[apport] gdmgreeter crashed with SIGSEGV in _XkbReadGetMapReply()

Bug #94737 reported by Christophe Mehay
2
Affects Status Importance Assigned to Milestone
X.Org X server
Invalid
Medium
xorg-server (Ubuntu)
Invalid
Medium
Unassigned

Bug Description

Binary package hint: gdm

crash when I used xdmcp server

ProblemType: Crash
Architecture: i386
Date: Thu Mar 22 13:11:45 2007
DistroRelease: Ubuntu 7.04
ExecutablePath: /usr/lib/gdm/gdmgreeter
Package: gdm 2.18.0-0ubuntu2
PackageArchitecture: i386
ProcCmdline: /usr/lib/gdm/gdmgreeter
ProcCwd: /var/lib/gdm
ProcEnviron:
 LANG=fr_FR.UTF-8
 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/bin:/usr/bin:/usr/X11R6/bin
 LANGUAGE=
 SHELL=/bin/false
Signal: 11
SourcePackage: gdm
StacktraceTop:
 _XkbReadGetMapReply () from /usr/lib/libX11.so.6
 ?? () from /usr/lib/libX11.so.6
 ?? ()
 ?? ()
 ?? ()
Uname: Linux claude-desktop 2.6.20-12-generic #2 SMP Sun Mar 18 03:07:14 UTC 2007 i686 GNU/Linux
UserGroups:

Revision history for this message
Christophe Mehay (goldy-goldenfish) wrote :
Revision history for this message
Daniel Holbach (dholbach) wrote :

Thanks for your bug report.

Changed in gdm:
assignee: nobody → desktop-bugs
importance: Undecided → Medium
Revision history for this message
In , Sebastien Bacher (seb128) wrote :
Download full text (4.7 KiB)

The bug has been opened on https://launchpad.net/bugs/94737

"Binary package hint: gdm

crash when I used xdmcp server
...
libx11-6 2:1.1.1-1ubuntu1
...
http://librarian.launchpad.net/6898243/ThreadStacktrace.txt
ThreadStacktrace.txt
..."

Debug backtrace for the crash:

206 map->syms[offset]= 0;
(gdb) thread apply all bt full

Thread 1 (process 5372):
#0 0xb76df41b in _XkbReadGetMapReply (dpy=0x8086108, rep=0xbf8e97a4, xkb=0x8557fc0, nread_rtrn=0x0)
    at ../../../src/xkb/XKBGetMap.c:206
        sz = <value optimized out>
        prev_syms = (KeySym *) 0x855c7b8
        extraData = <value optimized out>
        mask = <value optimized out>
#1 0xb76df864 in _XkbHandleGetMapReply (dpy=0x8086108, xkb=0x8557fc0) at ../../../src/xkb/XKBGetMap.c:526
        rep = {type = 1 '\001', deviceID = 4 '\004', sequenceNumber = 843, length = 1010, pad1 = 0, minKeyCode = 8 '\b',
  maxKeyCode = 255 '�', present = 71, firstType = 0 '\0', nTypes = 18 '\022', totalTypes = 18 '\022',
  firstKeySym = 8 '\b', totalSyms = 289, nKeySyms = 248 '�', firstKeyAct = 0 '\0', totalActs = 0, nKeyActs = 0 '\0',
  firstKeyBehavior = 0 '\0', nKeyBehaviors = 0 '\0', totalKeyBehaviors = 0 '\0', firstKeyExplicit = 0 '\0',
  nKeyExplicit = 0 '\0', totalKeyExplicit = 0 '\0', firstModMapKey = 8 '\b', nModMapKeys = 248 '
  totalModMapKeys = 14 '\016', firstVModMapKey = 0 '\0', nVModMapKeys = 0 '\0', totalVModMapKeys = 0 '\0', pad2 = 0 '\0',
  virtualMods = 65535}
#2 0xb76e0204 in XkbGetUpdatedMap (dpy=0x8086108, which=71, xkb=0x8557fc0) at ../../../src/xkb/XKBGetMap.c:543
        req = <value optimized out>
        status = 0
#3 0xb76e02c4 in XkbGetMap (dpy=0x8086108, which=71, deviceSpec=256) at ../../../src/xkb/XKBGetMap.c:561
        xkb = (XkbDescPtr) 0x8557fc0
#4 0xb7bd4950 in get_xkb (keymap_x11=0x855a038) at gdkkeys-x11.c:256
        display_x11 = (GdkDisplayX11 *) 0x808e098
        xdisplay = (Display *) 0x8086108
#5 0xb7bd4f3f in update_direction (keymap_x11=0x85c3ae8, group=65825) at gdkkeys-x11.c:591
        xkb = <value optimized out>
        group_atom = 0
#6 0xb7bd5178 in IA__gdk_keymap_get_direction (keymap=0x855a038) at gdkkeys-x11.c:713
        state_rec = {group = 0 '\0', locked_group = 0 '\0', base_group = 0, latched_group = 0, mods = 0 '\0',
  base_mods = 0 '\0', latched_mods = 0 '\0', locked_mods = 0 '\0', compat_state = 0 '\0', grab_mods = 0 '\0',
  compat_grab_mods = 0 '\0', lookup_mods = 0 '\0', compat_lookup_mods = 0 '\0', ptr_buttons = 0}
        __PRETTY_FUNCTION__ = "IA__gdk_keymap_get_direction"
#7 0xb7ccfb25 in gtk_entry_ensure_layout (entry=0x82080a8, include_preedit=1) at gtkentry.c:3251
No locals.
#8 0xb7cd3033 in gtk_entry_adjust_scroll (entry=0x82080a8) at gtkentry.c:3705
        min_offset = <value optimized out>
        max_offset = <value optimized out>
        text_area_width = 152
        text_width = <value optimized out>
        inner_border = {left = 2, right = 2, top = 2, bottom = 2}
        strong_x = <value optimized out>
        weak_x = <value optimized out>
        strong_xoffset = <value optimized out>
        weak_xoffset = <value optimized out>
        xalign = 1.9375
        layout = <value optim...

