu0.3 0
        500 http://us.archive.ubuntu.com/ubuntu/ precise-updates/restricted amd64 Packages
        100 /var/lib/dpkg/status
     2:8.960-0ubuntu1 0
        500 http://us.archive.ubuntu.com/ubuntu/ precise/restricted amd64 Packages

Backtrace, produced via ssh-in and gdb attachment:

Program received signal SIGSEGV, Segmentation fault.
pixman_blt_sse2 (src_bits=<optimized out>, dst_bits=<optimized out>, src_stride=<optimized out>, dst_stride=<optimized out>, src_bpp=<optimized out>,
    src_x=<optimized out>, src_y=-30, dest_x=0, dest_y=0, width=718, height=<optimized out>, dst_bpp=<optimized out>) at ../../pixman/pixman-sse2.c:4524
4524 ../../pixman/pixman-sse2.c: No such file or directory.

(gdb) bt full
#0 pixman_blt_sse2 (src_bits=<optimized out>, dst_bits=<optimized out>, src_stride=<optimized out>, dst_stride=<optimized out>, src_bpp=<optimized out>,
    src_x=<optimized out>, src_y=-30, dest_x=0, dest_y=0, width=718, height=<optimized out>, dst_bpp=<optimized out>) at ../../pixman/pixman-sse2.c:4524
        w = <optimized out>
        s = 0x7f23c01c1788 <Address 0x7f23c01c1788 out of bounds>
        d = 0x7f23bdef8000 ""
        src_bytes = 0x7f23c01c2388 <Address 0x7f23c01c2388 out of bounds>
        dst_bytes = 0x7f23bdef8c00 ""
        byte_width = 2872
#1 0x00007f23e3cdb1eb in pixman_blt_sse2 (height=511, width=718, dest_y=0, dest_x=0, src_y=-30, src_x=-30, dst_bpp=32, src_bpp=32, dst_stride=768,
    src_stride=768, dst_bits=0x7f23bdef8000, src_bits=0x7f23c01d8000) at ../../pixman/pixman-sse2.c:4466
No locals.
#2 sse2_blt (imp=0x7f23e58f48a0, src_bits=0x7f23c01d8000, dst_bits=0x7f23bdef8000, src_stride=768, dst_stride=768, src_bpp=32, dst_bpp=32, src_x=-30,
    src_y=-30, dest_x=0, dest_y=0, width=718, height=511) at ../../pixman/pixman-sse2.c:5796
No locals.
#3 0x00007f23e3c71602 in pixman_blt (src_bits=<optimized out>, dst_bits=<optimized out>, src_stride=<optimized out>, dst_stride=<optimized out>,
    src_bpp=<optimized out>, dst_bpp=<optimized out>, src_x=-30, src_y=-30, dest_x=0, dest_y=0, width=718, height=511) at ../../pixman/pixman.c:754
No locals.
#4 0x00007f23dee5ae29 in fbCopyNtoN (pSrcDrawable=<optimized out>, pDstDrawable=<optimized out>, pGC=<optimized out>, pbox=0x7fff47750720,
    nbox=<optimized out>, dx=472, dy=177, reverse=0, upsidedown=0, bitplane=0, closure=0x0) at ../../fb/fbcopy.c:97
        alu = <optimized out>
        pm = 4294967295
        src = 0x7f23c01d8000
        srcStride = 768
        srcBpp = 32
        srcXoff = -502
        srcYoff = -207
        dst = 0x7f23bdef8000
        dstStride = 768
        dstBpp = 32
        dstXoff = 0
        dstYoff = 0
#5 0x00007f23dcfbe801 in ?? () from /usr/lib/x86_64-linux-gnu/xorg/extra-modules/modules/glesx.so
No symbol table info available.
#6 0x00007f23dcfc08c5 in ?? () from /usr/lib/x86_64-linux-gnu/xorg/extra-modules/modules/glesx.so
No symbol table info available.
#7 0x00007f23e4cf6464 in damageComposite (op=1 '\001', pSrc=0x7f23e71ea910, pMask=0x0, pDst=0x7f23e654e440, xSrc=-30, ySrc=-30, xMask=0, yMask=0, xDst=0,
    yDst=0, width=718, height=511) at ../../../miext/damage/damage.c:569
        pScreen = <optimized out>
        ps = 0x7f23e5b1d930
        pScrPriv = 0x7f23e5b32730
#8 0x00007f23e4cb9c6d in compNewPixmap (pWin=<optimized out>, x=<optimized out>, y=<optimized out>, w=718, h=511) at ../../composite/compalloc.c:614
        pDstFormat = 0x7f23e5b1d301
        inferiors = 1
        pDstPicture = 0x7f23e654e440
        pSrcFormat = <optimized out>
        error = 0
        pSrcPicture = 0x7f23e71ea910
