Bug #274988 “Xorg crashed with SIGSEGV in miValidateTree if Back...” : Bugs : xorg-server package : Ubuntu

Affects	Status	Importance	Assigned to	Milestone
	X.Org X server	Fix Released	Medium	freedesktop-bugs #18895
	xorg-server (Ubuntu)	Invalid	High	Unassigned

Revision history for this message

Chris Coulson (chrisccoulson) wrote on 2008-09-26:

#1

Thank you for taking the time to report this bug and helping to make Ubuntu better. gnome-system-monitor shouldn't be able to crash the X server, so I've reassigned your bug to xorg for now. Please could you trigger the crash, and then attach your old X server log file (/var/log/Xorg.0.log.old) when you log in to the next session after the crash. This should hopefully contain a backtrace of the crash.

Thanks in advance.

Changed in gnome-system-monitor:
status:	New → Incomplete

Revision history for this message

brad (bradlambeth) wrote on 2008-09-26:

#2

Xorg.0.log.old Edit (53.2 KiB, application/x-trash)

Revision history for this message

brad (bradlambeth) wrote on 2008-10-02:

#3

Is there anything else I need to do to confirm this bug?

Revision history for this message

Chris Coulson (chrisccoulson) wrote on 2008-10-02:

#4

Thanks.

Would you mind trying to obtain a backtrace of the crash, by following the steps at https://wiki.ubuntu.com/X/Backtracing

Revision history for this message

brad (bradlambeth) wrote on 2008-10-02:

#5

Here's the backtrace from my old Xorg log:

Backtrace:
0: /usr/X11R6/bin/X(xf86SigHandler+0x65) [0x481005]
1: /lib/libc.so.6 [0x7f100a383060]
2: /usr/X11R6/bin/X(miHandleValidateExposures+0x6c) [0x4e59fc]
3: /usr/X11R6/bin/X(UnmapWindow+0x248) [0x4386f8]
4: /usr/X11R6/bin/X(compFreeClientWindow+0x23e) [0x4ff36e]
5: /usr/X11R6/bin/X [0x4fca59]
6: /usr/X11R6/bin/X(FreeResource+0x134) [0x435fd4]
7: /usr/X11R6/bin/X(compUnredirectWindow+0x63) [0x4fef53]
8: /usr/X11R6/bin/X [0x4fd4a6]
9: /usr/X11R6/bin/X [0x4e5faf]
10: /usr/X11R6/bin/X [0x4e5ebc]
11: /usr/X11R6/bin/X(miChangeSaveUnder+0x50) [0x4e6050]
12: /usr/X11R6/bin/X(MapWindow+0x40c) [0x438e8c]
13: /usr/X11R6/bin/X(ProcMapWindow+0x46) [0x44cf66]
14: /usr/X11R6/bin/X(Dispatch+0x364) [0x44d7a4]
15: /usr/X11R6/bin/X(main+0x45d) [0x43378d]
16: /lib/libc.so.6(__libc_start_main+0xe6) [0x7f100a36e466]
17: /usr/X11R6/bin/X [0x432b69]
Saw signal 11. Server aborting.

I installed the dbg packages recommended in your guide. Which portion of the guide would you recommend?

Revision history for this message

brad (bradlambeth) wrote on 2008-10-02:

#6

gdb-Xorg.txt Edit (11.2 KiB, text/plain)

Nevermind, I figured it out. Attached is the backtrace from gdb.

Revision history for this message

Chris Coulson (chrisccoulson) wrote on 2008-10-02:

#7

Thanks for the backtrace. Before I triage this, would you mind attaching your /etc/X11/xorg.conf (if you have one). If you do have one, could you also try running without it? Please also run the following, and attach the resulting log file to this bug report:

"sudo lspci -vvnn > lspci.log"

Thanks

Changed in xorg:
importance:	Undecided → Medium

Revision history for this message

brad (bradlambeth) wrote on 2008-10-02: Re: Xorg crashed with SIGSEGV in miValidateTree

#8

xorg.conf Edit (1.6 KiB, text/plain)

When I run without an xorg.conf, it asks to reconfigure the graphics. After restarting, gnome-system-monitor doesn't crash x anymore, but is using the failsafe graphics, i.e. framebuffer.

Revision history for this message

brad (bradlambeth) wrote on 2008-10-02:

#9

lspci.log Edit (19.1 KiB, text/plain)

Chris Coulson (chrisccoulson) on 2008-10-02

Changed in xorg-server:
status:	Incomplete → Triaged

Revision history for this message

brad (bradlambeth) wrote on 2008-10-09:

#10

When I remove the backingstore option from xorg.conf, X doesn't crash anymore when opening gnome-system-monitor. Should backingstore work for my card, or should I just leave this alone?

