Bug#445509: xserver-xorg: 'pygoocanvas' demo app reliably causes X server to segfault

[Nathaniel Smith <njs@pobox.com>]

On Sat, Oct 06, 2007 at 02:09:47PM +0200, Julien Cristau wrote:
> On Sat, Oct  6, 2007 at 14:01:44 +0200, Julien Cristau wrote:
> 
> > You don't need to do that.  Just install xserver-xorg-core-dbg and
> > libpixman-1-0-dbg, that should get you a usable backtrace.
> > 
> Hrm, except that won't have debugging symbols for Xephyr.  But, just
> libpixman-1-0-dbg might already help.

Yes, that does improve the traceback... (this is all on x86-64, btw,
in case that helps in reproducing it).

New traceback:

#0  0x00002af2dd521bd3 in fbFetchPixel_a8r8g8b8 (image=0xbcc3f0, 
    bits=0x400cf2f08, offset=0, indexed=0x0)
    at ../../pixman/pixman-compose.c:703
#1  0x00002af2dd5279ac in fbFetchTransformed (pict=0xbcc3f0, 
    x=<value optimized out>, y=<value optimized out>, 
    width=<value optimized out>, buffer=0x7fffcd7a7470,
mask=0x7fffcd7a78b0, 
    maskBits=4278190080) at ../../pixman/pixman-compose.c:3893
#2 0x00002af2dd525b2e in pixman_composite_rect_general
(data=0x7fffcd7ad470, 
    scanline_buffer=0x0) at ../../pixman/pixman-compose.c:4394
#3 0x00002af2dd52dff3 in pixman_image_composite_rect
(op=PIXMAN_OP_OVER, 
    src=0xbcc3f0, mask=0xbcc510, dest=0xbcc600, src_x=22, src_y=193,
mask_x=0, 
    mask_y=0, dest_x=22, dest_y=193, width=136, height=83)
    at ../../pixman/pixman-pict.c:1381
#4  0x00002af2dd52d3ef in pixman_image_composite (op=PIXMAN_OP_OVER, 
    pSrc=0xbcc3f0, pMask=0xbcc510, pDst=0xbcc600, xSrc=22, ySrc=193,
xMask=0, 
    yMask=0, xDst=22, yDst=193, width=<value optimized out>, 
    height=<value optimized out>) at ../../pixman/pixman-pict.c:1287
#5  0x0000000000477cc8 in fbComposite ()
#6  0x00000000006a4206 in ?? ()
#7  0x000000000068b169 in miTrapezoids ()
#8  0x0000000000693ee4 in ?? ()
#9  0x0000000000455930 in ?? ()
#10 0x000000000043f5cc in ?? ()
#11 0x00002af2de7d3b44 in __libc_start_main () from /lib/libc.so.6
#12 0x0000000000421b89 in ?? ()
#13 0x00007fffcd7addc8 in ?? ()
#14 0x0000000000000000 in ?? ()

gdb thinks that the problem is indeed the 'bits' pointer:

(gdb) frame 0
#0  0x00002af2dd521bd3 in fbFetchPixel_a8r8g8b8 (image=0xbcc3f0, 
    bits=0x400cf2f08, offset=0, indexed=0x0)
    at ../../pixman/pixman-compose.c:703
703     {
(gdb) p bits
$14 = (const uint32_t *) 0x400cf2f08
(gdb) p *bits
Cannot access memory at address 0x400cf2f08

Not sure where to go from there, though.

-- Nathaniel

-- 
Electrons find their paths in subtle ways.