Bug 9488 - BadMatch (X_GetImage) abort in Xnest
Summary: BadMatch (X_GetImage) abort in Xnest
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Server/DDX/Xnest (show other bugs)
Version: 7.1 (2006.05)
Hardware: x86 (IA32) Linux (All)
: high normal
Assignee: Xorg Project Team
QA Contact: Xorg Project Team
URL:
Whiteboard: 2011BRB_Reviewed
Keywords:
Depends on:
Blocks: xserver-1.13
  Show dependency treegraph
 
Reported: 2006-12-30 09:29 UTC by Ed Catmur
Modified: 2014-04-07 17:59 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
xnest-XGetImage-ignore-errors.patch (832 bytes, patch)
2006-12-30 11:28 UTC, Ed Catmur
no flags Details | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Ed Catmur 2006-12-30 09:29:50 UTC
$ xauth add :10 . 454534543543543530
$ Xnest :10 &
$ DISPLAY=:10 gnome-session

After gnome has got a reasonable way through startup, switch workspace and back
again. Xnest crashes with:

X Error of failed request:  BadMatch (invalid parameter attributes)
  Major opcode of failed request:  73 (X_GetImage)
  Serial number of failed request:  40692
  Current serial number in output stream:  40692

Using xorg-server 1.1.1-r3 on Gentoo.
Comment 1 Ed Catmur 2006-12-30 09:49:45 UTC
Here's a trace:

