Bug 22752

With the latest moblin images, it is possible to reliably crash the X server by opening this url in the moblin-web-browser: http://flickr.com/photos/upload (you need to be logged in)

I shall try to add more information if I find anything more out, but I'm hoping the X server backtrace with symbols will gives someone with more insight a clue about what's broken.

versions:
xf86-video-intel-2.7.99.901
xorg-server-1.6.1.902 - with all moblin 2 patches
OpenGL renderer string: Mesa DRI Intel(R) 945GME GEM 20090114 x86/MMX/SSE2
OpenGL version string: 1.4 Mesa 7.5-rc4

hardware:
Acer aspire one

note: no compositor was running.

Program received signal SIGSEGV, Segmentation fault.
memcpy () at ../sysdeps/i386/i586/memcpy.S:90
90              movl    (%esi), %eax
Current language:  auto; currently asm
(gdb) bt
#0  memcpy () at ../sysdeps/i386/i586/memcpy.S:90
#1  0xb7879b55 in fbBlt (srcLine=0xb6cbc000, srcStride=512, srcX=0, dstLine=0x8b8a6b8, dstStride=1260, dstX=0, width=1260, 
    height=32, alu=3, pm=4294967295, bpp=32, reverse=0, upsidedown=0) at fbblt.c:93
#2  0xb787b12d in fbBltStip (src=0xb6cbc000, srcStride=128, srcX=0, dst=0x8b8a6b8, dstStride=315, dstX=0, width=10080, 
    height=32, alu=3, pm=4294967295, bpp=32) at fbblt.c:944
#3  0xb7881c75 in fbGetImage (pDrawable=0x8b9b028, x=130, y=292, w=315, h=32, format=2, planeMask=4294967295, 
    d=0x8b8a6b8 "���") at fbimage.c:332
#4  0xb791826c in uxa_get_image (pDrawable=0x8b9b028, x=0, y=0, w=315, h=32, format=2, planeMask=4294967295, 
    d=0x8b8a6b8 "���") at uxa-accel.c:1034
#5  0x081465c8 in miSpriteGetImage (pDrawable=0x8b9b028, sx=0, sy=0, w=315, h=32, format=2, planemask=4294967295, 
    pdstLine=0x8b8a6b8 "���") at misprite.c:354
#6  0x0808d457 in DoGetImage (client=0x8b51070, format=2, drawable=50331676, x=0, y=0, width=315, height=32, 
    planemask=4294967295, im_return=0x0) at dispatch.c:2041
#7  0x0808d6ff in ProcGetImage (client=0x8b51070) at dispatch.c:2128
#8  0x08088d2b in Dispatch () at dispatch.c:437
#9  0x0806f768 in main (argc=8, argv=0xbf9421e4, envp=0xbf942208) at main.c:397


At this point I have no idea what's special about the GetImage in question; I can just see from gdb'ing clutter-mozheadless that it comes from flash (though I don't expect that to really be helpful in itself)

Breakpoint 2, 0xb5f8b062 in XGetImage () from /usr/lib/libX11.so.6
#0  0xb5f8b062 in XGetImage () from /usr/lib/libX11.so.6
#1  0xb5f8b29b in XGetSubImage () from /usr/lib/libX11.so.6
#2  0xb5f17fb7 in _gdk_x11_copy_to_image (drawable=0x837f750, image=0x883f018, src_x=0, src_y=0, dest_x=0, dest_y=0, 
    width=315, height=32) at gdkimage-x11.c:619
#3  0xb5eed86c in IA__gdk_drawable_copy_to_image (drawable=0x837f750, image=0x883f018, src_x=0, src_y=0, dest_x=0, 
    dest_y=0, width=315, height=32) at gdkdraw.c:1070
#4  0xb5eed86c in IA__gdk_drawable_copy_to_image (drawable=0x80897c8, image=0x883f018, src_x=0, src_y=0, dest_x=0, 
    dest_y=0, width=315, height=32) at gdkdraw.c:1070
#5  0xb1ebdc23 in ?? () from /usr/lib/flash-plugin/libflashplayer.so
#6  0xb1eb19c5 in ?? () from /usr/lib/flash-plugin/libflashplayer.so
#7  0xb1ea8030 in ?? () from /usr/lib/flash-plugin/libflashplayer.so
#8  0xb1eacae4 in ?? () from /usr/lib/flash-plugin/libflashplayer.so
#9  0x089871fc in ?? ()
#10 0xbfffe888 in ?? ()
#11 0xb7f8ee60 in ?? () from /usr/lib/xulrunner-1.9.2a1pre-headless/libxul.so
#12 0xb7f8ee60 in ?? () from /usr/lib/xulrunner-1.9.2a1pre-headless/libxul.so
#13 0xb7fa0ff4 in sqlite3_bind_null () from /usr/lib/xulrunner-1.9.2a1pre-headless/libxul.so
#14 0xb7fa0ff4 in sqlite3_bind_null () from /usr/lib/xulrunner-1.9.2a1pre-headless/libxul.so
#15 0xbfffe858 in ?? ()
#16 0xb7605bfd in ?? () from /usr/lib/xulrunner-1.9.2a1pre-headless/libxul.so
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
clutter-mozheadless: Fatal IO error 11 (Resource temporarily unavailable) on X server :0.0.

Program received signal SIGSEGV, Segmentation fault.
__pthread_mutex_lock (mutex=0xb0e7d024) at pthread_mutex_lock.c:51
51                                  PTHREAD_MUTEX_TIMED_NP))

Note to be able to gdb clutter-mozheadless the moblin-web-browser can be run as follows:

$ CLUTTER_MOZEMBED_DEBUG=1 moblin-web-browser http://flickr.com/photos/upload
It will print somthing like:
** Message: Waiting for 'clutter-mozheadless /tmp/clutter-mozembed-21862-0 /tmp/clutter-mozheadless-21862-0 /mozheadless-21862-0' to be run
and clutter-mozheadless can be started like this:
$ gdb --args clutter-mozheadless /tmp/clutter-mozembed-21862-0 /tmp/clutter-mozheadless-21862-0 /mozheadless-21862-0