Bug 87207

Created attachment 110695 [details]
Crash Log #1

Created attachment 110696 [details]
Config #2

The same crash was observed on a DELL machine with a radeon card and an similar integrated intel card.

Created attachment 110697 [details]
Crash Log #2

This bug is a reproduction of one I opened against Fedora 21: https://bugzilla.redhat.com/show_bug.cgi?id=1172232

I should note that both of the "broken" configurations work correctly under Fedora 20 which has the driver package:
    xorg-x11-drv-intel-2.21.15-9.fc20.x86_64

vs that on Fedora 21:
    xorg-x11-drv-intel-2.99.916-3.20141117.fc21.x86_64

Seems to be an uninitialised pointer. Any chance you can capture a bt using gdb? Building xf86-video-intel with --enable-debug=full would be ideal.

I installed the *-debuginfo packages:

[root@sfb3 xorg.conf.d]# gdb /usr/libexec/Xorg.bin 
GNU gdb (GDB) Fedora 7.8.1-30.fc21
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/libexec/Xorg.bin...Reading symbols from /usr/lib/debug/usr/libexec/Xorg.bin.debug...done.
done.
(gdb) r
Starting program: /usr/libexec/Xorg.bin 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

X.Org X Server 1.16.2
Release Date: 2014-11-10
X Protocol Version 11, Revision 0
Build Operating System:  3.17.2-200.fc20.x86_64 
Current Operating System: Linux sfb3.samnet 3.17.4-301.fc21.x86_64 #1 SMP Thu Nov 27 19:09:10 UTC 2014 x86_64
Kernel command line: BOOT_IMAGE=/vmlinuz-3.17.4-301.fc21.x86_64 root=/dev/mapper/fedora-root ro rd.lvm.lv=fedora/swap rd.md=0 rd.dm=0 rd.luks.uuid=luks-cd76133d-e2e2-4c28-b276-14bab25a3f20 rd.lvm.lv=fedora/root rhgb quiet LANG=en_US.UTF-8 3
Build Date: 21 November 2014  01:15:20AM
Build ID: xorg-x11-server 1.16.2-1.fc21 
Current version of pixman: 0.32.6
	Before reporting problems, check http://wiki.x.org
	to make sure that you have the latest version.
Markers: (--) probed, (**) from config file, (==) default setting,
	(++) from command line, (!!) notice, (II) informational,
	(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(==) Log file: "/var/log/Xorg.0.log", Time: Wed Dec 10 16:43:25 2014
(==) Using config directory: "/etc/X11/xorg.conf.d"
(==) Using system config directory "/usr/share/X11/xorg.conf.d"
[tcsetpgrp failed in terminal_inferior: Operation not permitted]
[New Thread 0x7ffff2ed6700 (LWP 3392)]

Program received signal SIGSEGV, Segmentation fault.
sna_mode_init (sna=0x7ffff2689000, screen=0x9dafa0) at sna_driver.c:1075
1075		sna->mode.rrGetInfo = rp->rrGetInfo;
Missing separate debuginfos, use: debuginfo-install audit-libs-2.4.1-1.fc21.x86_64 bzip2-libs-1.0.6-14.fc21.x86_64 dbus-libs-1.8.6-3.fc21.x86_64 elfutils-libelf-0.160-1.fc21.x86_64 elfutils-libs-0.160-1.fc21.x86_64 freetype-2.5.3-11.fc21.x86_64 libXau-1.0.8-4.fc21.x86_64 libXdmcp-1.1.1-7.fc21.x86_64 libXfont-1.5.0-2.fc21.x86_64 libdrm-2.4.58-3.fc21.x86_64 libfontenc-1.1.2-3.fc21.x86_64 libgcrypt-1.6.1-7.fc21.x86_64 libgpg-error-1.13-3.fc21.x86_64 libpciaccess-0.13.3-0.3.fc21.x86_64 libpng-1.6.10-3.fc21.x86_64 libselinux-2.3-5.fc21.x86_64 libunwind-1.1-7.fc21.x86_64 libxshmfence-1.1-3.fc21.x86_64 openssl-libs-1.0.1j-1.fc21.x86_64 pcre-8.35-7.fc21.x86_64 pixman-0.32.6-4.fc21.x86_64 systemd-libs-216-12.fc21.x86_64 xz-libs-5.1.2-14alpha.fc21.x86_64 zlib-1.2.8-7.fc21.x86_64
(gdb) bt all
No symbol "all" in current context.
(gdb) help bt
Print backtrace of all stack frames, or innermost COUNT frames.
With a negative argument, print outermost -COUNT frames.
Use of the 'full' qualifier also prints the values of the local variables.
Use of the 'no-filters' qualifier prohibits frame filters from executing
on this backtrace.

(gdb) bt full
#0  sna_mode_init (sna=0x7ffff2689000, screen=0x9dafa0) at sna_driver.c:1075
        rp = 0x0
#1  sna_screen_init (screen=screen@entry=0x9dafa0, argc=argc@entry=1, argv=argv@entry=0x7fffffffe4c8) at sna_driver.c:1176
        scrn = 0x867b00
        sna = 0x7ffff2689000
        visuals = 0x9db730
        depths = 0x9db6b0
        nvisuals = 2
        ndepths = 7
        rootdepth = 24
        defaultVisual = 630
#2  0x0000000000439351 in AddScreen (pfnInit=0x7ffff35b4930 <sna_screen_init>, argc=argc@entry=1, argv=argv@entry=0x7fffffffe4c8) at dispatch.c:3821
        i = 1
        pScreen = 0x9dafa0
#3  0x000000000047b4b1 in InitOutput (pScreenInfo=pScreenInfo@entry=0x838280 <screenInfo>, argc=argc@entry=1, argv=argv@entry=0x7fffffffe4c8) at xf86Init.c:917
        i = 1
        j = <optimized out>
        k = <optimized out>
        scr_index = <optimized out>
        modulelist = <optimized out>
        optionlist = 0x84f770
        screenpix24 = <optimized out>
        pix24 = <optimized out>
        pix24From = <optimized out>
        pix24Fail = 0
        autoconfig = <optimized out>
        sigio_blocked = 0
        want_hw_access = <optimized out>
        configured_device = <optimized out>
#4  0x000000000043cf6a in dix_main (argc=1, argv=0x7fffffffe4c8, envp=<optimized out>) at main.c:202
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#5  0x0000003cdac1ffe0 in __libc_start_main (main=0x4275f0 <main>, argc=1, argv=0x7fffffffe4c8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe4b8)
    at libc-start.c:289
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, 2960306975316988272, 4355573, 140737488348352, 0, 0, -2960306652655300240, 2984948345770955120}, mask_was_saved = 0}}, priv = {pad = {
              0x0, 0x0, 0x5a8c20 <__libc_csu_init>, 0x7fffffffe4c8}, data = {prev = 0x0, cleanup = 0x0, canceltype = 5934112}}}
        not_first_call = <optimized out>
#6  0x000000000042761e in _start ()
No symbol table info available.
(gdb) 

...

(gdb) list
1070		xf86RandR12SetRotations(screen, RR_Rotate_All | RR_Reflect_All);
1071		xf86RandR12SetTransformSupport(screen, TRUE);
1072	
1073		/* Wrap RR queries to catch pending MST topology changes */
1074		rp = rrGetScrPriv(screen);
1075		sna->mode.rrGetInfo = rp->rrGetInfo;
1076		rp->rrGetInfo = sna_randr_getinfo;
1077	
1078		return TRUE;
1079	}
(gdb) print screen
$1 = (ScreenPtr) 0x9dafa0
(gdb) print rp
$2 = (rrScrPrivPtr) 0x0
(gdb) frame
#0  sna_mode_init (sna=0x7ffff2689000, screen=0x9dafa0) at sna_driver.c:1075
1075		sna->mode.rrGetInfo = rp->rrGetInfo;
(gdb)

Hmm, iirc this is due to a conflict between Xinerama and Randr. Thanks for the stacktrace, I think I have enough now to fix it.

Excellent. Thank you for your efforts!

commit f587d71f3c91f9ddcc4cdbe8a0f9ce59590d9db2
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Thu Dec 11 08:53:54 2014 +0000

    sna: Catch NULL RandR screen private
    
    If Xinerama is enabled, than RandR12 will be silently disabled. Be
    careful not to dereference the rrScrPiv when it doesn't exist.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=87207
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Might this be related to the bug I reported at
https://bugzilla.redhat.com/show_bug.cgi?id=1294536 

In which version has this been corrected?