Bug #705078 “Xorg crashed with SIGSEGV in pixman_image_set_has_c...” : Bugs : xf86-video-intel

Revision history for this message

In freedesktop.org Bugzilla #28882, E-tim-w (e-tim-w) wrote on 2010-07-01:

#40

Created attachment 36674
gdb trace of xorg-server seg fault

I'm running LXDE on an Arch Linux system and after a recent upgrade, now xorg-server exits with a segmentation fault whenever I try to run lxterminal (the terminal application in the LXDE suite). It happens every time and immediately after invoking the program (before a window even appears). I haven't been able to reproduce it with any other application.

I'm attaching a gdb backtrace collected according to these instructions:

http://wiki.x.org/wiki/Development/Documentation/ServerDebugging?highlight=(segmentation)|(fault)

Since it looks like I only get one attachment, see below for an excerpt from Xorg.0.log with a backtrace. There's also a gdb trace from lxterminal showing that it exits without a seg fault.

Here's some version info for my system:

lxterminal 0.1.7-1
lxde-common 0.5.0-1

kernel 2.6.34-ARCH

$ X -version

X.Org X Server 1.8.0
Release Date: 2010-04-02
X Protocol Version 11, Revision 0
Build Operating System: Linux 2.6.34-ARCH i686
Current Operating System: Linux deimos 2.6.34-ARCH #1 SMP PREEMPT Sat Jun 19 13:06:16 CEST 2010 i686
Kernel command line: root=/dev/disk/by-uuid/97258355-411c-456d-9ff4-d686b0a3408d ro
Build Date: 01 July 2010 10:29:43PM

Current version of pixman: 0.18.2

### excerpt from Xorg.0.log:

[ 4480.061]
Backtrace:
[ 4480.061] 0: /usr/bin/X (xorg_backtrace+0x3b) [0x80df05b]
[ 4480.062] 1: /usr/bin/X (0x8048000+0x63da5) [0x80abda5]
[ 4480.062] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0xb788340c]
[ 4480.062] 3: /usr/lib/xorg/modules/libfb.so (image_from_pict+0x3b8) [0xb72e6a58]
[ 4480.062] 4: /usr/lib/xorg/modules/libfb.so (fbComposite+0x121) [0xb72e6c51]
[ 4480.062] 5: /usr/bin/X (0x8048000+0xc7053) [0x810f053]
[ 4480.062] 6: /usr/bin/X (CompositePicture+0x290) [0x8103710]
[ 4480.062] 7: /usr/bin/X (0x8048000+0x12f0a2) [0x81770a2]
[ 4480.062] 8: /usr/bin/X (0x8048000+0x12eea8) [0x8176ea8]
[ 4480.063] 9: /usr/bin/X (0x8048000+0x12eea8) [0x8176ea8]
[ 4480.063] 10: /usr/bin/X (0x8048000+0x9885f) [0x80e085f]
[ 4480.063] 11: /usr/bin/X (BlockHandler+0x58) [0x80921f8]
[ 4480.063] 12: /usr/bin/X (WaitForSomething+0x10c) [0x80a7fec]
[ 4480.063] 13: /usr/bin/X (0x8048000+0x214d0) [0x80694d0]
[ 4480.063] 14: /usr/bin/X (0x8048000+0x1a4b5) [0x80624b5]
[ 4480.063] 15: /lib/libc.so.6 (__libc_start_main+0xe6) [0xb75c5c76]
[ 4480.064] 16: /usr/bin/X (0x8048000+0x1a0a1) [0x80620a1]
[ 4480.064] Segmentation fault at address 0x20
[ 4480.064]
Fatal server error:
[ 4480.064] Caught signal 11 (Segmentation fault). Server aborting
[ 4480.064]

### gdb launch of lxterminal:

Reading symbols from /usr/bin/lxterminal...done.
(gdb) run
Starting program: /usr/bin/lxterminal
[Thread debugging using libthread_db enabled]
[New Thread 0xb58c0b70 (LWP 23639)]
[Thread 0xb58c0b70 (LWP 23639) exited]

Program exited with code 01.
(gdb)

Created attachment 36674
gdb trace of xorg-server seg fault

I'm running LXDE on an Arch Linux system and after a recent upgrade, now xorg-server exits with a segmentation fault whenever I try to run lxterminal (the terminal application in the LXDE suite). It happens every time and immediately after invoking the program (before a window even appears). I haven't been able to reproduce it with any other application.

I'm attaching a gdb backtrace collected according to these instructions:

http://wiki.x.org/wiki/Development/Documentation/ServerDebugging?highlight=(segmentation)|(fault)

Since it looks like I only get one attachment, see below for an excerpt from Xorg.0.log with a backtrace. There's also a gdb trace from lxterminal showing that it exits without a seg fault.

Here's some version info for my system:

lxterminal 0.1.7-1
lxde-common 0.5.0-1

kernel 2.6.34-ARCH

$ X -version

X.Org X Server 1.8.0
Release Date: 2010-04-02
X Protocol Version 11, Revision 0
Build Operating System: Linux 2.6.34-ARCH i686 
Current Operating System: Linux deimos 2.6.34-ARCH #1 SMP PREEMPT Sat Jun 19 13:06:16 CEST 2010 i686
Kernel command line: root=/dev/disk/by-uuid/97258355-411c-456d-9ff4-d686b0a3408d ro
Build Date: 01 July 2010  10:29:43PM
 