Read more...

Revision history for this message
In , Daniel Stone (daniels) wrote :

what's the value of offset at the time, and what are xkb->map->{num,size}_syms?

Revision history for this message
In , Sebastien Bacher (seb128) wrote :

(gdb) p xkb->map
$1 = (XkbClientMapPtr) 0x853c0f0
(gdb) p xkb->map->num_syms
$2 = 0
(gdb) p xkb->map->size_syms
$3 = 6144
(gdb) p offset
No symbol "offset" in current context.

Do you have any idea why the offset value is not available?

Revision history for this message
In , Daniel Stone (daniels) wrote :

Egh, size_syms is clearly bogus. offset won't be available if the loop gets unrolled, IIRC. Depends on the level of optimisation.

Revision history for this message
Sebastien Bacher (seb128) wrote :
Download full text (4.4 KiB)

Debug backtrace for the crash:

(gdb) thread apply all bt full

Thread 1 (process 5372):
#0 0xb76df41b in _XkbReadGetMapReply (dpy=0x8086108, rep=0xbf8e97a4, xkb=0x8557fc0, nread_rtrn=0x0)
    at ../../../src/xkb/XKBGetMap.c:206
        sz = <value optimized out>
        prev_syms = (KeySym *) 0x855c7b8
        extraData = <value optimized out>
        mask = <value optimized out>
#1 0xb76df864 in _XkbHandleGetMapReply (dpy=0x8086108, xkb=0x8557fc0) at ../../../src/xkb/XKBGetMap.c:526
        rep = {type = 1 '\001', deviceID = 4 '\004', sequenceNumber = 843, length = 1010, pad1 = 0, minKeyCode = 8 '\b',
  maxKeyCode = 255 '�', present = 71, firstType = 0 '\0', nTypes = 18 '\022', totalTypes = 18 '\022',
  firstKeySym = 8 '\b', totalSyms = 289, nKeySyms = 248 '�', firstKeyAct = 0 '\0', totalActs = 0, nKeyActs = 0 '\0',
  firstKeyBehavior = 0 '\0', nKeyBehaviors = 0 '\0', totalKeyBehaviors = 0 '\0', firstKeyExplicit = 0 '\0',
  nKeyExplicit = 0 '\0', totalKeyExplicit = 0 '\0', firstModMapKey = 8 '\b', nModMapKeys = 248 '
  totalModMapKeys = 14 '\016', firstVModMapKey = 0 '\0', nVModMapKeys = 0 '\0', totalVModMapKeys = 0 '\0', pad2 = 0 '\0',
  virtualMods = 65535}
#2 0xb76e0204 in XkbGetUpdatedMap (dpy=0x8086108, which=71, xkb=0x8557fc0) at ../../../src/xkb/XKBGetMap.c:543
        req = <value optimized out>
        status = 0
#3 0xb76e02c4 in XkbGetMap (dpy=0x8086108, which=71, deviceSpec=256) at ../../../src/xkb/XKBGetMap.c:561
        xkb = (XkbDescPtr) 0x8557fc0
#4 0xb7bd4950 in get_xkb (keymap_x11=0x855a038) at gdkkeys-x11.c:256
        display_x11 = (GdkDisplayX11 *) 0x808e098
        xdisplay = (Display *) 0x8086108
#5 0xb7bd4f3f in update_direction (keymap_x11=0x85c3ae8, group=65825) at gdkkeys-x11.c:591
        xkb = <value optimized out>
        group_atom = 0
#6 0xb7bd5178 in IA__gdk_keymap_get_direction (keymap=0x855a038) at gdkkeys-x11.c:713
