Description of problem: X crashes deterministically when scrolling up in firefox on http://www.inyourpocket.com/germany/kaiserslautern/where_to_eat/category/59788-.html. Xorg: pixman-region.c:361: pixman_region_fini: Assertion `pixman_region_selfcheck (region)' failed. Version-Release number of selected component (if applicable): xorg-x11-server-common-1.6.99-9.20090706.fc12.x86_64 xorg-x11-drv-ati-6.12.2-19.fc12.x86_64 How reproducible: Always Steps to Reproduce: 1. Navigate to http://www.inyourpocket.com/germany/kaiserslautern/where_to_eat/category/59788-.html 2. Scroll to bottom of page 3. Scroll up by dragging scroll bar Actual results: Xorg: pixman-region.c:361: pixman_region_fini: Assertion `pixman_region_selfcheck (region)' failed. Expected results: X doesn't die. Additional info: - Composting in metacity is enabled [root@dent ~]# lspci 00:00.0 Host bridge: Intel Corporation Mobile 945GM/PM/GMS, 943/940GML and 945GT Express Memory Controller Hub (rev 03) 00:01.0 PCI bridge: Intel Corporation Mobile 945GM/PM/GMS, 943/940GML and 945GT Express PCI Express Root Port (rev 03) 00:1b.0 Audio device: Intel Corporation 82801G (ICH7 Family) High Definition Audio Controller (rev 02) 00:1c.0 PCI bridge: Intel Corporation 82801G (ICH7 Family) PCI Express Port 1 (rev 02) 00:1c.1 PCI bridge: Intel Corporation 82801G (ICH7 Family) PCI Express Port 2 (rev 02) 00:1c.2 PCI bridge: Intel Corporation 82801G (ICH7 Family) PCI Express Port 3 (rev 02) 00:1c.3 PCI bridge: Intel Corporation 82801G (ICH7 Family) PCI Express Port 4 (rev 02) 00:1d.0 USB Controller: Intel Corporation 82801G (ICH7 Family) USB UHCI Controller #1 (rev 02) 00:1d.1 USB Controller: Intel Corporation 82801G (ICH7 Family) USB UHCI Controller #2 (rev 02) 00:1d.2 USB Controller: Intel Corporation 82801G (ICH7 Family) USB UHCI Controller #3 (rev 02) 00:1d.3 USB Controller: Intel Corporation 82801G (ICH7 Family) USB UHCI Controller #4 (rev 02) 00:1d.7 USB Controller: Intel Corporation 82801G (ICH7 Family) USB2 EHCI Controller (rev 02) 00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev e2) 00:1f.0 ISA bridge: Intel Corporation 82801GBM (ICH7-M) LPC Interface Bridge (rev 02) 00:1f.1 IDE interface: Intel Corporation 82801G (ICH7 Family) IDE Controller (rev 02) 00:1f.2 SATA controller: Intel Corporation 82801GBM/GHM (ICH7 Family) SATA AHCI Controller (rev 02) 00:1f.3 SMBus: Intel Corporation 82801G (ICH7 Family) SMBus Controller (rev 02) 01:00.0 VGA compatible controller: ATI Technologies Inc M56GL [Mobility FireGL V5250] 02:00.0 Ethernet controller: Intel Corporation 82573L Gigabit Ethernet Controller 03:00.0 Network controller: Atheros Communications Inc. AR5008 Wireless Network Adapter (rev 01) 15:00.0 CardBus bridge: Texas Instruments PCI1510 PC card Cardbus Controller
gdb X bt full #0 0x00be6422 in __kernel_vsyscall () No symbol table info available. #1 0x0013b891 in *__GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 resultvar = <value optimized out> pid = 2654196 selftid = 3825 #2 0x0013d18a in *__GI_abort () at abort.c:92 act = {__sigaction_handler = {sa_handler = 0x1859f5 <*__GI___libc_realloc+213>, sa_sigaction = 0x1859f5 <*__GI___libc_realloc+213>}, sa_mask = {__val = {104, 104, 3217076800, 3217077040, 3217076828, 104, 104, 95, 2659200, 2654196, 95, 94, 3217077000, 1542962, 148162352, 95, 3217077040, 148162352, 0, 4222451712, 148162352, 148162352, 148162352, 148162352, 148162446, 148162452, 148162352, 148162452, 0, 0, 0, 0}}, sa_flags = 0, sa_restorer = 0} sigs = {__val = {32, 0 <repeats 31 times>}} #3 0x00134998 in *__GI___assert_fail (assertion=0x581ca7 "pixman_region_selfcheck (src)", file=0x581c22 "pixman-region.c", line=457, function=0x5820ad "pixman_region_copy") at assert.c:81 buf = 0x8d4c730 "X: pixman-region.c:457: pixman_region_copy: Assertion `pixman_region_selfcheck (src)' failed.\n" #4 0x0053c780 in pixman_region_copy (dst=0x8d55648, src=0x8d473f0) at pixman-region.c:457 __PRETTY_FUNCTION__ = "pixman_region_copy" #5 0x00581ca7 in pixman_transform_multiply () at pixman-matrix.c:122 No symbol table info available. #6 0x00581c22 in transparent_black.2613 () from /usr/lib/libpixman-1.so.0 No symbol table info available. #7 0x000001c9 in ?? () No symbol table info available. #8 0x005820ad in __PRETTY_FUNCTION__.5305 () from /usr/lib/libpixman-1.so.0 No symbol table info available. #9 0x0053abdc in pixman_region_init (region=0x838d0c24) at pixman-region.c:330 No locals. Backtrace stopped: previous frame inner to this frame (corrupt stack?) (gdb)
Happens only with latest pixman-0.15.16-1.fc12, previous build pixman-0.15.14-1.fc12 works fine.
Think this is pixman's fault.
And I think Søren knows more about it than I do.
I am concerned that there appears to be stack corruption, but the assertion is disabled in 0.15.18, which should show up in tomorrow's rawhide.