Bug 18895 - BackingStore option causes crashes in miValidateTree
Summary: BackingStore option causes crashes in miValidateTree
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Server/General (show other bugs)
Version: 7.3 (2007.09)
Hardware: All Linux (All)
: medium normal
Assignee: Adam Jackson
QA Contact: Xorg Project Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-12-04 18:26 UTC by Bryce Harrington
Modified: 2014-03-24 16:45 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments
Xorg.0.log (51.56 KB, application/octet-stream)
2009-04-02 17:23 UTC, Enrico Tagliavini
no flags Details

Description Bryce Harrington 2008-12-04 18:26:30 UTC
Several reporters are finding the Backingstore option causes crashes on a range of different hardware:
https://bugs.edge.launchpad.net/ubuntu/+source/xorg-server/+bug/274988

Below is a backtrace from the crash.  Is this option supposed to work reliably?  If not, perhaps it should be deprecated?

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fe72afc46e0 (LWP 11393)]
0x00000000004de71e in miValidateTree (pParent=0x2144a40, 
    pChild=0x7fff32fe79c0, kind=VTMap) at ../../mi/mivaltree.c:790
	in ../../mi/mivaltree.c
(gdb) backtrace full
#0  0x00000000004de71e in miValidateTree (pParent=0x2144a40, 
    pChild=0x7fff32fe79c0, kind=VTMap) at ../../mi/mivaltree.c:790
	totalClip = {extents = {x1 = 0, y1 = 24, x2 = 0, y2 = 24}, 
  data = 0x7e1c60}
	childClip = {extents = {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, 
  data = 0x7e1c60}
	childUnion = {extents = {x1 = 1, y1 = 0, x2 = 0, y2 = 0}, data = 0x0}
	exposed = {extents = {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, 
  data = 0x7e1c60}
	pScreen = (ScreenPtr) 0x20e4a90
	pWin = (WindowPtr) 0x0
	overlap = 1
	viewvals = 0
	forward = 855538080
#1  0x00007fe728693813 in DRIValidateTree (pParent=0x2144a40, 
    pChild=0x28daa00, kind=VTMap) at ../../../../hw/xfree86/dri/dri.c:2055
	pScreen = (ScreenPtr) 0x20e4a90
	returnValue = <value optimized out>
#2  0x0000000000438e67 in MapWindow (pWin=0x28daa00, 
    client=<value optimized out>) at ../../dix/window.c:2811
	event = {u = {u = {type = 19 '\023', detail = 123 '{', 
      sequenceNumber = 1236}, keyButtonPointer = {pad00 = 81034003, 
      time = 104, root = 52429243, event = 1, child = 36695712, rootX = 0, 
      rootY = 0, eventX = 22480, eventY = 126, state = 0, 
      sameScreen = 0 '\0', pad1 = 0 '\0'}, enterLeave = {pad00 = 81034003, 
      time = 104, root = 52429243, event = 1, child = 36695712, rootX = 0, 
      rootY = 0, eventX = 22480, eventY = 126, state = 0, mode = 0 '\0', 
      flags = 0 '\0'}, focus = {pad00 = 81034003, window = 104, 
      mode = 187 '»', pad1 = 1 '\001', pad2 = 32 ' ', pad3 = 3 '\003'}, 
    expose = {pad00 = 81034003, window = 104, x = 443, y = 800, width = 1, 
      height = 0, count = 61088, pad2 = 559}, graphicsExposure = {
      pad00 = 81034003, drawable = 104, x = 443, y = 800, width = 1, 
      height = 0, minorEvent = 61088, count = 559, majorEvent = 0 '\0', 
      pad1 = 0 '\0', pad2 = 0 '\0', pad3 = 0 '\0'}, noExposure = {
      pad00 = 81034003, drawable = 104, minorEvent = 443, 
      majorEvent = 32 ' ', bpad = 3 '\003'}, visibility = {pad00 = 81034003, 
      window = 104, state = 187 '»', pad1 = 1 '\001', pad2 = 32 ' ', 
      pad3 = 3 '\003'}, createNotify = {pad00 = 81034003, parent = 104, 
      window = 52429243, x = 1, y = 0, width = 61088, height = 559, 
      borderWidth = 0, override = 0 '\0', bpad = 0 '\0'}, destroyNotify = {
      pad00 = 81034003, event = 104, window = 52429243}, unmapNotify = {
      pad00 = 81034003, event = 104, window = 52429243, 
      fromConfigure = 1 '\001', pad1 = 0 '\0', pad2 = 0 '\0', pad3 = 0 '\0'}, 
    mapNotify = {pad00 = 81034003, event = 104, window = 52429243, 
      override = 1 '\001', pad1 = 0 '\0', pad2 = 0 '\0', pad3 = 0 '\0'}, 
