Debian Bug report logs - #567677
Server sometimes crashes when closing OpenGL programs

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Patrik Olsson <peo@xaci.be>

To: submit@bugs.debian.org

Subject: Server sometimes crashes when closing OpenGL programs

Date: Sat, 30 Jan 2010 18:34:25 +0100

[Message part 1 (text/plain, inline)]

Source: xorg-server
Version: 2:1.7.4-2
Severity: important

In about 1 of 5 times that I close OpenGL programs (that I have
written), the X server crashes. It doesn't seem to happen when I kill or
"^C" them, though. It is likely the programs are misbehaving (for
example, I currently don't clean up all X and GLX resources before exit,
and maybe I mix both new and old GLX api). I don't have the problem with
other OpenGL programs I have tested such as glxgears or glxinfo. I any
case, I don't think the server should crash, no matter whether
programs/clients are misbehaving or not. Also, I should mention that in
previous versions of the server, I didn't have the problem.

I attached to the process with gdb and below is a debug log (with
prompts). pScreen in #2 was optimized out so I got it from #3 instead.

pDraw at #3 is probably a freed pointer. Thus its pScreen field is
undefined/arbitrary and in this case was 0x1 which made 'privates' in #0
a pointer a bit higher (because implicitly, #2 will find 'privates' by
adding the field offset to the pScreen pointer, see the source code at
that part). Thus in the end it uses an invalid pointer of value 0x151
for 'privates'.

pDraw should not be freed until DRI2DestroyDrawable etc. has been called
with it. Considering it is only sometimes that the server crashes I
would guess there is a race condition.

Of course, there is also the possibility that pScreen has been set to 1
at some point. In other words, I'm not entirely sure if the pDraw
pointer is freed, as I know not how to check that.

I have also attached the Xorg.0.log.old.

(gdb) bt f
#0  0x0808c823 in privateExists (privates=0x151, key=0xb77d3234)
    at ../../dix/privates.c:79
No locals.
#1  dixLookupPrivate (privates=0x151, key=0xb77d3234)
    at ../../dix/privates.c:162
        ptr = <value optimized out>
#2  0xb77d1db9 in DRI2GetScreen (pScreen=<value optimized out>)
    at ../../../../hw/xfree86/dri2/dri2.c:78
No locals.
#3  0xb77d1edf in DRI2DestroyDrawable (pDraw=0x9280bd0)
    at ../../../../hw/xfree86/dri2/dri2.c:344
        ds = <value optimized out>
        pPriv = <value optimized out>
#4  0xb73f4228 in __glXDRIdrawableDestroy (drawable=0x92806f8)
    at ../../glx/glxdri2.c:110
No locals.
#5  0xb73e8bd8 in DrawableGone (glxPriv=0x92806f8, xid=58720288)
    at ../../glx/glxext.c:163
        c = 0x0
#6  0x0808fa4f in FreeClientResources (client=0x91e1518)
    at ../../dix/resource.c:806
        rtype = <value optimized out>
        resources = 0x9189210
        this = 0x932d228
        j = 32
#7  0x0806d1cf in CloseDownClient (client=0x91e1518)
    at ../../dix/dispatch.c:3631
        really_close_down = <value optimized out>
#8  0x08072e38 in Dispatch () at ../../dix/dispatch.c:450
        result = 1
        client = 0x91e1518
        nready = 0
        start_tick = 2340
#9  0x0806695a in main (argc=9, argv=0xbfa42904, envp=0xbfa4292c)
    at ../../dix/main.c:285
        i = <value optimized out>
        alwaysCheckForInput = {0, 1}
(gdb) select 3
(gdb) print pDraw->pScreen
$3 = (ScreenPtr) 0x1

/Patrik 

[xorg.log (text/x-log, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 567677@bugs.debian.org (full text, mbox, reply):

From: Brice Goglin <Brice.Goglin@ens-lyon.org>

To: Patrik Olsson <peo@xaci.be>, 567677@bugs.debian.org

Subject: Re: Bug#567677: Server sometimes crashes when closing OpenGL programs

Date: Sat, 30 Jan 2010 18:45:58 +0100

Random guess: Could be related to
http://cgit.freedesktop.org/xorg/xserver/commit/?id=711e26466ae04ae93ff4c48d377d83d68a6320e9
?