Revision history for this message

Chris Coulson (chrisccoulson) wrote on 2008-10-09:

#11

Hmmmmm, BackingStore causes problems for me too (but with a NVIDIA card). I'd remove it if you don't need it. I'll keep this bug open though because it still shouldn't cause the Xserver to crash.

Did you add the BackingStore option manually, or was it added automatically?

Revision history for this message

brad (bradlambeth) wrote on 2008-10-09:

#12

I added it manually. Just trying to squeeze all the performance I could out of the open-source drivers until the proprietary drivers start working with xserver 1.5.

A few threads I read mentioned that backingstore shouldn't be used with X.org 7.4. I can't find any official documentation of this, but for now I'm fine with not using it.

Revision history for this message

Chris Coulson (chrisccoulson) wrote on 2008-10-12:

#13

Thanks. I'm going to adjust the importance of the bug to low, as this really only occurs with a fairly non-standard configuration, and isn't going to affect many people. I will still keep the bug open though, as the crash shouldn't happen anyway.

Changed in xorg-server:
importance:	Medium → Low

Revision history for this message

brad (bradlambeth) wrote on 2008-10-17:

#14

Just wanted to add that this error happens with the fglrx driver as well. Backingstore just doesn't work.

Revision history for this message

Jakub Argasiński (argasek) wrote on 2008-10-26:

#15

Confirming here on Kubuntu Intrepid 8.10 rc, nvidia 177.80 drivers. With "Backingstore" option set to on KDE4 crashes *a lot* - mostly using Konsole. If Konsole gets remembered in session, this leads to KDE4 crashing immediately after login.
@Chris: I think this bug may affect more people than expected; examples:
- http://www.nvnews.net/vbulletin/showthread.php?t=120630
- http://my.stargazer.at/2008/10/13/kde-4-no-thanks-yet/
- http://www.nvnews.net/vbulletin/showthread.php?t=115535
- http://bugs.kde.org/show_bug.cgi?id=169147
Moreover, one can easily find instructions to improve performance in KDE4 for nVidia cards like this: http://userbase.kde.org/GPU-Performance and setting backingstore to "on" is mentioned all the time. It really took me a while to find this bug report and an advice: http://forum.kde.org/showthread.php?tid=6721&pid=7344#pid7344.

Revision history for this message

In freedesktop.org Bugzilla #18895, Bryce Harrington (bryce) wrote on 2008-12-04:

#16

Download full text (6.1 KiB)

Several reporters are finding the Backingstore option causes crashes on a range of different hardware:
https://bugs.edge.launchpad.net/ubuntu/+source/xorg-server/+bug/274988

Below is a backtrace from the crash. Is this option supposed to work reliably? If not, perhaps it should be deprecated?

