Bug 739488

Created attachment 523806 [details]
Xorg.0.log.old

Hardware: http://www.smolts.org/client/show/pub_46e92a8f-2fad-4ef2-b610-c88f04d8cde6

---------------------------------
In function RecordAReply:
(from frame 3: /usr/lib64/xorg/modules/extensions/librecord.so (0x7f9ad9bc9000+0x2693) [0x7f9ad9bcb693])
603: RecordAReply(CallbackListPtr *pcbl, pointer nulldata, pointer calldata)
604: {
605:     RecordContextPtr pContext;
606:     RecordClientsAndProtocolPtr pRCAP;
607:     int eci;
608:     int majorop;
609:     ReplyInfoRec *pri = (ReplyInfoRec *)calldata;
610:     ClientPtr client = pri->client;
611:     REQUEST(xReq);
612: 
613: >>>>>>>     majorop = stuff->reqType;
614:     for (eci = 0; eci < numEnabledContexts; eci++)
615:     {
616: 	pContext = ppAllContexts[eci];
617: 	pRCAP = RecordFindClientOnContext(pContext, client->clientAsMask,
618: 					  NULL);
619: 	if (pRCAP)
620: 	{
621: 	    if (pContext->continuedReply)
622: 	    {
623: 		RecordAProtocolElement(pContext, client, XRecordFromServer,


Frame 4: /usr/bin/Xorg (_CallCallbacks+0x3c) [0x43354c]
	/usr/src/debug/xorg-server-1.10.4/dix/dixutils.c:741
	_CallCallbacks
Frame 5: /usr/bin/Xorg (WriteToClient+0x1f5) [0x4619b5]
	/usr/src/debug/xorg-server-1.10.4/os/../include/callback.h:86
	CallCallbacks
Frame 10: /usr/bin/Xorg (WakeupHandler+0x5b) [0x432d2b]
	/usr/src/debug/xorg-server-1.10.4/dix/dixutils.c:418
	WakeupHandler
Frame 11: /usr/bin/Xorg (WaitForSomething+0x1a9) [0x45c2e9]
	/usr/src/debug/xorg-server-1.10.4/os/WaitFor.c:236
	WaitForSomething
Frame 12: /usr/bin/Xorg (0x400000+0x2eb4a) [0x42eb4a]
	/usr/src/debug/xorg-server-1.10.4/dix/dispatch.c:369
	Dispatch
Frame 13: /usr/bin/Xorg (0x400000+0x22e1a) [0x422e1a]
	/usr/src/debug/xorg-server-1.10.4/dix/main.c:296
	main

My Xserver restarted again. The traceback is exactly the same. This time I was opening zive.cz in Firefox.

I managed to crash X server many times, by entering a sequence of '9' and [Enter] into a text input field. 
Applications crashing the X server after the nine-enter sequence:
  KDE Konsole
  Firefox7 (I took several attempts to enter this comment. X server crashed several times, even after pressing 'Enter' alone)
  KDE System Activity (in Quick Search)
  KiCad schematic library editor 

Crashes are almost 100% reproducible (each of the above applications was tested multiple times, almost every time after 'nine-Enter' X Server crashed.

Environment:
Distro: F15/64
Desktop manager: KDE
Graphics card: NVIDIA GTS250
Driver: Nvidia binary blob 280.13

Backtrace from Xorg.0.log:
[ 25721.866] 0: /usr/bin/X (xorg_backtrace+0x2f) [0x45e84f]
[ 25721.866] 1: /usr/bin/X (0x400000+0x62ed6) [0x462ed6]
[ 25721.866] 2: /lib64/libpthread.so.0 (0x7f6353e62000+0xeef0) [0x7f6353e70ef0]
[ 25721.866] 3: /lib64/libc.so.6 (__select+0x13) [0x7f6352c551d3]
[ 25721.866] 4: /usr/bin/X (WaitForSomething+0x186) [0x45c2c6]
[ 25721.866] 5: /usr/bin/X (0x400000+0x2eb4a) [0x42eb4a]
[ 25721.866] 6: /usr/bin/X (0x400000+0x22e1a) [0x422e1a]
[ 25721.866] 7: /lib64/libc.so.6 (__libc_start_main+0xed) [0x7f6352b9d39d]
[ 25721.866] 8: /usr/bin/X (0x400000+0x23101) [0x423101]
[ 25721.866] 
Fatal server error:
[ 25721.866] Caught signal 3 (Quit). Server aborting

(In reply to comment #5)
> Driver: Nvidia binary blob 280.13

I am sorry, unless you can reproduce this with plain Fedora packages (run
rpm -Va 'xorg*' 'mesa*'
to make sure that none of these packages are corrupted), we cannot help you.

