Ubuntu
xorg-server package

Xvfb crashes with SIGSEGV in FreeColormap()

Bug #330052 reported by Adam Dickmeiss on 2009-02-16

Affects		Status	Importance	Assigned to	Milestone
	xorg-server (Ubuntu)	Invalid	High	Unassigned

Bug Description

Binary package hint: xvfb

adam@durum:~$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=8.10
DISTRIB_CODENAME=intrepid
DISTRIB_DESCRIPTION="Ubuntu 8.10"
adam@durum:~$ apt-cache policy xvfb
xvfb:
  Installed: 2:1.5.2-2ubuntu3
  Candidate: 2:1.5.2-2ubuntu3
  Version table:
*** 2:1.5.2-2ubuntu3 0
        500 http://dk.archive.ubuntu.com intrepid/main Packages
        100 /var/lib/dpkg/status

adam@durum:~$ echo localhost >hosts
adam@durum:~$ Xvfb :1 -auth hosts
Could not init font path element /usr/share/fonts/X11/cyrillic, removing from list!
(EE) config/hal: NewInputDeviceRequest failed
(EE) config/hal: NewInputDeviceRequest failed
(EE) config/hal: NewInputDeviceRequest failed
Segmentation fault
adam@durum:~$

The crash happens when an X client is shut down.. For example, when xeyes is shut down with Control-C.

adam@durum:~$ xeyes -display :1
^C

GDB session:

Starting program: /usr/bin/Xvfb :1 -auth hosts
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
[Thread debugging using libthread_db enabled]
(no debugging symbols found)
(no debugging symbols found)
[New Thread 0x7f677e5d06f0 (LWP 32363)]
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
Could not init font path element /usr/share/fonts/X11/cyrillic, removing from list!
(EE) config/hal: NewInputDeviceRequest failed
(EE) config/hal: NewInputDeviceRequest failed
(EE) config/hal: NewInputDeviceRequest failed

Program received signal SIGSEGV, Segmentation fault.
---Type <return> to continue, or q <return> to quit---
[Switching to Thread 0x7f677e5d06f0 (LWP 32363)]
0x0000000000507665 in FreeColormap ()
(gdb) bt
#0 0x0000000000507665 in FreeColormap ()
#1 0x000000000052a1cb in FreeClientResources ()
#2 0x000000000052a2b4 in FreeAllResources ()
#3 0x0000000000526adb in main ()
(gdb)

[lspci]
00:00.0 Host bridge [0600]: Intel Corporation Mobile PM965/GM965/GL960 Memory Controller Hub [8086:2a00] (rev 0c)
Subsystem: Lenovo Device [17aa:20b1]
01:00.0 VGA compatible controller [0300]: nVidia Corporation Quadro NVS 140M [10de:0429] (rev a1)
Subsystem: Lenovo Device [17aa:20d8]

See original description

Tags:

Revision history for this message

Adam Dickmeiss (adam-indexdata) wrote on 2009-02-16:

If I specify a screen the crash does not occur.

Xvfb :1 -auth hosts -screen 0 800x600x24

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-03-05:

Hi adam-indexdata,

Please attach the output of `lspci -vvnn`, and attach your /var/log/Xorg.0.log (and maybe Xorg.0.log.old) file from after reproducing this issue. If you've made any customizations to your /etc/X11/xorg.conf please attach that as well.

Could you please collect a full backtrace from when this crash occurs? Directions on collecting full backtraces are at https://wiki.ubuntu.com/X/Backtracing

[This is an automated message. Apologies if it has reached you inappropriately; please just reply to this message indicating so.]

Changed in xorg-server:
status:	New → Incomplete

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-03-19:

Please collect a 'bt full' on this issue. The 'bt' alone doesn't provide the variable values.

Changed in xorg-server (Ubuntu):
importance:	Undecided → High

Revision history for this message

Adam Dickmeiss (adam-indexdata) wrote on 2009-03-20:

lspci -vvnn Edit (17.1 KiB, text/plain)

Program received signal SIGSEGV, Segmentation fault.
---Type <return> to continue, or q <return> to quit---
[Switching to Thread 0x7facb72e46f0 (LWP 7931)]
0x0000000000507665 in FreeColormap ()
(gdb) bt full
#0 0x0000000000507665 in FreeColormap ()
No symbol table info available.
#1 0x000000000052a1cb in FreeClientResources ()
No symbol table info available.
#2 0x000000000052a2b4 in FreeAllResources ()
No symbol table info available.
#3 0x0000000000526adb in main ()
No symbol table info available.
(gdb)

Revision history for this message

Adam Dickmeiss (adam-indexdata) wrote on 2009-03-20:

