Comment 28 for bug 1007588

Revision history for this message
Chris Coulson (chrisccoulson) wrote :

Ok, with some help from mterry who is able to reproduce this quite easily, it looks like we've determined that what happens is something in set_disable_w_typing() writes 0x0 to the %ebx register and doesn't restore its original contents (%ebx must be preserved by the callee as per the SysV i386 ABI).

As %ebx is used to hold the base address of the GOT on i386, the next call which goes via the PLT (which happens to be gdk_device_manager_list_devices) crashes when trying to read the address to jump to