Xonotic segfaults in libX11

[maddaemon]

UPDATE More insight: https://bugzilla.redhat.com/show_bug.cgi?id=1181085

Hi.

I'm having a problem with Xonotic from git master on my Fedora 21. The game crashes (segfault in libpthread code) when closing the display. This means on every exit and you can't even change the resolution or other display properties that require video engine to restart. The problem apparently lies in libX11. I'm on Fedora 21 with nVidia proprietary drivers and I think I don't remember such problem in Fedora 20.

It seems it happens occurs only when Xonotic is compiled on Fedora 21 machine. I've tried autobuild (nightly binary) which is compiled elsewhere and it didn't crash.

I did some investigation and I hope it can help you to help me because I've reached the point where I have no clue about how to continue.

sudo dnf install alsa-lib-devel desktop-file-utils file libX11-devel mesa-libGL-devel libjpeg-devel libjpeg-turbo-devel libXext-devel libXpm-devel libXxf86dga-devel libXxf86vm-devel SDL-devel
cd ~/src
git clone git://git.xonotic.org/xonotic/xonotic.git
cd xonotic
./all pull
./all compile
./all run

Now quit the game and notice in the detailed log that it segfaulted. Now debug it (I assume debuginfos are installed):

gdb ./darkplaces/darkplaces-sdl
Reading symbols from ./darkplaces/darkplaces-sdl...done.
(gdb) run
Starting program: /home/gamer/xonotic/darkplaces/darkplaces-sdl 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

Logging removed. Now quit the game.

[Thread 0x7fffda3fd700 (LWP 20537) exited]
Program received signal SIGSEGV, Segmentation fault.
__GI___pthread_mutex_lock (mutex=0x0) at ../nptl/pthread_mutex_lock.c:67
67	  unsigned int type = PTHREAD_MUTEX_TYPE_ELISION (mutex);
Missing separate debuginfos, use: debuginfo-install systemd-libs-216-13.fc21.x86_64
(gdb) bt
#0  __GI___pthread_mutex_lock (mutex=0x0) at ../nptl/pthread_mutex_lock.c:67
#1  0x00007ffff6aaa667 in XrmDestroyDatabase (db=0x2a0f860) at Xrm.c:2653
#2  0x00007ffff6a91d33 in _XFreeDisplayStructure (dpy=dpy@entry=0x29cb8f0) at OpenDis.c:618
#3  0x00007ffff6a7ee9f in XCloseDisplay (dpy=0x29cb8f0) at ClDisplay.c:72
#4  0x00007ffff6ffd92e in X11_VideoQuit (this=0x29cb230) at src/video/x11/SDL_x11video.c:1548
#5  0x00007ffff6fec14e in SDL_VideoQuit () at src/video/SDL_video.c:1365
#6  0x00007ffff6fc5f95 in SDL_QuitSubSystem (flags=32) at src/SDL.c:196
#7  0x000000000040a04f in VID_Shutdown () at ../../../vid_sdl.c:2790
#8  0x000000000057467f in Host_Shutdown () at ../../../host.c:1449
#9  0x00000000006fa0a9 in Sys_Quit (returnvalue=0) at ../../../sys_shared.c:54
#10 0x00000000005746e6 in Host_Quit_f () at ../../../host_cmd.c:63
#11 0x00000000004163ae in M_Quit_Key (key=121, ascii=121) at ../../../menu.c:3300
#12 0x0000000000419c01 in M_KeyEvent (key=121, ascii=121, downevent=true)
	at ../../../menu.c:4997
#13 0x0000000000588055 in Key_Event (key=121, ascii=121, down=true) at ../../../keys.c:1962
#14 0x00000000004089e2 in Sys_SendKeyEvents () at ../../../vid_sdl.c:1121
#15 0x0000000000573037 in Host_Main () at ../../../host.c:757
#16 0x000000000040470e in main (argc=1, argv=0x7fffffffe058) at ../../../sys_sdl.c:223
(gdb) l
62	__pthread_mutex_lock (mutex)
63	     pthread_mutex_t *mutex;
64	{
65	  assert (sizeof (mutex->__size) >= sizeof (mutex->__data));
66	
67	  unsigned int type = PTHREAD_MUTEX_TYPE_ELISION (mutex);
68	
69	  LIBC_PROBE (mutex_entry, 1, mutex);
70	
71	  if (__builtin_expect (type & ~(PTHREAD_MUTEX_KIND_MASK_NP
(gdb) p mutex
$9 = (pthread_mutex_t *) 0x0
(gdb) frame 1
#1  0x00007ffff6aaa667 in XrmDestroyDatabase (db=0x2a0f860) at Xrm.c:2653
2653		_XLockMutex(&db->linfo);
(gdb) l
2648	    XrmDatabase   db)
2649	{
2650	    register NTable table, next;
2651	
2652	    if (db) {
2653		_XLockMutex(&db->linfo);
2654		for (next = db->table; (table = next); ) {
2655		    next = table->next;
2656		    if (table->leaf)
2657			DestroyLTable((LTable)table);

_XLockMutex is pthread_mutex_lock. Where in libX11 is ->linfo created?

cd /usr/src/debug/libX11-1.6.2/
grep -r -- '->linfo' .|egrep -v '(Unl|L)ock'                                                
./src/Context.c:	_XFreeMutex(&db->linfo);
./src/Context.c:	_XCreateMutex(&db->linfo);
./src/Xrm.c:	_XCreateMutex(&db->linfo);
./src/Xrm.c:	_XFreeMutex(&from->linfo);
./src/Xrm.c:	_XFreeMutex(&db->linfo);

The code actually goes only in Xrm.c:500. Continuing in gdb:

(gdb) break Xrm.c:500
Note: breakpoint 1 also set at pc 0x7ffff6aa65c3.
Breakpoint 2 at 0x7ffff6aa65c3: file Xrm.c, line 500.
(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /home/gamer/xonotic/darkplaces/darkplaces-sdl 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
# game logging removed

Breakpoint 1, NewDatabase () at Xrm.c:500
500		_XCreateMutex(&db->linfo);
(gdb) l
495	{
496	    register XrmDatabase db;
497	
498	    db = Xmalloc(sizeof(XrmHashBucketRec));
499	    if (db) {
500		_XCreateMutex(&db->linfo);
501		db->table = (NTable)NULL;
502		db->mbstate = (XPointer)NULL;
503		db->methods = _XrmInitParseInfo(&db->mbstate);
504		if (!db->methods)
(gdb) p db->linfo
$10 = {lock = 0x0}
(gdb) s
503		db->methods = _XrmInitParseInfo(&db->mbstate);
(gdb) p db->linfo->lock
$11 = (xmutex_t) 0x0

So it seems that _XCreateMutex(), in whatever call it ends up, wasn't called. Why is that? The value in db->linfo is mostly 0 (not always though).

Thank you for your replies.