        pScreen = <optimized out>
        pParent = 0x7f23e6c29450
        pPixmap = 0x7f23e6e102e0
#9 0x00007f23e4cbb122 in compReallocPixmap (pWin=0x7f23e70fcf90, draw_x=<optimized out>, draw_y=<optimized out>, w=718, h=<optimized out>, bw=<optimized out>)
    at ../../composite/compalloc.c:717
        pScreen = <optimized out>
        pOld = 0x7f23e7135070
        pNew = <optimized out>
        cw = 0x7f23e6fda2e0
        pix_x = 472
        pix_y = 177
        pix_w = <optimized out>
        pix_h = <optimized out>
        __PRETTY_FUNCTION__ = "compReallocPixmap"
#10 0x00007f23e4cb7ec2 in compConfigNotify (pWin=0x7f23e70fcf90, x=<optimized out>, y=<optimized out>, w=<optimized out>, h=511, bw=0, pSib=0x0)
    at ../../composite/compwindow.c:827
        pScreen = 0x7f23e5b126b0
        cs = 0x7f23e5d5df60
        ret = <optimized out>
        pParent = 0x7f23e6c29450
        draw_x = <optimized out>
        draw_y = <optimized out>
        alloc_ret = <optimized out>
#11 0x00007f23e4c59194 in ConfigureWindow (pWin=<optimized out>, mask=12, vlist=<optimized out>, client=0x7f23e60c9ee0) at ../../dix/window.c:2408
        ret = <optimized out>
        pSib = 0x0
        pParent = <optimized out>
        sibwid = <optimized out>
        index2 = <optimized out>
        tmask = <optimized out>
        pVlist = <optimized out>
        x = -30
        y = -30
        beforeX = -30
        beforeY = -30
        w = 718
        h = 511
        bw = 0
        rc = <optimized out>
        action = 2
        smode = <optimized out>
        event = {u = {u = {type = 23 '\027', detail = 0 '\000', sequenceNumber = 0}, keyButtonPointer = {pad00 = 23, time = 29914854, root = 29914870,
              event = 0, child = 4293066722, rootX = 718, rootY = 511, eventX = 0, eventY = 12, state = 0, sameScreen = 0 '\000', pad1 = 0 '\000'},
            enterLeave = {pad00 = 23, time = 29914854, root = 29914870, event = 0, child = 4293066722, rootX = 718, rootY = 511, eventX = 0, eventY = 12,
              state = 0, mode = 0 '\000', flags = 0 '\000'}, focus = {pad00 = 23, window = 29914854, mode = 246 '\366', pad1 = 118 'v', pad2 = 200 '\310',
              pad3 = 1 '\001'}, expose = {pad00 = 23, window = 29914854, x = 30454, y = 456, width = 0, height = 0, count = 65506, pad2 = 65506},
            graphicsExposure = {pad00 = 23, drawable = 29914854, x = 30454, y = 456, width = 0, height = 0, minorEvent = 65506, count = 65506,
              majorEvent = 206 '\316', pad1 = 2 '\002', pad2 = 255 '\377', pad3 = 1 '\001'}, noExposure = {pad00 = 23, drawable = 29914854, minorEvent = 30454,
              majorEvent = 200 '\310', bpad = 1 '\001'}, visibility = {pad00 = 23, window = 29914854, state = 246 '\366', pad1 = 118 'v', pad2 = 200 '\310',
              pad3 = 1 '\001'}, createNotify = {pad00 = 23, parent = 29914854, window = 29914870, x = 0, y = 0, width = 65506, height = 65506,
              borderWidth = 718, override = 255 '\377', bpad = 1 '\001'}, destroyNotify = {pad00 = 23, event = 29914854, window = 29914870}, unmapNotify = {
              pad00 = 23, event = 29914854, window = 29914870, fromConfigure = 0 '\000', pad1 = 0 '\000', pad2 = 0 '\000', pad3 = 0 '\000'}, mapNotify = {
              pad00 = 23, event = 29914854, window = 29914870, override = 0 '\000', pad1 = 0 '\000', pad2 = 0 '\000', pad3 = 0 '\000'}, mapRequest = {
              pad00 = 23, parent = 29914854, window = 29914870}, reparent = {pad00 = 23, event = 29914854, window = 29914870, parent = 0, x = -30, y = -30,
