Bug 512514

Summary: Xorg crash: pixman-region.c:361: pixman_region_fini: Assertion `pixman_region_selfcheck (region)' failed.
Product: [Fedora] Fedora Reporter: Saikat Guha <sg266>
Component: pixmanAssignee: Søren Sandmann Pedersen <sandmann>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: rawhideCC: ajax, kem, lkundrak, xgl-maint
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-07-21 12:27:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Saikat Guha 2009-07-18 11:54:56 UTC
Description of problem:
X crashes deterministically when scrolling up in firefox on http://www.inyourpocket.com/germany/kaiserslautern/where_to_eat/category/59788-.html.

Xorg: pixman-region.c:361: pixman_region_fini: Assertion `pixman_region_selfcheck (region)' failed.


Version-Release number of selected component (if applicable):
xorg-x11-server-common-1.6.99-9.20090706.fc12.x86_64
xorg-x11-drv-ati-6.12.2-19.fc12.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Navigate to http://www.inyourpocket.com/germany/kaiserslautern/where_to_eat/category/59788-.html
2. Scroll to bottom of page
3. Scroll up by dragging scroll bar
  
Actual results:
Xorg: pixman-region.c:361: pixman_region_fini: Assertion `pixman_region_selfcheck (region)' failed.

Expected results:
X doesn't  die.

Additional info:
- Composting in metacity is enabled


[root@dent ~]# lspci
00:00.0 Host bridge: Intel Corporation Mobile 945GM/PM/GMS, 943/940GML and 945GT Express Memory Controller Hub (rev 03)
00:01.0 PCI bridge: Intel Corporation Mobile 945GM/PM/GMS, 943/940GML and 945GT Express PCI Express Root Port (rev 03)
00:1b.0 Audio device: Intel Corporation 82801G (ICH7 Family) High Definition Audio Controller (rev 02)
00:1c.0 PCI bridge: Intel Corporation 82801G (ICH7 Family) PCI Express Port 1 (rev 02)
00:1c.1 PCI bridge: Intel Corporation 82801G (ICH7 Family) PCI Express Port 2 (rev 02)
00:1c.2 PCI bridge: Intel Corporation 82801G (ICH7 Family) PCI Express Port 3 (rev 02)
00:1c.3 PCI bridge: Intel Corporation 82801G (ICH7 Family) PCI Express Port 4 (rev 02)
00:1d.0 USB Controller: Intel Corporation 82801G (ICH7 Family) USB UHCI Controller #1 (rev 02)
00:1d.1 USB Controller: Intel Corporation 82801G (ICH7 Family) USB UHCI Controller #2 (rev 02)
00:1d.2 USB Controller: Intel Corporation 82801G (ICH7 Family) USB UHCI Controller #3 (rev 02)
00:1d.3 USB Controller: Intel Corporation 82801G (ICH7 Family) USB UHCI Controller #4 (rev 02)
00:1d.7 USB Controller: Intel Corporation 82801G (ICH7 Family) USB2 EHCI Controller (rev 02)
00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev e2)
00:1f.0 ISA bridge: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge (rev 02)
00:1f.1 IDE interface: Intel Corporation 82801G (ICH7 Family) IDE Controller (rev 02)
00:1f.2 SATA controller: Intel Corporation 82801GBM/GHM (ICH7 Family) SATA AHCI Controller (rev 02)
00:1f.3 SMBus: Intel Corporation 82801G (ICH7 Family) SMBus Controller (rev 02)
01:00.0 VGA compatible controller: ATI Technologies Inc M56GL [Mobility FireGL V5250]
02:00.0 Ethernet controller: Intel Corporation 82573L Gigabit Ethernet Controller
03:00.0 Network controller: Atheros Communications Inc. AR5008 Wireless Network Adapter (rev 01)
15:00.0 CardBus bridge: Texas Instruments PCI1510 PC card Cardbus Controller

Comment 1 Lubomir Rintel 2009-07-18 15:20:54 UTC
gdb X
bt full
#0  0x00be6422 in __kernel_vsyscall ()
No symbol table info available.
#1  0x0013b891 in *__GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
        resultvar = <value optimized out>
        pid = 2654196
        selftid = 3825
#2  0x0013d18a in *__GI_abort () at abort.c:92
        act = {__sigaction_handler = {sa_handler = 0x1859f5 <*__GI___libc_realloc+213>, sa_sigaction = 0x1859f5 <*__GI___libc_realloc+213>}, 
          sa_mask = {__val = {104, 104, 3217076800, 3217077040, 3217076828, 104, 104, 95, 2659200, 2654196, 95, 94, 3217077000, 1542962, 
              148162352, 95, 3217077040, 148162352, 0, 4222451712, 148162352, 148162352, 148162352, 148162352, 148162446, 148162452, 
              148162352, 148162452, 0, 0, 0, 0}}, sa_flags = 0, sa_restorer = 0}
        sigs = {__val = {32, 0 <repeats 31 times>}}
#3  0x00134998 in *__GI___assert_fail (assertion=0x581ca7 "pixman_region_selfcheck (src)", file=0x581c22 "pixman-region.c", line=457, 
    function=0x5820ad "pixman_region_copy") at assert.c:81
        buf = 0x8d4c730 "X: pixman-region.c:457: pixman_region_copy: Assertion `pixman_region_selfcheck (src)' failed.\n"
#4  0x0053c780 in pixman_region_copy (dst=0x8d55648, src=0x8d473f0) at pixman-region.c:457
        __PRETTY_FUNCTION__ = "pixman_region_copy"
#5  0x00581ca7 in pixman_transform_multiply () at pixman-matrix.c:122
No symbol table info available.
#6  0x00581c22 in transparent_black.2613 () from /usr/lib/libpixman-1.so.0
No symbol table info available.
#7  0x000001c9 in ?? ()
No symbol table info available.
#8  0x005820ad in __PRETTY_FUNCTION__.5305 () from /usr/lib/libpixman-1.so.0
No symbol table info available.
#9  0x0053abdc in pixman_region_init (region=0x838d0c24) at pixman-region.c:330
No locals.
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
(gdb)

Comment 2 Lubomir Rintel 2009-07-18 15:54:37 UTC
Happens only with latest pixman-0.15.16-1.fc12, previous build pixman-0.15.14-1.fc12 works fine.

Comment 3 Adam Jackson 2009-07-20 21:39:30 UTC
Think this is pixman's fault.

Comment 4 Adam Jackson 2009-07-20 21:40:00 UTC
And I think Søren knows more about it than I do.

Comment 5 Søren Sandmann Pedersen 2009-07-21 12:27:39 UTC
I am concerned that there appears to be stack corruption, but the assertion is disabled in 0.15.18, which should show up in tomorrow's rawhide.