Xorg server crashes when drawing dashed circles

[Romano Giannetti]

To reproduce:

install xfig (sudo apt-get install xfig)

open xfig --- then try to draw a circle with dashed line (choose the circle, select the dash line in the row below the main screen, click in the canvas to draw). The Xorg ser4ver crashes and You are back to login.

The first time it happened apport created a report, but then did not open the browser to submit it --- so I am sending this by hand; will attach the report if I can (it's 12M compressed). I am attaching a version without core dump, ask me if you need the full one.

It could be related to bad rendering of filled area: https://bugs.launchpad.net/bugs/1177535
Or maybe a regression: https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/553647

All the data in the attached file; nevertheless, this is a -intel driver. Ubuntu 13.04 with gnome-shell.

Thanks
---
.tmp.unity.support.test.0:

ApportVersion: 2.9.2-0ubuntu8
Architecture: amd64
CompizPlugins: No value set for `/apps/compiz-1/general/screen0/options/active_plugins'
CompositorRunning: None
DistUpgraded: 2013-05-01 12:26:11,977 DEBUG enabling apt cron job
DistroCodename: raring
DistroRelease: Ubuntu 13.04
DistroVariant: ubuntu
DkmsStatus:
 vboxhost, 4.2.12, 3.8.0-21-generic, x86_64: installed
 vboxhost, 4.2.12, 3.8.0-22-generic, x86_64: installed
ExtraDebuggingInterest: Yes, if not too technical
GraphicsCard:
 Intel Corporation Xeon E3-1200 v2/3rd Gen Core processor Graphics Controller [8086:0152] (rev 09) (prog-if 00 [VGA controller])
   Subsystem: Gigabyte Technology Co., Ltd Device [1458:d000]
InstallationDate: Installed on 2012-12-15 (162 days ago)
InstallationMedia: Ubuntu 12.10 "Quantal Quetzal" - Release amd64 (20121017.5)
MachineType: Gigabyte Technology Co., Ltd. To be filled by O.E.M.
MarkForUpload: True
Package: xorg-server (not installed)
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-3.8.0-21-generic root=/dev/mapper/ubuntu-root ro quiet splash vt.handoff=7
ProcVersionSignature: Ubuntu 3.8.0-21.32-generic 3.8.8
Tags: raring ubuntu
Uname: Linux 3.8.0-21-generic x86_64
UpgradeStatus: Upgraded to raring on 2013-05-01 (25 days ago)
UserGroups: adm lpadmin sambashare sudo vboxusers
dmi.bios.date: 08/23/2012
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: F11
dmi.board.asset.tag: To be filled by O.E.M.
dmi.board.name: B75M-D3H
dmi.board.vendor: Gigabyte Technology Co., Ltd.
dmi.board.version: x.x
dmi.chassis.asset.tag: To Be Filled By O.E.M.
dmi.chassis.type: 3
dmi.chassis.vendor: Gigabyte Technology Co., Ltd.
dmi.chassis.version: To Be Filled By O.E.M.
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvrF11:bd08/23/2012:svnGigabyteTechnologyCo.,Ltd.:pnTobefilledbyO.E.M.:pvrTobefilledbyO.E.M.:rvnGigabyteTechnologyCo.,Ltd.:rnB75M-D3H:rvrx.x:cvnGigabyteTechnologyCo.,Ltd.:ct3:cvrToBeFilledByO.E.M.:
dmi.product.name: To be filled by O.E.M.
dmi.product.version: To be filled by O.E.M.
dmi.sys.vendor: Gigabyte Technology Co., Ltd.
version.compiz: compiz 1:0.9.9~daily13.04.18.1~13.04-0ubuntu1
version.ia32-libs: ia32-libs 20090808ubuntu36
version.libdrm2: libdrm2 2.4.43-0ubuntu1
version.libgl1-mesa-dri: libgl1-mesa-dri 9.1.1-0ubuntu3
version.libgl1-mesa-dri-experimental: libgl1-mesa-dri-experimental N/A
version.libgl1-mesa-glx: libgl1-mesa-glx 9.1.1-0ubuntu3
version.xserver-xorg-core: xserver-xorg-core 2:1.13.3-0ubuntu6
version.xserver-xorg-input-evdev: xserver-xorg-input-evdev 1:2.7.3-0ubuntu2b2
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:7.1.0-0ubuntu2
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.21.6-0ubuntu4
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:1.0.7-0ubuntu1
xserver.bootTime: Sun May 26 13:11:04 2013
xserver.configfile: default
xserver.errors:

xserver.logfile: /var/log/Xorg.0.log
xserver.version: 2:1.13.3-0ubuntu6
xserver.video_driver: intel

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[reia2k (barchies)]

I have the same problem with Ubuntu 13.04 (unity) 32 bit version. I found the same bug in Linux Mint 15 RC (cinnamon) 64 bit version.