Current version of pixman: 0.18.2

### excerpt from Xorg.0.log:

[  4480.061] 
Backtrace:
[  4480.061] 0: /usr/bin/X (xorg_backtrace+0x3b) [0x80df05b]
[  4480.062] 1: /usr/bin/X (0x8048000+0x63da5) [0x80abda5]
[  4480.062] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0xb788340c]
[  4480.062] 3: /usr/lib/xorg/modules/libfb.so (image_from_pict+0x3b8) [0xb72e6a58]
[  4480.062] 4: /usr/lib/xorg/modules/libfb.so (fbComposite+0x121) [0xb72e6c51]
[  4480.062] 5: /usr/bin/X (0x8048000+0xc7053) [0x810f053]
[  4480.062] 6: /usr/bin/X (CompositePicture+0x290) [0x8103710]
[  4480.062] 7: /usr/bin/X (0x8048000+0x12f0a2) [0x81770a2]
[  4480.062] 8: /usr/bin/X (0x8048000+0x12eea8) [0x8176ea8]
[  4480.063] 9: /usr/bin/X (0x8048000+0x12eea8) [0x8176ea8]
[  4480.063] 10: /usr/bin/X (0x8048000+0x9885f) [0x80e085f]
[  4480.063] 11: /usr/bin/X (BlockHandler+0x58) [0x80921f8]
[  4480.063] 12: /usr/bin/X (WaitForSomething+0x10c) [0x80a7fec]
[  4480.063] 13: /usr/bin/X (0x8048000+0x214d0) [0x80694d0]
[  4480.063] 14: /usr/bin/X (0x8048000+0x1a4b5) [0x80624b5]
[  4480.063] 15: /lib/libc.so.6 (__libc_start_main+0xe6) [0xb75c5c76]
[  4480.064] 16: /usr/bin/X (0x8048000+0x1a0a1) [0x80620a1]
[  4480.064] Segmentation fault at address 0x20
[  4480.064] 
Fatal server error:
[  4480.064] Caught signal 11 (Segmentation fault). Server aborting
[  4480.064]

### gdb launch of lxterminal:

Reading symbols from /usr/bin/lxterminal...done.
(gdb) run
Starting program: /usr/bin/lxterminal 
[Thread debugging using libthread_db enabled]
[New Thread 0xb58c0b70 (LWP 23639)]
[Thread 0xb58c0b70 (LWP 23639) exited]

Program exited with code 01.
(gdb)

Revision history for this message

In freedesktop.org Bugzilla #28882, E-tim-w (e-tim-w) wrote on 2010-07-04:

#41

Created attachment 36745
gdb trace with debug symbols for libpixman

Revision history for this message

In freedesktop.org Bugzilla #28882, E-tim-w (e-tim-w) wrote on 2010-07-04:

#42

Created attachment 36746
gdb stack trace with code context for the calls

gdb short stack trace with the full function source code (w/line numbers) for each routine in the trace

Revision history for this message

In freedesktop.org Bugzilla #28882, Soren-sandmann (soren-sandmann) wrote on 2010-07-06:

#43

Apparently, the server calls set_has_client_clip() with a NULL image:

#0 0xb75cb7bc in pixman_image_set_has_client_clip (image=0x0, client_clip=1) at pixman-image.c:530
No locals.

Revision history for this message

Mario Limonciello (superm1) wrote on 2011-01-19:

#1

BootDmesg.txt Edit (54.0 KiB, text/plain; charset="utf-8")
CurrentDmesg.txt Edit (2.5 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (4.2 KiB, text/plain; charset="utf-8")
Disassembly.txt Edit (580 bytes, text/plain; charset="utf-8")
GconfCompiz.txt Edit (34.5 KiB, text/plain; charset="utf-8")
GdmLog.txt Edit (17.4 KiB, text/plain; charset="utf-8")
Lspci.txt Edit (28.3 KiB, text/plain; charset="utf-8")
Lsusb.txt Edit (733 bytes, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (1.5 KiB, text/plain; charset="utf-8")
ProcCpuinfo_.txt Edit (1.5 KiB, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (1.5 KiB, text/plain; charset="utf-8")
ProcInterrupts_.txt Edit (1.5 KiB, text/plain; charset="utf-8")
ProcMaps.txt Edit (4.2 MiB, text/plain; charset="utf-8")
ProcModules.txt Edit (2.5 KiB, text/plain; charset="utf-8")
ProcModules_.txt Edit (2.5 KiB, text/plain; charset="utf-8")
ProcStatus.txt Edit (725 bytes, text/plain; charset="utf-8")
Registers.txt Edit (462 bytes, text/plain; charset="utf-8")
Stacktrace.txt Edit (1.4 KiB, text/plain; charset="utf-8")
ThreadStacktrace.txt Edit (1.5 KiB, text/plain; charset="utf-8")
UdevDb.txt Edit (115.1 KiB, text/plain; charset="utf-8")
UdevLog.txt Edit (271.5 KiB, text/plain; charset="utf-8")
UdevLog_.txt Edit (271.6 KiB, text/plain; charset="utf-8")
XorgLog.txt Edit (25.9 KiB, text/plain; charset="utf-8")
XorgLogOld.txt Edit (435.0 KiB, text/plain; charset="utf-8")
XorgLogOld_.txt Edit (435.0 KiB, text/plain; charset="utf-8")
XorgLog_.txt Edit (25.9 KiB, text/plain; charset="utf-8")

Revision history for this message

Apport retracing service (apport) wrote on 2011-01-19:

#2

StacktraceTop:
XISendDeviceHierarchyEvent (flags=0xbfcccf9c)
DisableDevice (dev=0xaaa8e70, sendevent=1 '\001')
?? ()

Revision history for this message

Apport retracing service (apport) wrote on 2011-01-19: Stacktrace.txt

#3

Stacktrace.txt Edit (2.1 KiB, text/plain)

Revision history for this message

Apport retracing service (apport) wrote on 2011-01-19: ThreadStacktrace.txt

#4

ThreadStacktrace.txt Edit (2.1 KiB, text/plain)

Changed in xorg-server (Ubuntu):
importance:	Undecided → Medium
tags:	removed: need-i386-retrace

Mario Limonciello (superm1) on 2011-01-19

summary:	- Xorg crashed with SIGSEGV in pixman_image_set_has_cleint_clip%28%29 + Xorg crashed with SIGSEGV in pixman_image_set_has_client_clip
summary:	- Xorg crashed with SIGSEGV in pixman_image_set_has_client_clip + Xorg crashed with SIGSEGV in pixman_image_set_has_client_clip()

Bryce Harrington (bryce) on 2011-01-20

Changed in xorg-server (Ubuntu):
importance:	Medium → High

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-01-20:

#5

Hrm, unfortunately it looks like the apport retracer is choking, so the interpreted backtrace isn't valid.