If you can reproduce it with free software, please, provide as with exact version numbers of packages for all files mentioned in the backtrace). Thank you.

Reproduced with NOUVEAU driver. Server crashed after nine-Enter sequence typed in the process search field of KDE's System Activity window.
Binary Nvidia driver has been uninstalled, xorg.conf deleted and KDE configuration reset (by removing ~/.kde directory) prior to performing the test. 

All xorg and mesa packages are intact:
[jacek@dragon32 ~]$ sudo rpm -Va 'xorg*' 'mesa*'
[jacek@dragon32 ~]$ 

List of installed xorg and mesa packages produced by "rpm -qa |egrep -i 'xorg|mesa'" and a complete Xorg.0.log attached.

Created attachment 525889 [details]
X server crash log for NOUVEAU driver

Created attachment 525890 [details]
List of packages corresponding to the crash log

As a side note: I could not reproduce the crash when nouveau.modeset=0 option was active and the X server was running with vesa driver.

(In reply to comment #0)
> [   601.209] 0: /usr/bin/Xorg (xorg_backtrace+0x2f) [0x45e84f]
> [   601.209] 1: /usr/bin/Xorg (0x400000+0x62ed6) [0x462ed6]
> [   601.209] 2: /lib64/libpthread.so.0 (0x38da000000+0xeef0) [0x38da00eef0]
> [   601.209] 3: /usr/lib64/xorg/modules/extensions/librecord.so
> (0x7f9ad9bc9000+0x2693) [0x7f9ad9bcb693]
> [   601.209] 4: /usr/bin/Xorg (_CallCallbacks+0x3c) [0x43354c]
> [   601.209] 5: /usr/bin/Xorg (WriteToClient+0x1f5) [0x4619b5]
> [   601.209] 6: /usr/lib64/xorg/modules/extensions/libdri2.so
> (ProcDRI2WaitMSCReply+0x4f) [0x7f9ad97bcf6f]
> [   601.209] 7: /usr/lib64/xorg/modules/extensions/libdri2.so
> (DRI2WaitMSCComplete+0x52) [0x7f9ad97bb702]
> [   601.209] 8: /usr/lib64/xorg/modules/drivers/intel_drv.so
> (0x7f9ad9569000+0x2556d) [0x7f9ad958e56d]
> [   601.209] 9: /usr/lib64/libdrm.so.2 (drmHandleEvent+0xa3) [0x38eec074e3]
> [   601.209] 10: /usr/bin/Xorg (WakeupHandler+0x5b) [0x432d2b]
> [   601.209] 11: /usr/bin/Xorg (WaitForSomething+0x1a9) [0x45c2e9]
> [   601.209] 12: /usr/bin/Xorg (0x400000+0x2eb4a) [0x42eb4a]
> [   601.209] 13: /usr/bin/Xorg (0x400000+0x22e1a) [0x422e1a]
> [   601.209] 14: /lib64/libc.so.6 (__libc_start_main+0xed) [0x38d9c2139d]
> [   601.209] 15: /usr/bin/Xorg (0x400000+0x23101) [0x423101]
> [   601.209] Segmentation fault at address 0x7f9ad411e010

The backtrace looks exactly like this one in upstream bugzilla:

https://bugs.freedesktop.org/show_bug.cgi?id=36930

This message is a notice that Fedora 15 is now at end of life. Fedora
has stopped maintaining and issuing updates for Fedora 15. It is
Fedora's policy to close all bug reports from releases that are no
longer maintained. At this time, all open bugs with a Fedora 'version'
of '15' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that
we were unable to fix it before Fedora 15 reached end of life. If you
would still like to see this bug fixed and are able to reproduce it
against a later version of Fedora, you are encouraged to click on
"Clone This Bug" (top right of this page) and open it against that
version of Fedora.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

The process we are following is described here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping