Skip to content

Reproducible segfault in miPointerUpdateSprite()

Submitted by Martin Jansa

Assigned to Xorg Project Team

Link to original bug (#24181)

Description

Hello,

on armv4t (neo freerunner) we're using xorg from git master and 1.7 branch. There is reproducible segfault in miPointerUpdateSprite()

Not sure where exactly, because first it occured in miDCRestoreUnderCursor(), so commented this function out and tested again and it occured in miDCSaveUnderCursor(), so I commented this one too and it occured in miDCPutUpCursor().

With all miPointerUpdateSprite() calls commented out it works good (just cursor background isn't redrawn).

Another workaround is to run Xorg with -nocursor.

Easiest way to reproduce this is run terminal (vala-terminal) and on screen keyboard (illume-keyboard) and type wery quickly. Maybe its because every key-press is highlighted with key drawn slightly above keyboard, so we're redrawing the same part of screen twice (for cursor-left redraw and key up&down - maybe some concurrency).

Maybe the problem lives in DDX driver for SMedia Glamo graphics http://git.openmoko.org/?p=xf86-video-glamo.git;a=summary

  1. Program received signal SIGSEGV, Segmentation fault.

  2. [Switching to Thread 0x4001edc0 (LWP 1701)]

  3. 0x0013c9b4 in miDCRestoreUnderCursor ()

  4. Current language: auto; currently asm

  5. (gdb) back

  6. #0 0x0013c9b4 in miDCRestoreUnderCursor ()

  7. #1 (closed) 0x00160780 in miSpriteRemoveCursor ()

  8. #2 0x00160934 in miSpriteSetCursor ()

  9. #3 (closed) 0x00160a40 in miSpriteMoveCursor ()

  10. #4 (closed) 0x00056ad4 in miPointerUpdateSprite ()

  11. #5 (closed) 0x0009da28 in ProcXTestFakeInput ()

  12. #6 (closed) 0x0004fc58 in Dispatch ()

  13. #7 (closed) 0x000216a8 in main ()

  15. /* now i commented miDCRestoreUnderCursor out from Xorg */

  17. Program received signal SIGSEGV, Segmentation fault.

  18. [Switching to Thread 0x4001edc0 (LWP 2175)]

  19. 0x0013c8e4 in miDCSaveUnderCursor ()

  20. Current language: auto; currently asm

  21. (gdb) back

  22. #0 0x0013c8e4 in miDCSaveUnderCursor ()

  23. #1 (closed) 0x001602d4 in miSpriteSaveUnderCursor ()

  24. #2 0x0016078c in miSpriteSetCursor ()

  25. #3 (closed) 0x001608e0 in miSpriteMoveCursor ()

  26. #4 (closed) 0x00056ad4 in miPointerUpdateSprite ()

  27. #5 (closed) 0x0009da28 in ProcXTestFakeInput ()

  28. #6 (closed) 0x0004fc58 in Dispatch ()

  29. #7 (closed) 0x000216a8 in main ()

  31. /* now i commented miDCSaveUnderCursor out from Xorg */

  33. Program received signal SIGSEGV, Segmentation fault.

  34. [Switching to Thread 0x4001edc0 (LWP 2306)]

  35. 0x0013d500 in miDCPutUpCursor ()

  36. Current language: auto; currently asm

  37. (gdb) back

  38. #0 0x0013d500 in miDCPutUpCursor ()

  39. #1 (closed) 0x0015ffc8 in miSpriteRestoreCursor ()

  40. #2 0x00160734 in miSpriteMoveCursor ()

  41. #3 (closed) 0x00056ad4 in miPointerUpdateSprite ()

  42. #4 (closed) 0x0009da20 in ProcXTestFakeInput ()

  43. #5 (closed) 0x0004fc58 in Dispatch ()

  44. #6 (closed) 0x000216a8 in main ()

  46. /* It works ok when I removed every miPointerUpdateSprite call, or when Xorg is executed with -nocursor */

  48. /* better backtrace */

  50. Program received signal SIGSEGV, Segmentation fault.

  51. [Switching to Thread 0x404da000 (LWP 1748)]

  52. 0x00232d34 in miDCSaveUnderCursor (pDev=0x32f728, pScreen=0x2c2a80, x=304, y=509, w=32, h=32) at midispcur.c:536

  53. 536 midispcur.c: No such file or directory.

  54.     in midispcur.c

  55. (gdb) break

  56. Breakpoint 1 at 0x232d34: file midispcur.c, line 536.

  57. (gdb) back

  58. #0 0x00232d34 in miDCSaveUnderCursor (pDev=0x32f728, pScreen=0x2c2a80, x=304, y=509, w=32, h=32) at midispcur.c:536

  59. #1 (closed) 0x00270588 in miSpriteSaveUnderCursor (pDev=0x32f728, pScreen=0x2c2a80) at misprite.c:1039

  60. #2 0x0026fe20 in miSpriteSetCursor (pDev=0x32f728, pScreen=0x2c2a80, pCursor=0x335dd0, x=319, y=524) at misprite.c:902

  61. #3 (closed) 0x0026ff74 in miSpriteMoveCursor (pDev=0x32f728, pScreen=0x2c2a80, x=319, y=524) at misprite.c:922

  62. #4 (closed) 0x00082420 in miPointerUpdateSprite (pDev=0x32f728) at mipointer.c:428

  63. #5 (closed) 0x00103d60 in ProcXTestFakeInput (client=0x453cd8) at xtest.c:454

  64. #6 (closed) 0x00103ec0 in ProcXTestDispatch (client=0x453cd8) at xtest.c:487

  65. #7 (closed) 0x0006e0a4 in Dispatch () at dispatch.c:445

  66. #8 (closed) 0x000218c0 in main (argc=1, argv=0xbec36d14, envp=0xbec36d1c) at main.c:285

Version: git

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information