Ubuntu

Xvfb crashes with SIGSEGV in FreeColormap()

Reported by Adam Dickmeiss on 2009-02-16
4
Affects Status Importance Assigned to Milestone
xorg-server (Ubuntu)
High
Unassigned

Bug Description

Binary package hint: xvfb

adam@durum:~$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=8.10
DISTRIB_CODENAME=intrepid
DISTRIB_DESCRIPTION="Ubuntu 8.10"
adam@durum:~$ apt-cache policy xvfb
xvfb:
  Installed: 2:1.5.2-2ubuntu3
  Candidate: 2:1.5.2-2ubuntu3
  Version table:
 *** 2:1.5.2-2ubuntu3 0
        500 http://dk.archive.ubuntu.com intrepid/main Packages
        100 /var/lib/dpkg/status

adam@durum:~$ echo localhost >hosts
adam@durum:~$ Xvfb :1 -auth hosts
Could not init font path element /usr/share/fonts/X11/cyrillic, removing from list!
(EE) config/hal: NewInputDeviceRequest failed
(EE) config/hal: NewInputDeviceRequest failed
(EE) config/hal: NewInputDeviceRequest failed
Segmentation fault
adam@durum:~$

The crash happens when an X client is shut down.. For example, when xeyes is shut down with Control-C.

adam@durum:~$ xeyes -display :1
^C

GDB session:

Starting program: /usr/bin/Xvfb :1 -auth hosts
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
[Thread debugging using libthread_db enabled]
(no debugging symbols found)
(no debugging symbols found)
[New Thread 0x7f677e5d06f0 (LWP 32363)]
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
Could not init font path element /usr/share/fonts/X11/cyrillic, removing from list!
(EE) config/hal: NewInputDeviceRequest failed
(EE) config/hal: NewInputDeviceRequest failed
(EE) config/hal: NewInputDeviceRequest failed

Program received signal SIGSEGV, Segmentation fault.
---Type <return> to continue, or q <return> to quit---
[Switching to Thread 0x7f677e5d06f0 (LWP 32363)]
0x0000000000507665 in FreeColormap ()
(gdb) bt
#0 0x0000000000507665 in FreeColormap ()
#1 0x000000000052a1cb in FreeClientResources ()
#2 0x000000000052a2b4 in FreeAllResources ()
#3 0x0000000000526adb in main ()
(gdb)

[lspci]
00:00.0 Host bridge [0600]: Intel Corporation Mobile PM965/GM965/GL960 Memory Controller Hub [8086:2a00] (rev 0c)
     Subsystem: Lenovo Device [17aa:20b1]
01:00.0 VGA compatible controller [0300]: nVidia Corporation Quadro NVS 140M [10de:0429] (rev a1)
     Subsystem: Lenovo Device [17aa:20d8]

Adam Dickmeiss (adam-indexdata) wrote :

If I specify a screen the crash does not occur.

 Xvfb :1 -auth hosts -screen 0 800x600x24

Bryce Harrington (bryce) wrote :

Hi adam-indexdata,

Please attach the output of `lspci -vvnn`, and attach your /var/log/Xorg.0.log (and maybe Xorg.0.log.old) file from after reproducing this issue. If you've made any customizations to your /etc/X11/xorg.conf please attach that as well.

Could you please collect a full backtrace from when this crash occurs? Directions on collecting full backtraces are at https://wiki.ubuntu.com/X/Backtracing

[This is an automated message. Apologies if it has reached you inappropriately; please just reply to this message indicating so.]

Changed in xorg-server:
status: New → Incomplete
Bryce Harrington (bryce) wrote :

Please collect a 'bt full' on this issue. The 'bt' alone doesn't provide the variable values.

Changed in xorg-server (Ubuntu):
importance: Undecided → High
Adam Dickmeiss (adam-indexdata) wrote :

Program received signal SIGSEGV, Segmentation fault.
---Type <return> to continue, or q <return> to quit---
[Switching to Thread 0x7facb72e46f0 (LWP 7931)]
0x0000000000507665 in FreeColormap ()
(gdb) bt full
#0 0x0000000000507665 in FreeColormap ()
No symbol table info available.
#1 0x000000000052a1cb in FreeClientResources ()
No symbol table info available.
#2 0x000000000052a2b4 in FreeAllResources ()
No symbol table info available.
#3 0x0000000000526adb in main ()
No symbol table info available.
(gdb)

Adam Dickmeiss (adam-indexdata) wrote :

xserver configuration

Bryce Harrington (bryce) on 2009-04-07
summary: - Xvfb crashes with SIGSEGV
+ Xvfb crashes with SIGSEGV in FreeColormap()
Bryce Harrington (bryce) on 2009-04-21
description: updated
WangLu (coolwanglu) wrote :

also confirmed in a 64-bit ubuntu 9.04
(however, this didn't happen on a 32-bit ubuntu 9.04)

Bryce Harrington (bryce) wrote :

Unfortunately there still is not enough information in the backtrace to troubleshoot this bug; please follow the directions at http://wiki.ubuntu.com/X/Backtracing to collect a full backtrace.

