xserver 1.8.0 radeonhd crashing

[Artur Skawina]

Michel Dänzer wrote:
> On Tue, 2010-04-06 at 10:30 +0200, Artur Skawina wrote: 
>> Upgraded xorg to git head a few days ago, today tried to view a youtube page
>> in ff3.6 and every attempt leads to an xserver segfault at 0x10.
>> Server backtrace (below) didn't contain much info; gdb version looks like this:

>> #10 0xf72cfefb in R300CheckComposite (op=3, pSrcPicture=0x88a63f0, 
>>     pMaskPicture=0x88a6460, pDstPicture=0x86ec9c8)
>>     at ../../src/radeon_exa_render.c:1228
>> #11 0xf723227c in exaTryDriverComposite (op=0 '\000', pSrc=0x88a63f0, 
>>     pMask=0x88a6460, pDst=0x86ec9c8, xSrc=275, ySrc=334, xMask=0, yMask=0, 
>>     xDst=275, yDst=334, width=77, height=23) at ../../exa/exa_render.c:695
>> #12 0xf7233590 in exaComposite (op=3 '\003', pSrc=0x88a63f0, pMask=0x88a6460, 
>>     pDst=0x86ec9c8, xSrc=275, ySrc=334, xMask=0, yMask=0, xDst=275, yDst=334, 
>>     width=77, height=23) at ../../exa/exa_render.c:1034
> 
> Most likely pSrcPicture->pDrawable is NULL (i.e. it's a source-only,
> solid or gradient picture) in R300CheckComposite(), and that fails to
> check the pointer before dereferencing it.

Yep, to confirm, i tried:

diff --git a/src/radeon_exa_render.c b/src/radeon_exa_render.c
index 252e7b0..766d04f 100644
--- a/src/radeon_exa_render.c
+++ b/src/radeon_exa_render.c
@@ -1225,6 +1225,8 @@ static Bool FUNC_NAME(R300TextureSetup)(PicturePtr pPict, PixmapPtr pPix,
 static Bool R300CheckComposite(int op, PicturePtr pSrcPicture, PicturePtr pMaskPicture,
 			       PicturePtr pDstPicture)
 {
+    if (!pSrcPicture->pDrawable)
+	return FALSE;
     VAR_PREAMBLE(pSrcPicture->pDrawable->pScreen);
     uint32_t tmp1;
     PixmapPtr pSrcPixmap, pDstPixmap;

and the crash is gone.

Thank you for the quick reply.

artur