However, poking around through the X logs, I notice it prints out a bunch of this:

[ 40.000] (II) Dell WMI hotkeys: Device reopened after 1 attempts.
[ 45.264] (II) AIGLX: Suspending AIGLX clients for VT switch
[ 62.004] (WW) intel(0): intel_uxa_prepare_access: bo map failed: Cannot allocate memory
[ 62.005] (WW) intel(0): intel_uxa_prepare_access: bo map failed: Cannot allocate memory
[ 62.005] (WW) intel(0): intel_uxa_prepare_access: bo map failed: Cannot allocate memory
... repeating ...
[ 62.616] (WW) intel(0): intel_uxa_prepare_access: bo map failed: Cannot allocate memory
[ 62.616] (WW) intel(0): intel_uxa_prepare_access: bo map failed: Cannot allocate memory
[ 62.617] (WW) intel(0): intel_uxa_prepare_access: bo map failed: Cannot allocate memory
[ 62.617]
Backtrace:
[ 62.617] 0: X (xorg_backtrace+0x3b) [0x80e83bb]
[ 62.617] 1: X (0x8048000+0x5d4f8) [0x80a54f8]
[ 62.617] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0x6e240c]
[ 62.617] 3: /usr/lib/xorg/modules/libfb.so (0x7e5000+0x16ff0) [0x7fbff0]
[ 62.617] 4: /usr/lib/xorg/modules/libfb.so (fbComposite+0x121) [0x7fc241]
[ 62.617] 5: /usr/lib/xorg/modules/drivers/intel_drv.so (0x240000+0x2fc66) [0x26fc66]
[ 62.617] 6: /usr/lib/xorg/modules/drivers/intel_drv.so (0x240000+0x2c4a0) [0x26c4a0]
[ 62.617] 7: X (0x8048000+0xdb0f2) [0x81230f2]
[ 62.617] 8: X (CompositePicture+0x22b) [0x811822b]
[ 62.617] 9: X (0x8048000+0xd3d39) [0x811bd39]
[ 62.617] 10: X (0x8048000+0xd0a33) [0x8118a33]
[ 62.617] 11: X (0x8048000+0x276c7) [0x806f6c7]
[ 62.617] 12: X (0x8048000+0x1a64c) [0x806264c]
[ 62.617] 13: /lib/libc.so.6 (__libc_start_main+0xe6) [0xd0fce6]
[ 62.617] 14: X (0x8048000+0x1a241) [0x8062241]
[ 62.617] Segmentation fault at address 0x20

visibility:

private → public

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-01-20:

#6

The above is making me wonder if this is just a symptom of something that changed in the kernel.

Could you please provide a bit more context behind this crash? Was this the first time you tested natty livecd install on this hw, or have you been doing regular test installs up until now and it only regressed on this version? Have you experienced other instances of this X crash but only these two triggered apport? Have you run ubuntu on this hw previously, meaning that this is a regression - if so what version(s) successfully ran on it? Were you able to complete this particular installation, and if so what did you do to work around it? If not, have you attempted installation of a different snapshot? Any other information you can provide which may help narrow down the source of this issue?

Changed in xorg-server (Ubuntu):
status:	New → Incomplete

Revision history for this message

Mario Limonciello (superm1) wrote on 2011-01-20:

#7

Hi Bryce,

Natty live CD install's haven't been functional for about a week, but they were working fine on both of the pieces of hardware that i've filed bugs on.

Ubuntu's ran successfully with previous versions (10.10 and 10.04) on both pieces of hardware. I was able to complete the installation by forcing it to run in vesa and nomodeset.

Revision history for this message

Mario Limonciello (superm1) wrote on 2011-01-20:

#8

And to be clear (probably should have reread before posting).

* Natty live cds from a week ago worked, but there haven't been any live cds up until a few days ago

* I was able to successfully install 10.10 and 10.04 on both pieces of hardware without workarounds. Same as the natty builds from ~1 week ago. It's very recent that I have to use xforcevesa/nomodeset

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-01-20: Re: [Bug 705078] Re: Xorg crashed with SIGSEGV in pixman_image_set_has_client_clip()

#9

On Thu, Jan 20, 2011 at 08:25:26PM -0000, Mario Limonciello wrote:
> * Natty live cds from a week ago worked, but there haven't been any live
> cds up until a few days ago

Hmm, ok that's very interesting information.

There was a fix to mesa I posted to mesa for bug 681915 within the past
week, but otherwise there haven't been any significant X changes in this
time period.

Might be some change elsewhere in the system is triggering the X crash?
Sure would be nice to have a more complete backtrace.

Is there any chance we could have you do a reinstall and hook gdb to X
to get a full backtrace on this? If not, I've posted a bug to apport
to get the retracer issue investigated.

Revision history for this message

Mario Limonciello (superm1) wrote on 2011-01-20:

#10

Bryce:

I can reproduce this at will by scrolling text in windows or dragging windows around even on a live session. What exactly are you looking for with gdb attached? I tried to attach gdb to the running X process, but the box hung when I did that. Could you give me a particular set of steps to follow?

