Comment 13 for bug 774978

I have tried running X under strace, but no success. I couldn't reproduce the crash, probably because X became too slow. Log file when calibre was running was 5 GB.

I also tried xtrace and valgrind without luck. xtrace only showed what calibre was doing. Valgrind shows errors, but only before and right after login. Also, with valgrind I couldn't reproduce the crash, as X was very slow again.

Then I enabled additional debugging in X by defining DEBUG_COMMUNICATION (in os/io.c). I added the requestbuffer address, request name and event name to the debugging output.
The attached log looks interesting to me. Right before the crash we see the same requestbuffer is used by 2 different clients:

[ 11518.727] REQUEST: ClientIDX: 6, type: 0x89 data: 0xa len: 8 buffer: 0x7f3071065010 name: DRI2
[ 11518.729] REQUEST: ClientIDX: 32, type: 0x35 data: 0x18 len: 4 buffer: 0x7f3071065010 name: CreatePixmap
[ 11518.746] REPLY: ClientIDX: 6 buffer: 0x7f3071065010 Xreply: type: 0x1 data: 0xff len: 0 seq#: 0x1802
[ 11518.747] Segmentation fault at address 0x7f3071065010

(clientidx 32 is calibre, clientidx 6 is most likely compiz)

As RecordAReply uses the requestbuffer to find the details of the DRI2 request, this looks very suspicious to me.