Bug 598761
| Summary: | X server crash when text entered in Firefox Search bar | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Jerry Amundson <jamundso> |
| Component: | xorg-x11-server | Assignee: | Adam Jackson <ajax> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | low | ||
| Version: | 13 | CC: | airlied, ajax, brendon, brick, bskeggs, cooling.crystals, jglisse, mariofutire, mcepl, nuttchr, xgl-maint |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | i686 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | xorg-x11-server-Xorg-1.8.2-1.fc13 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 580251 | Environment: | |
| Last Closed: | 2010-07-13 15:08:42 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Attachments: | |||
|
Description
Jerry Amundson
2010-06-02 01:10:18 UTC
Realistically, the best way for me to research is by Debugging with gdbserver, but even that does not give many clues. This is low level. Only help if you're up to the challenge. http://www.x.org/wiki/Development/Documentation/ServerDebugging#Debuggingwithgdbserver The key part is I can search in FF and crash X. jerry, for the future, when we ask you to create a 'separate' bug, please create a new bug, do _not_ use the clone function. as you can see from the above, cloning a bug brings in all sorts of information from the original bug, which is not at all relevant to your report and will just confuse people. thanks. please add the attachments mcepl requested, too. thanks. Created attachment 419197 [details]
dmesg output
Created attachment 419198 [details]
messages
What gdb gives me: gdb) c Continuing. Program received signal SIGSEGV, Segmentation fault. __memcpy_ia32 () at ../sysdeps/i386/i686/memcpy.S:75 75 rep (gdb) bt #0 __memcpy_ia32 () at ../sysdeps/i386/i686/memcpy.S:75 #1 0x00000000 in ?? () > Yes, because your backtrace is completely different:
>
> Backtrace:
> [ 2216.783] 0: /usr/bin/X (xorg_backtrace+0x3c) [0x80e51dc]
> [ 2216.783] 1: /usr/bin/X (0x8047000+0x5e176) [0x80a5176]
> [ 2216.784] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0xc4640c]
> [ 2216.784] 3: /lib/libc.so.6 (0x282000+0x792c6) [0x2fb2c6]
> [ 2216.784] Segmentation fault at address (nil)
> [ 2216.784]
> Fatal server error:
> [ 2216.784] Caught signal 11 (Segmentation fault). Server aborting
>
> Please file a separate bug with attachments
>
> * your X server config file (/etc/X11/xorg.conf, if available),
> * output of the dmesg command, and
> * system log (/var/log/messages)
>
> to the bug report as individual uncompressed file attachments using the
> bugzilla file attachment link above.
>
> We will review this issue again once you've had a chance to attach this
> information.
>
> Thanks in advance.
Exactly the same here.
I was typing something in the search box and got this crash.
I'm running F13 in KDE up to date.
Linux thinkpad 2.6.33.5-112.fc13.i686 #1 SMP Thu May 27 03:11:56 UTC 2010 i686 i686 i386 GNU/Linux
I do not have any /etc/X11/xorg.conf.
I've attached Xorg.log, dmesg, /var/log/messages.
Created attachment 421925 [details]
Xorg.0.log of the crash
Created attachment 421926 [details]
dmesg
Created attachment 421927 [details]
/var/log/messages
I've seen that this bug has been assigned to nouveau, but in my case I do not have a nvidia card. It's a ATI. Does it matter? ATI here also. 01:00.0 VGA compatible controller: ATI Technologies Inc Radeon RV250 [Mobility FireGL 9000] (rev 01) I think this may be different to the nouveau issue it was cloned from (based on the backtraces being completely different), I'll reassign to ati for the moment and see :) Andrea you are on kde too ? Can you attach your Xorg log of a crash please. Yes KDE. I've attached it. It's the 3rd attachment is the list upstairs. You confirm that entering text in firefox search bar while under kde always lead to crash ? Do you have any custom plugin in firefox ? Created attachment 422328 [details]
Starting in safe mode, everything disabled or reset except bookmarks.
It is not always the *first* search which causes the crash, but one search or another will, eventually.
I just reproduced this with "firefox -safe-mode".