Revision history for this message

Mario Limonciello (superm1) wrote on 2011-01-20:

#11

Well managed to get it to crash over SSH, but doesn't look too useful to me without ddeb's installed.

(gdb) backtrace full
#0 0x00491004 in ?? () from /usr/lib/xorg/modules/drivers/intel_drv.so
No symbol table info available.
#1 0x081183f8 in CompositeRects ()
No symbol table info available.
#2 0x0811c690 in ?? ()
No symbol table info available.
#3 0x08118a33 in ?? ()
No symbol table info available.
#4 0x0806f6c7 in ?? ()
No symbol table info available.
#5 0x0806264c in _start ()
No symbol table info available.
(gdb) info registers
eax 0xbfe6326c -1075432852
ecx 0x3063c0 3171264
edx 0xbc01098 197136536
ebx 0x4abff4 4898804
esp 0xbfe631f0 0xbfe631f0
ebp 0xbfe63298 0xbfe63298
esi 0xbc0b3a8 197178280
edi 0x0 0
eip 0x491004 0x491004
eflags 0x213246 [ PF ZF IF #12 #13 RF ID ]
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
fs 0x0 0
gs 0x33 51
(gdb) x/16i $pc
=> 0x491004: mov (%edi),%eax
   0x491006: mov %eax,(%esp)
   0x491009: call 0x488420
   0x49100e: mov -0x6c(%ebp),%edx
   0x491011: test %eax,%eax
   0x491013: mov %eax,%ecx
   0x491015: je 0x4912c7
   0x49101b: mov %edi,-0x58(%ebp)
   0x49101e: mov -0x4c(%ebp),%edi
   0x491021: mov (%edi),%eax
   0x491023: mov -0x54(%ebp),%edi
   0x491026: mov %ecx,0x10(%esp)
   0x49102a: mov -0x58(%ebp),%ecx
   0x49102d: mov %edx,(%esp)
   0x491030: mov %edx,-0x6c(%ebp)
   0x491033: mov %edi,0x18(%esp)
(gdb) thread apply all backtrace

Thread 1 (Thread 0xb77887c0 (LWP 6289)):
#0 0x00491004 in ?? () from /usr/lib/xorg/modules/drivers/intel_drv.so
#1 0x081183f8 in CompositeRects ()
#2 0x0811c690 in ?? ()
#3 0x08118a33 in ?? ()
#4 0x0806f6c7 in ?? ()
#5 0x0806264c in _start ()

Revision history for this message

Mario Limonciello (superm1) wrote on 2011-01-20:

#12

Here we go, here's a better one with -dbg symbols installed:

Program received signal SIGSEGV, Segmentation fault.
0x00228004 in uxa_solid_rects (op=<value optimized out>, dst=0xbe38080, color=0xbdb73c0, num_rects=4, rects=0xbdb73c8) at ../../uxa/uxa-render.c:1070
1070 ../../uxa/uxa-render.c: No such file or directory.
in ../../uxa/uxa-render.c
(gdb) backtrace full
#0 0x00228004 in uxa_solid_rects (op=<value optimized out>, dst=0xbe38080, color=0xbdb73c0, num_rects=4, rects=0xbdb73c8) at ../../uxa/uxa-render.c:1070
        solid = 0x0
        src_off_x = 135352438
        src_off_y = -1075839992
        error = 199458944
        screen = <value optimized out>
        dst_pixmap = 0xbe37f88
        src_pixmap = 0x0
        region = {extents = {x1 = 28, y1 = 102, x2 = 313, y2 = 143}, data = 0xbe37cd0}
        boxes = 0xbe37cd8
        extents = <value optimized out>
        src = 0x0
        dst_x = 0
        dst_y = 0
        num_boxes = 4
#1 0x081183f8 in CompositeRects (op=3 '\003', pDst=0xbe38080, color=0xbdb73c0, nRect=4, rects=0xbdb73c8) at ../../render/picture.c:1734
        ps = <value optimized out>
#2 0x0811c690 in ProcRenderFillRectangles (client=0xb22e528) at ../../render/render.c:1475
        pDst = 0xbe38080
        things = <value optimized out>
        stuff = 0xbdb73b4
#3 0x08118a33 in ProcRenderDispatch (client=0xb22e528) at ../../render/render.c:2051
        stuff = <value optimized out>
#4 0x0806f6c7 in Dispatch () at ../../dix/dispatch.c:432
        clientReady = 0xb3fa048
        result = <value optimized out>
        client = 0xb22e528
        nready = 0
        icheck = 0x8204138
        start_tick = 30960
#5 0x0806264c in main (argc=8, argv=0xbfdffe54, envp=0xbfdffe78) at ../../dix/main.c:291
        i = <value optimized out>
        alwaysCheckForInput = {0, 1}

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-01-22:

#13

Perfect mario, that points to the cause of the crash:

#0 0x00228004 in uxa_solid_rects (op=<value optimized out>, dst=0xbe38080, color=0xbdb73c0, num_rects=4, rects=0xbdb73c8) at ../../uxa/uxa-render.c:1070
solid = 0x0
src = 0x0

Code at this location is:

solid = uxa_acquire_solid(screen, src->pSourcePict);
FreePicture(src, 0);

                        src = solid;
                        src_pixmap = uxa_get_offscreen_pixmap(src->pDrawable,
                                                              &src_off_x, &src_off_y);

uxa_acquire_solid() can return 0 for all manner of different reasons, if it could not create a solid picture. Yet the return value isn't checked before dereferencing it. Looks like this code has been there for a while, and doesn't appear to have been fixed in the upstream codebase (at least, there's no null pointer check).