        state_rec = {group = 0 '\0', locked_group = 0 '\0', base_group = 0, latched_group = 0, mods = 0 '\0',
  base_mods = 0 '\0', latched_mods = 0 '\0', locked_mods = 0 '\0', compat_state = 0 '\0', grab_mods = 0 '\0',
  compat_grab_mods = 0 '\0', lookup_mods = 0 '\0', compat_lookup_mods = 0 '\0', ptr_buttons = 0}
        __PRETTY_FUNCTION__ = "IA__gdk_keymap_get_direction"
#7 0xb7ccfb25 in gtk_entry_ensure_layout (entry=0x82080a8, include_preedit=1) at gtkentry.c:3251
No locals.
#8 0xb7cd3033 in gtk_entry_adjust_scroll (entry=0x82080a8) at gtkentry.c:3705
        min_offset = <value optimized out>
        max_offset = <value optimized out>
        text_area_width = 152
        text_width = <value optimized out>
        inner_border = {left = 2, right = 2, top = 2, bottom = 2}
        strong_x = <value optimized out>
        weak_x = <value optimized out>
        strong_xoffset = <value optimized out>
        weak_xoffset = <value optimized out>
        xalign = 1.9375
        layout = <value optimized out>
---Type <return> to continue, or q <return> to quit---
        logical_rect = {x = 136347816, y = 1079488016, width = -1218125536, height = -1208607828}
#9 0xb7cd31c7 in recompute_idle_func (data=0x82080a8) at gtkentry.c:3111
        entry = (GtkEntry *) 0x85c3ae8
#10 0xb78d...

Read more...

Revision history for this message
Sebastien Bacher (seb128) wrote :

Reassigning to libx11, might be also GTK using wrong arguments, the lib should not crash though

Changed in gdm:
assignee: desktop-bugs → nobody
status: Unconfirmed → Confirmed
Revision history for this message
Sebastien Bacher (seb128) wrote :
Changed in xorg-server:
status: Unknown → Confirmed
Revision history for this message
Bryce Harrington (bryce) wrote :

It's been a considerable time since the last comment on this issue, and Xkb has undergone significant reworking. Are you still having the problem with the more current versions of Ubuntu?

Changed in libx11:
status: Confirmed → Incomplete
Revision history for this message
Bryce Harrington (bryce) wrote :

We're closing this bug since it is has been some time with no response from the original reporter. However, if the issue still exists please feel free to reopen with the requested information. Also, if you could, please test against the latest development version of Ubuntu, since this confirms the bug is one we may be able to pass upstream for help.

Changed in xorg-server:
status: Incomplete → Invalid
Changed in xorg-server:
importance: Unknown → Medium
Changed in xorg-server:
importance: Medium → Unknown
Changed in xorg-server:
importance: Unknown → Medium
Changed in xorg-server:
status: Confirmed → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.