              override = 206 '\316', pad1 = 2 '\002', pad2 = 255 '\377', pad3 = 1 '\001'}, configureNotify = {pad00 = 23, event = 29914854, window = 29914870,
              aboveSibling = 0, x = -30, y = -30, width = 718, height = 511, borderWidth = 0, override = 12 '\f', bpad = 0 '\000'}, configureRequest = {
              pad00 = 23, parent = 29914854, window = 29914870, sibling = 0, x = -30, y = -30, width = 718, height = 511, borderWidth = 0, valueMask = 12,
              pad1 = 0}, gravity = {pad00 = 23, event = 29914854, window = 29914870, x = 0, y = 0, pad1 = 4293066722, pad2 = 33489614, pad3 = 786432, pad4 = 0},
            resizeRequest = {pad00 = 23, window = 29914854, width = 30454, height = 456}, circulate = {pad00 = 23, event = 29914854, window = 29914870,
              parent = 0, place = 226 '\342', pad1 = 255 '\377', pad2 = 226 '\342', pad3 = 255 '\377'}, property = {pad00 = 23, window = 29914854,
              atom = 29914870, time = 0, state = 226 '\342', pad1 = 255 '\377', pad2 = 65506}, selectionClear = {pad00 = 23, time = 29914854, window = 29914870,
              atom = 0}, selectionRequest = {pad00 = 23, time = 29914854, owner = 29914870, requestor = 0, selection = 4293066722, target = 33489614,
              property = 786432}, selectionNotify = {pad00 = 23, time = 29914854, requestor = 29914870, selection = 0, target = 4293066722,
              property = 33489614}, colormap = {pad00 = 23, window = 29914854, colormap = 29914870, new = 0 '\000', state = 0 '\000', pad1 = 0 '\000',
              pad2 = 0 '\000'}, mappingNotify = {pad00 = 23, request = 230 '\346', firstKeyCode = 118 'v', count = 200 '\310', pad1 = 1 '\001'},
            clientMessage = {pad00 = 23, window = 29914854, u = {l = {type = 29914870, longs0 = 0, longs1 = -1900574, longs2 = 33489614, longs3 = 786432,
                  longs4 = 0}, s = {type = 29914870, shorts0 = 0, shorts1 = 0, shorts2 = -30, shorts3 = -30, shorts4 = 718, shorts5 = 511, shorts6 = 0,
                  shorts7 = 12, shorts8 = 0, shorts9 = 0}, b = {type = 29914870,
                  bytes = "\000\000\000\000\342\377\342\377\316\002\377\001\000\000\f\000\000\000\000"}}}}}
#12 0x00007f23e4c2930b in ProcConfigureWindow (client=0x7f23e60c9ee0) at ../../dix/dispatch.c:886
        pWin = 0x7f23e70fcf90
        stuff = 0x7f23e7278b80
        len = 2
        rc = <optimized out>
#13 0x00007f23e4c2e8a1 in Dispatch () at ../../dix/dispatch.c:442
        clientReady = 0x7f23e6000860
        result = <optimized out>
        client = 0x7f23e60c9ee0
        nready = 0
        icheck = 0x7f23e4fe5c10
        start_tick = 28160
#14 0x00007f23e4c1d7ba in main (argc=8, argv=<optimized out>, envp=<optimized out>) at ../../dix/main.c:287
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
(gdb) quit

[Christian (christian-j)]

I FART IN YOUR GENERAL DIRECTION! (I.e., this is a test to see whether anybody actually bothers to read these bug reports, because it doesn't really look like it...)

[supaiku (supaiku-ppa)]

I can confirm this bug. Same graphics card and KDE 4.10.3. This isn't distribution specific and only occurs under KDE.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Ma Yuxin (mikemyx-2002-9)]

I have suffered from this bug for quite a long time from KDE 4.9 to KDE 4.10.4 and from Ubuntu 12.10 to 13.04. There is a post about some details on this bug in AMD Linux bug report:

Bug 657 - X server crashes when resizing or mapping RGBA window (fbCopyNtoN)
http://ati.cchtml.com/show_bug.cgi?id=657

It seems that this problem has been existed for quite a long time.