Bug 453607

Summary: specific webpage in firefox crashes X
Product: Red Hat Enterprise Linux 5 Reporter: Suzanne Hillman <shillman>
Component: xorg-x11-serverAssignee: Adam Jackson <ajax>
Status: CLOSED DUPLICATE QA Contact:
Severity: high Docs Contact:
Priority: medium    
Version: 5.2CC: bugs+fedora, xgl-maint
Target Milestone: rcKeywords: Desktop
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-07-15 16:47:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Xorg log, having reproduced the error
none
Xorg Log file from crash none

Description Suzanne Hillman 2008-07-01 15:01:22 UTC
Program received signal SIGSEGV, Segmentation fault.
0x081478a5 in ValidateOnePicture (pPicture=0x8e9d680) at picture.c:1600
1600            (*ps->ValidatePicture) (pPicture, pPicture->stateChanges);
(gdb) bt
#0  0x081478a5 in ValidateOnePicture (pPicture=0x8e9d680) at picture.c:1600
#1  0x081478e1 in ValidatePicture (pPicture=0x8e9d680) at picture.c:1609
#2  0x081479a1 in CompositePicture (op=12 '\f', pSrc=0x8ea7418, 
    pMask=0x8e9d680, pDst=0x8e9d5d0, xSrc=0, ySrc=0, xMask=0, yMask=0, xDst=0, 
    yDst=0, width=1, height=1) at picture.c:1782
#3  0x08146dc8 in miTrapezoids (op=12 '\f', pSrc=0x8ea7418, pDst=0x8e9d5d0, 
    maskFormat=<value optimized out>, xSrc=0, ySrc=0, ntrap=0, traps=0x8eac408)
    at mitrap.c:175
#4  0x08147d13 in CompositeTrapezoids (op=12 '\f', pSrc=0x8ea7418, 
    pDst=0x8e9d5d0, maskFormat=0x8d9fc28, xSrc=0, ySrc=0, ntrap=3, 
    traps=0x8eac390) at picture.c:1848
#5  0x0814e9c4 in ProcRenderTrapezoids (client=0x8df5320) at render.c:820
#6  0x0814ac15 in ProcRenderDispatch (client=0x8d9aaff) at render.c:2005
#7  0x0808815a in Dispatch () at dispatch.c:459
#8  0x0806fab5 in main (argc=10, argv=0xbf8f5b54, envp=0x0) at main.c:447



xorg-x11-server-Xorg-1.1.1-48.41.el5_2.1
xorg-x11-drv-mga-1.4.2-7.el5
xorg-x11-drv-vesa-1.3.0-8.1.el5



Section "ServerLayout"
        Identifier     "Default Layout"
        Screen      0  "Screen0" 0 0
        InputDevice    "Keyboard0" "CoreKeyboard"
EndSection

Section "InputDevice"
        Identifier  "Keyboard0"
        Driver      "kbd"
        Option      "XkbModel" "pc105"
        Option      "XkbLayout" "us"
        Option      "XkbVariant" "dvorak"
EndSection

Section "Device"
        Identifier  "Videocard0"
        Driver      "vesa"
EndSection

Section "Screen"
        Identifier "Screen0"
        Device     "Videocard0"
        DefaultDepth     24
        SubSection "Display"
                Viewport   0 0
                Depth     24
        EndSubSection
EndSection

Section "Extensions"
        Option "Composite" "off"
EndSection

---

Does not happen on benl's machine (Intel something?). Something about wrapping
the code that would normally be used; the vesa driver may cause it on that
machine, too. 

URL in question:
http://idmwiki.sfbay.redhat.com/export/idmwiki/index.php/RHEL5_SSO_TSD

Comment 1 Matěj Cepl 2008-07-01 23:35:17 UTC
Please attach your X server log file (/var/log/Xorg.*.log) to the bug report as
individual uncompressed file attachment using the bugzilla file attachment link
below.

We will review this issue again once you've had a chance to attach this information.

Thanks in advance.

Comment 2 Suzanne Hillman 2008-07-02 16:31:45 UTC
FYI, it does also happen with mga as the Device; vesa was just testing that ajax
did. Will attach log file soon.

Comment 3 Suzanne Hillman 2008-07-02 16:40:19 UTC
Created attachment 310825 [details]
Xorg log, having reproduced the error

This does seem to require the 1400x1050 resolution; it did not happen at
1600x1200 when I was trying to give a logfile in which it had been reproduced.

Comment 4 Matěj Cepl 2008-07-04 13:24:18 UTC
Looks more like server to me -- crash in
usr/bin/Xorg(ValidatePicture+0x11) [0x81478e1]


Comment 5 Juliano F. Ravasi 2008-07-13 01:28:54 UTC
URL doesn't open.

Please, could you confirm if this URL causes the same crash?
http://en.wikipedia.org/wiki/Special:Allmessages

I'm having similar crashes in Fedora 8 with the above URL, with intel
(open-source) and nvidia (closed-source) drivers, but with a different backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x0044817f in fbRasterizeEdges (buf=0x8695098, bpp=8, width=436, stride=109,
l=0xbffaff54,
    r=0xbffaff2c, t=-2147481464, b=28571510) at fbedge.c:171
171                     ap[lxi] = clip255 (ap[lxi] + N_X_FRAC(8) - lxs);
(gdb) backtrace
#0  0x0044817f in fbRasterizeEdges (buf=0x8695098, bpp=8, width=436, stride=109,
l=0xbffaff54,
    r=0xbffaff2c, t=-2147481464, b=28571510) at fbedge.c:171
#1  0x00440a0f in fbRasterizeTrapezoid (pPicture=0x85fe368, trap=0x864e978,
    x_off=<value optimized out>, y_off=0) at fbtrap.c:143
#2  0x0035534a in _nv000753X () from /usr/lib/xorg/modules/drivers//nvidia_drv.so

Also bug 448586 seems related.

Comment 6 Matěj Cepl 2008-07-15 16:47:20 UTC

*** This bug has been marked as a duplicate of 455209 ***

Comment 7 Matěj Cepl 2008-07-15 16:47:43 UTC

*** This bug has been marked as a duplicate of 448586 ***

Comment 8 Suzanne Hillman 2008-07-18 13:54:15 UTC
FWIW, the URL in comment #5 does also cause a crash, although I'm not sure that
it's the same problem. Attaching log from that crash.

Comment 9 Suzanne Hillman 2008-07-18 13:54:46 UTC
Created attachment 312138 [details]
Xorg Log file from crash