Bug 7246

Summary:	"bitmap" crashes Xorg server when compositing is enabled
Product:	xorg	Reporter:	Olivier Fourdan <fourdan>
Component:	Server/General	Assignee:	Xorg Project Team <xorg-team>
Status:	RESOLVED DUPLICATE	QA Contact:
Severity:	normal
Priority:	high
Version:	7.0.0
Hardware:	x86 (IA32)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:

Description Olivier Fourdan 2006-06-16 01:43:45 UTC

The application "bitmap" causes the Xorg server to crash as soon as compositing
is enabled.

It crashes with all the compositor I tried (xfwm4, xcompmgr, kcompmgr), with
either manual or automatic redirect.

To reproduce:

1) run "xcompmgr -a" to enable automatic compositor
2) run "bitmap"
3) Select "File -> Save As", click "Cancel" to close the save-as window
3) If not crashed yet, repeat step 3), it crashes.

The problem occurs with i386 and amd64, with both 6.9.0 and 7.0.0, and doesn't
seem to depend on the driver (open source "nv" driver and closed source "nvidia"
driver makes no difference). I can reproduce on several different hardware, with
different video cards, agp or pci-e.

Comment 1 Adam Jackson 2006-06-16 08:33:01 UTC

Nice one.  Reproducable on 7.1 on amd64:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 46912507052688 (LWP 2136)]
0x00002aaaac9225c4 in XAAPolyRectanglePixmap (pDraw=0x7c8490, pGC=0x792da0,
    nRectsInit=1, pRectsInit=0x7abf40) at xaaGC.c:484
484         XAA_PIXMAP_OP_EPILOGUE(pGC);
(gdb) print pixPriv
$5 = 0x6000ca
(gdb) print pixPriv->flags
Cannot access memory at address 0x6000ca
#0  0x00002aaaac9225c4 in XAAPolyRectanglePixmap (pDraw=0x7c8490,
    pGC=0x792da0, nRectsInit=1, pRectsInit=0x7abf40) at xaaGC.c:484
#1  0x0000000000510c92 in cwPolyRectangle (pDst=Variable "pDst" is not
available.) at cw_ops.c:292
#2  0x000000000050c39d in damagePolyRectangle (pDrawable=0x7c8490,
    pGC=0x792da0, nRects=1, pRects=0x7abf40) at damage.c:1089
#3  0x0000000000510c92 in cwPolyRectangle (pDst=Variable "pDst" is not
available.) at cw_ops.c:292
#4  0x000000000050c39d in damagePolyRectangle (pDrawable=0x7c8490,
    pGC=0x794860, nRects=1, pRects=0x7abf40) at damage.c:1089
#5  0x0000000000445788 in ProcPolyRectangle (client=0x79e9f0)
    at dispatch.c:1884

Comment 2 Eric Anholt 2006-06-16 15:39:36 UTC

This is a dupe of #5120, but it was an excellent testcase.  Thanks!

*** This bug has been marked as a duplicate of 5120 ***

Comment 3 Olivier Fourdan 2006-06-17 03:06:05 UTC

Humm, odd, if it's the same issue, it still crashes with latest nVidia
proprietary driver too, so the mentionned workarround doens't work (nVidia
proprietaty driver used is 8762, released in may 2006 while #5120 was entered in
november 2005).

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.