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fe72afc46e0 (LWP 11393)]
0x00000000004de71e in miValidateTree (pParent=0x2144a40,
    pChild=0x7fff32fe79c0, kind=VTMap) at ../../mi/mivaltree.c:790
in ../../mi/mivaltree.c
(gdb) backtrace full
#0 0x00000000004de71e in miValidateTree (pParent=0x2144a40,
    pChild=0x7fff32fe79c0, kind=VTMap) at ../../mi/mivaltree.c:790
totalClip = {extents = {x1 = 0, y1 = 24, x2 = 0, y2 = 24},
  data = 0x7e1c60}
childClip = {extents = {x1 = 0, y1 = 0, x2 = 0, y2 = 0},
  data = 0x7e1c60}
childUnion = {extents = {x1 = 1, y1 = 0, x2 = 0, y2 = 0}, data = 0x0}
exposed = {extents = {x1 = 0, y1 = 0, x2 = 0, y2 = 0},
  data = 0x7e1c60}
pScreen = (ScreenPtr) 0x20e4a90
pWin = (WindowPtr) 0x0
overlap = 1
viewvals = 0
forward = 855538080
#1 0x00007fe728693813 in DRIValidateTree (pParent=0x2144a40,
    pChild=0x28daa00, kind=VTMap) at ../../../../hw/xfree86/dri/dri.c:2055
pScreen = (ScreenPtr) 0x20e4a90
returnValue = <value optimized out>
#2 0x0000000000438e67 in MapWindow (pWin=0x28daa00,
    client=<value optimized out>) at ../../dix/window.c:2811
event = {u = {u = {type = 19 '\023', detail = 123 '{',
      sequenceNumber = 1236}, keyButtonPointer = {pad00 = 81034003,
      time = 104, root = 52429243, event = 1, child = 36695712, rootX = 0,
      rootY = 0, eventX = 22480, eventY = 126, state = 0,
      sameScreen = 0 '\0', pad1 = 0 '\0'}, enterLeave = {pad00 = 81034003,
      time = 104, root = 52429243, event = 1, child = 36695712, rootX = 0,
      rootY = 0, eventX = 22480, eventY = 126, state = 0, mode = 0 '\0',
      flags = 0 '\0'}, focus = {pad00 = 81034003, window = 104,
      mode = 187 '»', pad1 = 1 '\001', pad2 = 32 ' ', pad3 = 3 '\003'},
    expose = {pad00 = 81034003, window = 104, x = 443, y = 800, width = 1,
      height = 0, count = 61088, pad2 = 559}, graphicsExposure = {
      pad00 = 81034003, drawable = 104, x = 443, y = 800, width = 1,
      height = 0, minorEvent = 61088, count = 559, majorEvent = 0 '\0',
      pad1 = 0 '\0', pad2 = 0 '\0', pad3 = 0 '\0'}, noExposure = {
      pad00 = 81034003, drawable = 104, minorEvent = 443,
      majorEvent = 32 ' ', bpad = 3 '\003'}, visibility = {pad00 = 81034003,
      window = 104, state = 187 '»', pad1 = 1 '\001', pad2 = 32 ' ',
      pad3 = 3 '\003'}, createNotify = {pad00 = 81034003, parent = 104,
      window = 52429243, x = 1, y = 0, width = 61088, height = 559,
      borderWidth = 0, override = 0 '\0', bpad = 0 '\0'}, destroyNotify = {
      pad00 = 81034003, event = 104, window = 52429243}, unmapNotify = {
      pad00 = 81034003, event = 104, window = 52429243,
      fromConfigure = 1 '\001', pad1 = 0 '\0', pad2 = 0 '\0', pad3 = 0 '\0'},
    mapNotify = {pad00 = 81034003, event = 104, window = 52429243,
      override = 1 '\001', pad1 = 0 '\0', pad2 = 0 '\0', pad3 = 0 '\0'},
    mapReques...

Several reporters are finding the Backingstore option causes crashes on a range of different hardware:
https://bugs.edge.launchpad.net/ubuntu/+source/xorg-server/+bug/274988

Below is a backtrace from the crash.  Is this option supposed to work reliably?  If not, perhaps it should be deprecated?