    mapRequest = {pad00 = 81034003, parent = 104, window = 52429243}, 
    reparent = {pad00 = 81034003, event = 104, window = 52429243, parent = 1, 
      x = -4448, y = 559, override = 0 '\0', pad1 = 0 '\0', pad2 = 0 '\0', 
      pad3 = 0 '\0'}, configureNotify = {pad00 = 81034003, event = 104, 
      window = 52429243, aboveSibling = 1, x = -4448, y = 559, width = 0, 
      height = 0, borderWidth = 22480, override = 126 '~', bpad = 0 '\0'}, 
    configureRequest = {pad00 = 81034003, parent = 104, window = 52429243, 
      sibling = 1, x = -4448, y = 559, width = 0, height = 0, 
      borderWidth = 22480, valueMask = 126, pad1 = 0}, gravity = {
      pad00 = 81034003, event = 104, window = 52429243, x = 1, y = 0, 
      pad1 = 36695712, pad2 = 0, pad3 = 8280016, pad4 = 0}, resizeRequest = {
      pad00 = 81034003, window = 104, width = 443, height = 800}, 
    circulate = {pad00 = 81034003, event = 104, window = 52429243, 
      parent = 1, place = 160 ' ', pad1 = 238 'î', pad2 = 47 '/', 
      pad3 = 2 '\002'}, property = {pad00 = 81034003, window = 104, 
      atom = 52429243, time = 1, state = 160 ' ', pad1 = 238 'î', 
      pad2 = 559}, selectionClear = {pad00 = 81034003, time = 104, 
      window = 52429243, atom = 1}, selectionRequest = {pad00 = 81034003, 
      time = 104, owner = 52429243, requestor = 1, selection = 36695712, 
      target = 0, property = 8280016}, selectionNotify = {pad00 = 81034003, 
      time = 104, requestor = 52429243, selection = 1, target = 36695712, 
      property = 0}, colormap = {pad00 = 81034003, window = 104, 
      colormap = 52429243, new = 1 '\001', state = 0 '\0', pad1 = 0 '\0', 
      pad2 = 0 '\0'}, mappingNotify = {pad00 = 81034003, request = 104 'h', 
      firstKeyCode = 0 '\0', count = 0 '\0', pad1 = 0 '\0'}, clientMessage = {
      pad00 = 81034003, window = 104, u = {l = {type = 52429243, longs0 = 1, 
          longs1 = 36695712, longs2 = 0, longs3 = 8280016, longs4 = 0}, s = {
          type = 52429243, shorts0 = 1, shorts1 = 0, shorts2 = -4448, 
          shorts3 = 559, shorts4 = 0, shorts5 = 0, shorts6 = 22480, 
          shorts7 = 126, shorts8 = 0, shorts9 = 0}, b = {type = 52429243, 
          bytes = "\001\000\000\000 î/\002\000\000\000\000ÐW~\000\000\000\000"}}}}}
	anyMarked = 1
	win_owner = (ClientPtr) 0x28bba10
	ag_leader = (ClientPtr) 0x0
	pScreen = (ScreenPtr) 0x20e4a90
	pParent = <value optimized out>
	dosave = 0
	pLayerWin = (WindowPtr) 0x28daa00
#3  0x000000000044cf66 in ProcMapWindow (client=0x28bba10)
    at ../../dix/dispatch.c:695
	pWin = (WindowPtr) 0x28daa00
	rc = 0
#4  0x000000000044d7a4 in Dispatch () at ../../dix/dispatch.c:454
	result = <value optimized out>
	client = (ClientPtr) 0x28bba10
	nready = 0
	start_tick = 800
#5  0x000000000043378d in main (argc=10, argv=0x7fff32fe7ca8, 
    envp=<value optimized out>) at ../../dix/main.c:441
	i = 1
	error = 0
	xauthfile = <value optimized out>
	alwaysCheckForInput = {0, 1}
(gdb) quit
The program is running.  Quit anyway (and detach it)? (y or n) Detaching from program: /usr/bin/Xorg, process 11393
Comment 1 Enrico Tagliavini 2009-04-02 17:23:02 UTC
Created attachment 24481 [details]
Xorg.0.log

I have a similar problem with backingstore option enabled using kde4.2.1 under xorg 7.4 (xorg-server-1.5.3) xf86-video-ati-6.10.0. I'm using a radeon 9250 (r200 based) card.

When some dialog pop up or when i drag and drop a plasmoid to the desktop Xorg crash with segfault (the log is obtained in latter case). If i disable desktop effect Xorg crash at login.

If i disable backingstore the issue is not present.
Comment 2 Adam Jackson 2014-03-24 16:45:51 UTC
I think this is fixed since 1.6.  The backtrace seems to point into the old dix save-under code, which no longer exists as of 1.6 (but did in 1.5, when these backtraces seem to originate).


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.