Arch Linux

Is it really firefox 11.0-3 too?
Firefox 11.0-3 doesn't use the buggy cairo version and should work.

Yes, I'm sure I have firefox 11.0-3:
$ yaourt -Qs firefox
testing/firefox 11.0-3
Standalone web browser from mozilla.org

I even did a test...
1. Downgraded cairo to 1.10.2-3
2. Started nxclient
3. Started firefox in NX session
4. Firefox worked OK, closed firefox
5. Upgraded cairo to 1.12.0-2
6. Started firefox in NX session and it NX session crashed


BTW
The topic should state "cairo 1.12.0-2" as there's no "1.12.0-3"

One more test I did.

Forced remove cairo (pacman -Rdd cairo) to check how firefox will act and:
$ firefox
XPCOMGlueLoad error for file /usr/lib/firefox/libxpcom.so:
libcairo.so.2: cannot open shared object file: No such file or directory
Couldn't load XPCOM.

So now we know which libs loads cairo:
$ ldd /usr/lib/firefox/libxpcom.so |grep cairo
libpangocairo-1.0.so.0 => /usr/lib/libpangocairo-1.0.so.0 (0x00007f6887f87000)
libcairo.so.2 => /usr/lib/libcairo.so.2 (0x00007f6887a47000)

NXagent segfaults immediatly here when opening a remote connection when cairo 1.12.0 is installed on the server running a Xfce session. So this segfault is independent from Firefox.

I've already reported this to the X2go and FreeNX mailing lists. Debian user can reproduce it seems.

I'm a debian (aptosid) user, but I thought I'd report my investigation into this issue here. I have the same crash issues with libcairo (same version).

I recompiled the x2goagent (actually nxagent) package with debug symbols. It downloads all of the nx-libs which are required to re-create nxagent. From the size and recompile time it looks like it builds an entire X nest implementation.

Anyway I started an X session using x2go. I normally run KDE, but I do need Firefox, emacs and some other programs which depend on gtk etc.

After I logged in I started gdb in a separate remote SSH session and attached to x2goagent.

The process seg faults in the nxagentTrapezoids function on line 1752 of the nx-libs-3.5.0.12/nx-X11/hw/nxagent/Render.c file.

"if (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronize)"

'p' here means Picture. The backtrace indicates that this is the result of new or bogus render op.

pSrc is defined, pSrc.id seems valid, but pDrawable == 0 and that's why the segfault.

I don't understand enough about X to determine the cause of this, but if I had to make an educated guess I'd say that the newest libcairo defines some sort of picture which is (for some reason) not drawable or "pDrawable" doesn't make sense for it.

In any case, here's the rest of the backtrace -- basically just the callstack for a render dispatch.

(gdb) bt
#0 0x00000000004ac268 in nxagentTrapezoids (op=3 '\003', pSrc=0x40c1770, pDst=0x40c1970, maskFormat=<optimized out>, xSrc=1680, ySrc=31, ntrap=1,
traps=0x304aed0) at Render.c:1752
#1 0x000000000043790a in ProcRenderTrapezoids (client=0x3328ee0) at X/NXrender.c:1123
#2 0x000000000043131d in ProcRenderDispatch (client=<optimized out>) at X/NXrender.c:2519
#3 0x00000000004305d6 in Dispatch () at X/NXdispatch.c:747
#4 0x000000000040fea5 in main (argc=11, argv=0x7fff7a1a8168, envp=<optimized out>) at main.c:450

I suppose that the most fruitful investigation of this would be to hunt down the render operation being called and either skip it or prevent it from being executed.





I examined some of the rendering variables. Haven't had a lot of time to examine the issue, but it appears that

I'm a debian (aptosid) user, but I thought I'd report my investigation into this issue here. I have the same crash issues with libcairo (same version).

I recompiled the x2goagent (actually nxagent) package with debug symbols. It downloads all of the nx-libs which are required to re-create nxagent. From the size and recompile time it looks like it builds an entire X nest implementation.

Anyway I started an X session using x2go. I normally run KDE, but I do need Firefox, emacs and some other programs which depend on gtk etc.

After I logged in I started gdb in a separate remote SSH session and attached to x2goagent.

The process seg faults in the nxagentTrapezoids function on line 1752 of the nx-libs-3.5.0.12/nx-X11/hw/nxagent/Render.c file.

"if (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronize)"

'p' here means Picture. The backtrace indicates that this is the result of new or bogus render op.

pSrc is defined, pSrc.id seems valid, but pDrawable == 0 and that's why the segfault.

I don't understand enough about X to determine the cause of this, but if I had to make an educated guess I'd say that the newest libcairo defines some sort of picture which is (for some reason) not drawable or "pDrawable" doesn't make sense for it.

In any case, here's the rest of the backtrace -- basically just the callstack for a render dispatch.