Changed in xorg-server (Ubuntu):
assignee:	nobody → Bryce Harrington (bryce)
status:	Incomplete → Triaged

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-01-22:

#14

solid_nullptr_check.patch Edit (1.3 KiB, text/plain)

This adds the missing null pointer checks.

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-01-22:

#15

I've set up a PPA with the patch at https://launchpad.net/~bryce/+archive/bug705078

Hopefully there should be a .deb there for you in a few hours. Give it a go, let me know how it works.

While the check for the null pointer seems obviously needed, it's not clear why it got a null in the first place. Something deeper may be at work.

affects:	xorg-server (Ubuntu) → xserver-xorg-video-intel (Ubuntu)
Changed in xserver-xorg-video-intel (Ubuntu):
status:	Triaged → In Progress

Brian Murray (brian-murray) on 2011-01-22

tags:

added: patch

bugbot (bugbot) on 2011-01-23

tags:

added: crash

Revision history for this message

Launchpad Janitor (janitor) wrote on 2011-01-24:

#16

This bug was fixed in the package xserver-xorg-video-intel - 2:2.13.901-2ubuntu3

---------------
xserver-xorg-video-intel (2:2.13.901-2ubuntu3) natty; urgency=low

  * Add 107_solid_null_ptr.patch: uxa_acquire_solid() can return NULL
    under some circumstances, so check for this when called.
    (LP: #705078)
-- Bryce Harrington <email address hidden> Fri, 21 Jan 2011 19:17:34 -0800

Changed in xserver-xorg-video-intel (Ubuntu):
status:	In Progress → Fix Released

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-01-24:

#17

Well maybe this is hard for you to test given that it shows up during installation from a livecd.

Since the patch is just a simple null pointer check it's quite safe. So for your testing convenience I'll go ahead and push it to the archive. Please snag tomorrow's livecd image and test it to see what happens.

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-01-24:

#18

Famous last words, I know.

Anyway, reopen bug if for some reason this does not fix the crash.

I expect that there is a chance this is papering over a deeper problem, and that the livecd will still fail but in some new and more exciting way. If that does happen please file a new bug report (either via automatic apport reporting, or with 'ubuntu-bug xorg') and we'll go from there.

Revision history for this message

Erick Brunzell (lbsolost) wrote on 2011-02-02:

#19

Just had this appear iso-testing i386 Alpha 2. It appeared along with bug 652916 and bug 702898 during installation just as the Keyboard layout screen opened.

No idea if the three are in any way related.

Revision history for this message

Erick Brunzell (lbsolost) wrote on 2011-02-02:

#20

Please read:

https://bugs.launchpad.net/ubuntu/+source/ubiquity/+bug/702898/comments/8

Revision history for this message

George Karavasilev (kokoto-java) wrote on 2011-02-02:

#21

I can confirm this on x86_64 architecture too

Bryce Harrington (bryce) on 2011-02-02

Changed in xserver-xorg-video-intel (Ubuntu):
status:	Fix Released → Confirmed

Revision history for this message

Erick Brunzell (lbsolost) wrote on 2011-02-02:

#22

I've not been able to reproduce this bug with the rebuilt image this AM.

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-02:

#23

Ah, excellent, alright re-closing. If it regresses please open the bug.

Changed in xserver-xorg-video-intel (Ubuntu):
status:	Confirmed → Fix Released

Ubuntu QA Website (ubuntuqa) on 2011-02-02

tags:

added: iso-testing

Revision history for this message

jerrylamos (jerrylamos) wrote on 2011-02-02:

#24

Natty 20110201 today's build installing from USB onto an Aspire one D255E and got this bug.

Was running Unity 3D fine on the -12 kernel. Updated to kernel -18 and will not run Unity 3D so since the USB booted into Unity 3D O.K. tried an install. So the failure occurred on 2 Feb with the latest daily build 1 Feb.

Will try again on the next daily build.

Jerry

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-04:

#25

As luck would have it, I reproduced this bug myself while booting the livecd on one of my systems.

Changed in xserver-xorg-video-intel (Ubuntu):
status:	Fix Released → Confirmed

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-04:

#26

Mine is bug #712866. However even though apport showed the error, I didn't actually notice a crash of X... things seemed to come up fine in the LiveCD environment.

Changed in xserver-xorg-video-intel (Ubuntu):
status:	Confirmed → Triaged

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-04:

#27

Bumping to critical since this appears to be a widespread crash reproducible on the livecd.

description:	updated
Changed in xserver-xorg-video-intel (Ubuntu):
importance:	High → Critical
description:	updated

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-04:

#28

I'm noticing the crash appears in a libpixman call, the source code of which is trivial:

PIXMAN_EXPORT void
pixman_image_set_has_client_clip (pixman_image_t *image,
pixman_bool_t client_clip)
{
image->common.client_clip = client_clip;
}

Looks like it could segfault if image was NULL.

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-04:

#29

Download full text (6.1 KiB)

Aha progress.

