Created attachment 16173 [details]
10000x4 GIF file that causes BadAlloc

BadAlloc errors when crashing Seamonkey:

Gdk-ERROR **: The program 'seamonkey-bin' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
  (Details: serial 9199 error_code 11 request_code 53 minor_code 0)

Gdk-ERROR **: The program 'seamonkey-bin' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
  (Details: serial 9832 error_code 11 request_code 53 minor_code 0)

Error when crashing Firefox:

Gdk-ERROR **: The program 'gecko' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
  (Details: serial 9718 error_code 11 request_code 53 minor_code 0)

gordon, you might try to test on 915GM. I can't see firefox crash on my 915G. Mine is debian's iceweasel 2.0.0.13.

> --- Comment #3 from Wang Zhenyu <zhenyu.z.wang@intel.com>  2008-04-25 02:03:04 PST ---
> gordon, you might try to test on 915GM. I can't see firefox crash on my 915G.
> Mine is debian's iceweasel 2.0.0.13.
> 
I think this might be a bug in exa fixed in the server since 1.3, there
was a commit by Eric to fix an overly restrictive check in
exaCreatePixmap a while ago.

Cheers,
Julien

(In reply to comment #4)
> I think this might be a bug in exa fixed in the server since 1.3, there
> was a commit by Eric to fix an overly restrictive check in
> exaCreatePixmap a while ago.
> 
> Cheers,
> Julien

Looks like that was it! Putting

Option      "AccelMethod" "XAA"

into xorg.conf fixes the crash.

I'm not sure of the proper resolution for this bug. Should it be FIXED or WORKSFORME?

(In reply to comment #5)
> I'm not sure of the proper resolution for this bug. Should it be FIXED or
> WORKSFORME?

So it's EXA bug. Let's keep this open until confirming the fix has been committed.

kmike, can you use the latest xserver to verify?

Eric, can you provide the commit mentioned in comment#4? 

> --- Comment #6 from Gordon Jin <gordon.jin@intel.com>  2008-04-25 23:10:06 PST ---
> Eric, can you provide the commit mentioned in comment#4? 
> 
FWIW, I was talking about bc2d516f16d94c805b4dfa8e5b9eef40ff0cbe98.
No idea whether this is in F8.

Cheers,
Julien

Thanks Julien.

kmike, can you verify if below patch fixes?

diff-tree bc2d516f16d94c805b4dfa8e5b9eef40ff0cbe98 (from feb1b3e45513bd6eaa2e6a5ee536183f20d9cb68)
Author: Eric Anholt <eric@anholt.net>
Date:   Fri Aug 17 12:14:16 2007 -0700

    Fix overly-restrictive integer overflow check in EXA pixmap creation.
    
    The result was that at 32bpp, pixmaps of width 8192 or greater couldn't be
    created, due to treating a pitch value as a width.

diff --git a/exa/exa.c b/exa/exa.c
index aa42b92..b2faf2f 100644
--- a/exa/exa.c
+++ b/exa/exa.c
@@ -253,7 +253,7 @@ exaCreatePixmap(ScreenPtr pScreen, int w
 				     pExaScr->info->pixmapPitchAlign);
     pExaPixmap->fb_size = pExaPixmap->fb_pitch * h;
 
-    if (pExaPixmap->fb_pitch > 32767) {
+    if (pExaPixmap->fb_pitch > 131071) {
 	fbDestroyPixmap(pPixmap);
 	return NULL;
     }

Unfortunately I can't recompile xserver as of this moment. Will 1.5.0-pre from Fedora Rawhide be sufficient?
http://rpmfind.net//linux/RPM/fedora/devel/i386/xorg-x11-server-Xorg-1.4.99.901-26.20080415.fc9.i386.html

(In reply to comment #9)
> Unfortunately I can't recompile xserver as of this moment. Will 1.5.0-pre from
> Fedora Rawhide be sufficient?
> http://rpmfind.net//linux/RPM/fedora/devel/i386/xorg-x11-server-Xorg-1.4.99.901-26.20080415.fc9.i386.html
> 

Maybe you can give it a try. But I'm not optimistic.

I'm closing this. Please reopen if you find new xserver including the patch doesn't help.

*** Bug 17022 has been marked as a duplicate of this bug. ***