Brice



Patrik Olsson wrote:
> Source: xorg-server
> Version: 2:1.7.4-2
> Severity: important
>
> In about 1 of 5 times that I close OpenGL programs (that I have
> written), the X server crashes. It doesn't seem to happen when I kill or
> "^C" them, though. It is likely the programs are misbehaving (for
> example, I currently don't clean up all X and GLX resources before exit,
> and maybe I mix both new and old GLX api). I don't have the problem with
> other OpenGL programs I have tested such as glxgears or glxinfo. I any
> case, I don't think the server should crash, no matter whether
> programs/clients are misbehaving or not. Also, I should mention that in
> previous versions of the server, I didn't have the problem.
>
> I attached to the process with gdb and below is a debug log (with
> prompts). pScreen in #2 was optimized out so I got it from #3 instead.
>
> pDraw at #3 is probably a freed pointer. Thus its pScreen field is
> undefined/arbitrary and in this case was 0x1 which made 'privates' in #0
> a pointer a bit higher (because implicitly, #2 will find 'privates' by
> adding the field offset to the pScreen pointer, see the source code at
> that part). Thus in the end it uses an invalid pointer of value 0x151
> for 'privates'.
>
> pDraw should not be freed until DRI2DestroyDrawable etc. has been called
> with it. Considering it is only sometimes that the server crashes I
> would guess there is a race condition.
>
> Of course, there is also the possibility that pScreen has been set to 1
> at some point. In other words, I'm not entirely sure if the pDraw
> pointer is freed, as I know not how to check that.
>   

Message #15 received at 567677@bugs.debian.org (full text, mbox, reply):

From: Patrik Olsson <peo@xaci.be>

To: Brice Goglin <Brice.Goglin@ens-lyon.org>

Cc: 567677@bugs.debian.org

Subject: Re: Bug#567677: Server sometimes crashes when closing OpenGL programs

Date: Sun, 31 Jan 2010 13:46:43 +0100

[Message part 1 (text/plain, inline)]

I don't know, but I don't think so since none of the lines changed in
that commit are actually reached before the crash (at least for that
drawable). Furthermore, it appears to fix a problem in more recent API.
The only part of the patch that applies on version 2:1.7.4-2 is the
extraction of the ending of the DRI2DestroyDrawable into
DRI2FreeDrawable, which is still equivalent.

I think the problem is here (#4 in backtrace, __glXDRIdrawableDestroy in
glx/glxdri2.c):

    /* If the X window was destroyed, the dri DestroyWindow hook will
     * aready have taken care of this, so only call if pDraw isn't NULL. */
    if (drawable->pDraw != NULL)
	DRI2DestroyDrawable(drawable->pDraw);

It assumes that drawable->pDraw has been set to NULL if it is already
freed. However, wherever it is freed this pointer is not set to NULL
afterwards (at least that's what I suspect). I don't know where I can
find the code of the "dri DestroyWindow hook", though.

/Patrik

On Sat, 2010-01-30 at 18:45 +0100, Brice Goglin wrote:
> Random guess: Could be related to
> http://cgit.freedesktop.org/xorg/xserver/commit/?id=711e26466ae04ae93ff4c48d377d83d68a6320e9
> ?
> 
> Brice
> 

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 567677@bugs.debian.org (full text, mbox, reply):

From: Brice Goglin <Brice.Goglin@ens-lyon.org>

To: Patrik Olsson <peo@xaci.be>

Cc: 567677@bugs.debian.org

Subject: Re: Bug#567677: Server sometimes crashes when closing OpenGL programs

Date: Sun, 31 Jan 2010 16:18:22 +0100

Patrik Olsson wrote:
> I don't know, but I don't think so since none of the lines changed in
> that commit are actually reached before the crash (at least for that
> drawable). Furthermore, it appears to fix a problem in more recent API.
> The only part of the patch that applies on version 2:1.7.4-2 is the
> extraction of the ending of the DRI2DestroyDrawable into
> DRI2FreeDrawable, which is still equivalent.
>
> I think the problem is here (#4 in backtrace, __glXDRIdrawableDestroy in
> glx/glxdri2.c):
>
>     /* If the X window was destroyed, the dri DestroyWindow hook will
>      * aready have taken care of this, so only call if pDraw isn't NULL. */
>     if (drawable->pDraw != NULL)
> 	DRI2DestroyDrawable(drawable->pDraw);
>
> It assumes that drawable->pDraw has been set to NULL if it is already
> freed. However, wherever it is freed this pointer is not set to NULL
> afterwards (at least that's what I suspect). I don't know where I can
> find the code of the "dri DestroyWindow hook", though.
>   

Given how deep you were able to dig into this, you should report the bug
directly upstream at bugzilla.freedesktop.org

Brice

Message #29 received at 567677@bugs.debian.org (full text, mbox, reply):

From: "Jason D. Clinton" <me@jasonclinton.com>

To: 567677@bugs.debian.org

Subject: Fixed upstream

Date: Mon, 26 Apr 2010 13:41:56 -0500

[Message part 1 (text/plain, inline)]

The fixes have been posted for a few days on the upstream bug. BTW, this bug
also causes all Clutter 1.2 apps to crash due to that library's use of GLX
1.3; so GNOME Games and Empathy cause the X server to crash.

