Hi, using OpenBSD's memory allocator (which has an option to fill free()'d memory with a specific pattern) I found out that xserver 1.5.3 is dumping core on exit.
This is caused by a bad pointer caused by accessing free'd memory in DeliverPropertyEvent, because when the RRProperties are destroyed, the associated windows have been free'd already. Here's a short debugging session that shows the problem (0xfd is the value used to fill free()'d regions: Program received signal SIGSEGV, Segmentation fault. 0x1c1486f7 in DeliverPropertyEvent (pWin=0xdfdfdfdf, value=0xcfbc2400) at /usr/xenocara/xserver/randr/rrproperty.c:34 34 pHead = LookupIDByType(pWin->drawable.id, RREventType); (gdb) p **WindowTable $1 = {drawable = {type = 223 'ß', class = 223 'ß', depth = 223 'ß', bitsPerPixel = 223 'ß', id = 3755991007, x = -8225, y = -8225, width = 57311, height = 57311, pScreen = 0xdfdfdfdf, serialNumber = 3755991007}, devPrivates = 0xdfdfdfdf, parent = 0xdfdfdfdf, nextSib = 0xdfdfdfdf, prevSib = 0xdfdfdfdf, firstChild = 0xdfdfdfdf, lastChild = 0xdfdfdfdf, clipList = {extents = {x1 = -8225, y1 = -8225, x2 = -8225, y2 = -8225}, data = 0xdfdfdfdf}, borderClip = {extents = { x1 = -8225, y1 = -8225, x2 = -8225, y2 = -8225}, data = 0xdfdfdfdf}, valdata = 0xdfdfdfdf, winSize = {extents = {x1 = -8225, y1 = -8225, x2 = -8225, y2 = -8225}, data = 0xdfdfdfdf}, borderSize = {extents = { x1 = -8225, y1 = -8225, x2 = -8225, y2 = -8225}, data = 0xdfdfdfdf}, origin = {x = -8225, y = -8225}, borderWidth = 57311, deliverableEvents = 57311, eventMask = 3755991007, background = { pixmap = 0xdfdfdfdf, pixel = 3755991007}, border = {pixmap = 0xdfdfdfdf, pixel = 3755991007}, backStorage = 0xdfdfdfdf, optional = 0xdfdfdfdf, backgroundState = 3, borderIsPixel = 1, cursorIsNone = 1, backingStore = 1, saveUnder = 1, DIXsaveUnder = 1, bitGravity = 15, winGravity = 13, overrideRedirect = 1, visibility = 3, mapped = 1, realized = 1, viewable = 0, dontPropagate = 7, forcedBS = 1, redirectDraw = 3, forcedBG = 1} (gdb) bt #0 0x1c1486f7 in DeliverPropertyEvent (pWin=0xdfdfdfdf, value=0xcfbc2400) at /usr/xenocara/xserver/randr/rrproperty.c:34 #1 0x1c025c5c in TraverseTree (pWin=0x879d7900, func=0x1c1486d0 <DeliverPropertyEvent>, data=0xcfbc2400) at /usr/xenocara/xserver/dix/window.c:225 #2 0x1c025d03 in WalkTree (pScreen=0x81310400, func=0x1c1486d0 <DeliverPropertyEvent>, data=0xcfbc2400) at /usr/xenocara/xserver/dix/window.c:253 #3 0x1c148858 in RRDeliverPropertyEvent (pScreen=0x81310400, event=0xcfbc2400) at /usr/xenocara/xserver/randr/rrproperty.c:62 #4 0x1c1488d2 in RRDeleteAllOutputProperties (output=0x88fa2000) at /usr/xenocara/xserver/randr/rrproperty.c:80 #5 0x1c147c9f in RROutputDestroyResource (value=0x88fa2000, pid=60) at /usr/xenocara/xserver/randr/rroutput.c:410 #6 0x1c025078 in FreeClientResources (client=0x7d3f1400) at /usr/xenocara/xserver/dix/resource.c:809 #7 0x1c02515e in FreeAllResources () at /usr/xenocara/xserver/dix/resource.c:826 #8 0x1c021acd in main (argc=1, argv=0xcfbc2578, envp=0xcfbc2580) at /usr/xenocara/xserver/dix/main.c:453 (gdb) Ideas for fixing that are of course welcome. -- Matthieu Herrb _______________________________________________ xorg mailing list xorg@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/xorg