Xorg server segfaults in cwGetBackingPicture
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
xorg-server (Ubuntu) |
Fix Released
|
High
|
Bryce Harrington |
Bug Description
Description: Ubuntu 8.04.2
Release: 8.04
xserver-xorg-core 2:1.4.1~
xserver-
How to reproduce the crash:
- log in to GNOME session
- make sure compiz is enabled
- open Firefox
- go to http://
- play a video
- repeatedly minimize and restore the Firefox window while the video is playing in Firefox
=> observe a segfault in the Xorg server after minimizing/
I was able to reproduce this problem with both compiz and the composite manager in metacity. In metacity the problem is also triggered by switching virtual desktops. I'm using the radeon driver from xserver-
I captured the following backtrace with gdb through ssh:
Program received signal SIGSEGV, Segmentation fault.
0xb78f1412 in cwGetBackingPicture (pPicture=
y_off=
128 ../../.
in ../../.
(gdb) bt
#0 0xb78f1412 in cwGetBackingPicture (pPicture=
y_off=
#1 0xb78f15b9 in cwComposite (op=3 '\003', pSrcPicture=
pMskPicture
yMsk=0, xDst=256, yDst=64, width=222, height=64)
at ../../.
#2 0x08173013 in damageComposite (op=173 '�', pSrc=0x89a6d28,
pMask=
ySrc=<value optimized out>, xMask=<value optimized out>,
yMask=<value optimized out>, xDst=<value optimized out>,
yDst=<value optimized out>, width=<value optimized out>,
height=<value optimized out>) at ../../.
#3 0x0815a1f0 in CompositePicture (op=3 '\003', pSrc=0x89a6d28,
pMask=
ySrc=<value optimized out>, xMask=<value optimized out>,
yMask=<value optimized out>, xDst=<value optimized out>,
yDst=<value optimized out>, width=<value optimized out>,
height=<value optimized out>) at ../../render/
#4 0x081601df in ProcRenderComposite (client=0x89641e8)
at ../../render/
#5 0x0815d085 in ProcRenderDispatch (client=0x0) at ../../render/
#6 0x081506ee in XaceCatchExtProc (client=0x89641e8) at ../../Xext/
#7 0x0808d8df in Dispatch () at ../../dix/
---Type <return> to continue, or q <return> to quit---
#8 0x0807471b in main (argc=10, argv=0xbfe9ffd4, envp=Cannot access memory at address 0x8
)
at ../../dix/
[lspci]
00:00.0 Host bridge [0600]: Intel Corporation 82975X Memory Controller Hub [8086:277c]
Subsystem: Hewlett-Packard Company Unknown device [103c:280c]
01:00.0 VGA compatible controller [0300]: ATI Technologies Inc RV380 0x3e50 [Radeon X600] [1002:3e50] (prog-if 00 [VGA controller])
Subsystem: NEC Corporation Unknown device [1033:0268]
Related branches
Changed in xorg-server: | |
status: | Incomplete → Confirmed |
Changed in xorg-server: | |
importance: | Undecided → High |
status: | Confirmed → Triaged |
description: | updated |
Changed in xorg-server (Ubuntu): | |
assignee: | nobody → bryceharrington |
I downloaded the source and did some more debugging. I found that when the crash happens pPixmap is NULL. Or in other words (pWindow) ->devPrivates[ cwWindowIndex] .ptr == NULL. See the debugging session below. I had to jump through some hoops because the compiler optimized away some local variables.
Program received signal SIGSEGV, Segmentation fault. 0x85d3ac0, x_off=0xbf89d3e8, 0xbf89d3e4) at ../../. ./miext/ cw/cw_render. c:128 ./miext/ cw/cw_render. c: No such file or directory. ./miext/ cw/cw_render. c pPicture- >pDrawable) ->devPrivates[ cwWindowIndex]
[Switching to Thread 0xb7c0aa30 (LWP 5977)]
0xb78d6412 in cwGetBackingPicture (pPicture=
y_off=
128 ../../.
in ../../.
(gdb) print pPixmap
$4 = (PixmapPtr) 0x0
(gdb) print ((WindowPtr)
$6 = {ptr = 0x0, val = 0, uval = 0, fptr = 0}
(gdb)