On Tue, Sep 18, 2012 at 12:58:23AM +0200, Matthieu Herrb wrote:
> On Tue, Sep 18, 2012 at 12:14:45AM +0200, Tobias Ulmer wrote:
> > Xorg from "Fri Aug 31 16:27:51 MDT 2012" worked fine, Xorg from "Tue Sep
> > 11 15:42:48 MDT 2012" segfaults:
> 
> Can you follow instructions in /usr/xenocara/README to get a stack
> trace from the X server ? 
> 
> I fail to see what could cause that in the commits between aug31 and
> sep11. Those where mostly updates to drivers that aren't used on your
> machine... 
> -- 
> Matthieu Herrb
> 

There is some compiler madness going on IMO. The following is a trace
from a slightly modified (see diff below) debug build (-O0 -ggdb).
The results are always repeatable.

What seems to happen is that sparcDriverName() gets called, which
returns a string constant. I've logged its address (0x4ebffff2d8) below.

In listPossibleVideoDrivers(), that address should be assigned to
sbusDriver, but instead something garbled appears. The lower part
clearly contains part of the address it should have, but the upper part
is all set to ff.

It finally crashes in strlen(), but note that the uninitialized "ret"
in XNFstrdup() still has "name" from sparcDriverName() on the stack...


#0  strlen () at /usr/src/lib/libc/arch/sparc64/string/strlen.S:42
42              ldsb    [%o0], %o2      ! fetch byte
(gdb) bt full
#0  strlen () at /usr/src/lib/libc/arch/sparc64/string/strlen.S:42
No locals.
#1  0x00000050cad867d0 in strdup (str=0xffffffffbffff2d8 <Address 
0xffffffffbffff2d8 out of bounds>) at /usr/src/lib/libc/string/strdup.c:44
        siz = 338224544152
        copy = 0x0
#2  0x0000004ebfedfbb8 in XNFstrdup (s=0xffffffffbffff2d8 <Address 
0xffffffffbffff2d8 out of bounds>) at /usr/xenocara/xserver/os/utils.c:1111
        ret = 0x4ebffff2d8 "sunffb"
#3  0x0000004ebfd326c4 in listPossibleVideoDrivers (matches=0xffffffffffff9ec0, 
nmatches=20)
    at /usr/xenocara/xserver/hw/xfree86/common/xf86AutoConfig.c:258
        sbusDriver = 0xffffffffbffff2d8 <Address 0xffffffffbffff2d8 out of 
bounds>
        i = 0
#4  0x0000004ebfd32a2c in autoConfigDevice (preconf_device=0x0) at 
/usr/xenocara/xserver/hw/xfree86/common/xf86AutoConfig.c:360
        ptr = 0x50c91eb400
        matches = {0x0 <repeats 20 times>}
        num_matches = 0
        num_screens = 0
        i = 6
        slp = 0x50c6b02d40
#5  0x0000004ebfcfd268 in InitOutput (pScreenInfo=0x4ec0548410, argc=5, 
argv=0xffffffffffffa348) at 
/usr/xenocara/xserver/hw/xfree86/common/xf86Init.c:489
        i = 0
        j = 0
        k = 0
        scr_index = 0
        was_blocked = 0
        modulelist = (char **) 0x50c89ac5c0
        optionlist = (pointer *) 0x50c89ac9c0
        screenpix24 = Pix24DontCare
        pix24 = Pix24DontCare
        pix24From = X_DEFAULT
        pix24Fail = 0
        autoconfig = 0
        configured_device = 0x0
#6  0x0000004ebfc5fda4 in main (argc=5, argv=0xffffffffffffa348, 
envp=0xffffffffffffa378) at /usr/xenocara/xserver/dix/main.c:203
        i = 256
        alwaysCheckForInput = {0, 1}
Current language:  auto; currently asm
(gdb)


[193070.501]    ABI class: X.Org Server Extension, version 6.0
[193070.502] (II) Loading extension XFree86-DRI
[193070.502] (II) LoadModule: "dri2"
[193070.504] (II) Loading /usr/X11R6/lib/modules/extensions/libdri2.so
[193070.506] (II) Module dri2: vendor="X.Org Foundation"
[193070.506]    compiled for 1.12.3, module version = 1.2.0
[193070.507]    ABI class: X.Org Server Extension, version 6.0
[193070.507] (II) Loading extension DRI2
[193070.507] (II) bsd_sbus sparcDriverName()
[193070.507] (II) sparcDriverName() returning sunffb (0x4ebffff2d8)
<crash here>


diff --git a/xserver/hw/xfree86/common/xf86AutoConfig.c 
b/xserver/hw/xfree86/common/xf86AutoConfig.c
index b02aaf0..29d54a2 100644
--- a/xserver/hw/xfree86/common/xf86AutoConfig.c
+++ b/xserver/hw/xfree86/common/xf86AutoConfig.c
@@ -252,7 +252,7 @@ listPossibleVideoDrivers(char *matches[], int nmatches)
 #endif
 #if defined(__sparc__)
     {
-        char *sbusDriver = sparcDriverName();
+        const char *sbusDriver = sparcDriverName();
 
         if (sbusDriver)
             matches[i++] = xnfstrdup(sbusDriver);
diff --git a/xserver/hw/xfree86/common/xf86sbusBus.h 
b/xserver/hw/xfree86/common/xf86sbusBus.h
index a4d9c6c..52ea3ff 100644
--- a/xserver/hw/xfree86/common/xf86sbusBus.h
+++ b/xserver/hw/xfree86/common/xf86sbusBus.h
@@ -102,7 +102,7 @@ extern _X_EXPORT int sparcPromGetBool(sbusPromNodePtr 
pnode, const char *prop);
 extern _X_EXPORT void sparcPromAssignNodes(void);
 extern _X_EXPORT char *sparcPromNode2Pathname(sbusPromNodePtr pnode);
 extern _X_EXPORT int sparcPromPathname2Node(const char *pathName);
-extern _X_EXPORT char *sparcDriverName(void);
+extern _X_EXPORT const char *sparcDriverName(void);
 
 extern Bool xf86SbusConfigure(void *busData, sbusDevicePtr sBus);
 extern void xf86SbusConfigureNewDev(void *busData, sbusDevicePtr sBus,
diff --git a/xserver/hw/xfree86/os-support/bsd/bsd_sbus.c 
b/xserver/hw/xfree86/os-support/bsd/bsd_sbus.c
index 883b272..a8993f6 100644
--- a/xserver/hw/xfree86/os-support/bsd/bsd_sbus.c
+++ b/xserver/hw/xfree86/os-support/bsd/bsd_sbus.c
@@ -191,13 +191,18 @@ sparcPromClose(void)
 {
 }
 
-char *
+const char *
 sparcDriverName(void)
 {
+       const char *name = "sunffb";
+
+       xf86Msg(X_INFO, "bsd_sbus sparcDriverName()\n");
        switch (sbusInfo.devId) {
        case SBUS_DEVICE_FFB:
-               return "sunffb";
+               xf86Msg(X_INFO, "sparcDriverName() returning %s (%p)\n", name, 
name);
+               return name;
        default:
+               xf86Msg(X_INFO, "sparcDriverName() returning NULL\n");
                return NULL;
        }
 }

Reply via email to