[Bug 29285] New: X server crash in dixLookupPrivate on closing GL screensaver

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=29285

           Summary: X server crash in dixLookupPrivate on closing GL
                    screensaver
           Product: xorg
           Version: git
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Driver/Radeon
        AssignedTo: xorg-driver-ati at lists.x.org
        ReportedBy: chalserogers at gmail.com
         QAContact: xorg-team at lists.x.org


With the radeon driver, both 6.13.1 and git master, it seems that closing a GL
screensaver will crash X.  This is easy to reproduce by going to
gnome-screensaver-preferences and switching between a couple of the GL
screensavers.

Looking at the backtrace it seems that dixLookupDrawable in
radeon_dri2_frame_event is grabbing a Drawable that's invalid in some way -
either it's been free'd and partially invalidated but not removed from the
resource system yet, or event->front has an attachment of DRI2BufferFrontLeft
but the drawable isn't a pixmap.

dixLookupPrivate (pPix=0x247ddb0) at ../../include/privates.h:167
167     ../../include/privates.h: No such file or directory.
        in ../../include/privates.h
(gdb) bt full
#0  dixLookupPrivate (pPix=0x247ddb0) at ../../include/privates.h:167
No locals.
#1  exaGetPixmapDriverPrivate (pPix=0x247ddb0) at ../../exa/exa.c:70
No locals.
#2  0x00007f8dc26c4861 in radeon_dri2_copy_region (drawable=0x24805e0,
region=0x7fff4c91b750, dest_buffer=<value optimised out>,
    src_buffer=<value optimised out>) at ../../src/radeon_dri2.c:309
        src_private = <value optimised out>
        dst_private = 0x2472860
        pScreen = <value optimised out>
        pScrn = 0x1f6da80
        src_drawable = <value optimised out>
        dst_drawable = 0x24805e0
        copy_clip = <value optimised out>
        gc = 0x1fb8430
        info = 0x1f715b0
        vsync = <value optimised out>
#3  0x00007f8dc26c4e93 in radeon_dri2_frame_event_handler (frame=951421,
tv_sec=1280294933, tv_usec=333116, event_data=<value optimised out>)
    at ../../src/radeon_dri2.c:381
        event = 0x2521960
        drawable = 0x24805e0
        scrn = <value optimised out>
        status = <value optimised out>
        region = {extents = {x1 = 0, y1 = 0, x2 = 480, y2 = 300}, data = 0x0}
        __func__ = "radeon_dri2_frame_event_handler"
#4  0x00007f8dc2d04a43 in drmHandleEvent (fd=9, evctx=0x1f72280) at
../xf86drmMode.c:781
        buffer = "\001\000\000\000
\000\000\000`\031R\002\000\000\000\000\025\300OL<\025\005\000}\204\016\000\000\000\000\000\000\000\000\000\000\005\0
00\004", '\000' <repeats 14 times>, "\032", '\000' <repeats 19 times>,
"\001\000\000\000\000\000\000\000\001", '\000' <repeats 27 times>,
"\001\000\000
\000\000\000\237\226>\302\215\177\000\000\000\006", '\000' <repeats 14 times>,
"\004", '\000' <repeats 11 times>"\215, \177\000\000\000\000\000\000\000
\000\271\001\000\000\000\000\000\000\260\025\367\001\000\000\000\000\a\000\000\000\000\000\000\000\000P\000\000\000\000\000\000\254;k\302\215\177",
'\0
eats 11 times>,
"Q\366\001\000\000\000\000\260\025\367\001\000\000\000\000\060\217\367\001\000\000\000\000\060\217\367\001\000\000\000\000\200\332\366\
000\000\000\260\025\367"...
        len = 32
        i = <value optimised out>
        e = 0x7fff4c91b7a0
#5  0x000000000044019b in WakeupHandler (result=1, pReadmask=0x7e06c0) at
../../dix/dixutils.c:419
        i = 0
#6  0x0000000000469637 in WaitForSomething (pClientsReady=<value optimised
out>) at ../../os/WaitFor.c:232
        i = 104
        waittime = {tv_sec = 19, tv_usec = 972915}
        wt = 0x7fff4c91be50
        timeout = <value optimised out>
---Type <return> to continue, or q <return> to quit---q
Quit
(gdb) up
#1  exaGetPixmapDriverPrivate (pPix=0x247ddb0) at ../../exa/exa.c:70
70      ../../exa/exa.c: No such file or directory.
        in ../../exa/exa.c
(gdb) print *pPix
$7 = {drawable = {type = 160 '\240', class = 224 '\340', depth = 71 'G',
bitsPerPixel = 2 '\002', id = 0, x = 33, y = 0, width = 0, height = 0,
    pScreen = 0x247de20, serialNumber = 0}, devPrivates = 0x0, refcnt = 81,
devKind = 0, devPrivate = {ptr = 0x0, val = 0, uval = 0, fptr = 0},
  screen_x = 0, screen_y = 0, usage_hint = 220}

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.