Arch Linux

nomanor

Member

Registered: 2013-11-13

Posts: 2

LibreOffice xserver crash

I have the same crashes and stacktraces as in these threads:

https://bbs.archlinux.org/viewtopic.php?id=195666
https://bbs.archlinux.org/viewtopic.php?id=194819

I am using xfce and xorg-server 1.17.1-4 and libreoffice-fresh 4.4.2-1. I have the same problem with libreoffice-still. My graphics card is an ATI R9 290 with the xf86-video-ati driver.
I compiled the xorg package with debug symbols and got the following backtrace:

Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x00007ff5d541a122 in fbBltOne (src=0x3143874, srcStride=0, srcX=0, dst=0x0, dstStride=0, dstX=0, dstBpp=32, width=768, height=23, fgand=4294967295, fgxor=0, bgand=0, bgxor=0)
    at fbbltone.c:344
344	                            WRITE(dst, FbStippleRRop(READ(dst), mask, fgand,

Thread 2 (Thread 0x7ff5d625e700 (LWP 18270)):
#0  0x00007ff5e04ec9af in pthread_cond_wait@@GLIBC_2.3.2 () from /usr/lib/libpthread.so.0
No symbol table info available.
#1  0x00007ff5d9a77aab in ?? () from /usr/lib/xorg/modules/dri/radeonsi_dri.so
No symbol table info available.
#2  0x00007ff5d9a77237 in ?? () from /usr/lib/xorg/modules/dri/radeonsi_dri.so
No symbol table info available.
#3  0x00007ff5e04e7374 in start_thread () from /usr/lib/libpthread.so.0
No symbol table info available.
#4  0x00007ff5e07e527d in clone () from /usr/lib/libc.so.6
No symbol table info available.

Thread 1 (Thread 0x7ff5e27aa900 (LWP 18269)):
#0  0x00007ff5d541a122 in fbBltOne (src=0x3143874, srcStride=0, srcX=0, dst=0x0, dstStride=0, dstX=0, dstBpp=32, width=768, height=23, fgand=4294967295, fgxor=0, bgand=0, bgxor=0)
    at fbbltone.c:344
        fbBits = 0x7ff5d5429a10 <fbStipple1Bits>
        srcEnd = 0x31438d0
        pixelsPerDst = 1
        unitsPerSrc = 32
        leftShift = 0
        rightShift = 32
        startmask = 0
        endmask = 0
        bits = 16777215
        bitsLeft = 0
        bitsRight = 32757
        left = 1
        mask = 4294967295
        nDst = 24
        w = 0
        n = 23
        nmiddle = 24
        dstS = 0
        copy = 0
        transparent = 0
        srcinc = 1
        endNeedsLoad = 0
        startbyte = 0
        endbyte = 0
#1  0x00007ff5d541c532 in fbCopy1toN (pSrcDrawable=0x3143800, pDstDrawable=0x315eaa0, pGC=0x3164110, pbox=0x7ffe2038f000, nbox=0, dx=0, dy=0, reverse=0, upsidedown=0, bitplane=1, 
    closure=0x0) at fbcopy.c:123
        pPriv = 0x31641b8
        src = 0x3143870
        srcStride = 1
        srcBpp = 1
        srcXoff = 0
        srcYoff = 0
        dst = 0x0
        dstStride = 24
        dstBpp = 32
        dstXoff = 0
        dstYoff = 0
#2  0x00007ff5dab87870 in glamor_copy_bail (src=0x3143800, dst=0x315eaa0, gc=0x3164110, box=0x7ffe2038f000, nbox=1, dx=0, dy=0, reverse=0, upsidedown=0, bitplane=1, closure=0x0)
    at glamor_copy.c:171
No locals.
#3  0x00000000005a4522 in miCopyRegion (pSrcDrawable=0x3143800, pDstDrawable=0x315eaa0, pGC=0x3164110, pDstRegion=0x7ffe2038f000, dx=0, dy=0, copyProc=0x7ff5dab88b50 <glamor_copy>, 
    bitPlane=1, closure=0x0) at micopy.c:121
        careful = 0
        reverse = 0
        upsidedown = 0
        pbox = 0x7ffe2038f000
        nbox = 1
        pboxNew1 = 0x0
        pboxNew2 = 0x0
        pboxBase = 0x4e2d0e <compSourceValidate+94>
        pboxNext = 0x7ffe2038ef40
        pboxTmp = 0x10051495b
#4  0x00000000005a4a88 in miDoCopy (pSrcDrawable=0x3143800, pDstDrawable=0x315eaa0, pGC=0x3164110, xIn=0, yIn=0, widthSrc=24, heightSrc=24, xOut=0, yOut=0, 
    copyProc=0x7ff5dab88b50 <glamor_copy>, bitPlane=1, closure=0x0) at micopy.c:296
        prgnSrcClip = 0x0
        freeSrcClip = 0
        prgnExposed = 0x0
        rgnDst = {extents = {x1 = 0, y1 = 0, x2 = 24, y2 = 24}, data = 0x0}
        dx = 0
        dy = 0
        numRects = 1
        box_x1 = 0
        box_y1 = 0
        box_x2 = 24
        box_y2 = 24
        fastSrc = 1
        fastDst = 1
        fastExpose = 1
#5  0x00007ff5dab88ca0 in glamor_copy_plane (src=<optimized out>, dst=<optimized out>, gc=<optimized out>, srcx=<optimized out>, srcy=<optimized out>, width=<optimized out>, 
    height=24, dstx=0, dsty=0, bitplane=1) at glamor_copy.c:681
        dstx = 0
        height = 24
        width = <optimized out>
        srcy = <optimized out>
        dsty = 0
        gc = <optimized out>
        src = <optimized out>
        bitplane = 1
        srcx = <optimized out>
        dst = <optimized out>
#6  0x000000000054594b in damageCopyPlane (pSrc=0x3143800, pDst=0x315eaa0, pGC=0x3164110, srcx=0, srcy=0, width=24, height=24, dstx=0, dsty=0, bitPlane=1) at damage.c:797
        ret = 0x26003f900000000
        pGCPriv = 0x31641a8
        oldFuncs = 0x859840 <damageGCFuncs>
#7  0x0000000000439168 in ProcCopyPlane (client=0x2fb2250) at dispatch.c:1719
        psrcDraw = 0x3143800
        pdstDraw = 0x315eaa0
        pGC = 0x3164110
        stuff = 0x3070c10
        pRgn = 0x2fb2250
        rc = 0
#8  0x00000000004356ae in Dispatch () at dispatch.c:432
        clientReady = 0x2c302e0
        result = 0
        client = 0x2fb2250
        nready = 0
        icheck = 0x863f80 <checkForInput>
        start_tick = 955
#9  0x00000000004446b9 in dix_main (argc=5, argv=0x7ffe2038f358, envp=0x7ffe2038f388) at main.c:298
        i = 1
        alwaysCheckForInput = {0, 1}
#10 0x000000000042583e in main (argc=5, argv=0x7ffe2038f358, envp=0x7ffe2038f388) at stubmain.c:34
No locals.

As far as I can see, the problem is that the call

fbGetDrawable(pDstDrawable, dst, dstStride, dstBpp, dstXoff, dstYoff);

in fb/fbcopy.c line 106 sets dst to NULL which is caused by the
struct member devPrivate.ptr in fb/fb.h line 507.

If this is an upstream bug, should I report it on the xorg bug tracker?

Last edited by nomanor (2015-04-11 15:00:32)