[Dave Gilbert (ubuntu-treblig)]

Can you try an

apport-collect 1184085

after triggering it? In the hope it will include a full set of info.

(I tried triggering this on my Arch box running KDE on Intel and it doesn't trigger, so it's not as general as that)

From your logs:

 [ 409.670] (EE)
 [ 409.670] (EE) Backtrace:
 [ 409.671] (EE) 0: /usr/bin/X (xorg_backtrace+0x36) [0x7f3140341476]
 [ 409.671] (EE) 1: /usr/bin/X (0x7f3140191000+0x1b42b9) [0x7f31403452b9]
 [ 409.671] (EE) 2: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7f313f294000+0xfbd0) [0x7f313f2a3bd0]
 [ 409.671] (EE) 3: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7f313ca33000+0x412ae) [0x7f313ca742ae]
 [ 409.671] (EE) 4: /usr/bin/X (0x7f3140191000+0x1a356d) [0x7f314033456d]
 [ 409.671] (EE) 5: /usr/bin/X (0x7f3140191000+0x1a5b81) [0x7f3140336b81]
 [ 409.671] (EE) 6: /usr/bin/X (miWideDash+0x1564) [0x7f31403388d4]
 [ 409.671] (EE) 7: /usr/lib/xorg/modules/drivers/intel_drv.so (0x7f313ca33000+0x5f105) [0x7f313ca92105]
 [ 409.671] (EE) 8: /usr/bin/X (0x7f3140191000+0x13c33c) [0x7f31402cd33c]
 [ 409.671] (EE) 9: /usr/bin/X (0x7f3140191000+0x54ebc) [0x7f31401e5ebc]
 [ 409.671] (EE) 10: /usr/bin/X (0x7f3140191000+0x58ac1) [0x7f31401e9ac1]
 [ 409.671] (EE) 11: /usr/bin/X (0x7f3140191000+0x4757a) [0x7f31401d857a]
 [ 409.671] (EE) 12: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xf5) [0x7f313dee1ea5]
 [ 409.671] (EE) 13: /usr/bin/X (0x7f3140191000+0x478c1) [0x7f31401d88c1]
 [ 409.671] (EE)
 [ 409.671] (EE) Segmentation fault at address 0x0

[Dave Gilbert (ubuntu-treblig)]

High: High impact on small proportion of users (i.e. xfig users on Intel) -
   but I guess ther eis a chance that it could be a cause of other X crashes as well.

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

apport information

[Romano Giannetti (romano-giannetti)]

@Dave:
I managed to have a working apport-collect. It wasn't working because for whichever reason python-launchpadlib and python-launchpadlib-toolkit were not installed. It reported the bug of the last error, but spat out this:

(process:13190): GLib-CRITICAL **: g_slice_set_config: assertion `sys_page_size == 0' failed
dpkg-query: no packages found matching xorg-server
ERROR: hook /usr/share/apport/general-hooks/cloud_archive.py crashed:
Traceback (most recent call last):
  File "/usr/lib/python2.7/dist-packages/apport/report.py", line 197, in _run_hook
    symb['add_info'](report, ui)
  File "/usr/share/apport/general-hooks/cloud_archive.py", line 18, in add_info
    if '~cloud' in packaging.get_version(package) and \
  File "/usr/lib/python2.7/dist-packages/apport/packaging_impl.py", line 120, in get_version
    pkg = self._apt_pkg(package)
  File "/usr/lib/python2.7/dist-packages/apport/packaging_impl.py", line 115, in _apt_pkg
    raise ValueError('package %s does not exist' % package)
ValueError: package xorg-server does not exist

I will try now to trigger again the bug and restart the apport-collect again.