(gdb) bt
#0 0x00000000004ac268 in nxagentTrapezoids (op=3 '\003', pSrc=0x40c1770, pDst=0x40c1970, maskFormat=<optimized out>, xSrc=1680, ySrc=31, ntrap=1,
traps=0x304aed0) at Render.c:1752
#1 0x000000000043790a in ProcRenderTrapezoids (client=0x3328ee0) at X/NXrender.c:1123
#2 0x000000000043131d in ProcRenderDispatch (client=<optimized out>) at X/NXrender.c:2519
#3 0x00000000004305d6 in Dispatch () at X/NXdispatch.c:747
#4 0x000000000040fea5 in main (argc=11, argv=0x7fff7a1a8168, envp=<optimized out>) at main.c:450

I suppose that the most fruitful investigation of this would be to hunt down the render operation being called and either skip it or prevent it from being executed.





I examined some of the rendering variables. Haven't had a lot of time to examine the issue, but it appears that

I've performed Google searches on "pSrc -> pDrawable" and found that this bug crops up in nxagent every year or so. Many references throughout nxagent code to pSrc->pDrawable never check to make sure that pDrawable is a valid pointer. Whether because of picture structures sent in error or because some spec has been updated / changed or because of rarely used edge-cases, a pSrc with null drawable field gets sent. No matter what the case, good programming practice should always check pointer structures to make sure they are intact.

I'm currently testing nxagent in debug mode with some patches to (hopefully intelligently) skip certain operations if the picture source has a null drawable. As soon as I get a bug-free build I'll post the patches here.

Still fixing segfaults in Render.c. These issues crop up all over the Render.c code and also in some of the Pixel.h decision macros. The previous committer tried to remove them, but problem still exists. Modifying some of the macro code to ease debugging.

Still testing and debugging. The new libcairo must really exercise some newly defined renderops. Unless there are major upstream bugs in the new libcairo, render ops now allow both source images and image masks to be either completely null or null drawables. Kind of a mess to handle.

Still testing and debugging. The new libcairo must really exercise some newly defined renderops. Unless there are major upstream bugs in the new libcairo, render ops now allow both source images and image masks to be either completely null or null drawables. Kind of a mess to handle.

Looks like my patches for nxagent work. I'll be distributing them as soon as I can find the official open source nx authority. Would it be x2go or xorg?

If you need them before they get posted around, just let me know and I'll email them to you or post them here.

Here's the patch against the latest version:

*** x2go/nx-libs-3.5.0.12/nx-X11/programs/Xserver/hw/nxagent/Render.c 2012-03-07 14:04:02.000000000 -0700
--- x2go-new/nx-libs-3.5.0.12/nx-X11/programs/Xserver/hw/nxagent/Render.c 2012-05-10 11:09:39.631786853 -0600
***************
*** 995,1000 ****
--- 995,1030 ----
#endif
}

+
+ int nxagentShouldDeferComposite(PicturePtr pSrc, PicturePtr pMask, PicturePtr pDst)
+ {
+
+ int drawableDst;
+ int linkDeferred;
+ int unSyncedSrcMask;
+
+ drawableDst = ( nxagentRenderVersionMajor == 0 &&
+ nxagentRenderVersionMinor == 8 &&
+ (pDst) -> pDrawable -> type == DRAWABLE_PIXMAP
+ );
+
+ linkDeferred = ( nxagentOption(DeferLevel) >= 2 &&
+ nxagentOption(LinkType) < LINK_TYPE_ADSL
+ );
+
+ unSyncedSrcMask = ( nxagentOption(DeferLevel) == 1 &&
+ (pDst) -> pDrawable -> type == DRAWABLE_PIXMAP &&
+ (
+ (pSrc -> pDrawable && (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronized)) ||
+ ((pMask) && pMask -> pDrawable && (nxagentDrawableStatus((pMask) -> pDrawable) == NotSynchronized))
+ )
+ );
+
+
+ return drawableDst || linkDeferred || unSyncedSrcMask;
+ }
+
+
void nxagentComposite(CARD8 op, PicturePtr pSrc, PicturePtr pMask, PicturePtr pDst,
INT16 xSrc, INT16 ySrc, INT16 xMask, INT16 yMask, INT16 xDst,
INT16 yDst, CARD16 width, CARD16 height)
***************
*** 1036,1043 ****
}

#endif
!
! if (NXAGENT_SHOULD_DEFER_COMPOSITE(pSrc, pMask, pDst))
{
pDstRegion = nxagentCreateRegion(pDst -> pDrawable, NULL, xDst, yDst, width, height);

--- 1066,1073 ----
}

#endif
! /* if (NXAGENT_SHOULD_DEFER_COMPOSITE(pSrc, pMask, pDst)) */
! if (nxagentShouldDeferComposite(pSrc, pMask, pDst))
{
pDstRegion = nxagentCreateRegion(pDst -> pDrawable, NULL, xDst, yDst, width, height);

