Comment 22 for bug 794895

Created attachment 463801
abrt report from Xorg crash

Description of problem:
If you attempt to use the X font server (xorg-x11-xfs) on Fedora 14 with
the Fedora 14 X server, the X server will crash on many or any operation
that seems to involve inventorying fonts. The minimal set of packages over
a stock install necessary to do this seems to be xfs itself and the 100dpi
bitmapped fonts, but it's possible that other font types will also do this.
(I have not attempted to do an exhaustive inventory.)

Reverting back to the Fedora 13 X server (and dependent drivers) on a
Fedora 14 system avoids the crash. This crash happens with all versions
of the Fedora 14 X server that I have seen, both the one on the
distribution image, the initial update in the updates repository, and the
latest update.

This may be the same bug as #651197 and #648608. I am refiling because
I have somewhat different abrt traces and a minimal reproduction, but
please feel free to mark this bug as a duplicate of one of the others
as appropriate.

Version-Release number of selected component (if applicable):

xorg-x11-xfs-1.0.5-8.fc14.x86_64
xorg-x11-fonts-100dpi-7.2-11.fc14.noarch
xorg-x11-server-Xorg-1.9.1-3.fc14.x86_64

How reproducible:
Completely

Steps to Reproduce:
1. install a stock 64-bit Fedora 14 system (may repro on i686; haven't tried)
2. install xorg-x11-utils (for xlsfonts), xorg-x11-xfs and xorg-x11-fonts-100dpi
3. start xfs with '/etc/rc.d/init.d/xfs start'
4. log in and add the xfs server to your font path:
       xset fp+ unix/:7100
5. run xlsfonts; the server will immediately crash

Actual results:

Server crash.

Expected results:

List of fonts.

Additional info:

The stock xfs configuration serves the same fonts that the X server
is already using, since both point to catalogue:/etc/X11/fontpath.d.
This has let me see that just having X with the bitmapped fonts or
just having X talk to xfs for fonts are not enough to create the crash.

The crash can also be reproduced with Xvfb:

Xvfb :1 -noreset &
DISPLAY=:1 xset fp+ unix/:7100
DISPLAY=:1 xlsfonts

Testing with Xvfb this way commonly shows a glibc error:
*** glibc detected *** Xvfb: double free or corruption (!prev): 0x0000000001d82210 ***

(the address varies)

I am attaching an abrt trace (from an Xorg crash, not Xvfb).