As requested here https://bugzilla.redhat.com/show_bug.cgi?id=601364 where I originally reported this bug before finding this similar situation, I'm posting the same files again with drm.debug=0x04. Moreover I've tried to attach gdb to firefox but it does not show anything. Just Program received signal SIGHUP, Hangup. I've tried as well to attach gdb to /usr/bin/X, but after attching when I try to Continue, the pc hangs. How do I debug this? Created attachment 422667 [details]
dmesg.txt with drm.debug=0x04
Created attachment 422669 [details]
/var/log/messages with drm.debug=0x04
Created attachment 422670 [details]
Xorg.0.log with drm.debug=0x04
(In reply to comment #17) > As requested here > > https://bugzilla.redhat.com/show_bug.cgi?id=601364 > > where I originally reported this bug before finding this similar situation, > > I'm posting the same files again with drm.debug=0x04. > > Moreover I've tried to attach gdb to firefox but it does not show anything. > Just > > Program received signal SIGHUP, Hangup. > > I've tried as well to attach gdb to /usr/bin/X, but after attching when I try > to Continue, the pc hangs. > > How do I debug this? I found http://www.x.org/wiki/Development/Documentation/ServerDebugging helpful. I did try the 1 machine but Xdbg does not want to start even with permissive selinux. The 2nd approach I do not have xorg.conf. I need to try to use a 2nd pc. Which method did you succed with? (In reply to comment #22) > I did try the 1 machine but Xdbg does not want to start even with permissive > selinux. > The 2nd approach I do not have xorg.conf. > > I need to try to use a 2nd pc. > > Which method did you succed with? I used a 2nd PC, with the crash PC on a wired connection, as the X restart would also drop wireless. *** Bug 601364 has been marked as a duplicate of this bug. *** Just to comment that I am having the same issue in F13 Thinkpad T41 running a ATI Radeon 7500. Only happens in firefox, never have the issue in Konquror (In reply to comment #5) > What gdb gives me: > > gdb) c > Continuing. > > Program received signal SIGSEGV, Segmentation fault. > __memcpy_ia32 () at ../sysdeps/i386/i686/memcpy.S:75 > 75 rep > (gdb) bt > #0 __memcpy_ia32 () at ../sysdeps/i386/i686/memcpy.S:75 > #1 0x00000000 in ?? () I finally managed to debug it and got exactly the same as you. 2 open points: 1) any other suggestion to debug it? 2) have we found a "precise" way to cause the crash? sometimes the first search crashes it, other time it stays on for an hour. Andrea (In reply to comment #26) > (In reply to comment #5) > > What gdb gives me: > > > > gdb) c > > Continuing. > > > > Program received signal SIGSEGV, Segmentation fault. > > __memcpy_ia32 () at ../sysdeps/i386/i686/memcpy.S:75 > > 75 rep > > (gdb) bt > > #0 __memcpy_ia32 () at ../sysdeps/i386/i686/memcpy.S:75 > > #1 0x00000000 in ?? () > > I finally managed to debug it and got exactly the same as you. > 2) have we found a "precise" way to cause the crash? sometimes the first search > crashes it, other time it stays on for an hour. In "crash world", that should be all that is required - we can reproduce it. Someone else needs to step up.... Created attachment 424551 [details] I can recreate this consistently now, and there seems more to this backtrace. To re-create, go to http://www.rosedalechev.com/Service and down in the Service Specials coupon, click "Schedule Appointment". Ping. Some love needed here. Consistently reproduced, on latest/greatest version, but always with unhelpful debuginfo. Could somebody step it up a notch please? Even just to give debugging instruction is fine. Possibly related bugs: bug #598761 bug #601898 bug #603974 Steps to Reproduce: 1. Boot using the KDE Live Fedora 13 i386 CD, and install firefox. 2. Run firefox, and start doing searches in the Google toolbar. 3. (In reply to comment #28) > Created an attachment (id=424551) [details] > I can recreate this consistently now, and there seems more to this backtrace. > > To re-create, go to http://www.rosedalechev.com/Service > and down in the Service Specials coupon, click "Schedule Appointment". Cannot reproduce here as I don't have flash installed. Makes me suspicious. And concerning that crash mentioned in comment 27 ... memcpy.S is a very low level part of glibc (.S files are assembler), so we would be much more interested in how we've got there. Which unfortunately leads to #1 0x00000000 in ?? () which tells us nothing. Are you sure you have all debuginfo packages installed (didn't gdb mention something about missing debuginfo packages)? If yes, then I am getting even more suspicious we are talking about Flash crash here (because of course there is no debuginfo for flash). If you uninstall flash plugin (just for purposes of debugging), are you still able to reproduce the issue. Of course, nothing should lead to crash of Xorg server (clearly recognized in the attachment 422670 [details] in comment 20): Backtrace: [ 101.423] 0: /usr/bin/X (xorg_backtrace+0x3c) [0x80e51dc] [ 101.423] 1: /usr/bin/X (0x8047000+0x5e176) [0x80a5176] [ 101.423] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0xf6b40c] [ 101.423] 3: /lib/libc.so.6 (0x744000+0x792c6) [0x7bd2c6] [ 101.423] Segmentation fault at address (nil) [ 101.423] I have just come across this bug report and it sounds very similar to the problem I am having on my Thinkpad R50 laptop.