[Message part 2 (text/html, inline)]

Message #38 received at 567677-close@bugs.debian.org (full text, mbox, reply):

From: Julien Cristau <jcristau@debian.org>

To: 567677-close@bugs.debian.org

Subject: Bug#567677: fixed in xorg-server 2:1.7.7-1

Date: Tue, 04 May 2010 16:05:27 +0000

Source: xorg-server
Source-Version: 2:1.7.7-1

We believe that the bug you reported is fixed in the latest version of
xorg-server, which is due to be installed in the Debian FTP archive:

xdmx-tools_1.7.7-1_i386.deb
  to main/x/xorg-server/xdmx-tools_1.7.7-1_i386.deb
xdmx_1.7.7-1_i386.deb
  to main/x/xorg-server/xdmx_1.7.7-1_i386.deb
xnest_1.7.7-1_i386.deb
  to main/x/xorg-server/xnest_1.7.7-1_i386.deb
xorg-server_1.7.7-1.diff.gz
  to main/x/xorg-server/xorg-server_1.7.7-1.diff.gz
xorg-server_1.7.7-1.dsc
  to main/x/xorg-server/xorg-server_1.7.7-1.dsc
xorg-server_1.7.7.orig.tar.gz
  to main/x/xorg-server/xorg-server_1.7.7.orig.tar.gz
xserver-common_1.7.7-1_all.deb
  to main/x/xorg-server/xserver-common_1.7.7-1_all.deb
xserver-xephyr_1.7.7-1_i386.deb
  to main/x/xorg-server/xserver-xephyr_1.7.7-1_i386.deb
xserver-xfbdev_1.7.7-1_i386.deb
  to main/x/xorg-server/xserver-xfbdev_1.7.7-1_i386.deb
xserver-xorg-core-dbg_1.7.7-1_i386.deb
  to main/x/xorg-server/xserver-xorg-core-dbg_1.7.7-1_i386.deb
xserver-xorg-core-udeb_1.7.7-1_i386.udeb
  to main/x/xorg-server/xserver-xorg-core-udeb_1.7.7-1_i386.udeb
xserver-xorg-core_1.7.7-1_i386.deb
  to main/x/xorg-server/xserver-xorg-core_1.7.7-1_i386.deb
xserver-xorg-dev_1.7.7-1_i386.deb
  to main/x/xorg-server/xserver-xorg-dev_1.7.7-1_i386.deb
xvfb_1.7.7-1_i386.deb
  to main/x/xorg-server/xvfb_1.7.7-1_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 567677@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Julien Cristau <jcristau@debian.org> (supplier of updated xorg-server package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Tue, 04 May 2010 15:17:59 +0200
Source: xorg-server
Binary: xserver-xorg-core xserver-xorg-core-udeb xserver-xorg-dev xdmx xdmx-tools xnest xvfb xserver-xephyr xserver-xfbdev xserver-xorg-core-dbg xserver-common
Architecture: source all i386
Version: 2:1.7.7-1
Distribution: unstable
Urgency: low
Maintainer: Debian X Strike Force <debian-x@lists.debian.org>
Changed-By: Julien Cristau <jcristau@debian.org>
Description: 
 xdmx       - distributed multihead X server
 xdmx-tools - Distributed Multihead X tools
 xnest      - Nested X server
 xserver-common - common files used by various X servers
 xserver-xephyr - nested X server
 xserver-xfbdev - Linux framebuffer device tiny X server
 xserver-xorg-core - Xorg X server - core server
 xserver-xorg-core-dbg - Xorg - the X.Org X server (debugging symbols)
 xserver-xorg-core-udeb - Xorg X server - core server (udeb)
 xserver-xorg-dev - Xorg X server - development files
 xvfb       - Virtual Framebuffer 'fake' X server
