Bug 510403 - Xorg crashes when attempting to view movie with VLC
Xorg crashes when attempting to view movie with VLC
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: xorg-x11-server (Show other bugs)
rawhide
All Linux
low Severity medium
: ---
: ---
Assigned To: X/OpenGL Maintenance List
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-07-09 00:14 EDT by Jonathan Kamens
Modified: 2009-07-18 23:10 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-07-18 23:10:39 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jonathan Kamens 2009-07-09 00:14:07 EDT
With all current packages from Rawhide and vlc-1.0.0-0.11rc3 recompiled from source downloaded from rpmfusion-free-rawhide, my X server (vesa driver) crashes pretty consistently when I attempt to view a movie with vlc.

I replaced /usr/bin/Xorg with a valgrind wrapper with valgrind output redirected into a file, and found a number of memory read/write errors, some of which are almost certainly relevant to the crash (the ones in libpixman happen right before the crash).  You can reproduce them yourself easily enough by running Xorg with valgrind, but I'll cut and paste a sampling of them here for reference.

Several like this happen early on:

==13150== Invalid read of size 4
==13150==    at 0x8150DF7: SrvXkbApplyCompatMapToKey (in /usr/bin/Xorg.real)
==13150==    by 0x813C972: XkbUpdateDescActions (in /usr/bin/Xorg.real)
==13150==    by 0x813CC08: XkbUpdateActions (in /usr/bin/Xorg.real)
==13150==    by 0x8144C86: InitKeyboardDeviceStruct (in /usr/bin/Xorg.real)
==13150==    by 0x80649B0: CoreKeyboardProc (in /usr/bin/Xorg.real)
==13150==    by 0x8067D32: ActivateDevice (in /usr/bin/Xorg.real)
==13150==    by 0x8069012: InitCoreDevices (in /usr/bin/Xorg.real)
==13150==    by 0x8063187: main (in /usr/bin/Xorg.real)
==13150==  Address 0x590c5a0 is 0 bytes after a block of size 1,952 alloc'd
==13150==    at 0x4006F3D: malloc (vg_replace_malloc.c:207)
==13150==    by 0x80A8368: Xalloc (in /usr/bin/Xorg.real)
==13150==    by 0x813BEE8: XkbCopyKeymap (in /usr/bin/Xorg.real)
==13150==    by 0x81448FA: InitKeyboardDeviceStruct (in /usr/bin/Xorg.real)
==13150==    by 0x80649B0: CoreKeyboardProc (in /usr/bin/Xorg.real)
==13150==    by 0x8067D32: ActivateDevice (in /usr/bin/Xorg.real)
==13150==    by 0x8069012: InitCoreDevices (in /usr/bin/Xorg.real)
==13150==    by 0x8063187: main (in /usr/bin/Xorg.real)

And these happen right before the crash:

==13150== Invalid read of size 4
==13150==    at 0x71ECBD4: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43ea88c is not stack'd, malloc'd or (recently) free'd
==13150== 
==13150== Invalid write of size 4
==13150==    at 0x71ECBBA: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43ea88c is not stack'd, malloc'd or (recently) free'd
==13150== 
==13150== Invalid read of size 8
==13150==    at 0x71ECD00: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43ea8b0 is 16 bytes inside a block of size 88 free'd
==13150==    at 0x4005BCA: free (vg_replace_malloc.c:323)
==13150==    by 0x80A80B0: Xfree (in /usr/bin/Xorg.real)
==13150==    by 0x8082C9A: FreeGC (in /usr/bin/Xorg.real)
==13150==    by 0x808C80E: FreeClientResources (in /usr/bin/Xorg.real)
==13150==    by 0x8069E9E: CloseDownClient (in /usr/bin/Xorg.real)
==13150==    by 0x806EC17: Dispatch (in /usr/bin/Xorg.real)
==13150==    by 0x80631E4: main (in /usr/bin/Xorg.real)
==13150== 
==13150== Invalid write of size 8
==13150==    at 0x71ECD69: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43ea8b0 is 16 bytes inside a block of size 88 free'd
==13150==    at 0x4005BCA: free (vg_replace_malloc.c:323)
==13150==    by 0x80A80B0: Xfree (in /usr/bin/Xorg.real)
==13150==    by 0x8082C9A: FreeGC (in /usr/bin/Xorg.real)
==13150==    by 0x808C80E: FreeClientResources (in /usr/bin/Xorg.real)
==13150==    by 0x8069E9E: CloseDownClient (in /usr/bin/Xorg.real)
==13150==    by 0x806EC17: Dispatch (in /usr/bin/Xorg.real)
==13150==    by 0x80631E4: main (in /usr/bin/Xorg.real)
==13150== 
==13150== Invalid read of size 4
==13150==    at 0x71ECDCE: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43ea8e0 is 64 bytes inside a block of size 88 free'd
==13150==    at 0x4005BCA: free (vg_replace_malloc.c:323)
==13150==    by 0x80A80B0: Xfree (in /usr/bin/Xorg.real)
==13150==    by 0x8082C9A: FreeGC (in /usr/bin/Xorg.real)
==13150==    by 0x808C80E: FreeClientResources (in /usr/bin/Xorg.real)
==13150==    by 0x8069E9E: CloseDownClient (in /usr/bin/Xorg.real)
==13150==    by 0x806EC17: Dispatch (in /usr/bin/Xorg.real)
==13150==    by 0x80631E4: main (in /usr/bin/Xorg.real)
==13150== 
==13150== Invalid write of size 4
==13150==    at 0x71ECDB5: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43ea8e0 is 64 bytes inside a block of size 88 free'd
==13150==    at 0x4005BCA: free (vg_replace_malloc.c:323)
==13150==    by 0x80A80B0: Xfree (in /usr/bin/Xorg.real)
==13150==    by 0x8082C9A: FreeGC (in /usr/bin/Xorg.real)
==13150==    by 0x808C80E: FreeClientResources (in /usr/bin/Xorg.real)
==13150==    by 0x8069E9E: CloseDownClient (in /usr/bin/Xorg.real)
==13150==    by 0x806EC17: Dispatch (in /usr/bin/Xorg.real)
==13150==    by 0x80631E4: main (in /usr/bin/Xorg.real)
==13150== 
==13150== Invalid write of size 4
==13150==    at 0x71ECC35: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DC709: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71DD789: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71E8218: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71B39B2: (within /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x71D5F83: pixman_image_composite (in /usr/lib/libpixman-1.so.0.15.14)
==13150==    by 0x4AE1DDE: fbComposite (in /usr/lib/xorg/modules/libfb.so)
==13150==    by 0x811574A: damageComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810906F: CompositePicture (in /usr/bin/Xorg.real)
==13150==    by 0x810EF2C: ProcRenderComposite (in /usr/bin/Xorg.real)
==13150==    by 0x810BBD2: ProcRenderDispatch (in /usr/bin/Xorg.real)
==13150==    by 0x806ED86: Dispatch (in /usr/bin/Xorg.real)
==13150==  Address 0x43eae6c is 876 bytes inside a block of size 1,792 free'd
==13150==    at 0x4007070: realloc (vg_replace_malloc.c:429)
==13150==    by 0x80A8202: Xrealloc (in /usr/bin/Xorg.real)
==13150==    by 0x809C4E9: mieqProcessInputEvents (in /usr/bin/Xorg.real)
==13150==    by 0x80B2E06: ProcessInputEvents (in /usr/bin/Xorg.real)
==13150==    by 0x806EAAF: Dispatch (in /usr/bin/Xorg.real)
==13150==    by 0x80631E4: main (in /usr/bin/Xorg.real)
Comment 1 Søren Sandmann Pedersen 2009-07-17 20:24:26 EDT
Can you still reproduce these with latest rawhide? I believe they are fixed now.

Note You need to log in before you can comment on or make changes to this bug.