Changed in xorg-server (Ubuntu):
status: Incomplete → New
status: New → Incomplete
Bryce Harrington (bryce) on 2009-08-13
tags: added: intrepid
Bryce Harrington (bryce) wrote :

We're closing this bug since it is has been some time with no response from the original reporter. However, if the issue still exists please feel free to reopen with the requested information. Also, if you could, please test against the latest development version of Ubuntu, since this confirms the bug is one we may be able to pass upstream for help.

Changed in xorg-server (Ubuntu):
status: Incomplete → Invalid
Adam Dickmeiss (adam-indexdata) wrote :

The problem still exists and has been reported by others..
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529927

Compiled xvfb (2:1.6.0-0ubuntu14) from deb sources but with debugging enabled and no stripping..

adam@durum:~/xvfb$ diff rules xorg-server-1.6.0/debian/rules
16c16
< CFLAGS += -O0
---
> CFLAGS += -O2
181c181
< # dh_strip -s --dbg-package=xserver-xorg-core
---
> dh_strip -s --dbg-package=xserver-xorg-core

In console 1:
   valgrind Xvfb -auth hosts :1
In console 2:
   xeyes -display :1

Download full text (5.9 KiB)

valgrind output shows that the immediate problem is that xrealloc in glx/glxscreen.c:276 causes some colormaps to have a bad pVisual member.. That is : some colormaps STILL point to the old memory .. In other words.. not all colormaps gets fixed up in AddScreenVisuals. Here is a gdb session where we track the colormaps created/destroyed.

adam@durum:~/xvfb$ gdb --args Xvfb -auth hosts :1
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu"...
(gdb) break colormap.c:279
Breakpoint 1 at 0x56db8c: file ../../dix/colormap.c, line 279.
(gdb) break FreeColormap
Breakpoint 2 at 0x56e2d1: file ../../dix/colormap.c, line 428.
(gdb) run
Starting program: /usr/bin/Xvfb -auth hosts :1
[Thread debugging using libthread_db enabled]
[New Thread 0x7f0639991710 (LWP 3767)]
[Switching to Thread 0x7f0639991710 (LWP 3767)]

Breakpoint 1, CreateColormap (mid=32, pScreen=0x2253800, pVisual=0x2253dc0,
    ppcmap=0x7fff419bba90, alloc=0, client=0) at ../../dix/colormap.c:279
279 if (!pmap)
(gdb) print pmap
$1 = (ColormapPtr) 0x2254e20
(gdb) bt
#0 CreateColormap (mid=32, pScreen=0x2253800, pVisual=0x2253dc0,
    ppcmap=0x7fff419bba90, alloc=0, client=0) at ../../dix/colormap.c:279
#1 0x00000000005cf8b2 in miCreateDefColormap (pScreen=0x2253800)
    at ../../mi/micmap.c:318
#2 0x000000000056d551 in fbCreateDefColormap (pScreen=0x2253800)
    at ../../../fb/fbcmap_mi.c:91
#3 0x000000000042defc in vfbScreenInit (index=0, pScreen=0x2253800, argc=4,
    argv=0x7fff419bbd28) at ../../../hw/vfb/InitOutput.c:952
#4 0x00000000005a1199 in AddScreen (pfnInit=0x42db2b <vfbScreenInit>, argc=4,
    argv=0x7fff419bbd28) at ../../dix/main.c:702
#5 0x000000000042e0e3 in InitOutput (screenInfo=0x88a780, argc=4,
    argv=0x7fff419bbd28) at ../../../hw/vfb/InitOutput.c:1018
#6 0x00000000005a03b6 in main (argc=4, argv=0x7fff419bbd28,
    envp=0x7fff419bbd50) at ../../dix/main.c:315
(gdb) cont
Continuing.

Breakpoint 1, CreateColormap (mid=64, pScreen=0x2253800, pVisual=0x2253df8,
    ppcmap=0x2254238, alloc=0, client=0) at ../../dix/colormap.c:279
279 if (!pmap)
(gdb) print pmap
$2 = (ColormapPtr) 0x2265d90
(gdb) bt
#0 CreateColormap (mid=64, pScreen=0x2253800, pVisual=0x2253df8,
    ppcmap=0x2254238, alloc=0, client=0) at ../../dix/colormap.c:279
#1 0x00000000004ee198 in PictureInitIndexedFormat (pScreen=0x2253800,
    format=0x2254210) at ../../render/picture.c:417
#2 0x00000000004ee238 in PictureInitIndexedFormats (pScreen=0x2253800)
    at ../../render/picture.c:439
#3 0x00000000004ee28b in PictureFinishInit () at ../../render/picture.c:451
#4 0x00000000004f133c in RenderExtensionInit () at ../../render/render.c:244
#5 0x000000000042e41c in InitExtensions (argc=4, argv=0x7fff419bbd28)
    at ../../../mi/miinitext.c:457
#6 0x00000000005a03e1 in main (argc=4, argv=0x7fff419bbd28,
    envp=0x7fff419bbd50) at ../../dix/main.c:319
(gdb) cont
Cont...

Read more...

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.