Bug 680116

Summary: [Cantiga] Quitting OpenGL app crashes Xorg
Product: [Fedora] Fedora Reporter: Kamil Páral <kparal>
Component: xorg-x11-serverAssignee: Adam Jackson <ajax>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 15CC: ajax, xgl-maint, zkabelac
Target Milestone: ---Keywords: Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 680082 Environment:
Last Closed: 2011-04-14 21:49:47 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 680082    
Bug Blocks:    
Attachments:
Description Flags
Xorg.0.log.old
none
messages after Xorg crash
none
dmesg after Xorg crash none

Description Kamil Páral 2011-02-24 12:00:52 UTC
+++ This bug was initially created as a clone of Bug #680082 +++

Description of problem:
While doing this test day:
https://fedoraproject.org/wiki/Test_Day:2011-02-24_Intel
https://fedoraproject.org/wiki/QA:Testcase_intelvideo_3D_tuxracer

I discovered problems when running etracer. Before running this command, I had two displays attached (internal laptop LCD and external display through docking station). After running etracer, external display is turned off and internal LCD displays gnome shell in "expo" mode (bug 680082 concerns that problem). After quitting etracer, there is about 50% chance that Xserver crashes and restarts.

I have also reproduces this behaviour with openarena. I believe this could be the same for most fullscreen OpenGL apps (games).

Version-Release number of selected component (if applicable):
xorg-x11-drv-intel-2.14.0-2.fc15.x86_64
xorg-x11-server-Xorg-1.9.99.1-4.20101201.fc15.x86_64

How reproducible:
always

Steps to Reproduce:
1. have two displays
2. run etracer
4. quit etracer
5. see Xserver crash (repeat if it doesn't crash)
  
Expected results:
Xserver doesn't crash.

--- Additional comment from kparal on 2011-02-24 05:22:04 EST ---

Created attachment 480706 [details]
rpm -qa output

--- Additional comment from kparal on 2011-02-24 05:23:41 EST ---

Created attachment 480708 [details]
dmesg

--- Additional comment from kparal on 2011-02-24 05:23:56 EST ---

Created attachment 480709 [details]
messages

--- Additional comment from kparal on 2011-02-24 05:24:11 EST ---

Created attachment 480711 [details]
Xorg.0.log

Comment 1 Kamil Páral 2011-02-24 12:02:44 UTC
Created attachment 480735 [details]
Xorg.0.log.old

The Xserver backtrace is:

Backtrace:
[  5998.225] 0: /usr/bin/Xorg (xorg_backtrace+0x2f) [0x4a120f]
[  5998.225] 1: /usr/bin/Xorg (0x400000+0x61da6) [0x461da6]
[  5998.225] 2: /lib64/libc.so.6 (0x32dd200000+0x36300) [0x32dd236300]
[  5998.225] 3: /usr/lib64/xorg/modules/extensions/libglx.so (0x7ff3a93d3000+0x32c8b) [0x7ff3a9405c8b]
[  5998.225] 4: /usr/bin/Xorg (FreeClientResources+0xd5) [0x44bf95]
[  5998.225] 5: /usr/bin/Xorg (CloseDownClient+0x5e) [0x42db5e]
[  5998.225] 6: /usr/bin/Xorg (0x400000+0x2de02) [0x42de02]
[  5998.225] 7: /usr/bin/Xorg (0x400000+0x2e6a1) [0x42e6a1]
[  5998.225] 8: /usr/bin/Xorg (0x400000+0x2292a) [0x42292a]
[  5998.225] 9: /lib64/libc.so.6 (__libc_start_main+0xed) [0x32dd2212fd]
[  5998.225] 10: /usr/bin/Xorg (0x400000+0x22c11) [0x422c11]
[  5998.225] Segmentation fault at address 0x3af
[  5998.225] 
Fatal server error:
[  5998.225] Caught signal 11 (Segmentation fault). Server aborting

Comment 3 Kamil Páral 2011-02-24 12:08:46 UTC
Created attachment 480736 [details]
messages after Xorg crash

Comment 4 Kamil Páral 2011-02-24 12:09:16 UTC
Created attachment 480737 [details]
dmesg after Xorg crash

Comment 5 Zdenek Kabelac 2011-03-08 21:19:34 UTC
My assumption is - it's the same bug as my problem I could see when I quit Xsession:

(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007fd95594fb31 in DrawableGone (glxPriv=0x3362d60, xid=<optimized out>) at glxext.c:171
#2  0x000000000044c4a5 in FreeClientResources (client=0x1372ca0) at resource.c:854
#3  0x000000000044c558 in FreeAllResources () at resource.c:871
#4  0x0000000000422d9c in main (argc=<optimized out>, argv=0x7fff2250b368, envp=<optimized out>) at main.c:301


(gdb) up
#1  0x00007fd95594fb31 in DrawableGone (glxPriv=0x3362d60, xid=<optimized out>) at glxext.c:171
171	    glxPriv->destroy(glxPriv);
(gdb) print *glxPriv 
$1 = {destroy = 0, swapBuffers = 0, copySubBuffer = 0, waitX = 0x1, waitGL = 0x39527225, pDraw = 0x3440590, drawId = 0, 
  type = 0, config = 0x0, target = 0, format = 0, eventMask = 1}



Obviously  'destroy' pointer is NULL - so either the structure is improperly initialized - or damaged by some overwrite - I assume valgrind would show more details.

Comment 6 Zdenek Kabelac 2011-03-08 21:20:24 UTC
Note - as mutter is now opengl app - every user of gnome3 is affected.

Comment 7 Zdenek Kabelac 2011-03-08 21:21:49 UTC
Assuming it's duplication of  Bug 674464.

Comment 8 Adam Jackson 2011-04-14 21:49:47 UTC

*** This bug has been marked as a duplicate of bug 690461 ***