[Romano Giannetti (romano-giannetti)]

I can confirm that the bug *does NOT* occur in another machine with ATI card which uses the open-source radeon modules. In that machine, xfig works ok (no crashes and the solid color fill are ok). So it seems a intel-driver bug.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Chris Wilson (ickle)]

It's a bug in the core fb implementation of Xorg.

[Romano Giannetti (romano-giannetti)]

@Chris Wilson:
Sorry, didn't know. I supposed an -intel problem because my other PC (ATI radeon based) works ok.
Any hint on a possible fix/workaround? I know I am in a minority, but I use xfig quite a lot... :-(

[Chris Wilson (ickle)]

In the short term, Option "NoAccel" "true" will prevent that bug being hit.

[Romano Giannetti (romano-giannetti)]

Thanks --- although I suspect it will be tough on performance. Now the problem I have... it was in 2003 the last time I had to edit an xorg.conf file, and now I discovered it's not there anymore. I have seen a group of files in /ust/share/X11/xorg.conf.d/, but no idea on how and where to add that option...

[Romano Giannetti (romano-giannetti)]

@Chris: is there an upstream bug to link?
I hoped that the last update to X that entered this morning could have fixed it, but no, still here.

[Dave Gilbert (ubuntu-treblig)]

Is this https://bugs.freedesktop.org/show_bug.cgi?id=54013 ?

[Chris Wilson (ickle)]

Certainly looks related. I was thinking of the aliasing bug in miFillWideEllipse, but that is actually unlikely to be hit in your test case.

[penalvch (penalvch)]

Romano Giannetti, this bug was reported a while ago and there hasn't been any activity in it recently. We were wondering if this is still an issue? If so, could you please test for this with the latest development release of Ubuntu? ISO images are available from http://cdimage.ubuntu.com/daily-live/current/ .

If it remains an issue, could you please run the following command in the development release from a Terminal (Applications->Accessories->Terminal), as it will automatically gather and attach updated debug information to this report:

apport-collect -p xorg REPLACE-WITH-BUG-NUMBER

Please note, given that the information from the prior release is already available, doing this on a release prior to the development one would not be helpful.

Thank you for your understanding.

Helpful bug reporting tips:
https://wiki.ubuntu.com/ReportingBugs

[Romano Giannetti (romano-giannetti)]

I can confirm that the bug (both the badly rendered fill areas and the crash) still happens in my laptop with 13.04 (intel drivers) and still does not happen in one of my desktop with 13.04 (radeon open source drivers).

I am now downloading the test image of trusty to see if I am able to check for it; unfortunately I will be able to check only with the intel laptop (the desktop is half a planet away).

[Romano Giannetti (romano-giannetti)]

Short: fixed on Trusty Thar beta.

Long:
Tested on Trusty image as of today (2014-01-7), with versions:

    xfig 1:3.2.5.c-1ubuntu1
    unity 7.1.2+14.04.20131106.1-0ubuntu1
    xserver-xorg-video-intel 2:2.99.907-0ubuntu1

in this configuration I was *not* able to trigger the bug (neither the crash, neither the incorrect fill areas).
A backport of the fix would be great, but I understand that is quite improbable. Will wait (or use the beta releases, I'll see). Thanks to all involved.

[penalvch (penalvch)]

Romano Giannetti, thank you for taking the time to report this bug and helping to make Ubuntu better. However, I am closing it because as per https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/1184085/comments/43 the bug has been fixed in the latest development version of Ubuntu - Trusty Tahr.

This is a significant bug in Ubuntu. If you need a fix for the bug in previous versions of Ubuntu, please perform as much as possible of the SRU Procedure [1] to bring the need to a developer's attention.

[1]: https://wiki.ubuntu.com/StableReleaseUpdates#Procedure

[Romano Giannetti (romano-giannetti)]

PS: in Trusty xfig will core dump on exiting, though. But it seems unrelated.

[Romano Giannetti (romano-giannetti)]

Christopher M. Penalver, it seems fit to mark the bug closed (it is fixed).

About the SRU procedure, the problem is that I have no idea which patch / package release / update to which software caused the fix, so I am quite swamped by the SRU procedure posted.

The impact of this bug could be high (it can crash your machine if you have xfig installed and receive an email with an xfig attachment and preview it), but given that probably xfig is used by me and a couple more people, I am not sure it deserves a lot of developer love...

[Romano Giannetti (romano-giannetti)]

I can confirm that the bug is fixed in Trusty Thar 14.04.