Xserver SEGFAULT - touchscreen related

[Krzysztof Halasa]

Hello,

I have a case of Xserver crashing. I believe it's related to a
touchscreen.

This is Arch Linux, x86-64, using xorg-server 1.15.0-5 and
xf86-input-evdev 2.8.2-2. Getac V100-X laptop, Intel(R) Core(TM) i7 CPU
U 640 @ 1.20GHz, Intel HD graphics.

(II) Using input driver 'evdev' for 'IDEACOM  IDC 6650'
(**) IDEACOM  IDC 6650: always reports core events
(**) evdev: IDEACOM  IDC 6650: Device: "/dev/input/event11"
(II) evdev: IDEACOM  IDC 6650: Using mtdev for this device
(--) evdev: IDEACOM  IDC 6650: Vendor 0x1cb6 Product 0x6650
(--) evdev: IDEACOM  IDC 6650: Found absolute axes
(--) evdev: IDEACOM  IDC 6650: Found absolute multitouch axes
(II) evdev: IDEACOM  IDC 6650: No buttons found, faking one.
(--) evdev: IDEACOM  IDC 6650: Found x and y absolute axes
(--) evdev: IDEACOM  IDC 6650: Found absolute touchscreen
(II) evdev: IDEACOM  IDC 6650: Configuring as touchscreen
(**) evdev: IDEACOM  IDC 6650: YAxisMapping: buttons 4 and 5
(**) evdev: IDEACOM  IDC 6650: EmulateWheelButton: 4,
EmulateWheelInertia: 10, EmulateWheelTimeout: 200
(**) Option "config_info"
"udev:/sys/devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.4/2-1.4.2/2-1.4.2:1.0/input/input18/event11"
(II) XINPUT: Adding extended input device "IDEACOM  IDC 6650" (type: TOUCHSCREEN, id 10)
(II) evdev: IDEACOM  IDC 6650: initialized for absolute axes.
(**) IDEACOM  IDC 6650: (accel) keeping acceleration scheme 1
(**) IDEACOM  IDC 6650: (accel) acceleration profile 0
(**) IDEACOM  IDC 6650: (accel) acceleration factor: 2.000
(**) IDEACOM  IDC 6650: (accel) acceleration threshold: 4

(EE) Backtrace:
(EE) 0: /usr/bin/X (xorg_backtrace+0x48) [0x584ae8]
(EE) 1: /usr/bin/X (0x400000+0x1887c9) [0x5887c9]
(EE) 2: /usr/lib/libpthread.so.0 (0x7f2ebde08000+0xf880) [0x7f2ebde17880]
(EE) 3: /usr/bin/X (miPointerSetPosition+0x9e) [0x570dae]
(EE) 4: /usr/bin/X (0x400000+0x4ac3e) [0x44ac3e]
(EE) 5: /usr/bin/X (0x400000+0x4d328) [0x44d328]
(EE) 6: /usr/bin/X (0x400000+0x4d541) [0x44d541]
(EE) 7: /usr/lib/xorg/modules/input/evdev_drv.so (0x7f2eb4ff7000+0x551b) [0x7f2eb4ffc51b]
(EE) 8: /usr/bin/X (0x400000+0x72f68) [0x472f68]
(EE) 9: /usr/bin/X (0x400000+0x9b530) [0x49b530]
(EE) 10: /usr/lib/libpthread.so.0 (0x7f2ebde08000+0xf880) [0x7f2ebde17880]
(EE) 11: /usr/bin/X (0x400000+0x1746e0) [0x5746e0]
(EE) 12: /usr/bin/X (0x400000+0x16fcf9) [0x56fcf9]
(EE) 13: /usr/bin/X (0x400000+0x2e21a) [0x42e21a]
(EE) 14: /usr/bin/X (0x400000+0x451cb) [0x4451cb]
(EE) 15: /usr/bin/X (0x400000+0x4055c) [0x44055c]
(EE) 16: /usr/bin/X (0x400000+0x11f5db) [0x51f5db]
(EE) 17: /usr/bin/X (0x400000+0x35d1e) [0x435d1e]
(EE) 18: /usr/bin/X (0x400000+0x39b2a) [0x439b2a]
(EE) 19: /usr/lib/libc.so.6 (__libc_start_main+0xf5) [0x7f2ebca7fb05]
(EE) 20: /usr/bin/X (0x400000+0x250ce) [0x4250ce]
(EE)
(EE) Segmentation fault at address 0x0

Another case:
(EE) Backtrace:
(EE) 0: /usr/bin/X (xorg_backtrace+0x48) [0x584ae8]
(EE) 1: /usr/bin/X (0x400000+0x1887c9) [0x5887c9]
(EE) 2: /usr/lib/libpthread.so.0 (0x7fba157df000+0xf880) [0x7fba157ee880]
(EE) 3: /usr/bin/X (0x400000+0x4cf62) [0x44cf62]
(EE) 4: /usr/bin/X (0x400000+0x4d541) [0x44d541]
(EE) 5: /usr/lib/xorg/modules/input/evdev_drv.so (0x7fba0c9ce000+0x551b) [0x7fba0c9d351b]
    5516: callq 3070 <xf86PostTouchEvent at plt>

(EE) 6: /usr/bin/X (0x400000+0x72f68) [0x472f68]
(EE) 7: /usr/bin/X (0x400000+0x9b530) [0x49b530]
(EE) 8: /usr/lib/libpthread.so.0 (0x7fba157df000+0xf880) [0x7fba157ee880]
(EE) 9: /usr/bin/X (0x400000+0x3f52a) [0x43f52a]
(EE) 10: /usr/bin/X (0x400000+0x2e233) [0x42e233]
(EE) 11: /usr/bin/X (0x400000+0x451cb) [0x4451cb]
(EE) 12: /usr/bin/X (0x400000+0x4055c) [0x44055c]
(EE) 13: /usr/bin/X (0x400000+0x11f5db) [0x51f5db]
(EE) 14: /usr/bin/X (0x400000+0x35d1e) [0x435d1e]
(EE) 15: /usr/bin/X (0x400000+0x39b2a) [0x439b2a]
(EE) 16: /usr/lib/libc.so.6 (__libc_start_main+0xf5) [0x7fba14456b05]
(EE) 17: /usr/bin/X (0x400000+0x250ce) [0x4250ce]
(EE)
(EE) Segmentation fault at address 0x0

This 3rd address is dix/getevents.c:GetTouchEvents():
44cf4e: mov 0x148(%rsi),%rax # dev->spriteInfo
44cf55: mov %r8d,0x24(%rsp)
44cf5a: mov %r9,0x18(%rsp)
44cf5f: mov (%rax),%rax      # dev->spriteInfo->sprite
44cf62: mov 0x48(%rax),%rax  # dev->spriteInfo->sprite->hotPhys.pScreen <<< FAILS

This means dev->spriteInfo->sprite is NULL.

This happened which using the touchscreen. I assume it's not a common
occurrence because touchscreens aren't that common on laptops.
Nothing spectacular in other logs.

Any ideas?
-- 
Krzysztof Halasa