Bug#354721: X.org crashes on x11perf -aa4trap1 -reps 1 -repeat 1

[Ruben Nunez Francisco <ruben.nunez@tang-it.com>]

Package: xserver-xorg
Version: 6.9.0.dfsg.1-4

looks like the the picture format used is not implemented...

from xc/programs/Xserver/fb/fbcompose.c:

static fetchProc fetchProcForPicture (PicturePtr pict)
{
    switch(pict->format) {
    case PICT_a8r8g8b8: return fbFetch_a8r8g8b8;
    case PICT_x8r8g8b8: return fbFetch_x8r8g8b8;
    case PICT_a8b8g8r8: return fbFetch_a8b8g8r8;
    case PICT_x8b8g8r8: return fbFetch_x8b8g8r8;

        /* 24bpp formats */
    case PICT_r8g8b8: return fbFetch_r8g8b8;
    case PICT_b8g8r8: return fbFetch_b8g8r8;

        /* 16bpp formats */
    case PICT_r5g6b5: return fbFetch_r5g6b5;
    case PICT_b5g6r5: return fbFetch_b5g6r5;

    case PICT_a1r5g5b5: return fbFetch_a1r5g5b5;
    case PICT_x1r5g5b5: return fbFetch_x1r5g5b5;
    case PICT_a1b5g5r5: return fbFetch_a1b5g5r5;
    case PICT_x1b5g5r5: return fbFetch_x1b5g5r5;
    case PICT_a4r4g4b4: return fbFetch_a4r4g4b4;
    case PICT_x4r4g4b4: return fbFetch_x4r4g4b4;
    case PICT_a4b4g4r4: return fbFetch_a4b4g4r4;
    case PICT_x4b4g4r4: return fbFetch_x4b4g4r4;

        /* 8bpp formats */
    case PICT_a8: return  fbFetch_a8;
    case PICT_r3g3b2: return fbFetch_r3g3b2;
    case PICT_b2g3r3: return fbFetch_b2g3r3;
    case PICT_a2r2g2b2: return fbFetch_a2r2g2b2;
    case PICT_a2b2g2r2: return fbFetch_a2b2g2r2;
    case PICT_c8: return  fbFetch_c8;
    case PICT_g8: return  fbFetch_c8;

        /* 4bpp formats */
    case PICT_a4: return  fbFetch_a4;
    case PICT_r1g2b1: return fbFetch_r1g2b1;
    case PICT_b1g2r1: return fbFetch_b1g2r1;
    case PICT_a1r1g1b1: return fbFetch_a1r1g1b1;
    case PICT_a1b1g1r1: return fbFetch_a1b1g1r1;
    case PICT_c4: return  fbFetch_c4;
    case PICT_g4: return  fbFetch_c4;

        /* 1bpp formats */
    case PICT_a1: return  fbFetch_a1;
    case PICT_g1: return  fbFetch_g1;
    default:
        return NULL;
    }
}

static void fbFetch(PicturePtr pict, int x, int y, int width, CARD32
*buffer)
{
    FbBits *bits;
    FbStride stride;
    int bpp;
    int xoff, yoff;
    fetchProc fetch = fetchProcForPicture(pict);
    miIndexedPtr indexed = (miIndexedPtr) pict->pFormat->index.devPrivate;

    fbGetDrawable (pict->pDrawable, bits, stride, bpp, xoff, yoff);
    x += xoff;
    y += yoff;

    bits += y*stride;

    fetch(bits, x, width, buffer, indexed);
}

it crashes because 'fetch' is NULL.


(gdb) b fbCompositeGeneral
Breakpoint 1 at 0xb69885ba: file fbcompose.c, line 3534.
(gdb) continue
Continuing.

Breakpoint 1, fbCompositeGeneral (op=3 '\003', pSrc=0x84d7570,
pMask=0x84d70c8, pDst=0x84d7650, xSrc=0, ySrc=0, xMask=0,
    yMask=0, xDst=3, yDst=3, width=600, height=600) at fbcompose.c:3534
3534        if (pSrc->pDrawable)
(gdb) p *pMask
$1 = {pDrawable = 0xb16f8008, pFormat = 0x824b968, format = 134299648,
refcnt = 1, id = 2097161, pNext = 0x0, repeat = 0,
  graphicsExposures = 0, subWindowMode = 0, polyEdge = 0, polyMode = 0,
freeCompClip = 1, clientClipType = 0,
  componentAlpha = 0, repeatType = 0, unused = 0, alphaMap = 0x0,
alphaOrigin = {x = 0, y = 0}, clipOrigin = {x = 0, y = 0},
  clientClip = 0x0, dither = 0, stateChanges = 0, serialNumber = 46,
pCompositeClip = 0x83e5118, devPrivates = 0x84d711c,
  transform = 0x0, filter = 0, filter_params = 0x0, filter_nparams = 0,
pSourcePict = 0x0}
(gdb) p/x pMask->format
$2 = 0x8014000
(gdb) continue
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) The program is running.  Quit anyway (and detach it)? (y or n) y
Detaching from program: /usr/X11R6/bin/Xorg, process 3455

   *** If unresolved symbols were reported above, they might not
   *** be the reason for the server aborting.

Backtrace:
0: X(xf86SigHandler+0x88) [0x80897b8]
1: [0xffffe420]
2: /usr/X11R6/lib/modules/libfb.so(fbCompositeGeneral+0x8e4) [0xb6988e64]
3: /usr/X11R6/lib/modules/libfb.so(fbComposite+0x1c9) [0xb6999269]
4: /usr/X11R6/lib/modules/libxaa.so(XAAComposite+0x20e) [0xb69516ee]
5: X [0x816f701]
6: X [0x8185c9d]
7: X [0x818a0ce]
8: X(Dispatch+0x15e) [0x80c9a5e]
9: X(main+0x415) [0x80d6765]
10: /lib/tls/libc.so.6(__libc_start_main+0xd0) [0xb7e5fed0]
11: X [0x8070131]

Fatal server error:
Caught signal 11.  Server aborting