/etc/X11/xort.conf Edit (1.1 KiB, text/plain)

xserver configuration

Bryce Harrington (bryce) on 2009-04-07

summary:

- Xvfb crashes with SIGSEGV
+ Xvfb crashes with SIGSEGV in FreeColormap()

Bryce Harrington (bryce) on 2009-04-21

description:

updated

Revision history for this message

WangLu (coolwanglu) wrote on 2009-05-09:

also confirmed in a 64-bit ubuntu 9.04
(however, this didn't happen on a 32-bit ubuntu 9.04)

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-08-12:

Unfortunately there still is not enough information in the backtrace to troubleshoot this bug; please follow the directions at http://wiki.ubuntu.com/X/Backtracing to collect a full backtrace.

Changed in xorg-server (Ubuntu):
status:	Incomplete → New
status:	New → Incomplete

Bryce Harrington (bryce) on 2009-08-13

tags:

added: intrepid

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-09-12:

We're closing this bug since it is has been some time with no response from the original reporter. However, if the issue still exists please feel free to reopen with the requested information. Also, if you could, please test against the latest development version of Ubuntu, since this confirms the bug is one we may be able to pass upstream for help.

Changed in xorg-server (Ubuntu):
status:	Incomplete → Invalid

Revision history for this message

Adam Dickmeiss (adam-indexdata) wrote on 2009-09-15:

The problem still exists and has been reported by others..
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529927

Revision history for this message

Adam Dickmeiss (adam-indexdata) wrote on 2009-09-16:

#10

Valgrind output Edit (4.6 KiB, text/plain)

Compiled xvfb (2:1.6.0-0ubuntu14) from deb sources but with debugging enabled and no stripping..

adam@durum:~/xvfb$ diff rules xorg-server-1.6.0/debian/rules
16c16
< CFLAGS += -O0
---
> CFLAGS += -O2
181c181
< # dh_strip -s --dbg-package=xserver-xorg-core
---
> dh_strip -s --dbg-package=xserver-xorg-core

In console 1:
valgrind Xvfb -auth hosts :1
In console 2:
xeyes -display :1

Revision history for this message

Adam Dickmeiss (adam-indexdata) wrote on 2009-09-16:

#11

Download full text (5.9 KiB)

valgrind output shows that the immediate problem is that xrealloc in glx/glxscreen.c:276 causes some colormaps to have a bad pVisual member.. That is : some colormaps STILL point to the old memory .. In other words.. not all colormaps gets fixed up in AddScreenVisuals. Here is a gdb session where we track the colormaps created/destroyed.

adam@durum:~/xvfb$ gdb --args Xvfb -auth hosts :1
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu"...
(gdb) break colormap.c:279
Breakpoint 1 at 0x56db8c: file ../../dix/colormap.c, line 279.
(gdb) break FreeColormap
Breakpoint 2 at 0x56e2d1: file ../../dix/colormap.c, line 428.
(gdb) run
Starting program: /usr/bin/Xvfb -auth hosts :1
[Thread debugging using libthread_db enabled]
[New Thread 0x7f0639991710 (LWP 3767)]
[Switching to Thread 0x7f0639991710 (LWP 3767)]

Breakpoint 1, CreateColormap (mid=32, pScreen=0x2253800, pVisual=0x2253dc0,
    ppcmap=0x7fff419bba90, alloc=0, client=0) at ../../dix/colormap.c:279
279 if (!pmap)
(gdb) print pmap
$1 = (ColormapPtr) 0x2254e20
(gdb) bt
#0 CreateColormap (mid=32, pScreen=0x2253800, pVisual=0x2253dc0,
    ppcmap=0x7fff419bba90, alloc=0, client=0) at ../../dix/colormap.c:279
#1 0x00000000005cf8b2 in miCreateDefColormap (pScreen=0x2253800)
    at ../../mi/micmap.c:318
#2 0x000000000056d551 in fbCreateDefColormap (pScreen=0x2253800)
    at ../../../fb/fbcmap_mi.c:91
#3 0x000000000042defc in vfbScreenInit (index=0, pScreen=0x2253800, argc=4,
    argv=0x7fff419bbd28) at ../../../hw/vfb/InitOutput.c:952
#4 0x00000000005a1199 in AddScreen (pfnInit=0x42db2b <vfbScreenInit>, argc=4,
    argv=0x7fff419bbd28) at ../../dix/main.c:702
#5 0x000000000042e0e3 in InitOutput (screenInfo=0x88a780, argc=4,
    argv=0x7fff419bbd28) at ../../../hw/vfb/InitOutput.c:1018
#6 0x00000000005a03b6 in main (argc=4, argv=0x7fff419bbd28,
    envp=0x7fff419bbd50) at ../../dix/main.c:315
(gdb) cont
Continuing.

Breakpoint 1, CreateColormap (mid=64, pScreen=0x2253800, pVisual=0x2253df8,
    ppcmap=0x2254238, alloc=0, client=0) at ../../dix/colormap.c:279
279 if (!pmap)
(gdb) print pmap
$2 = (ColormapPtr) 0x2265d90
(gdb) bt
#0 CreateColormap (mid=64, pScreen=0x2253800, pVisual=0x2253df8,
    ppcmap=0x2254238, alloc=0, client=0) at ../../dix/colormap.c:279
#1 0x00000000004ee198 in PictureInitIndexedFormat (pScreen=0x2253800,
    format=0x2254210) at ../../render/picture.c:417
#2 0x00000000004ee238 in PictureInitIndexedFormats (pScreen=0x2253800)
    at ../../render/picture.c:439
#3 0x00000000004ee28b in PictureFinishInit () at ../../render/picture.c:451
#4 0x00000000004f133c in RenderExtensionInit () at ../../render/render.c:244
#5 0x000000000042e41c in InitExtensions (argc=4, argv=0x7fff419bbd28)
    at ../../../mi/miinitext.c:457
#6 0x00000000005a03e1 in main (argc=4, argv=0x7fff419bbd28,
    envp=0x7fff419bbd50) at ../../dix/main.c:319
(gdb) cont
Cont...

adam@durum:~/xvfb$ gdb --args Xvfb  -auth hosts :1 
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu"...
(gdb) break colormap.c:279
Breakpoint 1 at 0x56db8c: file ../../dix/colormap.c, line 279.
(gdb) break FreeColormap
Breakpoint 2 at 0x56e2d1: file ../../dix/colormap.c, line 428.
(gdb) run
Starting program: /usr/bin/Xvfb -auth hosts :1
[Thread debugging using libthread_db enabled]
[New Thread 0x7f0639991710 (LWP 3767)]
[Switching to Thread 0x7f0639991710 (LWP 3767)]

Breakpoint 1, CreateColormap (mid=32, pScreen=0x2253800, pVisual=0x2253dc0, 
    ppcmap=0x7fff419bba90, alloc=0, client=0) at ../../dix/colormap.c:279
279	    if (!pmap)
(gdb) print pmap
$1 = (ColormapPtr) 0x2254e20
(gdb) bt
#0  CreateColormap (mid=32, pScreen=0x2253800, pVisual=0x2253dc0, 
    ppcmap=0x7fff419bba90, alloc=0, client=0) at ../../dix/colormap.c:279
#1  0x00000000005cf8b2 in miCreateDefColormap (pScreen=0x2253800)
    at ../../mi/micmap.c:318
#2  0x000000000056d551 in fbCreateDefColormap (pScreen=0x2253800)
    at ../../../fb/fbcmap_mi.c:91
#3  0x000000000042defc in vfbScreenInit (index=0, pScreen=0x2253800, argc=4, 
    argv=0x7fff419bbd28) at ../../../hw/vfb/InitOutput.c:952
#4  0x00000000005a1199 in AddScreen (pfnInit=0x42db2b <vfbScreenInit>, argc=4, 
    argv=0x7fff419bbd28) at ../../dix/main.c:702
#5  0x000000000042e0e3 in InitOutput (screenInfo=0x88a780, argc=4, 
    argv=0x7fff419bbd28) at ../../../hw/vfb/InitOutput.c:1018
#6  0x00000000005a03b6 in main (argc=4, argv=0x7fff419bbd28, 
    envp=0x7fff419bbd50) at ../../dix/main.c:315
(gdb) cont
Continuing.

Breakpoint 1, CreateColormap (mid=64, pScreen=0x2253800, pVisual=0x2253df8, 
    ppcmap=0x2254238, alloc=0, client=0) at ../../dix/colormap.c:279
279	    if (!pmap)
(gdb) print pmap
$2 = (ColormapPtr) 0x2265d90
(gdb) bt
#0  CreateColormap (mid=64, pScreen=0x2253800, pVisual=0x2253df8, 
    ppcmap=0x2254238, alloc=0, client=0) at ../../dix/colormap.c:279
#1  0x00000000004ee198 in PictureInitIndexedFormat (pScreen=0x2253800, 
    format=0x2254210) at ../../render/picture.c:417
#2  0x00000000004ee238 in PictureInitIndexedFormats (pScreen=0x2253800)
    at ../../render/picture.c:439
#3  0x00000000004ee28b in PictureFinishInit () at ../../render/picture.c:451
#4  0x00000000004f133c in RenderExtensionInit () at ../../render/render.c:244
#5  0x000000000042e41c in InitExtensions (argc=4, argv=0x7fff419bbd28)
    at ../../../mi/miinitext.c:457
#6  0x00000000005a03e1 in main (argc=4, argv=0x7fff419bbd28, 
    envp=0x7fff419bbd50) at ../../dix/main.c:319
(gdb) cont
Continuing.