(gdb) bt full
#0  _XDefaultError (dpy=0x83ff598, event=0xbf8076dc) at XlibInt.c:2748
No locals.
#1  0xb7d412de in _XError (dpy=0x83ff598, rep=0xbf8077cc) at XlibInt.c:2905
        rtn_val = <value optimized out>
        event = {type = 0, xany = {type = 0, serial = 138409368, 
    send_event = 123734220, display = 0x3485, window = 3070249224}, xkey = {
    type = 0, serial = 138409368, send_event = 123734220, display = 0x3485, 
    window = 3070249224, root = 3083905088, subwindow = 3084914688, 
    time = 3212867376, x = -1208605267, y = -1210052168, x_root = 0, 
    y_root = 1, state = 1, keycode = 0, same_screen = -1211049272}, xbutton = {
    type = 0, serial = 138409368, send_event = 123734220, display = 0x3485, 
    window = 3070249224, root = 3083905088, subwindow = 3084914688, 
    time = 3212867376, x = -1208605267, y = -1210052168, x_root = 0, 
    y_root = 1, state = 1, button = 0, same_screen = -1211049272}, xmotion = {
    type = 0, serial = 138409368, send_event = 123734220, display = 0x3485, 
    window = 3070249224, root = 3083905088, subwindow = 3084914688, 
    time = 3212867376, x = -1208605267, y = -1210052168, x_root = 0, 
    y_root = 1, state = 1, is_hint = 0 '\0', same_screen = -1211049272}, 
  xcrossing = {type = 0, serial = 138409368, send_event = 123734220, 
    display = 0x3485, window = 3070249224, root = 3083905088, 
    subwindow = 3084914688, time = 3212867376, x = -1208605267, 
    y = -1210052168, x_root = 0, y_root = 1, mode = 1, detail = 0, 
    same_screen = -1211049272, focus = -1211084800, state = 1020136}, 
---Type <return> to continue, or q <return> to quit---
  xfocus = {type = 0, serial = 138409368, send_event = 123734220, 
    display = 0x3485, window = 3070249224, mode = -1211062208, 
    detail = -1210052608}, xexpose = {type = 0, serial = 138409368, 
    send_event = 123734220, display = 0x3485, window = 3070249224, 
    x = -1211062208, y = -1210052608, width = -1082099920, 
    height = -1208605267, count = -1210052168}, xgraphicsexpose = {type = 0, 
    serial = 138409368, send_event = 123734220, display = 0x3485, 
    drawable = 3070249224, x = -1211062208, y = -1210052608, 
    width = -1082099920, height = -1208605267, count = -1210052168, 
    major_code = 0, minor_code = 1}, xnoexpose = {type = 0, 
    serial = 138409368, send_event = 123734220, display = 0x3485, 
    drawable = 3070249224, major_code = -1211062208, 
    minor_code = -1210052608}, xvisibility = {type = 0, serial = 138409368, 
    send_event = 123734220, display = 0x3485, window = 3070249224, 
    state = -1211062208}, xcreatewindow = {type = 0, serial = 138409368, 
    send_event = 123734220, display = 0x3485, parent = 3070249224, 
    window = 3083905088, x = -1210052608, y = -1082099920, 
    width = -1208605267, height = -1210052168, border_width = 0, 
    override_redirect = 1}, xdestroywindow = {type = 0, serial = 138409368, 
    send_event = 123734220, display = 0x3485, event = 3070249224, 
    window = 3083905088}, xunmap = {type = 0, serial = 138409368, 
    send_event = 123734220, display = 0x3485, event = 3070249224, 
    window = 3083905088, from_configure = -1210052608}, xmap = {type = 0, 
---Type <return> to continue, or q <return> to quit---
    serial = 138409368, send_event = 123734220, display = 0x3485, 
    event = 3070249224, window = 3083905088, override_redirect = -1210052608}, 
  xmaprequest = {type = 0, serial = 138409368, send_event = 123734220, 
    display = 0x3485, parent = 3070249224, window = 3083905088}, xreparent = {
    type = 0, serial = 138409368, send_event = 123734220, display = 0x3485, 
    event = 3070249224, window = 3083905088, parent = 3084914688, 
    x = -1082099920, y = -1208605267, override_redirect = -1210052168}, 
  xconfigure = {type = 0, serial = 138409368, send_event = 123734220, 
    display = 0x3485, event = 3070249224, window = 3083905088, 
    x = -1210052608, y = -1082099920, width = -1208605267, 
    height = -1210052168, border_width = 0, above = 1, override_redirect = 1}, 
  xgravity = {type = 0, serial = 138409368, send_event = 123734220, 
    display = 0x3485, event = 3070249224, window = 3083905088, 
    x = -1210052608, y = -1082099920}, xresizerequest = {type = 0, 
    serial = 138409368, send_event = 123734220, display = 0x3485, 
    window = 3070249224, width = -1211062208, height = -1210052608}, 
  xconfigurerequest = {type = 0, serial = 138409368, send_event = 123734220, 
    display = 0x3485, parent = 3070249224, window = 3083905088, 
    x = -1210052608, y = -1082099920, width = -1208605267, 
    height = -1210052168, border_width = 0, above = 1, detail = 1, 
    value_mask = 0}, xcirculate = {type = 0, serial = 138409368, 
    send_event = 123734220, display = 0x3485, event = 3070249224, 
    window = 3083905088, place = -1210052608}, xcirculaterequest = {type = 0, 
---Type <return> to continue, or q <return> to quit---
    serial = 138409368, send_event = 123734220, display = 0x3485, 
    parent = 3070249224, window = 3083905088, place = -1210052608}, 
  xproperty = {type = 0, serial = 138409368, send_event = 123734220, 
