Bug 125973 - XDrawImageString16 sometimes crashes the X server with the nv driver
Summary: XDrawImageString16 sometimes crashes the X server with the nv driver
Alias: None
Product: Fedora
Classification: Fedora
Component: xorg-x11 (Show other bugs)
(Show other bugs)
Version: 3
Hardware: i386 Linux
Target Milestone: ---
Assignee: X/OpenGL Maintenance List
QA Contact: David Lawrence
Depends On:
Blocks: FC4Blocker
TreeView+ depends on / blocked
Reported: 2004-06-14 18:07 UTC by Jerry James
Modified: 2007-11-30 22:10 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-04-20 17:25:15 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
X server log (34.25 KB, text/plain)
2004-07-12 16:48 UTC, Jerry James
no flags Details
X configuration file (11.17 KB, text/plain)
2004-07-12 16:50 UTC, Jerry James
no flags Details
lsmod output (1.36 KB, text/plain)
2004-07-12 16:52 UTC, Jerry James
no flags Details
/var/log/messages (103.93 KB, text/plain)
2004-07-12 16:54 UTC, Jerry James
no flags Details
X server log (34.53 KB, text/plain)
2004-07-14 15:07 UTC, Jerry James
no flags Details
/var/log/messages (5.68 KB, text/plain)
2004-07-14 15:09 UTC, Jerry James
no flags Details
spam that crashes X (40.07 KB, text/plain)
2004-08-12 23:36 UTC, Jeffrey Siegal
no flags Details
Spam that crashes X server (1.62 KB, application/octet-stream)
2005-01-07 15:32 UTC, Jerry James
no flags Details

Description Jerry James 2004-06-14 18:07:15 UTC
Description of problem:

I have an nVidia GeForce 4 MX video card.  Using the "nv" X11 driver,
I get a repeatable X server crash (signal 11) when using XEmacs 21.5
(current CVS) + Gnus, using the steps specified below.  I compiled a
vanilla 2.6.6 kernel, and installed nVidia's proprietary drive.  Now
it sometimes works, sometimes gets the same segfault, and sometimes
locks up the X server, all using the same recipe to reproduce.  I used
GDB in a TTY to attach to the XEmacs process prior to inducing the
crash, and ran XEmacs with -synchronous.  Doing so revealed that the
crash or lockup is occurring immediately after XEmacs makes a call to
XDrawImageString16 in order to draw the separator between the Summary
window and the Article window in Gnus.  Since the X server has no
debug symbols, I have no way of knowing what it thinks it is doing.

The end of /var/log/Xorg.0.log always looks like this right after the

(II) XINPUT: Adding extended input device "Mouse0" (type: MOUSE)
(II) Mouse0: ps2EnableDataReporting: succeeded
SetClientVersion: 0 8

   *** If unresolved symbols were reported above, they might not
   *** be the reason for the server aborting.

Fatal server error:
Caught signal 11.  Server aborting

Please consult the The X.Org Foundation support
         at http://wiki.X.Org
 for help.
Please also check the log file at "/var/log/Xorg.0.log" for additional

The "SetClientVersion" line is the last one in the log in the case of
a lockup.

Version-Release number of selected component (if applicable):

XEmacs 21.5 (current CVS)
Gnus 5.10.6 (XEmacs package version 1.80)

How reproducible:

Get a machine with an nVidia GeForce 4 MX video card, compile XEmacs
21.5 from CVS, install the Gnus package, and try to read mail or news.

Steps to Reproduce:
1. Start XEmacs 21.5
2. Start Gnus (with M-x gnus or from the toolbar)
3. Select a news or mail group to read
4. Observe a server segfault (or lockup using nVidia's driver)

Actual results:

X server segfault or lockup

Expected results:

No X server segfault or lockup

Additional info:

Comment 1 Mike A. Harris 2004-07-07 07:12:55 UTC
In order to investigate this, we'll need you to first attach your
X server log, config file and /var/log/messages from the time
of system boot onward, as uncompressed file attachments using the
bugzilla file attachment link below.

Please also include the output of "lsmod".

Thanks in advance.

Comment 2 Jerry James 2004-07-07 18:35:00 UTC
I upgraded to xorg-x11-6.7.0-5 just before receiving your message, and
now I cannot provoke the crash anymore.  Whether it has been fixed or
gone Heisenberg, I cannot say.  If you would like to investigate
further, I will downgrade and produce the information you requested. 
Otherwise, from my point of view, X11 is now working correctly.

Comment 3 Jerry James 2004-07-12 16:48:45 UTC
Created attachment 101815 [details]
X server log

Comment 4 Jerry James 2004-07-12 16:49:21 UTC
Apparently it went Heisenberg.  Over the weekend, I managed to trigger
the crash on 2 different machines.  I am attaching the requested files
from one of those 2 machines.  I am willing to build the X server with
debug symbols to help track this down.  However, I will need
information on how to successfully attach a debugger to the X server,
or get it to dump core when it segfaults.

Comment 5 Jerry James 2004-07-12 16:50:56 UTC
Created attachment 101816 [details]
X configuration file

Comment 6 Jerry James 2004-07-12 16:52:02 UTC
Created attachment 101817 [details]
lsmod output

Comment 7 Jerry James 2004-07-12 16:54:58 UTC
Created attachment 101818 [details]

Comment 8 Mike A. Harris 2004-07-12 17:26:04 UTC
gdb is incapable of debugging a running modular X server.  You have
to recompile a static X server in order to debug it, or use a hacked
gdb.  I've got a hacked gdb source and binaries on my ftp space
on people.redhat.com but it only works on older OS releases.

xf86Msg() is another mechanism that can be used to debug, although
it is rather painful.

Your system appears to be using SELinux, which is highly experimental
currently and not yet recommended for everyday usage.  Please disable
selinux by putting "selinux=0" in your kernel commandline, and see
if the problems still occur.

Also, your system has the proprietary Nvidia drivers installed on it
which are interfering with proper X server operation of the "nv"

(EE) Failed to initialize GLX extension (NVIDIA XFree86 driver not found)

In order to resolve that issue, you will have to uninstall the
proprietary driver, and reinstall the xorg-x11 package that comes
with the OS, in order to restore the Xorg supplied libglx which
Nvidia's driver installation deletes, along with the libGL that
comes with the OS.

Please update with your results, and a new X server log file once
you've reinstalled the OS supplied files, and we'll review the

Thanks in advance.

Comment 9 Jerry James 2004-07-14 15:05:32 UTC
Yes, I am experimenting with SELinux here, but I have no problem
turning it off while trying to debug the X problem.  As I mentioned in
the original report, I tried the nVidia drivers to see if they made
the problem go away.  I thought I had uninstalled them, but obviously
muffed that step.  They are all the way gone now.

I have discovered that the crash only occurs when I try to enter a
mail folder where some of the message subjects have non-ASCII
characters.  In practical terms, this means I only crash when entering
my spam folder.  I do not yet know whether all non-ASCII characters
cause the crash or only some of them.

With SELinux off and nVidia really gone, I reproduced the crash this
morning.  I will attach the new X server log file and /var/log/messages.

Comment 10 Jerry James 2004-07-14 15:07:24 UTC
Created attachment 101902 [details]
X server log

Comment 11 Jerry James 2004-07-14 15:09:12 UTC
Created attachment 101903 [details]

Comment 12 Jeffrey Siegal 2004-08-12 23:36:29 UTC
Created attachment 102684 [details]
spam that crashes X

I'm seeing this as well, fully patched FC2 on Radeon 8500 with standard driver.
Opening the attached spam message in mozilla 1.7.2 causes the X server to

Comment 13 Jerry James 2005-01-07 15:32:36 UTC
Created attachment 109473 [details]
Spam that crashes X server

I have a complete (i.e., all packages installed) FC3 installation, updated as
of this morning, 7 Jan 2005.  Opening the attached spam email with XEmacs 21.5
+ Gnus (current CVS of both) crashes the X server.  The nv driver appears to be
absolved of blame; I get the crash on another FC3 machine with a different
video card.  Note that this spam has Big5 encoded From and Subject headers, and
that the crash occurs when Gnus tries to draw the Summary buffer; i.e., it is
only drawing the From and Subject lines, and NOT the message body when the
crash occurs.

Comment 14 Jerry James 2005-02-08 23:34:05 UTC
The problem lies with at least one of the fonts in the ttfonts-zh_TW
RPM (I have ttfonts-zh_TW-2.11-28 installed on my FC3 machines).  Here
are the steps to reproduce.

1. Start up xfontsel.
2. Choose foundry "arphic technology co.".  Note that window
corruption has already started.  It will get worse.
3. Choose family "ar pl kaitim big5".
4. Choose registry "iso10646".
5. At this point, the X server segfaults.

Note that ftlint finds no problems with the font file, which is

Comment 15 Jerry James 2005-02-25 15:59:54 UTC
The crash using xfontsel can be provoked on Fedora Core 3 as well, so I am
changing the bug header accordingly.  Also note that the font in question can be
viewed successfully with ftview.

Comment 16 Mike A. Harris 2005-03-06 22:46:49 UTC
Soeren recently fixed a very similar bug to this, and I think
this might be a duplicate bug with a different font triggering it.

Please test xorg-x11-6.8.2 from rawhide, and let us know if it
fixes the problem.

Comment 17 Jerry James 2005-03-07 21:31:39 UTC
I installed xorg-x11-6.8.2 from rawhide.  The xfontsel recipe still crashes the
X server.

Comment 19 Mike A. Harris 2005-04-15 10:53:21 UTC
Please report this problem to X.Org developers also by filing a bug report
in the X.org bugzilla located at http://bugs.freedesktop.org in the "xorg"
component.  This will maximize the number of developers who are aware of the
problem, and increase the chances of it being resolved sooner.

Once you've filed your bug report to X.Org, if you paste the new
bug URL here, Red Hat will continue to track the issue in the
centralized X.Org bug tracker, and will review any bug fixes that
become available for consideration in future updates.

Setting status to "NEEDINFO", and awaiting uptream bug report URL.

Thanks in advance.

Comment 21 Mike A. Harris 2005-04-19 19:49:16 UTC
James:  While reviewing this today, we discovered that the fix that
was checked into rawhide which we believed should fix this for you,
did not end up getting built until March 10th due to some build
failures.  You indicated on the 7th that rawhide did not solve the
problem, which makes sense now as the fix was in CVS but not actually
in rawhide.

Could you please try updating to xorg-x11-6.8.2-22 or later from
rawhide, which has the patch I had referred to before.  This would
be helpful in diagnosing this, as we still believe this patch
should likely resolve the issue.

If not, we'll have to explore other possibilities.

Sorry for any confusion.

Comment 22 Jerry James 2005-04-20 16:33:24 UTC
I installed xorg-x11-6.8.2-25 from rawhide.  I can no longer provoke the crash.
 Thank you very much!

Comment 23 Mike A. Harris 2005-04-20 17:25:15 UTC
Good news!  Thanks for the feedback!

Setting status to "RAWHIDE"

Note You need to log in before you can comment on or make changes to this bug.