Bug 18696 - crash in XUnionRegion->miRegionCopy->memcpy - when starting compiz with X
Summary: crash in XUnionRegion->miRegionCopy->memcpy - when starting compiz with X
Alias: None
Product: xorg
Classification: Unclassified
Component: App/compiz (show other bugs)
Version: git
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: David Reveman
QA Contact: Xorg Project Team
Keywords: have-backtrace
Depends on:
Reported: 2008-11-25 05:07 UTC by Joel Bosveld
Modified: 2008-12-10 05:58 UTC (History)
0 users

See Also:
i915 platform:
i915 features:

backtrace / compiz crash report (28.35 KB, text/plain)
2008-11-25 05:08 UTC, Joel Bosveld
no flags Details

Description Joel Bosveld 2008-11-25 05:07:21 UTC
It only happens when I start compiz with X (from a script that is called by xinit/startx/whatever calls the script). If I start X and then start compiz (over ssh or from a gnome-terminal) then it works fine. 

If started with X compiz will crash once a window is opened (when I start gnome-terminal or glxgears)

I have attached the crash output from compiz (thanks to crashhandler plugin). Here is the x part:

#4  0x00007f261a5c4db9 in memcpy () from /lib/libc.so.6
#5  0x00007f261b5b1129 in miRegionCopy (dstrgn=0xc61ff0, rgn=0x7fff26427e40)
    at Region.c:553
No locals.
#6  0x00007f261b5b2258 in XUnionRegion (reg1=0xc61ff0, reg2=0x7fff26427e40, 
    newReg=0xc61ff0) at Region.c:1297
No locals.

I had a look at the code, and put some fprintf's to try figure out why it was failing. It seems that miRegionCopy would break if destrgn->rects was NULL initially (as memory is only (re)allocated if destrgn->rects != NULL) - however, after patching this (potential) problem, it was still crashing. The debug output indicated that destrgn->rects, rgn->rects were both not NULL, and numRects was 1.

Is there any more information I can/should give?

Thanks for your attention, 
Comment 1 Joel Bosveld 2008-11-25 05:08:46 UTC
Created attachment 20573 [details]
backtrace / compiz crash report
Comment 2 Joel Bosveld 2008-11-25 05:12:41 UTC
Also, this is happening with ATi radeon x800 using opensource drivers, and mesa (also from git)
Comment 3 Michel Dänzer 2008-11-25 23:41:22 UTC
I think this looks like compiz is passing at least one invalid Region to XUnionRegion().
Comment 4 Joel Bosveld 2008-12-10 05:37:20 UTC
The problem seems to be with an unofficial plugin (freewins). It seems that I missed disabling this plugin when I was testing compiz with only essential plugins.
Comment 5 Joel Bosveld 2008-12-10 05:58:23 UTC
Additionally, after updating to the latest version of freewins this no longer happens. Sorry for the noise.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.