My very repeatable scenario is ...
1. Start virt-manager on the laptop.
2. Connect to a KVM hypervisor on a remote server (via ssh)
3. Open a running guest on the remote server
- a popup window appears containing the message "Connecting to graphical console for guest"
- a second popup window appears on top of the first prompting for a password (to access the guest)
4. When the password is entered the X server on the laptop crashes (seemingly while trying to paint the graphical console window).
After the crash Xorg.0.log.old contains the following backtrace which is very similar to that mentioned in the previous comment (#31)
Backtrace:
[ 34175.301] 0: /usr/bin/Xorg (xorg_backtrace+0x3c) [0x80e592c]
[ 34175.301] 1: /usr/bin/Xorg (0x8047000+0x5e176) [0x80a5176]
[ 34175.301] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0x33340c]
[ 34175.301] 3: /lib/libc.so.6 (0xb55000+0x79296) [0xbce296]
[ 34175.301] Segmentation fault at address (nil)
[ 34175.301]
Fatal server error:
[ 34175.302] Caught signal 11 (Segmentation fault). Server aborting
Hooking up a second laptop to the first for debugging gives the same backtrace as in comment #27, where frame #0 is memcpy() and frame #1 is 0x00000000 in ?? ()
----------------------------------------------------------
The Thinkpad R50 contains an ATI Radeon RV250 (Mobility FireGL 9000) [1002:4c66] and is running Gnome under Fedora 13.
Interestingly the second laptop (an HP-Compaq nc6400) contains an ATI Radeon M52 (Mobility Radeon X1300) [1002:714a], and is also running Gnome under Fedora 13. However, when testing this laptop with the above scenario the X server does not crash (at least with the dozen or so runs I tried).
----------------------------------------------------------
On the Thinkpad I have tried the above scenario with Fedora 12 (fails) and Fedora 11 (succeeds).
I have tried simplifying the environment by testing it (under Fedora 13) with an Xterm in OpenBox (fails) and an Xterm in LXDE (fails).
I have tried running virt-manager on the remote server (via a tunnelled SSH session) and it still crashes the local X server.
I have tried including "nomodeset" in the boot parameters and it seems to solve the above scenario. However, sooner or later the laptop freezes up (no keyboard or mouse response).
----------------------------------------------------------
Assuming that the X server, the ATI driver, and Glibc (which contains memcpy()) are the main candidates the version information for each of these (for Fedora 13) is as follows:
xorg-x11-server-Xorg-1.8.0-17.fc13.i686
xorg-x11-drv-ati-6.13.0-1.fc13.i686
glibc-2.12-2.i686
----------------------------------------------------------
In case it is helpful, while playing around with the scenario described at the top of this comment, I found that I could avoid the X server crashing if, when being prompted for the password to access the guest (in the second popup window), I instead used the first popup window to switch from the "graphical console" presentation to the "virtual hardware details" presentation (using the "I" button), and then entered the password in the second popup window.
The second window would close, the first window would be populated with the details of the guest, and I could then switch back to the "graphical console" presentation without the X server crashing.
----------------------------------------------------------
I'll try to do some further testing / debugging. Let me know if there is any more information that might be useful.
Created attachment 429097 [details]
Debug session with resurrected stack
Following up on my previous comment (#32) the attached debugging session shows an attempt to reconstruct the call stack and debug the crash further.
If the stack can be trusted then memcpy() appears to have crashed because of a bad "dst" argument, which in turn might appears to have been caused by variables in the calling frame (such as "bpp") having bad values.
I ran out of time to push things further - perhaps tomorrow.
