Bug 453607 - specific webpage in firefox crashes X
Summary: specific webpage in firefox crashes X
Keywords:
Status: CLOSED DUPLICATE of bug 448586
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: xorg-x11-server
Version: 5.2
Hardware: All
OS: Linux
medium
high
Target Milestone: rc
: ---
Assignee: Adam Jackson
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-07-01 15:01 UTC by Suzanne Hillman
Modified: 2008-07-18 13:54 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-07-15 16:47:20 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
Xorg log, having reproduced the error (51.55 KB, text/plain)
2008-07-02 16:40 UTC, Suzanne Hillman
no flags Details
Xorg Log file from crash (51.48 KB, text/plain)
2008-07-18 13:54 UTC, Suzanne Hillman
no flags Details

Description Suzanne Hillman 2008-07-01 15:01:22 UTC
Program received signal SIGSEGV, Segmentation fault.
0x081478a5 in ValidateOnePicture (pPicture=0x8e9d680) at picture.c:1600
1600            (*ps->ValidatePicture) (pPicture, pPicture->stateChanges);
(gdb) bt
#0  0x081478a5 in ValidateOnePicture (pPicture=0x8e9d680) at picture.c:1600
#1  0x081478e1 in ValidatePicture (pPicture=0x8e9d680) at picture.c:1609
#2  0x081479a1 in CompositePicture (op=12 '\f', pSrc=0x8ea7418, 
    pMask=0x8e9d680, pDst=0x8e9d5d0, xSrc=0, ySrc=0, xMask=0, yMask=0, xDst=0, 
    yDst=0, width=1, height=1) at picture.c:1782
#3  0x08146dc8 in miTrapezoids (op=12 '\f', pSrc=0x8ea7418, pDst=0x8e9d5d0, 
    maskFormat=<value optimized out>, xSrc=0, ySrc=0, ntrap=0, traps=0x8eac408)
    at mitrap.c:175
#4  0x08147d13 in CompositeTrapezoids (op=12 '\f', pSrc=0x8ea7418, 
    pDst=0x8e9d5d0, maskFormat=0x8d9fc28, xSrc=0, ySrc=0, ntrap=3, 
    traps=0x8eac390) at picture.c:1848
#5  0x0814e9c4 in ProcRenderTrapezoids (client=0x8df5320) at render.c:820
#6  0x0814ac15 in ProcRenderDispatch (client=0x8d9aaff) at render.c:2005
#7  0x0808815a in Dispatch () at dispatch.c:459
#8  0x0806fab5 in main (argc=10, argv=0xbf8f5b54, envp=0x0) at main.c:447



xorg-x11-server-Xorg-1.1.1-48.41.el5_2.1
xorg-x11-drv-mga-1.4.2-7.el5
xorg-x11-drv-vesa-1.3.0-8.1.el5



Section "ServerLayout"
        Identifier     "Default Layout"
        Screen      0  "Screen0" 0 0
        InputDevice    "Keyboard0" "CoreKeyboard"
EndSection

Section "InputDevice"
        Identifier  "Keyboard0"
        Driver      "kbd"
        Option      "XkbModel" "pc105"
        Option      "XkbLayout" "us"
        Option      "XkbVariant" "dvorak"
EndSection

Section "Device"
        Identifier  "Videocard0"
        Driver      "vesa"
EndSection

Section "Screen"
        Identifier "Screen0"
        Device     "Videocard0"
        DefaultDepth     24
        SubSection "Display"
                Viewport   0 0
                Depth     24
        EndSubSection
EndSection

Section "Extensions"
        Option "Composite" "off"
EndSection

---

Does not happen on benl's machine (Intel something?). Something about wrapping
the code that would normally be used; the vesa driver may cause it on that
machine, too. 

URL in question:
http://idmwiki.sfbay.redhat.com/export/idmwiki/index.php/RHEL5_SSO_TSD

Comment 1 Matěj Cepl 2008-07-01 23:35:17 UTC
Please attach your X server log file (/var/log/Xorg.*.log) to the bug report as
individual uncompressed file attachment using the bugzilla file attachment link
below.

We will review this issue again once you've had a chance to attach this information.

Thanks in advance.

Comment 2 Suzanne Hillman 2008-07-02 16:31:45 UTC
FYI, it does also happen with mga as the Device; vesa was just testing that ajax
did. Will attach log file soon.

Comment 3 Suzanne Hillman 2008-07-02 16:40:19 UTC
Created attachment 310825 [details]
Xorg log, having reproduced the error

This does seem to require the 1400x1050 resolution; it did not happen at
1600x1200 when I was trying to give a logfile in which it had been reproduced.

Comment 4 Matěj Cepl 2008-07-04 13:24:18 UTC
Looks more like server to me -- crash in
usr/bin/Xorg(ValidatePicture+0x11) [0x81478e1]


Comment 5 Juliano F. Ravasi 2008-07-13 01:28:54 UTC
URL doesn't open.

Please, could you confirm if this URL causes the same crash?
http://en.wikipedia.org/wiki/Special:Allmessages

I'm having similar crashes in Fedora 8 with the above URL, with intel
(open-source) and nvidia (closed-source) drivers, but with a different backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x0044817f in fbRasterizeEdges (buf=0x8695098, bpp=8, width=436, stride=109,
l=0xbffaff54,
    r=0xbffaff2c, t=-2147481464, b=28571510) at fbedge.c:171
171                     ap[lxi] = clip255 (ap[lxi] + N_X_FRAC(8) - lxs);
(gdb) backtrace
#0  0x0044817f in fbRasterizeEdges (buf=0x8695098, bpp=8, width=436, stride=109,
l=0xbffaff54,
    r=0xbffaff2c, t=-2147481464, b=28571510) at fbedge.c:171
#1  0x00440a0f in fbRasterizeTrapezoid (pPicture=0x85fe368, trap=0x864e978,
    x_off=<value optimized out>, y_off=0) at fbtrap.c:143
#2  0x0035534a in _nv000753X () from /usr/lib/xorg/modules/drivers//nvidia_drv.so

Also bug 448586 seems related.

Comment 6 Matěj Cepl 2008-07-15 16:47:20 UTC

*** This bug has been marked as a duplicate of 455209 ***

Comment 7 Matěj Cepl 2008-07-15 16:47:43 UTC

*** This bug has been marked as a duplicate of 448586 ***

Comment 8 Suzanne Hillman 2008-07-18 13:54:15 UTC
FWIW, the URL in comment #5 does also cause a crash, although I'm not sure that
it's the same problem. Attaching log from that crash.

Comment 9 Suzanne Hillman 2008-07-18 13:54:46 UTC
Created attachment 312138 [details]
Xorg Log file from crash


Note You need to log in before you can comment on or make changes to this bug.