(gdb) bt full
#0 XISendDeviceHierarchyEvent (flags=0xbfb2d73c) at ../../Xi/xichangehierarchy.c:73
        ev = 0x0
        info = <value optimized out>
        dummyDev = {public = {devicePrivate = 0x0, processInputProc = 0, realInputProc = 0, enqueueInputProc = 0,
            on = 0}, next = 0x0, startup = 0, deviceProc = 0, inited = 0, enabled = 0, coreEvents = 0, deviceGrab = {
            grabTime = {months = 0, milliseconds = 0}, fromPassiveGrab = 0, implicitGrab = 0, activeGrab = {
              next = 0x0, resource = 0, device = 0x0, window = 0x0, ownerEvents = 0, keyboardMode = 0,
              pointerMode = 0, grabtype = GRABTYPE_CORE, type = 0 '\000', modifiersDetail = {exact = 0, pMask = 0x0},
              modifierDevice = 0x0, detail = {exact = 0, pMask = 0x0}, confineTo = 0x0, cursor = 0x0, eventMask = 0,
              deviceMask = 0, xi2mask = {"\000\000" <repeats 42 times>}}, grab = 0x0, activatingKey = 0 '\000',
            ActivateGrab = 0, DeactivateGrab = 0, sync = {frozen = 0, state = 0, other = 0x0, event = 0x0}},
          type = 0, xinput_type = 0, name = 0x0, id = 0, key = 0x0, valuator = 0x0, button = 0x0, focus = 0x0,
          proximity = 0x0, absolute = 0x0, kbdfeed = 0x0, ptrfeed = 0x0, intfeed = 0x0, stringfeed = 0x0, bell = 0x0,
          leds = 0x0, xkb_interest = 0x0, config_info = 0x0, unused_classes = 0x0, saved_master_id = 0,
          devPrivates = 0x0, unwrapProc = 0, spriteInfo = 0x0, u = {master = 0x0, lastSlave = 0x0}, last = {
            valuators = {0 <repeats 36 times>}, remainder = {0 <repeats 36 times>}, numValuators = 0, slave = 0x0},
          properties = {properties = 0x0, handlers = 0x0}, transform = {m = {{0, 0, 0}, {0, 0, 0}, {0,
                1.5236786157049496e-285, 2.179289842072959e-311}}}, xtest_master_id = 150345912}
        dev = <value optimized out>
        i = <value optimized out>
#1 0x08085b04 in DisableDevice (dev=0xa6e0830, sendevent=1 '\001') at ../../dix/devices.c:507
        prev = <value optimized out>
        other = <value optimized out>
        enabled = 0 '\000'
        flags = {0, 0, 0, 0, 128, 0 <repeats 35 times>}
#2 0x08085d33 in RemoveDevice (dev=0xa6e0830, sendevent=1 '\001') at ../../dix/devices.c:1057
        prev = <value optimized out>
        tmp = <value optimized out>
        next = <value optimized out>
        ret = 8
        screen = <value optimized out>
        deviceid = 4
        initialized = 1
        flags = {0 <repeats 40 times>}
#3 0x080bd6fd in DeleteInputDeviceRequest (pDev=0xa6e0830) at ../../../../hw/xfree86/common/xf86Xinput.c:961
        pInfo = 0x0
        drv = 0x0
        isMaster = <value optimized out>
#4 0x08082bb3 in CloseDeviceList (listHead=0x8208104) at ../../dix/devices.c:966
        freedIds = {0, 0, 1, 1, 1, 0 <repeats 35 times>}
        dev = <value optimized out>
        i = <value optimized out>
#5 0x080831e7 in CloseDownDevices () at ../../dix/devices.c:994
        dev = 0x0
#6 0x0809dbd0 in SigAbortServer (signo=11) at ../../os/log.c:411
No locals.
#7 0x0809e671 in FatalSignal (signo=11) at ../../os/log.c:541
        beenhere = 1
#8 0x080a4bfd in OsSigHandler (signo=11, sip=0xbfb2da...

Aha progress.

