Xvfb crashes due to dbus/hal problems

[Brad King <brad.king@kitware.com>]

Hello,

I'd like to report the bug described below but I'm unsure what package
is the culprit.

I run tests of a project that needs an X server on a nightly basis.  For
years I've been running them off-screen using Xvfb.  I start an instance:

  Xvfb :52 -screen 0 1024x768x24 -fbdir /tmp/xvfb.52 -ac

and then run tests with "DISPLAY=:52".  Recently I updated my debian
testing system and the server has started crashing regularly after a few
hundred tests have run.  I tried building the version of the code being
tested to a time before this problem started but it didn't help.
Unfortunately I've been unable to reproduce the crash except by running
all the tests.  However, I've localized the problem somewhat.

The machine is:

  Linux 2.6.22-2-amd64 #1 SMP x86_64 GNU/Linux

Packages of interest:

  xvfb        version 2:1.4.2-2
  dbus        version 1.2.1-2
  dbus-x11    version 1.2.1-2
  libdbus-1-3 version 1.2.1-2
  hal         version 0.5.11-2
  libhal1     version 0.5.11-2

The Xvfb process reports a bunch of these messages (about 1 per test):

----------------------------------------------------------------------
FreeFontPath: FPE "/usr/share/fonts/X11/misc" refcount is 2, should be
1; fixing.
----------------------------------------------------------------------

Later it reports a few messages of this form:

----------------------------------------------------------------------
[config/hal] couldn't initialise context:
org.freedesktop.DBus.Error.LimitsExceeded (Connection ":1.20" is not
allowed to add more match rules (increase limits in configuration file
if required))
----------------------------------------------------------------------

and then crashes.  If I stop the dbus daemon (/etc/init.d/dbus stop) the
crash does not occur.  I found some discussion about this error here:

http://www.nabble.com/org.freedesktop.DBus.Error.LimitsExceeded-td17000158.html

but didn't see much about fixing it.

I used apt-get source for dbus and hal to build them with debug symbols
and install them into my home directory.  Using LD_LIBRARY_PATH I ran
the system's Xvfb installation with my own dbus and hal libraries.  Of
course it stopped crashing.  Then I discovered that if I use
--localstatedir=/var when building dbus it crashes again.  I'm pretty
sure that's because it needs to see the file

  /var/run/dbus/system_bus_socket

Running with debug builds of the dbus and hal libraries let me get a
partial backtrace for the segfault:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x2b8f43d80610 (LWP 1266)]
0x0000000000000020 in ?? ()
(gdb) where
#0  0x0000000000000020 in ?? ()
#1  0x00002b8f428a8014 in filter_func (connection=0xb9abe0, message=0xb9b060, user_data=0xd2d2b0) at libhal.c:1190
#2  0x00002b8f42ac348b in dbus_connection_dispatch (connection=0xb9abe0) at dbus-connection.c:4385
#3  0x00002b8f42ac3843 in _dbus_connection_read_write_dispatch (connection=0xb9abe0, timeout_milliseconds=0, dispatch=<value optimized out>) at dbus-connection.c:3414
#4  0x00000000004bb0ab in ?? ()

The line "libhal.c:1190" is inside this a condition and loop:

if (dbus_message_is_signal (message, "org.freedesktop.Hal.Device", "PropertyModified"))
  if (ctx->device_property_modified != NULL) {
    ...
    for (i = 0; i < num_modifications; i++) {
      ...
				ctx->device_property_modified (ctx,  // line 1190
							       object_path,
							       key, removed,
							       added);

It looks like the device_property_modified pointer-to-function is bad.

Does anyone have a suggestion about how to proceed (or how to reproduce
this without running all my project's tests)?  To what package should I
report this in the bug tracker?

Thanks,
-Brad