***************
*** 1095,1101 ****
}
}

! if (pMask != NULL && pMask -> pDrawable != pSrc -> pDrawable &&
pMask -> pDrawable != pDst -> pDrawable)
{
nxagentSynchronizeShmPixmap(pMask -> pDrawable, xMask, yMask, width, height);
--- 1125,1132 ----
}
}

! if ((pMask) && (pMask->pDrawable) &&
! pMask -> pDrawable != pSrc -> pDrawable &&
pMask -> pDrawable != pDst -> pDrawable)
{
nxagentSynchronizeShmPixmap(pMask -> pDrawable, xMask, yMask, width, height);
***************
*** 1259,1265 ****
* on the real X server.
*/

! if (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronized)
{
#ifdef TEST
fprintf(stderr, "nxagentGlyphs: Synchronizing source [%s] at [%p].\n",
--- 1290,1296 ----
* on the real X server.
*/

! if (pSrc -> pDrawable && (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronized))
{
#ifdef TEST
fprintf(stderr, "nxagentGlyphs: Synchronizing source [%s] at [%p].\n",
***************
*** 1302,1315 ****
nxagentSynchronizeBox(pSrc -> pDrawable, &glyphBox, NEVER_BREAK);
}

! if (pSrc -> pDrawable -> type == DRAWABLE_PIXMAP)
{
nxagentIncreasePixmapUsageCounter((PixmapPtr) pSrc -> pDrawable);
}
}

! if (pSrc -> pDrawable != pDst -> pDrawable &&
! nxagentDrawableStatus(pDst -> pDrawable) == NotSynchronized)
{
#ifdef TEST
fprintf(stderr, "nxagentGlyphs: Synchronizing destination [%s] at [%p].\n",
--- 1333,1347 ----
nxagentSynchronizeBox(pSrc -> pDrawable, &glyphBox, NEVER_BREAK);
}

! if (pSrc -> pDrawable && (pSrc -> pDrawable -> type == DRAWABLE_PIXMAP))
{
nxagentIncreasePixmapUsageCounter((PixmapPtr) pSrc -> pDrawable);
}
}

!
! if (pSrc -> pDrawable && (pSrc -> pDrawable != pDst -> pDrawable &&
! nxagentDrawableStatus(pDst -> pDrawable) == NotSynchronized))
{
#ifdef TEST
fprintf(stderr, "nxagentGlyphs: Synchronizing destination [%s] at [%p].\n",
***************
*** 1749,1755 ****
return;
}

! if (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronized)
{
#ifdef TEST
fprintf(stderr, "nxagentTrapezoids: Going to synchronize the source drawable at [%p].\n",
--- 1781,1789 ----
return;
}

! /* the following blocks need fixing to ignore null values of pDrawable */
!
! if (pSrc -> pDrawable && (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronized))
{
#ifdef TEST
fprintf(stderr, "nxagentTrapezoids: Going to synchronize the source drawable at [%p].\n",
***************
*** 1843,1849 ****
* operation like nxagentTrapezoids() does.
*/

! if (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronized)
{
#ifdef TEST
fprintf(stderr, "nxagentTriangles: Going to synchronize the source drawable at [%p].\n",
--- 1877,1885 ----
* operation like nxagentTrapezoids() does.
*/

!
!
! if (pSrc -> pDrawable && (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronized))
{
#ifdef TEST
fprintf(stderr, "nxagentTriangles: Going to synchronize the source drawable at [%p].\n",
***************
*** 1920,1926 ****
* operation like nxagentTrapezoids() does.
*/

! if (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronized)
{
#ifdef TEST
fprintf(stderr, "nxagentTriStrip: Going to synchronize the source drawable at [%p].\n",
--- 1956,1963 ----
* operation like nxagentTrapezoids() does.
*/

!
! if (pSrc -> pDrawable && (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronized))
{
#ifdef TEST
fprintf(stderr, "nxagentTriStrip: Going to synchronize the source drawable at [%p].\n",
***************
*** 1997,2003 ****
* operation like nxagentTrapezoids() does.
*/

! if (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronized)
{
#ifdef TEST
fprintf(stderr, "nxagentTriFan: Going to synchronize the source drawable at [%p].\n",
--- 2034,2041 ----
* operation like nxagentTrapezoids() does.
*/

!
! if (pSrc -> pDrawable && (nxagentDrawableStatus(pSrc -> pDrawable) == NotSynchronized))
{
#ifdef TEST
fprintf(stderr, "nxagentTriFan: Going to synchronize the source drawable at [%p].\n",

Please attache the patch as a file, not directly in the comment.