(gdb) bt full
#0  XISendDeviceHierarchyEvent (flags=0xbfb2d73c) at ../../Xi/xichangehierarchy.c:73
        ev = 0x0
        info = <value optimized out>
        dummyDev = {public = {devicePrivate = 0x0, processInputProc = 0, realInputProc = 0, enqueueInputProc = 0, 
            on = 0}, next = 0x0, startup = 0, deviceProc = 0, inited = 0, enabled = 0, coreEvents = 0, deviceGrab = {
            grabTime = {months = 0, milliseconds = 0}, fromPassiveGrab = 0, implicitGrab = 0, activeGrab = {
              next = 0x0, resource = 0, device = 0x0, window = 0x0, ownerEvents = 0, keyboardMode = 0, 
              pointerMode = 0, grabtype = GRABTYPE_CORE, type = 0 '\000', modifiersDetail = {exact = 0, pMask = 0x0}, 
              modifierDevice = 0x0, detail = {exact = 0, pMask = 0x0}, confineTo = 0x0, cursor = 0x0, eventMask = 0, 
              deviceMask = 0, xi2mask = {"\000\000" <repeats 42 times>}}, grab = 0x0, activatingKey = 0 '\000', 
            ActivateGrab = 0, DeactivateGrab = 0, sync = {frozen = 0, state = 0, other = 0x0, event = 0x0}}, 
          type = 0, xinput_type = 0, name = 0x0, id = 0, key = 0x0, valuator = 0x0, button = 0x0, focus = 0x0, 
          proximity = 0x0, absolute = 0x0, kbdfeed = 0x0, ptrfeed = 0x0, intfeed = 0x0, stringfeed = 0x0, bell = 0x0, 
          leds = 0x0, xkb_interest = 0x0, config_info = 0x0, unused_classes = 0x0, saved_master_id = 0, 
          devPrivates = 0x0, unwrapProc = 0, spriteInfo = 0x0, u = {master = 0x0, lastSlave = 0x0}, last = {
            valuators = {0 <repeats 36 times>}, remainder = {0 <repeats 36 times>}, numValuators = 0, slave = 0x0}, 
          properties = {properties = 0x0, handlers = 0x0}, transform = {m = {{0, 0, 0}, {0, 0, 0}, {0, 
                1.5236786157049496e-285, 2.179289842072959e-311}}}, xtest_master_id = 150345912}
        dev = <value optimized out>
        i = <value optimized out>
#1  0x08085b04 in DisableDevice (dev=0xa6e0830, sendevent=1 '\001') at ../../dix/devices.c:507
        prev = <value optimized out>
        other = <value optimized out>
        enabled = 0 '\000'
        flags = {0, 0, 0, 0, 128, 0 <repeats 35 times>}
#2  0x08085d33 in RemoveDevice (dev=0xa6e0830, sendevent=1 '\001') at ../../dix/devices.c:1057
        prev = <value optimized out>
        tmp = <value optimized out>
        next = <value optimized out>
        ret = 8
        screen = <value optimized out>
        deviceid = 4
        initialized = 1
        flags = {0 <repeats 40 times>}
#3  0x080bd6fd in DeleteInputDeviceRequest (pDev=0xa6e0830) at ../../../../hw/xfree86/common/xf86Xinput.c:961
        pInfo = 0x0
        drv = 0x0
        isMaster = <value optimized out>
#4  0x08082bb3 in CloseDeviceList (listHead=0x8208104) at ../../dix/devices.c:966
        freedIds = {0, 0, 1, 1, 1, 0 <repeats 35 times>}
        dev = <value optimized out>
        i = <value optimized out>
#5  0x080831e7 in CloseDownDevices () at ../../dix/devices.c:994
        dev = 0x0
#6  0x0809dbd0 in SigAbortServer (signo=11) at ../../os/log.c:411
No locals.
#7  0x0809e671 in FatalSignal (signo=11) at ../../os/log.c:541
        beenhere = 1
#8  0x080a4bfd in OsSigHandler (signo=11, sip=0xbfb2dabc, unused=0xbfb2db3c) at ../../os/osinit.c:154
No locals.
#9  <signal handler called>
No symbol table info available.
#10 0x00125689 in pixman_image_set_has_client_clip (image=0x0, client_clip=1) at ../../pixman/pixman-image.c:530
No locals.
#11 0x0081aa38 in create_bits_picture (pict=0xb82cf98, has_clip=1, xoff=0xbfb2df6c, yoff=0xbfb2df68, is_alpha_map=0)
    at ../../fb/fbpict.c:188
        bits = <value optimized out>
        image = 0x0
        pixmap = <value optimized out>
        stride = <value optimized out>
        bpp = <value optimized out>
#12 image_from_pict_internal (pict=0xb82cf98, has_clip=1, xoff=0xbfb2df6c, yoff=0xbfb2df68, is_alpha_map=0)
    at ../../fb/fbpict.c:311
        image = 0x0
#13 0x0081ac81 in fbComposite (op=3 '\003', pSrc=0xa88f5c0, pMask=0xa88f628, pDst=0xb82cf98, xSrc=792, ySrc=22, 
    xMask=792, yMask=22, xDst=995, yDst=0, width=22, height=22) at ../../fb/fbpict.c:63
        src = <value optimized out>
        mask = 0x0
        dest = <value optimized out>
#14 0x00387b86 in uxa_check_composite (op=3 '\003', pSrc=0xa88f5c0, pMask=0xa88f628, pDst=0xb82cf98, xSrc=792, 
    ySrc=22, xMask=792, yMask=22, xDst=995, yDst=0, width=22, height=22) at ../../uxa/uxa-unaccel.c:371
        screen = <value optimized out>
        __FUNCTION__ = "uxa_check_composite"
#15 0x003843b0 in uxa_composite (op=3 '\003', pSrc=0xa88f5c0, pMask=0xa88f628, pDst=0xb82cf98, xSrc=792, ySrc=22, 
    xMask=792, yMask=22, xDst=995, yDst=0, width=22, height=22) at ../../uxa/uxa-render.c:1712
        uxa_screen = 0x3
        ret = <value optimized out>
        saveSrcRepeat = 768
        saveMaskRepeat = 0
        region = {extents = {x1 = -10896, y1 = 2696, x2 = 960, y2 = 0}, data = 0x18}
        tx = 0
        ty = 0
#16 0x0812c312 in damageComposite (op=3 '\003', pSrc=0xa88f5c0, pMask=0xa88f628, pDst=0xb82cf98, xSrc=792, ySrc=22, 
    xMask=792, yMask=22, xDst=995, yDst=0, width=22, height=22) at ../../../miext/damage/damage.c:613
        pScreen = <value optimized out>
        ps = 0xa644f18
        pScrPriv = 0xa6451f0
#17 0x08127c0b in CompositePicture (op=<value optimized out>, pSrc=0xa88f5c0, pMask=0xa88f628, pDst=0xb82cf98, 
    xSrc=792, ySrc=22, xMask=792, yMask=22, xDst=995, yDst=0, width=22, height=22) at ../../render/picture.c:1705
        ps = 0xa644f18
#18 0x0811ff79 in ProcRenderComposite (client=0xa7f8000) at ../../render/render.c:728
        pSrc = 0xa88f5c0
        pMask = 0xa88f628
        pDst = 0xb82cf98
        stuff = <value optimized out>
#19 0x0811cc63 in ProcRenderDispatch (client=0xa7f8000) at ../../render/render.c:2058
        stuff = <value optimized out>
#20 0x08070ab7 in Dispatch () at ../../dix/dispatch.c:431
        clientReady = 0xa801a80
        result = <value optimized out>
        client = 0xa7f8000
        nready = 0
        icheck = 0x8207c38
        start_tick = 37960
#21 0x0806284c in main (argc=9, argv=0xbfb2e484, envp=0xbfb2e4ac) at ../../dix/main.c:287
        i = <value optimized out>
        alwaysCheckForInput = {0, 1}
(gdb)

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-04:

#30

While not precisely the same crash, deb #596155 and fdo #28882 bugs are all faulting on the same bit of code. create_bits_picture() attempts to instantiate an image via a call to pixman_image_create_bits(), however that call can fail under a variety of circumstances and return a NULL image pointer. This is then passed unchecked to pixman_image_set_has_client_clip() where it is dereferenced and generates a seg fault as a result.