    display = 0x3485, window = 3070249224, atom = 3083905088, 
    time = 3084914688, state = -1082099920}, xselectionclear = {type = 0, 
    serial = 138409368, send_event = 123734220, display = 0x3485, 
    window = 3070249224, selection = 3083905088, time = 3084914688}, 
  xselectionrequest = {type = 0, serial = 138409368, send_event = 123734220, 
    display = 0x3485, owner = 3070249224, requestor = 3083905088, 
    selection = 3084914688, target = 3212867376, property = 3086362029, 
    time = 3084915128}, xselection = {type = 0, serial = 138409368, 
    send_event = 123734220, display = 0x3485, requestor = 3070249224, 
    selection = 3083905088, target = 3084914688, property = 3212867376, 
    time = 3086362029}, xcolormap = {type = 0, serial = 138409368, 
    send_event = 123734220, display = 0x3485, window = 3070249224, 
    colormap = 3083905088, new = -1210052608, state = -1082099920}, xclient = {
    type = 0, serial = 138409368, send_event = 123734220, display = 0x3485, 
    window = 3070249224, message_type = 3083905088, format = -1210052608, 
    data = {b = "0w\200��%���\021��\000\000\000\000\001\000\000", s = {30512, 
        -16512, 9645, -18442, 4536, -18464, 0, 0, 1, 0}, l = {-1082099920, 
        -1208605267, -1210052168, 0, 1}}}, xmapping = {type = 0, 
    serial = 138409368, send_event = 123734220, display = 0x3485, 
    window = 3070249224, request = -1211062208, first_keycode = -1210052608, 
---Type <return> to continue, or q <return> to quit---
    count = -1082099920}, xerror = {type = 0, display = 0x83ff598, 
    resourceid = 123734220, serial = 13445, error_code = 8 '\b', 
    request_code = 73 'I', minor_code = 0 '\0'}, xkeymap = {type = 0, 
    serial = 138409368, send_event = 123734220, display = 0x3485, 
    window = 3070249224, 
    key_vector =
"@�з\000\020��0w\200��%���\021��\000\000\000\000\001\000\000\000\001\000\000"},
pad = {0, 138409368, 123734220, 13445, -1224718072, 
    -1211062208, -1210052608, -1082099920, -1208605267, -1210052168, 0, 1, 1, 
    0, -1211049272, -1211084800, 1020136, -1211062208, -1210066172, 0, 
    138409368, -1082099832, -1208583280, -1210838549}}
        async = <value optimized out>
        next = <value optimized out>
#2  0xb7d42f50 in _XReply (dpy=0x83ff598, rep=0xbf8077cc, extra=0, discard=0)
    at XlibInt.c:1831
        ext = (_XExtension *) 0x0
        ret = 138409368
        ret_code = -1210831733
        serial = 13445
        cur_request = 13445
        cvl = <value optimized out>
#3  0xb7d24539 in XGetImage (dpy=0x83ff598, d=123734220, x=0, y=2, width=17, 
    height=18, plane_mask=4294967295, format=2) at GetImage.c:75
        rep = {type = 0 '\0', depth = 8 '\b', sequenceNumber = 13445, 
---Type <return> to continue, or q <return> to quit---
  length = 123734220, visual = 4784128, pad3 = 2, pad4 = 17, pad5 = 18, 
  pad6 = 4294967295, pad7 = 134746569}
        nbytes = <value optimized out>
        image = <value optimized out>
#4  0x080601a5 in xnestGetImage (pDrawable=0x8608de8, x=0, y=2, w=17, h=18, 
    format=138409368, planeMask=4294967295, pImage=0xbf807870 "")
    at GCOps.c:107
        ximage = <value optimized out>
#5  0x0807168f in DoGetImage (client=0x8538568, format=2, drawable=41943074, 
    x=0, y=2, width=17, height=<value optimized out>, planemask=4294967295, 
    im_return=0x0) at dispatch.c:2231
        pDraw = (DrawablePtr) 0x8608de8
        nlines = 18
        linesPerBuf = 18
        linesDone = 0
        widthBytesLine = 68
        length = <value optimized out>
        plane = 0
        pBuf = 0xbf807870 ""
        xgi = {type = 1 '\001', depth = 24 '\030', sequenceNumber = 538, 
  length = 306, visual = 34, pad3 = 3212869080, pad4 = 137826375, 
  pad5 = 139819208, pad6 = 139824832, pad7 = 4096}
        pVisibleRegion = (RegionPtr) 0x0
---Type <return> to continue, or q <return> to quit---
#6  0x08071846 in ProcGetImage (client=0x83ff598) at dispatch.c:2324
No locals.
#7  0x0807457d in Dispatch () at dispatch.c:459
        result = <value optimized out>
        client = (ClientPtr) 0x8538568
        nready = 0
        start_tick = 11880
#8  0x08087f6e in main (argc=2, argv=0xbf808314, envp=0x6) at main.c:447
        pScreen = <value optimized out>
        i = 1
        error = -1082096864
        xauthfile = <value optimized out>
        alwaysCheckForInput = {0, 1}
#9  0xb7bc283c in __libc_start_main (main=0x8087af0 <main>, argc=2, 
    ubp_av=0xbf808314, init=0x837cd00 <__libc_csu_init>, 
    fini=0x837ccf0 <__libc_csu_fini>, rtld_fini=0xb7f62ee0 <_dl_fini>, 
    stack_end=0xbf80830c) at libc-start.c:238
        result = <value optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {-1211301900, -1208550240, 
        0, -1082096920, -987628191, -853714960}, mask_was_saved = 0}}, priv = {
    pad = {0x0, 0x0, 0xb7f67b90, 0xb7bc276d}, data = {prev = 0x0, 
      cleanup = 0x0, canceltype = -1208583280}}}
        not_first_call = <value optimized out>
---Type <return> to continue, or q <return> to quit---
#10 0x0805c941 in _start ()
No symbol table info available.
Comment 2 Ed Catmur 2006-12-30 10:34:52 UTC
Info on the relevant (host server) drawable:

$ xwininfo -id 123734220

xwininfo: Window id: 0x76008cc (has no name)

  Absolute upper-left X:  977
  Absolute upper-left Y:  49
  Relative upper-left X:  0
  Relative upper-left Y:  0
  Width: 17
  Height: 23
  Depth: 24
  Visual Class: TrueColor
  Border width: 0
  Class: InputOutput
  Colormap: 0x760008d (not installed)
  Bit Gravity State: NorthWestGravity
  Window Gravity State: NorthWestGravity
  Backing Store State: NotUseful
  Save Under State: no
  Map State: IsViewable
  Override Redirect State: no
  Corners:  +977+49  -606+49  -606-952  +977-952
  -geometry 17x23+0+27

Comment 3 Ed Catmur 2006-12-30 11:10:27 UTC
I think the issue is that when the XGetImage call arrives the window is
unviewable (being on another workspace). There is AFAICT no way for dix to tell
this is the case, nor pass the error back up, so about all we can do is in
xnestGetImage wrap the XGetImage call in a fake error handler.
Comment 4 Ed Catmur 2006-12-30 11:28:15 UTC
Created attachment 8244 [details] [review]
xnest-XGetImage-ignore-errors.patch

Suggested patch.
Comment 5 Daniel Stone 2007-02-27 01:35:23 UTC
Sorry about the phenomenal bug spam, guys.  Adding xorg-team@ to the QA contact so bugs don't get lost in future.
Comment 6 Adam Jackson 2008-02-24 21:41:36 UTC
We should certainly do something here.  Probably best if Xnest were to throw the same error back to the application, since otherwise it'll get garbage without knowing that it's garbage.
Comment 7 Adam Jackson 2008-06-17 12:36:22 UTC
Punt to 7.5, not critical.  Might be best to treat the obscured areas as censored in the XACE sense of the word.  But at any rate, returning garbage for the ungettable parts of the image is totally legal, since there's no way you could know if someone went and drew on your stuff while you weren't looking.
Comment 8 Daniel Stone 2009-08-31 18:17:05 UTC
(In reply to comment #7)
> Punt to 7.5, not critical.  Might be best to treat the obscured areas as
> censored in the XACE sense of the word.  But at any rate, returning garbage for
> the ungettable parts of the image is totally legal, since there's no way you
> could know if someone went and drew on your stuff while you weren't looking.

indeed.  pushing to 7.6 with the same rationale.
Comment 9 Adam Jackson 2014-04-07 17:59:24 UTC
As of:

commit 6d5883bd7e5b765f8f0548501b825d9e56840799
Author: Keith Packard <keithp@keithp.com>
Date:   Sat Nov 23 16:19:46 2013 -0800

    xnest: Ignore GetImage() error in xnestGetImage() (v3)

commit 65fca558848acd907483d3c85c7cd4db5560f1b4
Author: Radek Doulik <rodo@novell.com>
Date:   Tue Aug 13 08:45:47 2013 +0200

    xnest: Ignore GetImage() error in xnestGetImage()

we no longer throw BadMatch for this, and (presumably) the gotten image will contain some garbage, so I think this is fixed now.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct.