xserver crash in CopyKeyClass when key press when vnc'ing into jaunty desktop

[Philip Wyett]

Binary package hint: vino

Symptom:

When accessing a jaunty desktop via vnc (remote desktop) it will crash and not allow further access.

From an Ubuntu 8.04.1 machine mouse input ok, but crash occurs when a key is pressed.
From Windows the crash will auto occur about 3 seconds after connection is established.

Reproduce:

* Install jaunty with updates to 5:30am GMT 2009-01-08.
* Setup Remote Desktop on jaunty machine.
* Access jaunty machine from another Ubuntu machine.
* Once desktop appears hit any key while window has focus.

What is happening:

A crash occurs and vnc connection is lost and cannot be immediately reestablished.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb7aa38d0 (LWP 3207)]
CopyKeyClass (device=0x98de7f0, master=0x0) at ../../Xi/exevents.c:201
201 ../../Xi/exevents.c: No such file or directory.
 in ../../Xi/exevents.c
(gdb) bt full
#0 CopyKeyClass (device=0x98de7f0, master=0x0) at ../../Xi/exevents.c:201
 mk = (KeyClassPtr) 0x9a05330
 dk = (KeyClassPtr) 0x98e5588
 i = <value optimized out>
 lastMapNotifyDevice = (DeviceIntPtr) 0x0
#1 0x08111fe7 in mieqProcessInputEvents () at ../../mi/mieq.c:361
 handler = (mieqHandler) 0
 e = (EventRec *) 0x81ef140
 type = 78
 nevents = 1
 i = <value optimized out>
 screen = (ScreenPtr) 0x97c7d00
 event = (xEvent *) 0x9a05330
 master_event = (xEvent *) 0x0
 dev = (DeviceIntPtr) 0x98de7f0
 master = (DeviceIntPtr) 0x0
#2 0x080c69c7 in ProcessInputEvents ()
    at ../../../../hw/xfree86/common/xf86Events.c:174
 x = 135031225
 y = 161752344
#3 0x0808ccf6 in Dispatch () at ../../dix/dispatch.c:399
 result = 0
 client = (ClientPtr) 0x9a42518
---Type <return> to continue, or q <return> to quit---
 nready = 0
 start_tick = 40
#4 0x08071aad in main (argc=10, argv=0xbfb8f0d4, envp=Cannot access memory at address 0x8
)
    at ../../dix/main.c:383
 i = <value optimized out>
 alwaysCheckForInput = {0, 1}
(gdb)

What should happen:

No crashes. ;-)

Additional info:

Looks like an x crash. I have this in my syslog:

Jan 8 05:32:31 wyett-pearl gdm[3181]: WARNING: gdm_slave_xioerror_handler: Fatal X error - Restarting :0
Jan 8 05:32:31 wyett-pearl console-kit-daemon[2967]: WARNING: Unable to activate console: No such device or address
Jan 8 05:32:31 wyett-pearl bonobo-activation-server (philip-3946): could not associate with desktop session: Failed to connect to socket /tmp/dbus-afsseAjdIh: Connection refused
Jan 8 05:32:32 wyett-pearl acpid: client connected from 3993[0:0]
Jan 8 05:32:34 wyett-pearl gdmgreeter[4008]: Gtk-WARNING: Unable to locate theme engine in module_path: "ubuntulooks",

Restarting gdm does allow you to access jaunty desktop again to begin the crash cycle once more.

[Sebastien Bacher (seb128)]

xorg-server crashing is an xorg-server bug, whatever the user software do the server should stay there

[Bryce Harrington (bryce)]

[This is an automated message]

Hi philipwyett,

Please attach the output of `lspci -vvnn`, and attach your /var/log/Xorg.0.log file from after reproducing this issue. If you've made any customizations to your /etc/X11/xorg.conf please attach that as well.

Please attach the output of `lspci -vvnn` too.

[Philip Wyett (philwyett)]

Quirk info
======

* This is a system with no monitor attached at this time.
* xorg.conf is empty.

[Bryce Harrington (bryce)]

Thanks for the excellent bug report! We've had other reports of crashes in CopyKeyClass (and have a patch pending inclusion from upstream), perhaps this is the same bug.

[Bryce Harrington (bryce)]

Yep, this seems to be a dupe of 309785. Thanks for the backtrace, that made it easy to confirm it's the same issue.