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fe72afc46e0 (LWP 11393)]
0x00000000004de71e in miValidateTree (pParent=0x2144a40, 
    pChild=0x7fff32fe79c0, kind=VTMap) at ../../mi/mivaltree.c:790
	in ../../mi/mivaltree.c
(gdb) backtrace full
#0  0x00000000004de71e in miValidateTree (pParent=0x2144a40, 
    pChild=0x7fff32fe79c0, kind=VTMap) at ../../mi/mivaltree.c:790
	totalClip = {extents = {x1 = 0, y1 = 24, x2 = 0, y2 = 24}, 
  data = 0x7e1c60}
	childClip = {extents = {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, 
  data = 0x7e1c60}
	childUnion = {extents = {x1 = 1, y1 = 0, x2 = 0, y2 = 0}, data = 0x0}
	exposed = {extents = {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, 
  data = 0x7e1c60}
	pScreen = (ScreenPtr) 0x20e4a90
	pWin = (WindowPtr) 0x0
	overlap = 1
	viewvals = 0
	forward = 855538080
#1  0x00007fe728693813 in DRIValidateTree (pParent=0x2144a40, 
    pChild=0x28daa00, kind=VTMap) at ../../../../hw/xfree86/dri/dri.c:2055
	pScreen = (ScreenPtr) 0x20e4a90
	returnValue = <value optimized out>
#2  0x0000000000438e67 in MapWindow (pWin=0x28daa00, 
    client=<value optimized out>) at ../../dix/window.c:2811
	event = {u = {u = {type = 19 '\023', detail = 123 '{', 
      sequenceNumber = 1236}, keyButtonPointer = {pad00 = 81034003, 
      time = 104, root = 52429243, event = 1, child = 36695712, rootX = 0, 
      rootY = 0, eventX = 22480, eventY = 126, state = 0, 
      sameScreen = 0 '\0', pad1 = 0 '\0'}, enterLeave = {pad00 = 81034003, 
      time = 104, root = 52429243, event = 1, child = 36695712, rootX = 0, 
      rootY = 0, eventX = 22480, eventY = 126, state = 0, mode = 0 '\0', 
      flags = 0 '\0'}, focus = {pad00 = 81034003, window = 104, 
      mode = 187 '»', pad1 = 1 '\001', pad2 = 32 ' ', pad3 = 3 '\003'}, 
    expose = {pad00 = 81034003, window = 104, x = 443, y = 800, width = 1, 
      height = 0, count = 61088, pad2 = 559}, graphicsExposure = {
      pad00 = 81034003, drawable = 104, x = 443, y = 800, width = 1, 
      height = 0, minorEvent = 61088, count = 559, majorEvent = 0 '\0', 
      pad1 = 0 '\0', pad2 = 0 '\0', pad3 = 0 '\0'}, noExposure = {
      pad00 = 81034003, drawable = 104, minorEvent = 443, 
      majorEvent = 32 ' ', bpad = 3 '\003'}, visibility = {pad00 = 81034003, 
      window = 104, state = 187 '»', pad1 = 1 '\001', pad2 = 32 ' ', 
      pad3 = 3 '\003'}, createNotify = {pad00 = 81034003, parent = 104, 
      window = 52429243, x = 1, y = 0, width = 61088, height = 559, 
      borderWidth = 0, override = 0 '\0', bpad = 0 '\0'}, destroyNotify = {
      pad00 = 81034003, event = 104, window = 52429243}, unmapNotify = {
      pad00 = 81034003, event = 104, window = 52429243, 
      fromConfigure = 1 '\001', pad1 = 0 '\0', pad2 = 0 '\0', pad3 = 0 '\0'}, 
    mapNotify = {pad00 = 81034003, event = 104, window = 52429243, 
      override = 1 '\001', pad1 = 0 '\0', pad2 = 0 '\0', pad3 = 0 '\0'}, 
    mapRequest = {pad00 = 81034003, parent = 104, window = 52429243}, 
    reparent = {pad00 = 81034003, event = 104, window = 52429243, parent = 1, 
      x = -4448, y = 559, override = 0 '\0', pad1 = 0 '\0', pad2 = 0 '\0', 
      pad3 = 0 '\0'}, configureNotify = {pad00 = 81034003, event = 104, 
      window = 52429243, aboveSibling = 1, x = -4448, y = 559, width = 0, 
      height = 0, borderWidth = 22480, override = 126 '~', bpad = 0 '\0'}, 
    configureRequest = {pad00 = 81034003, parent = 104, window = 52429243, 
      sibling = 1, x = -4448, y = 559, width = 0, height = 0, 
      borderWidth = 22480, valueMask = 126, pad1 = 0}, gravity = {
      pad00 = 81034003, event = 104, window = 52429243, x = 1, y = 0, 
      pad1 = 36695712, pad2 = 0, pad3 = 8280016, pad4 = 0}, resizeRequest = {
      pad00 = 81034003, window = 104, width = 443, height = 800}, 
    circulate = {pad00 = 81034003, event = 104, window = 52429243, 
      parent = 1, place = 160 ' ', pad1 = 238 'î', pad2 = 47 '/', 
      pad3 = 2 '\002'}, property = {pad00 = 81034003, window = 104, 
      atom = 52429243, time = 1, state = 160 ' ', pad1 = 238 'î', 
      pad2 = 559}, selectionClear = {pad00 = 81034003, time = 104, 
      window = 52429243, atom = 1}, selectionRequest = {pad00 = 81034003, 
      time = 104, owner = 52429243, requestor = 1, selection = 36695712, 
      target = 0, property = 8280016}, selectionNotify = {pad00 = 81034003, 
      time = 104, requestor = 52429243, selection = 1, target = 36695712, 
      property = 0}, colormap = {pad00 = 81034003, window = 104, 
      colormap = 52429243, new = 1 '\001', state = 0 '\0', pad1 = 0 '\0', 
      pad2 = 0 '\0'}, mappingNotify = {pad00 = 81034003, request = 104 'h', 
      firstKeyCode = 0 '\0', count = 0 '\0', pad1 = 0 '\0'}, clientMessage = {
      pad00 = 81034003, window = 104, u = {l = {type = 52429243, longs0 = 1, 
          longs1 = 36695712, longs2 = 0, longs3 = 8280016, longs4 = 0}, s = {
          type = 52429243, shorts0 = 1, shorts1 = 0, shorts2 = -4448, 
          shorts3 = 559, shorts4 = 0, shorts5 = 0, shorts6 = 22480, 
          shorts7 = 126, shorts8 = 0, shorts9 = 0}, b = {type = 52429243, 
          bytes = "\001\000\000\000 î/\002\000\000\000\000ÐW~\000\000\000\000"}}}}}
	anyMarked = 1
	win_owner = (ClientPtr) 0x28bba10
	ag_leader = (ClientPtr) 0x0
	pScreen = (ScreenPtr) 0x20e4a90
	pParent = <value optimized out>
	dosave = 0
	pLayerWin = (WindowPtr) 0x28daa00
#3  0x000000000044cf66 in ProcMapWindow (client=0x28bba10)
    at ../../dix/dispatch.c:695
	pWin = (WindowPtr) 0x28daa00
	rc = 0
#4  0x000000000044d7a4 in Dispatch () at ../../dix/dispatch.c:454
	result = <value optimized out>
	client = (ClientPtr) 0x28bba10
	nready = 0
	start_tick = 800
#5  0x000000000043378d in main (argc=10, argv=0x7fff32fe7ca8, 
    envp=<value optimized out>) at ../../dix/main.c:441
	i = 1
	error = 0
	xauthfile = <value optimized out>
	alwaysCheckForInput = {0, 1}
(gdb) quit
The program is running.  Quit anyway (and detach it)? (y or n) Detaching from program: /usr/bin/Xorg, process 11393

