Xorg crashed with SIGSEGV in miCompositeRects()

[Mikael Nilsson]

Completely unpredictable, but reoccurring crash. Nvidia GeForce Go7900GTX, Jaunty up to date.

ProblemType: Crash
Architecture: i386
CrashCounter: 1
DistroRelease: Ubuntu 9.04
ExecutablePath: /usr/bin/Xorg
NonfreeKernelModules: nvidia
Package: xserver-xorg-core 2:1.5.99.902-0ubuntu7
ProcAttrCurrent: unconfined
ProcCmdline: /usr/X11R6/bin/X :0 -br -audit 0 -auth /var/lib/gdm/:0.Xauth -nolisten tcp vt7
ProcEnviron:
 LANGUAGE=sv_SE:sv:en_GB:en
 PATH=(custom, no user)
 LANG=sv_SE.UTF-8
ProcVersion: Linux version 2.6.28-8-generic (buildd@vernadsky) (gcc version 4.3.3 (Ubuntu 4.3.3-3ubuntu5) ) #24-Ubuntu SMP Wed Feb 18 18:48:55 UTC 2009

#0 0xb7bcfb18 in _int_malloc () from /lib/tls/i686/cmov/libc.so.6
#1 0xb7bd19c5 in malloc () from /lib/tls/i686/cmov/libc.so.6
#2 0x081382f9 in Xalloc (amount=1) at ../../os/utils.c:1054
 ptr = (void *) 0xffffff
#3 0x0818d617 in XIChangeDeviceProperty (dev=0x9b52160, property=89,
    type=19, format=8, mode=0, len=1, value=0xbf9c6bdb, sendevent=1)
    at ../../Xi/xiproperty.c:152
 prop = (XIPropertyPtr) 0x9b52098
 event = {type = 0 '\0', state = 148 '\224', sequenceNumber = 47098,
  time = 29, atom = 51, pad0 = 3226337280, pad1 = 123, pad2 = 123,
  pad3 = 134549044, pad5 = 26, pad4 = 0 '\0', deviceid = 0 '\0'}
 size_in_bytes = <value optimized out>
 total_len = <value optimized out>
 new_value = {type = 19, format = 8, size = 1, data = 0x9b009b0}
 add = 0
 rc = <value optimized out>
#4 0x08085d07 in DisableDevice (dev=0x9b52160) at ../../dix/devices.c:412
 prev = (DeviceIntPtr *) 0x9afa74c
 other = (DeviceIntPtr) 0x9b52160
 dummyDev = {public = {devicePrivate = 0xb7cd92a8,
    processInputProc = 0, realInputProc = 0, enqueueInputProc = 0xbcc1e74,
    on = 0}, next = 0xb7cccce0, startup = -1208193036,
  deviceProc = 0x97a9994, inited = 3, enabled = -1080268236,
  coreEvents = -1208274771, deviceGrab = {grabTime = {months = 3083652324,
      milliseconds = 3214699056}, fromPassiveGrab = 26, implicitGrab = 0,
    activeGrab = {next = 0xb7cc8f60, resource = 3086757960,
      device = 0xbf9c6a00, window = 0xb7cc1094, ownerEvents = 1,
      keyboardMode = 0, pointerMode = 0, coreGrab = 0, coreMods = 1,
      type = 192 'À', modifiersDetail = {exact = 16384, pMask = 0x2eb600},
      modifierDevice = 0x23, detail = {exact = 48440, pMask = 0xb7f6ba2c},
      confineTo = 0xb7ccccd4, cursor = 0xb7ccc8d0, eventMask = 0,
      deviceMask = 0, genericMasks = 0x1}, grab = 0x84,
    activatingKey = 0 '\0', ActivateGrab = 0xb7f84000,
    DeactivateGrab = 0xb7cc23d6, sync = {frozen = -1208561240,
      state = -1211361148, other = 0x1, event = 0xb7fc6ff4,
      evcount = 97959953}}, isMaster = -1211263904, type = 3214699296,
  name = 0xb7fb32bf "\203ø", id = 16 '\020', key = 0xb7cc1884,
  valuator = 0xbf9c6b04, button = 0xb7fc77cc, focus = 0x0, proximity = 0x0,
  absolute = 0x1, kbdfeed = 0x0, ptrfeed = 0x1, intfeed = 0xb7cd92a8,
  stringfeed = 0x24, bell = 0x0, leds = 0x0, xkb_interest = 0xb7fc7020,
  config_info = 0xb7cc1000 <Address 0xb7cc1000 out of bounds>,
  devPrivates = 0xbf9c6b10, nPrivates = -1080268028, unwrapProc = 0xb7b60006,
  spriteInfo = 0x24, u = {master = 0x0, lastSlave = 0x0}, last = {
    valuators = {-1211327810, -1211466215, -1211358250, 0, 0, 50331648, 0,
      136197572, -1211305996, 136197572, 136197564, -1080267960, -1211324890,
      136197576, -1080267980, 1047, -1080267864, 135479706, 27028960,
      134512948, 134512884, 134512820, 1, 925907042, 828519985, 134512640,
      -1211305672, -1211421696, -1211469056, -1211305696, 136197576,
      135479706, 0, 0, 0, 0}, remainder = {0, -2.94746642e-05, 0,
      3.32051684e-41, 0, 1.40129846e-45, 1.40129846e-45, 4.76096518e-34,
      -2.42963215e-05, -2.24977339e-05, 0, -1.22203541, -2.42963215e-05,
      -nan(0x7fffff), -1.22202969, -2.25073873e-05, -1.22203302,
      1.96141209e-32, -nan(0x7fffff), -2.21544087e-05, -2.42963215e-05,
      1.96141209e-32, -1.22203302, -1.22205353, -2.24118339e-05, -1.22203302,
      -2.40840673e-05, -1.22206116, 1.96141209e-32, 0, -1.80172717e+36,
      1.96141209e-32, 1.96141209e-32, 1.96141209e-32, 1.96141209e-32,
      1.96141621e-32}, numValuators = -1}, properties = {
    properties = 0xacbaf47, handlers = 0xffffffff}}
 ev = {type = 0 '\0', pad00 = 0 '\0', sequenceNumber = 0, time = 0,
  devchange = 0 '\0', deviceid = 0 '\0', control = 0, pad02 = 0, pad03 = 0,
  pad04 = 0, pad05 = 0, pad06 = 181120304}
 enabled = 0 '\0'

