[RC410] Xorg assert failure: double free or corruption (fasttop): 0x092447a8 called from RADEONFreeRec()

[RdeWit]

X.org very often (multiple times a day) either freezes or restarts (or even system restart) and I cannot find the cause. I hope this bug report helps in determining the cause of this nuisance.

Thread 1 (process 1502):
#0 0x004dd422 in __kernel_vsyscall ()
No symbol table info available.
#1 0x001814d1 in *__GI_raise (sig=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
 resultvar = <value optimized out>
 pid = 2715636
 selftid = 1502
#2 0x00184932 in *__GI_abort () at abort.c:92
 act = {__sigaction_handler = {sa_handler = 0x805,
    sa_sigaction = 0x805}, sa_mask = {__val = {3220443204, 2464824, 11293284,
      917504, 134786576, 134608144, 0, 55133, 3220443352, 134556080,
      134536368, 2053, 11294320, 2210417, 2053, 134786576, 3220443280,
      2715636, 10, 3220444736, 3220443396, 2327956, 2, 3220443280, 4, 0, 3,
      3220443388, 2, 2589411, 2589407, 2584983}}, sa_flags = 2584957,
  sa_restorer = 0x27962b}
 sigs = {__val = {32, 0 <repeats 31 times>}}
#3 0x001b7ee5 in __libc_message (do_abort=2,
    fmt=0x27b438 "*** glibc detected *** %s: %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
 ap = <value optimized out>
 fd = -1074523588
 on_2 = <value optimized out>
 list = <value optimized out>
 nlist = <value optimized out>
 cp = <value optimized out>
 written = false
#4 0x001c1ff1 in malloc_printerr (action=<value optimized out>,
    str=0x6 <Address 0x6 out of bounds>, ptr=0x92447a8) at malloc.c:6217
 buf = "092447a8"
 cp = <value optimized out>
#5 0x001c36f2 in _int_free (av=<value optimized out>,
    p=<value optimized out>) at malloc.c:4750
 size = 0
 nextchunk = (mchunkptr) 0x5de
 nextsize = 56
 prevsize = <value optimized out>
 bck = <value optimized out>
 fwd = <value optimized out>
 errstr = 0x6 <Address 0x6 out of bounds>
 __PRETTY_FUNCTION__ = "_int_free"
#6 0x001c679d in *__GI___libc_free (mem=0x92447a8) at malloc.c:3716
 ar_ptr = (mstate) 0x2983a0
 p = (mchunkptr) 0x6
#7 0x08137a21 in Xfree ()
No symbol table info available.
#8 0x007a49f8 in RADEONFreeRec (pScrn=0x9231cd0)
    at ../../src/radeon_driver.c:390
 i = 2
#9 0x007a74d0 in RADEONPreInit (pScrn=0x9231cd0, flags=0)
    at ../../src/radeon_driver.c:3155
 info = (RADEONInfoPtr) 0x9242690
 pInt10 = (xf86Int10InfoPtr) 0x92446a8
 int10_save = (void *) 0x0
 s = <value optimized out>
 pRADEONEnt = (RADEONEntPtr) 0x9232658
 pPriv = (DevUnion *) 0x0
#10 0x080b05b9 in InitOutput ()
No symbol table info available.
#11 0x0807234b in main ()
No symbol table info available.

ProblemType: Crash
Architecture: i386
AssertionMessage: *** glibc detected *** /usr/bin/X: double free or corruption (fasttop): 0x092447a8 ***
Date: Wed Dec 30 15:53:03 2009
DistroRelease: Ubuntu 9.10
ExecutablePath: /usr/bin/Xorg
Lsusb:
 Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
 Bus 002 Device 002: ID 046d:08d7 Logitech, Inc. QuickCam Communicate STX
 Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
 Bus 003 Device 002: ID 045e:009d Microsoft Corp.
 Bus 003 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
MachineType: HP Pavilion 061 RC621AA-ABG s7545a
Package: xserver-xorg-core 2:1.6.4-2ubuntu4.1
ProcCmdLine: root=UUID=01ddfb21-9e0e-418e-8140-ea58f9306edb ro quiet splash
ProcCmdline: /usr/bin/X :1 -br -verbose -auth /var/run/gdm/auth-for-gdm-wqvJH0/database -nolisten tcp
ProcEnviron:
 LANG=en_AU.UTF-8
 PATH=(custom, no user)
 LANGUAGE=en_AU:en
ProcVersionSignature: Ubuntu 2.6.31-17.54-generic
RelatedPackageVersions:
 xserver-xorg 1:7.4+3ubuntu10
 libgl1-mesa-glx 7.6.0-1ubuntu4
 libdrm2 2.4.14-1ubuntu1
 xserver-xorg-video-intel 2:2.9.0-1ubuntu2
 xserver-xorg-video-ati 1:6.12.99+git20090929.7968e1fb-0ubuntu1
Signal: 6
SourcePackage: xorg-server
StacktraceTop:
 __kernel_vsyscall ()
 raise () from /lib/tls/i686/cmov/libc.so.6
 abort () from /lib/tls/i686/cmov/libc.so.6
 ?? () from /lib/tls/i686/cmov/libc.so.6
 ?? () from /lib/tls/i686/cmov/libc.so.6
Title: Xorg assert failure: *** glibc detected *** /usr/bin/X: double free or corruption (fasttop): 0x092447a8 ***
Uname: Linux 2.6.31-17-generic i686
UserGroups:

XsessionErrors:
 (gnome-settings-daemon:31355): GLib-CRITICAL **: g_propagate_error: assertion `src != NULL' failed
 (gnome-settings-daemon:31355): GLib-CRITICAL **: g_propagate_error: assertion `src != NULL' failed
 (nautilus:31431): Eel-CRITICAL **: eel_preferences_get_boolean: assertion `preferences_is_initialized ()' failed
 (polkit-gnome-authentication-agent-1:31480): GLib-CRITICAL **: g_once_init_leave: assertion `initialization_value != 0' failed
dmi.bios.date: 07/12/2006
dmi.bios.vendor: Phoenix Technologies, LTD
dmi.bios.version: 3.01
dmi.board.name: MAGNETITE
dmi.board.vendor: ASUSTeK Computer INC.
dmi.board.version: 1.02
dmi.chassis.asset.tag: 123456789000
dmi.chassis.type: 3
dmi.chassis.vendor: ASUS
dmi.chassis.version: Chassis Version
dmi.modalias: dmi:bvnPhoenixTechnologies,LTD:bvr3.01:bd07/12/2006:svnHPPavilion061:pnRC621AA-ABGs7545a:pvr0qm0104RE101MAGNE00:rvnASUSTeKComputerINC.:rnMAGNETITE:rvr1.02:cvnASUS:ct3:cvrChassisVersion:
dmi.product.name: RC621AA-ABG s7545a
dmi.product.version: 0qm0104RE101MAGNE00
dmi.sys.vendor: HP Pavilion 061
fglrx: Not loaded
system:
 distro: Ubuntu
 architecture: i686kernel: 2.6.31-17-generic

[lspci]
01:05.0 VGA compatible controller [0300]: ATI Technologies Inc RC410 [Radeon Xpress 200M] [1002:5a62]
     Subsystem: Hewlett-Packard Company Device [103c:2a39]

[Apport retracing service (apport)]

StacktraceTop:__kernel_vsyscall ()
*__GI_raise (sig=6)
*__GI_abort () at abort.c:92
__libc_message (do_abort=2,
malloc_printerr (action=<value optimized out>,

[RdeWit (rdewit)]

An extra comment: the many crashes that I mentioned in my initial report have gone away after I replaced my memory modules.

This problem however has not ceased to exist and every once or twice a week I get no monitor input (at all) on startup of X (boot menu shows up fine) and need to reboot the computer.

After rebooting my apport tells me that Xorg had crashed, which is this bug.

[Pauli (paniemin)]

On Tue, Mar 2, 2010 at 12:35 PM, RdeWit <email address hidden> wrote:
> An extra comment: the many crashes that I mentioned in my initial report
> have gone away after I replaced my memory modules.
>
> This problem however has not ceased to exist and every once or twice a
> week I get no monitor input (at all) on startup of X (boot menu shows up
> fine) and need to reboot the computer.
>
> After rebooting my apport tells me that Xorg had crashed, which is this
> bug.
>

Can you try to collect valgrind report?

You need to install xserver-xorg-core-dbg and
xserver-xorg-video-radeon-dbg packages to get some debug symbols.

Then you can start valgrind session from console with:

sudo ls && sudo valgrind Xorg :1.0 &> /tmp/xorg.valgrind.log & sleep
15; export DISPLAY=:1.0; /etc/X11/Xsession

[RdeWit (rdewit)]

Hi Pauli,

When would I start this valgrind session? Just any time, just to collect information, immediately after the crash happens (logged in from another machine), after reboot (when back in X) or in some other way?

Please note that when my screen is blank, there is no monitor input (ie, no console visible). Sometimes a CTRL-ALT-DEL allows me to reboot, sometimes I need to use the infamous REISUB method.

[Pauli (paniemin)]

On Wed, Mar 3, 2010 at 11:23 PM, RdeWit <email address hidden> wrote:
> Hi Pauli,
>
> When would I start this valgrind session? Just any time, just to collect
> information, immediately after the crash happens (logged in from another
> machine), after reboot (when back in X) or in some other way?
>

Valgrind had to run from program start. So you need to start new
xserver to collect valgrind report. So you need to go to console and
stop current xserver (sudo stop gdm or sudo stop kdm)

> Please note that when my screen is blank, there is no monitor input (ie,
> no console visible). Sometimes a CTRL-ALT-DEL allows me to reboot,
> sometimes I need to use the infamous REISUB method.
>

Yes. When X goes bad there isn't much you can do to fix the graphics card state.

[Bryce Harrington (bryce)]

[This is an automatic notification.]

Hi RdeWit,

This bug was reported against an earlier version of Ubuntu, can you
test if it still occurs on Lucid?

Please note we also provide technical support for older versions of
Ubuntu, but not in the bug tracker. Instead, to raise the issue through
normal support channels, please see:

    http://www.ubuntu.com/support

If you are the original reporter and can still reproduce the issue on
Lucid, please run the following command to refresh the report:

  apport-collect 501551

If you are not the original reporter, please file a new bug report, so
we can work with you as the original reporter instead (you can reference
bug 501551 in your report if you think it may be related):

  ubuntu-bug xorg

If by chance you can no longer reproduce the issue on Lucid or if you
feel it is no longer relevant, please mark the bug report 'Fix Released'
or 'Invalid' as appropriate, at the following URL:

  https://bugs.launchpad.net/ubuntu/+bug/501551

[Bryce Harrington (bryce)]

We're closing this bug since it is has been some time with no response from the original reporter. However, if the issue still exists please feel free to reopen with the requested information. Also, if you could, please test against the latest development version of Ubuntu, since this confirms the bug is one we may be able to pass upstream for help.