random X11 crash (SIGSEGV) when rendering firefox in pixman/intel

Submitted by Michael Stapelberg

Assigned to Chris Wilson @ickle

Link to original bug (#27313)

Description

Created attachment 34440
Xorg logfile

When moving firefox to a different workspace in my window manager, sometimes my Xorg exits because of receiving a SIGSEGV. I am not entirely sure where the origin of this problem is, but I would suspect the intel driver, which is why I assigned it to Driver/intel. If I am wrong, feel free to re-assign.

Backtrace comes here (Xorg logfile is attached):

#0  0x00007fb4cb103f45 in *__GI_raise (sig=<value optimized out>)<br>
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64<br>
#1  0x00007fb4cb106d80 in *__GI_abort () at abort.c:88<br>
#2  0x000000000047cff3 in ddxGiveUp () at ../../../../hw/xfree86/common/xf86Init.c:1214<br>
#3  0x000000000046346d in AbortServer () at ../../os/log.c:404<br>
#4  0x0000000000463b0e in FatalError (<br>
    f=0x571720 "Caught signal %d (%s). Server aborting\n") at ../../os/log.c:529<br>
#5  0x0000000000467d3e in OsSigHandler (signo=11, sip=0x7fb4c8090000, <br>
    unused=<value optimized out>) at ../../os/osinit.c:156<br>
#6  <signal handler called><br>
#7  _mm_store_si128 (bits=<value optimized out>, stride=131072, <br>
    bpp=<value optimized out>, x=<value optimized out>, y=<value optimized out>, <br>
    width=<value optimized out>, height=32767, data=16777215)<br>
    at /usr/lib/gcc/x86_64-linux-gnu/4.4.2/include/emmintrin.h:697<br>
#8  save_128_aligned (bits=<value optimized out>, stride=131072, <br>
    bpp=<value optimized out>, x=<value optimized out>, y=<value optimized out>, <br>
    width=<value optimized out>, height=32767, data=16777215)<br>
    at ../../pixman/pixman-sse2.c:400<br>
#9  pixman_fill_sse2 (bits=<value optimized out>, stride=131072, <br>
    bpp=<value optimized out>, x=<value optimized out>, y=<value optimized out>, <br>
    width=<value optimized out>, height=32767, data=16777215)<br>
    at ../../pixman/pixman-sse2.c:4017<br>
#10 0x00007fb4cbf8a40e in sse2_fill (imp=<value optimized out>, <br>
    bits=<value optimized out>, stride=<value optimized out>, bpp=32, x=0, y=0, <br>
    width=32767, height=32767, xor=16777215) at ../../pixman/pixman-sse2.c:5763<br>
#11 0x00007fb4cbf76dad in pixman_fill (bits=<value optimized out>, <br>
    stride=<value optimized out>, bpp=<value optimized out>, x=<value optimized out>, <br>
    y=<value optimized out>, width=<value optimized out>, height=32767, xor=16777215)<br>
    at ../../pixman/pixman.c:256<br>
#12 0x00007fb4c8c83846 in fbFill (pDrawable=0xd97320, pGC=0x1747e20, <br>
    x=<value optimized out>, y=<value optimized out>, width=<value optimized out>, <br>
    height=<value optimized out>) at ../../fb/fbfill.c:48<br>
#13 0x00007fb4c8c83ce2 in fbPolyFillRect (pDrawable=<value optimized out>, <br>
    pGC=<value optimized out>, nrect=<value optimized out>, prect=<value optimized out>)<br>
    at ../../fb/fbfillrect.c:77<br>
#14 0x00007fb4c90fbf31 in uxa_check_poly_fill_rect (pDrawable=0xd97320, pGC=0x1747e20, <br>
    nrect=1, prect=0xfa83d8) at ../../uxa/uxa-unaccel.c:257<br>
#15 0x00007fb4c90f62e8 in uxa_poly_fill_rect (pDrawable=0xd97320, pGC=0x1747e20, <br>
    nrect=1, prect=0xfa83d8) at ../../uxa/uxa-accel.c:727<br>
#16 0x00000000004c263b in damagePolyFillRect (pDrawable=0xd97320, pGC=0x1747e20, <br>
    nRects=1, pRects=0xfa83d8) at ../../../miext/damage/damage.c:1404<br>
#17 0x000000000055d5b7 in miColorRects (pDst=0xfd8970, pClipPict=0xfd8970, <br>
    color=<value optimized out>, nRect=<value optimized out>, rects=0xfa83d8, xoff=0, <br>
    yoff=0) at ../../render/mirect.c:84<br>
#18 0x000000000055d693 in miCompositeRects (op=3 '\003', pDst=0xfd8970, color=0xfa83d0, <br>
    nRect=<value optimized out>, rects=0xfa83d8) at ../../render/mirect.c:116<br>
#19 0x00000000004b62c4 in ProcRenderFillRectangles (client=0x19506f0)<br>
    at ../../render/render.c:1471<br>
#20 0x000000000043c974 in Dispatch () at ../../dix/dispatch.c:439<br>
#21 0x0000000000425b9a in main (argc=7, argv=0x7d5228, envp=<value optimized out>)<br>
    at ../../dix/main.c:285<br>
```<br>
  <br>
**Attachment 34440**, "Xorg logfile":  <br>
[Xorg.0.log](/uploads/e9ddf3438b4fd61a8f62ece24ea8646b/Xorg.0.log)<br>