Breakpoint 1, CreateColormap (mid=65, pScreen=0x2253800, pVisual=0x2253e30, 
    ppcmap=0x2254280, alloc=0, client=0) at ../../dix/colormap.c:279
279	    if (!pmap)
(gdb) print pmap
$3 = (ColormapPtr) 0x2271e50
(gdb) bt
#0  CreateColormap (mid=65, pScreen=0x2253800, pVisual=0x2253e30, 
    ppcmap=0x2254280, alloc=0, client=0) at ../../dix/colormap.c:279
#1  0x00000000004ee198 in PictureInitIndexedFormat (pScreen=0x2253800, 
    format=0x2254258) at ../../render/picture.c:417
#2  0x00000000004ee238 in PictureInitIndexedFormats (pScreen=0x2253800)
    at ../../render/picture.c:439
#3  0x00000000004ee28b in PictureFinishInit () at ../../render/picture.c:451
#4  0x00000000004f133c in RenderExtensionInit () at ../../render/render.c:244
#5  0x000000000042e41c in InitExtensions (argc=4, argv=0x7fff419bbd28)
    at ../../../mi/miinitext.c:457
#6  0x00000000005a03e1 in main (argc=4, argv=0x7fff419bbd28, 
    envp=0x7fff419bbd50) at ../../dix/main.c:319
(gdb) cont
Continuing.

Breakpoint 1, CreateColormap (mid=66, pScreen=0x2253800, pVisual=0x2253ed8, 
    ppcmap=0x2254310, alloc=0, client=0) at ../../dix/colormap.c:279
279	    if (!pmap)
(gdb) print pmap
$4 = (ColormapPtr) 0x227db00
(gdb) cont
Continuing.
[dix] Could not init font path element /usr/share/fonts/X11/cyrillic, removing from list!
(EE) config/hal: NewInputDeviceRequest failed (2)
(EE) config/hal: NewInputDeviceRequest failed (2)
(EE) config/hal: NewInputDeviceRequest failed (2)

Breakpoint 2, FreeColormap (value=0x2271e50, mid=65)
    at ../../dix/colormap.c:428
428	    ColormapPtr	pmap = (ColormapPtr)value;
(gdb) cont
Continuing.

Breakpoint 2, FreeColormap (value=0x2265d90, mid=64)
    at ../../dix/colormap.c:428
428	    ColormapPtr	pmap = (ColormapPtr)value;
(gdb) cont
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x000000000056e3d9 in FreeColormap (value=0x2265d90, mid=64)
    at ../../dix/colormap.c:454
454			if (--pent->co.shco.red->refcnt == 0)
(gdb) print *pmap
$5 = {pVisual = 0x2253df8, class = 1, pad0 = 0, pad1 = 0, mid = 64, pad2 = 0, 
  pScreen = 0x2253800, flags = 0, freeRed = 0, freeGreen = 0, freeBlue = 0, 
  numPixelsRed = 0x2268618, numPixelsGreen = 0x0, numPixelsBlue = 0x0, 
  clientPixelsRed = 0x2267e18, clientPixelsGreen = 0x0, 
  clientPixelsBlue = 0x0, red = 0x2265e18, green = 0x0, blue = 0x0, 
  devPriv = 0x0, devPrivates = 0x0}
(gdb) print *pmap->pVisual
$6 = {vid = 1919243129, class = 25974, bitsPerRGBValue = 21362, 
  ColormapEntries = 29300, nplanes = 28265, redMask = 33, 
  greenMask = 7307490906382814279, blueMask = 122485727655022, 
  offsetRed = 36273040, offsetGreen = 0, offsetBlue = 33}
(gdb)

Clearly pmap->pVisual is wrong. It's the three colormaps created in PictureInitIndexedFormat that are missed in the AddScreenVisuals function. One colormap seems OK.. Namely the first one created in miCreateDefColormap .

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Bug attachments

Add attachment

Remote bug watches

debbugs #529927
[done important upstream fixed-upstream] Edit

Bug watches keep track of this bug in other bug trackers.

Ubuntuxorg-server package

Xvfb crashes with SIGSEGV in FreeColormap()

Bug Description

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
xorg-server package