#8022 HIGH 8.2.0 (: X crashes when Browse views http://wiki.laptop.org/go/Hardware_specification

[Zarro Boogs per Child]

#8022: X crashes when Browse views
http://wiki.laptop.org/go/Hardware_specification
-----------------------------+----------------------------------------------
 Reporter:  tomeu            |         Owner:  bernie              
     Type:  defect           |        Status:  new                 
 Priority:  high             |     Milestone:  8.2.0 (was Update.2)
Component:  x window system  |       Version:  not specified       
 Keywords:  blocks?:8.2.0    |   Next_action:  communicate         
 Verified:  0                |     Blockedby:                      
 Blocking:                   |  
-----------------------------+----------------------------------------------
 seems like mozilla requests a pixmap too big for the available memory,
 then X tries to free the failed pixmap (NULL).

 {{{
 Program received signal SIGSEGV, Segmentation fault.
 XvDestroyPixmap (pPix=0x0) at xvmain.c:348
 348       pScreen = pPix->drawable.pScreen;
 (gdb) bt
 #0  XvDestroyPixmap (pPix=0x0) at xvmain.c:348
 #1  0x0808119f in ProcCreatePixmap (client=0x9450950) at dispatch.c:1342
 #2  0x08085dbf in Dispatch () at dispatch.c:454
 #3  0x0806b63d in main (argc=7, argv=0xbfa7c494, envp=0x0) at main.c:441
 (gdb) l
 343       XvAdaptorPtr pa;
 344       int na;
 345       XvPortPtr pp;
 346       int np;
 347
 348       pScreen = pPix->drawable.pScreen;
 349
 350       SCREEN_PROLOGUE(pScreen, DestroyPixmap);
 351
 352       pxvs = (XvScreenPtr)dixLookupPrivate(&pScreen->devPrivates,
 XvScreenKey);
 (gdb) up
 #1  0x0808119f in ProcCreatePixmap (client=0x9450950) at dispatch.c:1342
 1342        (*pDraw->pScreen->DestroyPixmap)(pMap);
 (gdb) l
 1337                return rc;
 1338            }
 1339            if (AddResource(stuff->pid, RT_PIXMAP, (pointer)pMap))
 1340                return(client->noClientException);
 1341        }
 1342        (*pDraw->pScreen->DestroyPixmap)(pMap);
 1343        return (BadAlloc);
 1344    }
 1345
 1346    int
 }}}

 I guess XvDestroyPixmap should check the state of the pointer, but I guess
 that depends on the X conventions.

 We should check if upstream has already fixed this and in that case
 backport the fix.

-- 
Ticket URL: <http://dev.laptop.org/ticket/8022>
One Laptop Per Child <http://laptop.org/>
OLPC bug tracking system