Ubuntu
xorg-server package

Xorg crashed with SIGABRT in free()

Bug #1065113 reported by Para Siva on 2012-10-10

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	xorg-server (Ubuntu)	Fix Released	High	Bryce Harrington	Ubuntu quantal-updates
	Quantal	Fix Released	High	Bryce Harrington	Ubuntu quantal-updates

Bug Description

Occurred during screen reader testing for amd64 quantal 20121010 soon after the installer started

1. Start your machine with the install media in place
1.1 Wait to hear the drums
2. Press Ctrl+s to start the screen-reader
3. Press Alt+Tab to change to the installer
4. Press Up or Down arrow to select your language(default is English)
5. Press Tab once to "Try Ubuntu"
6. Press Enter
7. Wait for the Desktop to begin the installation.
8. Press Super+1 to begin the installation. Super is the left windows key

*** The crash occurred at this point

ProblemType: Crash
DistroRelease: Ubuntu 12.10
Package: xserver-xorg-core 2:1.13.0-0ubuntu6
ProcVersionSignature: Ubuntu 3.5.0-17.27-generic 3.5.5
Uname: Linux 3.5.0-17-generic x86_64
.tmp.unity.support.test.0:

ApportVersion: 2.6.1-0ubuntu2
Architecture: amd64
CasperVersion: 1.327
CompizPlugins: No value set for `/apps/compiz-1/general/screen0/options/active_plugins'
CompositorRunning: compiz
Date: Wed Oct 10 16:00:00 2012
DistUpgraded: Fresh install
DistroCodename: quantal
DistroVariant: ubuntu
ExecutablePath: /usr/bin/Xorg
ExtraDebuggingInterest: Yes
GraphicsCard:
Intel Corporation Core Processor Integrated Graphics Controller [8086:0046] (rev 18) (prog-if 00 [VGA controller])
Subsystem: Dell Device [1028:0456]
LiveMediaBuild: Ubuntu 12.10 "Quantal Quetzal" - Beta amd64 (20121010)
MachineType: Dell Inc. Inspiron N4010
ProcCmdline: X -br -ac -noreset -nolisten tcp -background none vt7 :0
ProcEnviron:
TERM=linux
PATH=(custom, no user)
LANG=en_US.UTF-8
ProcKernelCmdLine: file=/cdrom/preseed/hostname.seed boot=casper initrd=/casper/initrd.lz quiet splash -- maybe-ubiquity
Signal: 6
SourcePackage: xorg-server
StacktraceTop:
free () from /lib/x86_64-linux-gnu/libc.so.6
SrvXkbFreeServerMap ()
SrvXkbFreeKeyboard ()
XkbFreeInfo ()
?? ()
Title: Xorg crashed with SIGABRT in free()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups:

dmi.bios.date: 01/19/2011
dmi.bios.vendor: Dell Inc.
dmi.bios.version: A11
dmi.board.name: 021CN3
dmi.board.vendor: Dell Inc.
dmi.board.version: A11
dmi.chassis.type: 8
dmi.chassis.vendor: Dell Inc.
dmi.chassis.version: A11
dmi.modalias: dmi:bvnDellInc.:bvrA11:bd01/19/2011:svnDellInc.:pnInspironN4010:pvrA11:rvnDellInc.:rn021CN3:rvrA11:cvnDellInc.:ct8:cvrA11:
dmi.product.name: Inspiron N4010
dmi.product.version: A11
dmi.sys.vendor: Dell Inc.
version.compiz: compiz 1:0.9.8.4-0ubuntu2
version.ia32-libs: ia32-libs N/A
version.libdrm2: libdrm2 2.4.39-0ubuntu1
version.libgl1-mesa-dri: libgl1-mesa-dri 9.0-0ubuntu1
version.libgl1-mesa-dri-experimental: libgl1-mesa-dri-experimental N/A
version.libgl1-mesa-glx: libgl1-mesa-glx 9.0-0ubuntu1
version.xserver-xorg-core: xserver-xorg-core 2:1.13.0-0ubuntu6
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev 1:2.7.3-0ubuntu1
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:6.99.99~git20120913.8637f772-0ubuntu1
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.20.9-0ubuntu2
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:1.0.2-0ubuntu3

See original description

Tags:

Revision history for this message

Para Siva (psivaa) wrote on 2012-10-10:

BootDmesg.txt Edit (57.1 KiB, text/plain; charset="utf-8")
BootLog.txt Edit (2.9 KiB, text/plain; charset="utf-8")
CoreDump.gz Edit (792.0 KiB, application/x-gzip)
CurrentDmesg.txt Edit (1.8 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (3.8 KiB, text/plain; charset="utf-8")
Disassembly.txt Edit (854 bytes, text/plain; charset="utf-8")
DpkgLog.txt Edit (992.1 KiB, text/plain; charset="utf-8")
GconfCompiz.txt Edit (39.1 KiB, text/plain; charset="utf-8")
LightdmDisplayLog.txt Edit (2.1 KiB, text/plain; charset="utf-8")
LightdmLog.txt Edit (2.2 KiB, text/plain; charset="utf-8")
Lspci.txt Edit (25.0 KiB, text/plain; charset="utf-8")
Lsusb.txt Edit (730 bytes, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (3.3 KiB, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (2.1 KiB, text/plain; charset="utf-8")
ProcMaps.txt Edit (59.6 KiB, text/plain; charset="utf-8")
ProcModules.txt Edit (4.3 KiB, text/plain; charset="utf-8")
ProcStatus.txt Edit (757 bytes, text/plain; charset="utf-8")
Registers.txt Edit (716 bytes, text/plain; charset="utf-8")
Stacktrace.txt Edit (1.5 KiB, text/plain; charset="utf-8")
ThreadStacktrace.txt Edit (1.6 KiB, text/plain; charset="utf-8")
UdevDb.txt Edit (142.0 KiB, text/plain; charset="utf-8")
UdevLog.txt Edit (322.4 KiB, text/plain; charset="utf-8")
UnitySupportTest.txt Edit (608 bytes, text/plain; charset="utf-8")
XorgLog.txt Edit (31.1 KiB, text/plain; charset="utf-8")
XorgLogOld.txt Edit (49.6 KiB, text/plain; charset="utf-8")
Xrandr.txt Edit (3.4 KiB, text/plain; charset="utf-8")
xdpyinfo.txt Edit (9.7 KiB, text/plain; charset="utf-8")

visibility:	private → public
description:	updated

Apport retracing service (apport) on 2012-10-10

tags:

removed: need-amd64-retrace

Victor Zhou (victor.zhou) on 2012-10-11

tags:

added: rls-q-incoming

Revision history for this message

Sebastien Bacher (seb128) wrote on 2012-10-12:

Hey Bryce, could you have a look if that's a known issue, something that should be considered for quantal SRUing, the log has

[ 86.119] (EE) Backtrace:
[ 86.119] (EE) 0: X (xorg_backtrace+0x36) [0x7ff71f617ac6]
[ 86.119] (EE) 1: X (0x7ff71f46f000+0x1ac8f9) [0x7ff71f61b8f9]
[ 86.119] (EE) 2: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7ff71e795000+0xfcb0) [0x7ff71e7a4cb0]
[ 86.119] (EE) 3: /lib/x86_64-linux-gnu/libc.so.6 (cfree+0x1c) [0x7ff71d47c59c]
[ 86.119] (EE) 4: X (SrvXkbFreeServerMap+0x83) [0x7ff71f5e2ce3]
[ 86.120] (EE) 5: X (SrvXkbFreeKeyboard+0x16f) [0x7ff71f5df63f]
[ 86.120] (EE) 6: X (XkbFreeInfo+0xd9) [0x7ff71f5ce569]
[ 86.120] (EE) 7: X (0x7ff71f46f000+0x4a80c) [0x7ff71f4b980c]
[ 86.120] (EE) 8: X (0x7ff71f46f000+0x4ab12) [0x7ff71f4b9b12]
[ 86.120] (EE) 9: X (0x7ff71f46f000+0x4b1cc) [0x7ff71f4ba1cc]
[ 86.120] (EE) 10: X (0x7ff71f46f000+0x445dc) [0x7ff71f4b35dc]
[ 86.120] (EE) 11: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xed) [0x7ff71d41a76d]
[ 86.120] (EE) 12: X (0x7ff71f46f000+0x448ad) [0x7ff71f4b38ad]

Changed in xorg-server (Ubuntu Quantal):
assignee:	nobody → Bryce Harrington (bryce)
importance:	Undecided → High
tags:	removed: rls-q-incoming

Sebastien Bacher (seb128) on 2012-10-17

Changed in xorg-server (Ubuntu Quantal):
milestone:	none → quantal-updates

Maarten Lankhorst (mlankhorst) on 2012-10-17

Changed in xorg-server (Ubuntu Quantal):
status:	New → Confirmed

Revision history for this message

Maarten Lankhorst (mlankhorst) wrote on 2012-10-17:

Download full text (3.5 KiB)

And valgrind fun..

==25858== Conditional jump or move depends on uninitialised value(s)
==25858== at 0x1EBF32: compClipNotify (compwindow.c:304)
==25858== by 0x2A2C23: miComputeClips (mivaltree.c:489)
==25858== by 0x2A321C: miValidateTree (mivaltree.c:695)
==25858== by 0x1896EE: MapWindow (window.c:2594)
==25858== by 0x1EB15B: compCreateOverlayWindow (compoverlay.c:155)
==25858== by 0x1E9ABA: ProcCompositeGetOverlayWindow (compext.c:304)
==25858== by 0x15DA50: Dispatch (dispatch.c:428)
==25858== by 0x14C569: main (main.c:295)
==25858== Uninitialised value was created by a heap allocation
==25858== at 0x4C2B3F8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==25858== by 0x1ED4A3: compRedirectWindow (compalloc.c:172)
==25858== by 0x1EC142: compCreateWindow (compwindow.c:558)
==25858== by 0x18C56C: CreateWindow (window.c:801)
==25858== by 0x1EB0FF: compCreateOverlayWindow (compoverlay.c:145)
==25858== by 0x1E9ABA: ProcCompositeGetOverlayWindow (compext.c:304)
==25858== by 0x15DA50: Dispatch (dispatch.c:428)
==25858== by 0x14C569: main (main.c:295)
==25858==
==25858== Conditional jump or move depends on uninitialised value(s)
==25858== at 0x5B3BA0A: pixman_region_translate (in /usr/lib/x86_64-linux-gnu/libpixman-1.so.0.26.0)
==25858== by 0x1EBF41: compClipNotify (regionstr.h:306)
==25858== by 0x2A2C23: miComputeClips (mivaltree.c:489)
==25858== by 0x2A321C: miValidateTree (mivaltree.c:695)
==25858== by 0x1896EE: MapWindow (window.c:2594)
==25858== by 0x1EB15B: compCreateOverlayWindow (compoverlay.c:155)
==25858== by 0x1E9ABA: ProcCompositeGetOverlayWindow (compext.c:304)
==25858== by 0x15DA50: Dispatch (dispatch.c:428)
==25858== by 0x14C569: main (main.c:295)
==25858== Uninitialised value was created by a heap allocation
==25858== at 0x4C2B3F8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==25858== by 0x1ED4A3: compRedirectWindow (compalloc.c:172)
==25858== by 0x1EC142: compCreateWindow (compwindow.c:558)
==25858== by 0x18C56C: CreateWindow (window.c:801)
==25858== by 0x1EB0FF: compCreateOverlayWindow (compoverlay.c:145)
==25858== by 0x1E9ABA: ProcCompositeGetOverlayWindow (compext.c:304)
==25858== by 0x15DA50: Dispatch (dispatch.c:428)
==25858== by 0x14C569: main (main.c:295)
==25858==
==25858== Conditional jump or move depends on uninitialised value(s)
==25858== at 0x5B3BA8F: pixman_region_translate (in /usr/lib/x86_64-linux-gnu/libpixman-1.so.0.26.0)
==25858== by 0x1EBF41: compClipNotify (regionstr.h:306)
==25858== by 0x2A2C23: miComputeClips (mivaltree.c:489)
==25858== by 0x2A321C: miValidateTree (mivaltree.c:695)
==25858== by 0x1896EE: MapWindow (window.c:2594)
==25858== by 0x1EB15B: compCreateOverlayWindow (compoverlay.c:155)
==25858== by 0x1E9ABA: ProcCompositeGetOverlayWindow (compext.c:304)
==25858== by 0x15DA50: Dispatch (dispatch.c:428)
==25858== by 0x14C569: main (main.c:295)
==25858== Uninitialised value was created by a heap allocation
==25858== at 0x4C2B3F8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==25858== by 0x1ED4A3: compRedirectWind...

And valgrind fun..

