Bug 510403

Summary:	Xorg crashes when attempting to view movie with VLC
Product:	[Fedora] Fedora	Reporter:	Jonathan Kamens <jik>
Component:	xorg-x11-server	Assignee:	X/OpenGL Maintenance List <xgl-maint>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	rawhide	CC:	sandmann, xgl-maint
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-07-19 03:10:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jonathan Kamens 2009-07-09 04:14:07 UTC

With all current packages from Rawhide and vlc-1.0.0-0.11rc3 recompiled from source downloaded from rpmfusion-free-rawhide, my X server (vesa driver) crashes pretty consistently when I attempt to view a movie with vlc.

I replaced /usr/bin/Xorg with a valgrind wrapper with valgrind output redirected into a file, and found a number of memory read/write errors, some of which are almost certainly relevant to the crash (the ones in libpixman happen right before the crash).  You can reproduce them yourself easily enough by running Xorg with valgrind, but I'll cut and paste a sampling of them here for reference.

Several like this happen early on:

==13150== Invalid read of size 4
==13150==    at 0x8150DF7: SrvXkbApplyCompatMapToKey (in /usr/bin/Xorg.real)
==13150==    by 0x813C972: XkbUpdateDescActions (in /usr/bin/Xorg.real)
==13150==    by 0x813CC08: XkbUpdateActions (in /usr/bin/Xorg.real)
==13150==    by 0x8144C86: InitKeyboardDeviceStruct (in /usr/bin/Xorg.real)
==13150==    by 0x80649B0: CoreKeyboardProc (in /usr/bin/Xorg.real)
==13150==    by 0x8067D32: ActivateDevice (in /usr/bin/Xorg.real)
==13150==    by 0x8069012: InitCoreDevices (in /usr/bin/Xorg.real)
==13150==    by 0x8063187: main (in /usr/bin/Xorg.real)
==13150==  Address 0x590c5a0 is 0 bytes after a block of size 1,952 alloc'd
==13150==    at 0x4006F3D: malloc (vg_replace_malloc.c:207)
==13150==    by 0x80A8368: Xalloc (in /usr/bin/Xorg.real)
==13150==    by 0x813BEE8: XkbCopyKeymap (in /usr/bin/Xorg.real)
==13150==    by 0x81448FA: InitKeyboardDeviceStruct (in /usr/bin/Xorg.real)
==13150==    by 0x80649B0: CoreKeyboardProc (in /usr/bin/Xorg.real)
==13150==    by 0x8067D32: ActivateDevice (in /usr/bin/Xorg.real)
==13150==    by 0x8069012: InitCoreDevices (in /usr/bin/Xorg.real)
==13150==    by 0x8063187: main (in /usr/bin/Xorg.real)

And these happen right before the crash:

==13150== Invalid read of size 4
==13150==    at 0x71ECBD4: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43ea88c is not stack'd, malloc'd or (recently) free'd
==13150== 
==13150== Invalid write of size 4
==13150==    at 0x71ECBBA: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43ea88c is not stack'd, malloc'd or (recently) free'd
==13150== 
==13150== Invalid read of size 8
==13150==    at 0x71ECD00: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43ea8b0 is 16 bytes inside a block of size 88 free'd
==13150==    at 0x4005BCA: free (vg_replace_malloc.c:323)
==13150==    by 0x80A80B0: Xfree (in /usr/bin/Xorg.real)
==13150==    by 0x8082C9A: FreeGC (in /usr/bin/Xorg.real)
==13150==    by 0x808C80E: FreeClientResources (in /usr/bin/Xorg.real)
==13150==    by 0x8069E9E: CloseDownClient (in /usr/bin/Xorg.real)
==13150==    by 0x806EC17: Dispatch (in /usr/bin/Xorg.real)
==13150==    by 0x80631E4: main (in /usr/bin/Xorg.real)
==13150== 
==13150== Invalid write of size 8
==13150==    at 0x71ECD69: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43ea8b0 is 16 bytes inside a block of size 88 free'd
==13150==    at 0x4005BCA: free (vg_replace_malloc.c:323)
==13150==    by 0x80A80B0: Xfree (in /usr/bin/Xorg.real)
==13150==    by 0x8082C9A: FreeGC (in /usr/bin/Xorg.real)
==13150==    by 0x808C80E: FreeClientResources (in /usr/bin/Xorg.real)
==13150==    by 0x8069E9E: CloseDownClient (in /usr/bin/Xorg.real)
==13150==    by 0x806EC17: Dispatch (in /usr/bin/Xorg.real)
==13150==    by 0x80631E4: main (in /usr/bin/Xorg.real)
==13150== 
==13150== Invalid read of size 4
==13150==    at 0x71ECDCE: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43ea8e0 is 64 bytes inside a block of size 88 free'd
==13150==    at 0x4005BCA: free (vg_replace_malloc.c:323)
==13150==    by 0x80A80B0: Xfree (in /usr/bin/Xorg.real)
==13150==    by 0x8082C9A: FreeGC (in /usr/bin/Xorg.real)
==13150==    by 0x808C80E: FreeClientResources (in /usr/bin/Xorg.real)
==13150==    by 0x8069E9E: CloseDownClient (in /usr/bin/Xorg.real)
==13150==    by 0x806EC17: Dispatch (in /usr/bin/Xorg.real)
==13150==    by 0x80631E4: main (in /usr/bin/Xorg.real)
==13150== 
==13150== Invalid write of size 4
==13150==    at 0x71ECDB5: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43ea8e0 is 64 bytes inside a block of size 88 free'd
==13150==    at 0x4005BCA: free (vg_replace_malloc.c:323)
==13150==    by 0x80A80B0: Xfree (in /usr/bin/Xorg.real)
==13150==    by 0x8082C9A: FreeGC (in /usr/bin/Xorg.real)
==13150==    by 0x808C80E: FreeClientResources (in /usr/bin/Xorg.real)
==13150==    by 0x8069E9E: CloseDownClient (in /usr/bin/Xorg.real)
==13150==    by 0x806EC17: Dispatch (in /usr/bin/Xorg.real)
==13150==    by 0x80631E4: main (in /usr/bin/Xorg.real)
==13150== 
==13150== Invalid write of size 4
==13150==    at 0x71ECC35: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43eae6c is 876 bytes inside a block of size 1,792 free'd
==13150==    at 0x4007070: realloc (vg_replace_malloc.c:429)
==13150==    by 0x80A8202: Xrealloc (in /usr/bin/Xorg.real)
==13150==    by 0x809C4E9: mieqProcessInputEvents (in /usr/bin/Xorg.real)
==13150==    by 0x80B2E06: ProcessInputEvents (in /usr/bin/Xorg.real)
==13150==    by 0x806EAAF: Dispatch (in /usr/bin/Xorg.real)
==13150==    by 0x80631E4: main (in /usr/bin/Xorg.real)

Comment 1 Søren Sandmann Pedersen 2009-07-18 00:24:26 UTC

Can you still reproduce these with latest rawhide? I believe they are fixed now.