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-04:

#31

210_pixman_null_ptr_check.patch Edit (950 bytes, text/plain)

Adds trivial check for null pointer

affects:

xserver-xorg-video-intel (Ubuntu) → xorg-server (Ubuntu)

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-04:

#32

xorg-server (2:1.9.99.901+git20110131.be3be758-0ubuntu3) natty; urgency=low

  * Restore 208_switch_on_release.diff - the patch does not appear to be
    upstream actually. Users confirm the fix regressed without it.
    (LP: #711842)
  * Add 210_pixman_null_ptr_check.patch: pixman_image_create_bits() can
    return NULL under a variety of circumstances, thus needs checked
    before dereferencing it in the pixman_image_set_has_client_clip()
    call.
    (LP: #705078, deb: 596155, fdo: 28882)

-- Bryce Harrington <email address hidden> Thu, 03 Feb 2011 22:42:52 -0800

Changed in xorg-server (Ubuntu):
status:	Triaged → Fix Released

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-04:

#33

Please test tomorrow's ISO with this fix and reopen if it still occurs.

Bug Watch Updater (bug-watch-updater) on 2011-02-04

Changed in xorg-server (Debian):
status:	Unknown → New
Changed in xserver-xorg-video-intel:
importance:	Unknown → High
status:	Unknown → Confirmed

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-04:

#34

The previous patch seems to still be relevant, so I've pushed it upstream here:
https://bugs.freedesktop.org/show_bug.cgi?id=33892

Revision history for this message

Daniel Manrique (roadmr) wrote on 2011-02-04:

#35

_usr_bin_Xorg.0.crash Edit (10.5 MiB, text/plain)

Hi, visiting from bug 708744. I managed to collect a crash report of one of our failed systems (a Dell Vostro 3400), which I'm attaching, hopefully it will help confirm what Bryce found. This happens during the live install process, stopping the installation and dropping the user into a LiveCD environment/session.

I'll also try the submitted fix on all our systems, though I can't do that until monday.

Here's the backtrace as requested, the attached .crash file has additional information.

[ 141.371] 0: X (xorg_backtrace+0x3b) [0x80ef99b]
[ 141.371] 1: X (0x8048000+0x5cba8) [0x80a4ba8]
[ 141.371] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0x1bc40c]
[ 141.371] 3: /usr/lib/xorg/modules/libfb.so (0x183000+0x16a38) [0x199a38]
[ 141.371] 4: /usr/lib/xorg/modules/libfb.so (fbComposite+0x121) [0x199c81]
[ 141.372] 5: /usr/lib/xorg/modules/drivers/intel_drv.so (0x3d4000+0x2fb86) [0x403b86]
[ 141.372] 6: /usr/lib/xorg/modules/drivers/intel_drv.so (0x3d4000+0x2c3b0) [0x4003b0]
[ 141.372] 7: X (0x8048000+0xe4312) [0x812c312]
[ 141.372] 8: X (CompositePicture+0x22b) [0x8127c0b]
[ 141.372] 9: X (0x8048000+0xd7f79) [0x811ff79]
[ 141.372] 10: X (0x8048000+0xd4c63) [0x811cc63]
[ 141.372] 11: X (0x8048000+0x28ab7) [0x8070ab7]
[ 141.372] 12: X (0x8048000+0x1a84c) [0x806284c]
[ 141.372] 13: /lib/libc.so.6 (__libc_start_main+0xe6) [0x1d3ce6]
[ 141.372] 14: X (0x8048000+0x1a441) [0x8062441]
[ 141.372] Segmentation fault at address 0x20

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-04:

#36

Hi Daniel, yes that looks like the same crash.

Revision history for this message

h.tornatzky (h-tornatzky) wrote on 2011-02-06:

#37

Hi i'm from 709508.

>Bryce Harrington wrote on 2011-02-04: #7
>Were you able to successfully install after running into this crash?
Yes i was. But the system is somewhat "strange" (don't know how to describe). I'll test it with todays build and report if the problem isn't solved (on my Laptop).

Best regards
H.T

Revision history for this message

Bryce Harrington (bryce) wrote on 2011-02-07:

#38

Btw, resolution was that there was an out-of-memory situation which led to the X crash.

So if anyone still finds there are other kinds of problems during installation, you might want to analyze it as a memory bug...

Revision history for this message

Daniel Manrique (roadmr) wrote on 2011-02-07:

#39

Bryce, thanks so much for this fix.

I'm still experiencing issues during installation. Admittedly it appears to happen in a different section of code though the symptoms look similar. I observed this using the 20110207 images that contain the fix for this bug, and I was able to reproduce it on several systems.

I filed bug 714829 regarding this new problem, just commenting here in case it might be related (maybe the same out-of-memory thing you mention?).

Regards, - Daniel

Bug Watch Updater (bug-watch-updater) on 2011-10-28

Changed in xorg-server (Debian):
status:	New → Confirmed

Bug Watch Updater (bug-watch-updater) on 2011-11-24

Changed in xorg-server (Debian):
status:	Confirmed → Fix Released

Revision history for this message

In freedesktop.org Bugzilla #28882, Gitlab-migration (gitlab-migration) wrote on 2018-12-13:

#44

-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/xorg/xserver/issues/402.

Bug Watch Updater (bug-watch-updater) on 2018-12-14

Changed in xserver-xorg-video-intel:
status:	Confirmed → Unknown

xf86-video-intel

Xorg crashed with SIGSEGV in pixman_image_set_has_client_clip()

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Patches

Bug attachments

Remote bug watches

	Status	Importance	Assigned to
xf86-video-intel	Unknown	High	freedesktop-bugs #28882
xorg-server (Debian)	Fix Released	Unknown	debbugs #596155
xorg-server (Ubuntu)	Fix Released	Critical	Bryce Harrington