Revision history for this message

Bryce Harrington (bryce) wrote on 2008-12-05: Re: Xorg crashed with SIGSEGV in miValidateTree

#17

Hi guys,

I've forwarded this issue upstream. Please subscribe to it in case upstream has further questions or wishes you to test something: https://bugs.freedesktop.org/show_bug.cgi?id=18895

Meanwhile, yeah, sounds like it would be wisest to avoid the option. Upstream (esp -intel upstream) has been doing a lot of performance work, and some of the non-default performance-related options can expose code that is not very thoroughly QA'd as the defaults.

Bug Watch Updater (bug-watch-updater) on 2008-12-05

Changed in xorg-server:
status:	Unknown → Confirmed

Bryce Harrington (bryce) on 2009-03-06

description:

updated

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-03-19:

#18

bug 310038 has a good backtrace on it. Set as dupe of this one.

summary:	- Xorg crashed with SIGSEGV in miValidateTree + Xorg crashed with SIGSEGV in miValidateTree if BackingStore option used + - compUnredirectWindow+0x7b
Changed in xorg-server (Ubuntu):
importance:	Low → High

Revision history for this message

In freedesktop.org Bugzilla #18895, Enrico-tagliavini (enrico-tagliavini) wrote on 2009-04-02:

#19

Created an attachment (id=24481)
Xorg.0.log

I have a similar problem with backingstore option enabled using kde4.2.1 under xorg 7.4 (xorg-server-1.5.3) xf86-video-ati-6.10.0. I'm using a radeon 9250 (r200 based) card.

When some dialog pop up or when i drag and drop a plasmoid to the desktop Xorg crash with segfault (the log is obtained in latter case). If i disable desktop effect Xorg crash at login.

If i disable backingstore the issue is not present.

Bryce Harrington (bryce) on 2009-08-13

tags:

added: intrepid

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-09-09:

#20

This bug seems to be pretty ancient; I'm guessing if it were still relevant we'd have seen more recent comments. In any case the backtraces have bitrotted; they no longer point into the right functions. So presumably code's been changed which has made this bug go away.

If I'm wrong and the bug can be reproduced on Karmic, feel free to reopen and attach a fresh Backtrace. A fresh Xorg.0.log couldn't hurt either.

Changed in xorg-server (Ubuntu):
status:	Triaged → Invalid

Bug Watch Updater (bug-watch-updater) on 2010-09-13

Changed in xorg-server:
importance:	Unknown → Medium

Bug Watch Updater (bug-watch-updater) on 2011-01-25

Changed in xorg-server:
importance:	Medium → Unknown

Bug Watch Updater (bug-watch-updater) on 2011-02-03

Changed in xorg-server:
importance:	Unknown → Medium

Revision history for this message

In freedesktop.org Bugzilla #18895, Ajax-a (ajax-a) wrote on 2014-03-24:

#21

I think this is fixed since 1.6. The backtrace seems to point into the old dix save-under code, which no longer exists as of 1.6 (but did in 1.5, when these backtraces seem to originate).

Bug Watch Updater (bug-watch-updater) on 2014-03-27

Changed in xorg-server:
status:	Confirmed → Fix Released

Ubuntu
xorg-server package

Xorg crashed with SIGSEGV in miValidateTree if BackingStore option used - compUnredirectWindow+0x7b

Bug Description

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntuxorg-server package

Xorg crashed with SIGSEGV in miValidateTree if BackingStore option used - compUnredirectWindow+0x7b

Bug Description

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
xorg-server package