Closes: 567677 575905 576656 579130
Changes: 
 xorg-server (2:1.7.7-1) unstable; urgency=low
 .
   [ Timo Aaltonen ]
   * Update patch 17; Add missing __datadir__ to cpprules.in.
 .
   [ Cyril Brulebois ]
   * Add listing files under /etc/X11/xorg.conf.d in bug script.
   * Fix typo in 10-mouse.conf: s/Mouse/Pointer/ (Closes: #579130).
 .
   [ Julien Cristau ]
   * Drop the GLX 1.4 patches to fix server crashes with DRI2 (closes:
     #567677).
   * Change driver ABI Conflicts to Breaks.  Drop old Conflicts/Replaces on
     pre-modular xserver packages.
   * Unset PRERELEASE to avoid the prerelease warning in the log.
   * New upstream release:
     - fixes Xvfb crash with XI2 (closes: #575905)
     - EXA: Check sys_ptr isn't NULL before passing it to the UploadToScreen
       hook (closes: #576656)
   * 19-exa-handle-pixmap-create-destroy-in-lower-layers.diff is now upstream,
     remove it.
   * Drop mention of input_id from debian/copyright since we stopped shipping
     it a while back.
Checksums-Sha1: 
 d50a4ef0e34206d74a115cf609131a75b319e06d 4199 xorg-server_1.7.7-1.dsc
 c391e4a13b04fdd2fe4d135c4758e09f35b8f5c0 6621190 xorg-server_1.7.7.orig.tar.gz
 6459f7db55087e8639f1573152033d32a1e4f1c8 363263 xorg-server_1.7.7-1.diff.gz
 b6bd199c46b825e95d3e8def77bccf4a1865570a 55866 xserver-common_1.7.7-1_all.deb
 1403c5b1045aa2b9544d3cdaa45ec38d38c0bcf6 2392208 xserver-xorg-core_1.7.7-1_i386.deb
 71133ce02752f743d59f6b181151b7f73f48bdb0 929360 xserver-xorg-core-udeb_1.7.7-1_i386.udeb
 c6db7501e291b4392933cc0651cdab78493ca9d0 1192302 xserver-xorg-dev_1.7.7-1_i386.deb
 713c0df6c143dbba715470efbc8670b7af9b83b3 1688292 xdmx_1.7.7-1_i386.deb
 516201dc69f34353b1a8cb93e16b05a59738c93f 1007790 xdmx-tools_1.7.7-1_i386.deb
 533831e9c6ac520afc710b363d268921062050b2 1601380 xnest_1.7.7-1_i386.deb
 b7c036ebe22fd419db897a2f931a315baebe98b8 1714678 xvfb_1.7.7-1_i386.deb
 35f81ab7b5395b188a53a672450a39125a0df9b4 1791394 xserver-xephyr_1.7.7-1_i386.deb
 b586e726d27c25e0cb768e05a3fc9b539c106e14 1737256 xserver-xfbdev_1.7.7-1_i386.deb
 443595300d0a877cc7555ef4b108129679de53f8 5921454 xserver-xorg-core-dbg_1.7.7-1_i386.deb
Checksums-Sha256: 
 c851d8b7917001b13099e990211a813f606f46aeb41a88149db857bce44f01fc 4199 xorg-server_1.7.7-1.dsc
 92e00fa8fc6723c7e0629de1e6a4b87fee34383967d36b6ae1e648f8a06cafd8 6621190 xorg-server_1.7.7.orig.tar.gz
 90447fc042641e84b1baae2e983d740c60115d8cc0616c50d3551bb462eb61ee 363263 xorg-server_1.7.7-1.diff.gz
 fd2b5f6595b834d1c8288fc011152ba7b2619de380924d1530bcd7d1209f4439 55866 xserver-common_1.7.7-1_all.deb
 04f6b815946a7c999b9cb1f7c89cdc829aa0d4c0397865e9d4069a2577a96547 2392208 xserver-xorg-core_1.7.7-1_i386.deb
 c84768a6a43b3fca1c1bd41f41b0e0b03a03b0aba732072cd698dd7689aa6c3f 929360 xserver-xorg-core-udeb_1.7.7-1_i386.udeb