(In reply to comment #31) > (In reply to comment #28) > > Created an attachment (id=424551) [details] [details] > > I can recreate this consistently now, and there seems more to this backtrace. > > > > To re-create, go to http://www.rosedalechev.com/Service > > and down in the Service Specials coupon, click "Schedule Appointment". > > Cannot reproduce here as I don't have flash installed. Makes me suspicious. The steps to reproduce this in comment 30 don't involve flash. > And concerning that crash mentioned in comment 27 ... memcpy.S is a very low > level part of glibc (.S files are assembler), so we would be much more > interested in how we've got there. Which unfortunately leads to > > #1 0x00000000 in ?? () > > which tells us nothing. Are you sure you have all debuginfo packages installed > (didn't gdb mention something about missing debuginfo packages)? If yes, then I > am getting even more suspicious we are talking about Flash crash here (because > of course there is no debuginfo for flash). If you uninstall flash plugin (just > for purposes of debugging), are you still able to reproduce the issue. See comment 30. > Of course, nothing should lead to crash of Xorg server (clearly recognized in > the attachment 422670 [details] in comment 20): > > Backtrace: > [ 101.423] 0: /usr/bin/X (xorg_backtrace+0x3c) [0x80e51dc] > [ 101.423] 1: /usr/bin/X (0x8047000+0x5e176) [0x80a5176] > [ 101.423] 2: (vdso) (__kernel_rt_sigreturn+0x0) [0xf6b40c] > [ 101.423] 3: /lib/libc.so.6 (0x744000+0x792c6) [0x7bd2c6] > [ 101.423] Segmentation fault at address (nil) > [ 101.423] AFAICT, all debuginfo packages are installed. I'll confirm when I am to test it again. *** Bug 603974 has been marked as a duplicate of this bug. *** *** Bug 601898 has been marked as a duplicate of this bug. *** Jerry do you have flash installed ? Test case in #28 works for me (well no flash so i don't know what i should see) (In reply to comment #37) > Jerry do you have flash installed ? Test case in #28 works for me (well no > flash so i don't know what i should see) This seems specific to the ATI Technologies Inc Radeon RV250, which Andrea, Simon, and myself are all using. Now what should we try? I will retest with such hw, can you confirm that without flash the bug appear ? also can you do screenshot of step you do to reproduce the bug thanks (In reply to comment #39) > I will retest with such hw, can you confirm that without flash the bug appear ? > also can you do screenshot of step you do to reproduce the bug thanks Yes, I confirmed flash was not involved. See comment 30. FWIW ... I tried the test in comment #28 and had no problems clicking on the "Schedule Appointment" button and bringing up the "Schedule Goodwrench Service" dialogue. This was done with ... Firefox (firefox-3.6.4-1.fc13.i686) Shockwave Flash (10.1 r53) The versions of the X server and ATI driver are the same as in comment #32 An update rpm for the X.org server has just been released
xorg-x11-server-Xorg-1.8.2-1.fc13.i686
With this installed I no longer experience the crash I mentioned in comment #32.
I have tried numerous times but have not been able to repeat the crash, so for me it appears that the update has fixed the problem..
I checked the changelog (below) to see if I could match anything there to the problem I was having, but it wasn't obvious.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jul 1 2010 Peter Hutterer <peter.hutterer@xxxxxxxxxx> 1.8.2-1
- xserver 1.8.2
- drop upstreamed patches
* Fri Jun 18 2010 Peter Hutterer <peter.hutterer@xxxxxxxxxx> 1.8.0-17
- xserver-1.8.0-signed-deviceevents.patch: make device events signed
(#567835)
* Mon Jun 7 2010 Ben Skeggs <bskeggs@xxxxxxxxxx> 1.8.0-16
- fix bug that caused unnecessary fb resize in multi-head configurations
* Mon May 31 2010 Dave Airlie <airlied@xxxxxxxxxx> 1.8.0-15
- update xvfb-run.sh (CVE-2009-1573) (#544036)
* Fri May 7 2010 Dave Airlie <airlied@xxxxxxxxxx> 1.8.0-14
- xserver-1.6.99-right-of.patch: don't try spanning on single crtc cards.
* Thu May 6 2010 Dave Airlie <airlied@xxxxxxxxxx> 1.8.0-13
- add no connected outputs at startup patch
--------------------------------------------------------------------------------
Jerry, do you agree with comment 42? Was this fixed for you in xorg-x11-server-Xorg-1.8.2-1.fc13? (In reply to comment #43) > Jerry, do you agree with comment 42? Was this fixed for you in > xorg-x11-server-Xorg-1.8.2-1.fc13? Yes, I agree. Thank you for letting us know. |