[lspci]
00:00.0 Host bridge [0600]: Intel Corporation Mobile 945GM/PM/GMS, 943/940GML and 945GT Express Memory Controller Hub [8086:27a0] (rev 03)
     Subsystem: Dell Device [1028:01ce]
01:00.0 VGA compatible controller [0300]: nVidia Corporation GeForce Go 7900 GTX [10de:0299] (rev a1)
     Subsystem: Dell Device [1028:019b]

[Apport retracing service (apport)]

StacktraceTop:damageRegionProcessPending (pDrawable=0xaa07290)
damagePolyFillRect (pDrawable=0xaa07290, pGC=0x9852b80,
miColorRects (pDst=0xaf33338, pClipPict=0xaf33338,
miCompositeRects (op=3 '\003', pDst=0xaf33338,
CompositeRects (op=3 '\003', pDst=0xaf33338,

[Bryce Harrington (bryce)]

Hi mini,

Could you please collect a full backtrace from when this crash occurs? Directions on collecting full backtraces are at https://wiki.ubuntu.com/X/Backtracing

[This is an automated message. Apologies if it has reached you inappropriately; please just reply to this message indicating so.]

[Bryce Harrington (bryce)]

 ptr = (void *) 0xffffff

probably due to len=1 (-> amount=1)

[Bryce Harrington (bryce)]

amount=1 seems to return a valid pointer for me.

[Bryce Harrington (bryce)]

Maybe this is just some wonky -nvidia proprietary driver madness. Refiling.

[Mikael Nilsson (mini)]

It could very well be just nvidia. Recent upgrades have apparently eliminated the crash. I can no longer reproduce it on jaunty.

/Mikael

[Bryce Harrington (bryce)]

[This is an automated message]

In Jaunty (9.04), we have just updated to the latest
nvidia-graphics-drivers-180 package from nVidia, version 180.44.

This package provides fixes for a large number of bugs, and we need your
assistance in testing if it fixes the issue you reported.

To do this, please do the following:

 a. Update to the 180.44 version of -nvidia using your favorite update
     method

 b. Attempt to reproduce your bug

 c. If your bug still remains, please simply reply to this email
     indicating so.

 d. If your bug is now solved, you can help us by setting your bug
     report to Fix Released:
     * In launchpad, go to your bug report
     * Click on the downward pointing arrow under Status
     * Set the Status field to 'Fix Released'
     * Comment on the change, such as, 'Verified fixed in 180.44'
     * Click 'Save Changes'

 e. If the original problem is solved but there are now other problems,
     please close the original bug and open new ones for those issues.

Thank you!

For details on the changes in this version of -nvidia, please see:

   http://www.nvidia.com/object/linux_display_ia32_180.44.html