 7cc93bc7dd32d4ea9f9cf566d0827fe5c3a52eb496e481567494c299a052b96a 1192302 xserver-xorg-dev_1.7.7-1_i386.deb
 e992ac86f7910fad42e91fd2bd3779f0ce714fa2fa80541183b1908ee64393ab 1688292 xdmx_1.7.7-1_i386.deb
 ebcba62a1ba072f406acd46242a8bebb7de5cd04f695738e11906713e1800d70 1007790 xdmx-tools_1.7.7-1_i386.deb
 95a81f2e4c3bf9602084b858821412e0f30042b1cd6c2e2f4fed6cbda1d19084 1601380 xnest_1.7.7-1_i386.deb
 684ba1114e26a82f275bc5f8cef9c17d2490c45672f42688af8bd061081f93e2 1714678 xvfb_1.7.7-1_i386.deb
 a33144040f5a8752b9ab54ef42d360266837f46358530c7ae31f64c6f7884394 1791394 xserver-xephyr_1.7.7-1_i386.deb
 0eaa4794997aa21abc25cbd2900e2b4048d0ba37fa00a3e408d10a97284d1f24 1737256 xserver-xfbdev_1.7.7-1_i386.deb
 2b00f69b6b50e83060c694583c6d85fd3304aaf4d5fe363a95ede6149ac6637c 5921454 xserver-xorg-core-dbg_1.7.7-1_i386.deb
Files: 
 fb362782068979b8464546a0f32759a2 4199 x11 optional xorg-server_1.7.7-1.dsc
 a88ab769d163a08ef77eda465206c890 6621190 x11 optional xorg-server_1.7.7.orig.tar.gz
 ea6df2a5eee75a547f2c3f2825bae246 363263 x11 optional xorg-server_1.7.7-1.diff.gz
 d345adef54d2f75fc5e01d9d48272f82 55866 x11 optional xserver-common_1.7.7-1_all.deb
 7db7c3d3ea828697800f1a6571fa60a6 2392208 x11 optional xserver-xorg-core_1.7.7-1_i386.deb
 0e2d09128101c23942d5af148a1190a8 929360 debian-installer optional xserver-xorg-core-udeb_1.7.7-1_i386.udeb
 2a1075087f87b67854685eb0a9bd6681 1192302 x11 optional xserver-xorg-dev_1.7.7-1_i386.deb
 8c8aad2659705ed0934add163a548832 1688292 x11 optional xdmx_1.7.7-1_i386.deb
 c32d5fe829d4be48acfe343f32cd80a6 1007790 x11 optional xdmx-tools_1.7.7-1_i386.deb
 c10bef3f51534734acd165b2a93b4511 1601380 x11 optional xnest_1.7.7-1_i386.deb
 ef003f1f6f2a18ac31442d9c9cbc8abb 1714678 x11 optional xvfb_1.7.7-1_i386.deb
 0ce7cbd373be69c56bcb8f47eae81cd5 1791394 x11 optional xserver-xephyr_1.7.7-1_i386.deb
 22d070bfea900648f2e7f45e0b5a2ed5 1737256 x11 optional xserver-xfbdev_1.7.7-1_i386.deb
 89d4ca8d023d911e8413cf61f3adea6c 5921454 debug extra xserver-xorg-core-dbg_1.7.7-1_i386.deb
Package-Type: udeb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQIcBAEBCAAGBQJL4CipAAoJEDEBgAUJBeQMw7AQAIZgE917DK+s0pIVHho1xsyz
iqNtPJl9iHpmNIF4GAxpLNwmINigv/kr3X79nhLVia5zRS8FEo47FoeJ4yV2W1bt
EzKpW/3Blw5tQeWJ57QfP8C4UPJEihYUKHgFiiqSLBONzRQMl5ji9kNh7iATm1dh
mf8ZOmzKhBMBDkHydQ4+U3zzCNk8Iu1agpyeW+JixyAvMC4oP3Laz7NZAJuLcA/0
E4Xph+B7XlIl6B2IrlsWuNlWqj/jhaVMzwuOEubA1GAVXQNucOJdbDIXPeSVgT+d
ftAke0pFeht07rk02Uofgq2aIBKrLauwwTl5lc72LMOBpOA37zBiV9AkOqqpbgRk
OIdQ5UY9fHdWaKtkkM93nrZ3oO2tL74wOohki/4qJDxGVqszOI25gg58vaY8Nouc
OUnqgUw1blOZO8RlixRL3ySYDV4Ke8p93M9ztFtpfppJOk03OmbV47n2WjsxSat1
jeFjTBdkCbOcQlxSUjwyhp6EhKaFSK2oLlYQgXO/pmfYWqpFsLeabnWMfByIXIx4
gGqaQf+PQNbGmpePcDqKAwE9/DruiG6xKJd4jCHmi1ugo+boK5rr7chbEmJI2HAv
vvPkeDBY0H+sdreqYrWxlDSI5fEJwJWdjc69sLI0HksiyZN3uPYb4SkjqjoXTHCO
Gc8eBuRsWjuE7fjavp2N
=Le81
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.