==25858== Conditional jump or move depends on uninitialised value(s)
==25858==    at 0x1EBF32: compClipNotify (compwindow.c:304)
==25858==    by 0x2A2C23: miComputeClips (mivaltree.c:489)
==25858==    by 0x2A321C: miValidateTree (mivaltree.c:695)
==25858==    by 0x1896EE: MapWindow (window.c:2594)
==25858==    by 0x1EB15B: compCreateOverlayWindow (compoverlay.c:155)
==25858==    by 0x1E9ABA: ProcCompositeGetOverlayWindow (compext.c:304)
==25858==    by 0x15DA50: Dispatch (dispatch.c:428)
==25858==    by 0x14C569: main (main.c:295)
==25858==  Uninitialised value was created by a heap allocation
==25858==    at 0x4C2B3F8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==25858==    by 0x1ED4A3: compRedirectWindow (compalloc.c:172)
==25858==    by 0x1EC142: compCreateWindow (compwindow.c:558)
==25858==    by 0x18C56C: CreateWindow (window.c:801)
==25858==    by 0x1EB0FF: compCreateOverlayWindow (compoverlay.c:145)
==25858==    by 0x1E9ABA: ProcCompositeGetOverlayWindow (compext.c:304)
==25858==    by 0x15DA50: Dispatch (dispatch.c:428)
==25858==    by 0x14C569: main (main.c:295)
==25858== 
==25858== Conditional jump or move depends on uninitialised value(s)
==25858==    at 0x5B3BA0A: pixman_region_translate (in /usr/lib/x86_64-linux-gnu/libpixman-1.so.0.26.0)
==25858==    by 0x1EBF41: compClipNotify (regionstr.h:306)
==25858==    by 0x2A2C23: miComputeClips (mivaltree.c:489)
==25858==    by 0x2A321C: miValidateTree (mivaltree.c:695)
==25858==    by 0x1896EE: MapWindow (window.c:2594)
==25858==    by 0x1EB15B: compCreateOverlayWindow (compoverlay.c:155)
==25858==    by 0x1E9ABA: ProcCompositeGetOverlayWindow (compext.c:304)
==25858==    by 0x15DA50: Dispatch (dispatch.c:428)
==25858==    by 0x14C569: main (main.c:295)
==25858==  Uninitialised value was created by a heap allocation
==25858==    at 0x4C2B3F8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==25858==    by 0x1ED4A3: compRedirectWindow (compalloc.c:172)
==25858==    by 0x1EC142: compCreateWindow (compwindow.c:558)
==25858==    by 0x18C56C: CreateWindow (window.c:801)
==25858==    by 0x1EB0FF: compCreateOverlayWindow (compoverlay.c:145)
==25858==    by 0x1E9ABA: ProcCompositeGetOverlayWindow (compext.c:304)
==25858==    by 0x15DA50: Dispatch (dispatch.c:428)
==25858==    by 0x14C569: main (main.c:295)
==25858== 
==25858== Conditional jump or move depends on uninitialised value(s)
==25858==    at 0x5B3BA8F: pixman_region_translate (in /usr/lib/x86_64-linux-gnu/libpixman-1.so.0.26.0)
==25858==    by 0x1EBF41: compClipNotify (regionstr.h:306)
==25858==    by 0x2A2C23: miComputeClips (mivaltree.c:489)
==25858==    by 0x2A321C: miValidateTree (mivaltree.c:695)
==25858==    by 0x1896EE: MapWindow (window.c:2594)
==25858==    by 0x1EB15B: compCreateOverlayWindow (compoverlay.c:155)
==25858==    by 0x1E9ABA: ProcCompositeGetOverlayWindow (compext.c:304)
==25858==    by 0x15DA50: Dispatch (dispatch.c:428)
==25858==    by 0x14C569: main (main.c:295)
==25858==  Uninitialised value was created by a heap allocation
==25858==    at 0x4C2B3F8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==25858==    by 0x1ED4A3: compRedirectWindow (compalloc.c:172)
==25858==    by 0x1EC142: compCreateWindow (compwindow.c:558)
==25858==    by 0x18C56C: CreateWindow (window.c:801)
==25858==    by 0x1EB0FF: compCreateOverlayWindow (compoverlay.c:145)
==25858==    by 0x1E9ABA: ProcCompositeGetOverlayWindow (compext.c:304)
==25858==    by 0x15DA50: Dispatch (dispatch.c:428)
==25858==    by 0x14C569: main (main.c:295)

Revision history for this message

Bryce Harrington (bryce) wrote on 2012-10-23:

Thanks for the detail steps to reproduce. However, following these directions I'm unable to reproduce the crash.

Are you still seeing it in current quantal? If so, please collect a full backtrace on this crash - see http://wiki.ubuntu.com/X/Backtracing for guidance.

Changed in xorg-server (Ubuntu):
status:	Confirmed → Incomplete

Bryce Harrington (bryce) on 2012-10-24

Changed in xorg-server (Ubuntu Quantal):
status:	Confirmed → Incomplete

Revision history for this message

Para Siva (psivaa) wrote on 2012-10-24:

I have tried a few times today to reproduce this without success. I'll keep trying and would add the trace once i hit the bug.

Revision history for this message

Bryce Harrington (bryce) wrote on 2012-11-09:

Any luck so far the last couple weeks?

Revision history for this message

Para Siva (psivaa) wrote on 2012-11-13:

Tried with quantal final image and i could not reproduce this after more than 5 attempts.

Revision history for this message

Bryce Harrington (bryce) wrote on 2012-11-13:

Thanks for following up. At this point let's assume the bug is fixed.

Changed in xorg-server (Ubuntu Quantal):
status:	Incomplete → Fix Released
Changed in xorg-server (Ubuntu):
status:	Incomplete → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Bug attachments

Add attachment

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntuxorg-server package

Xorg crashed with SIGABRT in free()

Bug Description

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
xorg-server package