[Splashy-devel] Bug#546819: splashy: Splashy shows: caught signal 8 (at <addr>, integer divide by zero)

[Stefan Weil]

The same thing happens on my system with similar packages installed.
I only get this crash with vga=795 (resolution 1280x1024), but not
with vga resolution 640x480.

The crash happens in libdirectfb-1.2.0:

Stack:
(gdb) i s
#0  0x00007f13ef04f5db in raise (sig=<value optimized out>) at
../nptl/sysdeps/unix/sysv/linux/pt-raise.c:41
#1  0x00007f13ef266a29 in signal_handler (num=8, info=0x0, foo=<value
optimized out>) at ../../../lib/direct/signals.c:411
#2  <signal handler called>
#3  0x00007f13ef6dce53 in dfb_surface_lock_buffer (surface=0xb59830,
role=CSBR_BACK, access=CSAF_CPU_WRITE, ret_lock=0x7f13ec0556c0) at
../../../src/core/surface.c:546
#4  0x00007f13ec4949e5 in IDirectFBImageProvider_PNG_RenderTo
(thiz=<value optimized out>, destination=<value optimized out>,
dest_rect=<value optimized out>)
    at
../../../interfaces/IDirectFBImageProvider/idirectfbimageprovider_png.c:354
#5  0x00007f13f005dcc4 in splashy_change_splash () from /lib/libsplashy.so.1
#6  0x00007f13f005ddd5 in ?? () from /lib/libsplashy.so.1
#7  0x00007f13f005dfed in splashy_printline_s () from /lib/libsplashy.so.1
#8  0x00000000004026bc in ?? ()
#9  0x00000000004029b9 in ?? ()
#10 0x0000000000402fb5 in ?? ()
#11 0x00007f13ef047f9a in start_thread (arg=<value optimized out>) at
pthread_create.c:300
#12 0x00007f13eedbc56d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#13 0x0000000000000000 in ?? ()

(gdb) disas dfb_surface_lock_buffer
Dump of assembler code for function dfb_surface_lock_buffer:
0x00007f13ef6dce00 <dfb_surface_lock_buffer+0>: mov    %r13,-0x18(%rsp)
0x00007f13ef6dce05 <dfb_surface_lock_buffer+5>: lea    0xe8(%rdi),%r13
0x00007f13ef6dce0c <dfb_surface_lock_buffer+12>:        mov   
%rbx,-0x30(%rsp)
0x00007f13ef6dce11 <dfb_surface_lock_buffer+17>:        mov   
%rbp,-0x28(%rsp)
0x00007f13ef6dce16 <dfb_surface_lock_buffer+22>:        mov   
%r12,-0x20(%rsp)
0x00007f13ef6dce1b <dfb_surface_lock_buffer+27>:        mov    %rdi,%rbx
0x00007f13ef6dce1e <dfb_surface_lock_buffer+30>:        mov   
%r14,-0x10(%rsp)
0x00007f13ef6dce23 <dfb_surface_lock_buffer+35>:        mov   
%r15,-0x8(%rsp)
0x00007f13ef6dce28 <dfb_surface_lock_buffer+40>:        mov    %r13,%rdi
0x00007f13ef6dce2b <dfb_surface_lock_buffer+43>:        sub    $0x38,%rsp
0x00007f13ef6dce2f <dfb_surface_lock_buffer+47>:        mov    %esi,%ebp
0x00007f13ef6dce31 <dfb_surface_lock_buffer+49>:        mov    %edx,%r15d
0x00007f13ef6dce34 <dfb_surface_lock_buffer+52>:        mov    %rcx,%r14
0x00007f13ef6dce37 <dfb_surface_lock_buffer+55>:        mov    $0x16,%r12d
0x00007f13ef6dce3d <dfb_surface_lock_buffer+61>:        callq 
0x7f13ef68e2a0 <fusion_skirmish_prevail at plt>
0x00007f13ef6dce42 <dfb_surface_lock_buffer+66>:        test   %eax,%eax
0x00007f13ef6dce44 <dfb_surface_lock_buffer+68>:        jne   
0x7f13ef6dce7e <dfb_surface_lock_buffer+126>
0x00007f13ef6dce46 <dfb_surface_lock_buffer+70>:        add   
0x244(%rbx),%ebp
0x00007f13ef6dce4c <dfb_surface_lock_buffer+76>:        xor    %edx,%edx
0x00007f13ef6dce4e <dfb_surface_lock_buffer+78>:        mov    %r15d,%esi
0x00007f13ef6dce51 <dfb_surface_lock_buffer+81>:        mov    %ebp,%eax
0x00007f13ef6dce53 <dfb_surface_lock_buffer+83>:        divl   0x228(%rbx)
0x00007f13ef6dce59 <dfb_surface_lock_buffer+89>:        mov    %edx,%edx
0x00007f13ef6dce5b <dfb_surface_lock_buffer+91>:        movslq
0x22c(%rbx,%rdx,4),%rax
0x00007f13ef6dce63 <dfb_surface_lock_buffer+99>:        mov    %r14,%rdx
0x00007f13ef6dce66 <dfb_surface_lock_buffer+102>:       mov   
0x1f8(%rbx,%rax,8),%rdi
0x00007f13ef6dce6e <dfb_surface_lock_buffer+110>:       callq 
0x7f13ef68d1b0 <dfb_surface_buffer_lock at plt>
0x00007f13ef6dce73 <dfb_surface_lock_buffer+115>:       mov    %r13,%rdi
0x00007f13ef6dce76 <dfb_surface_lock_buffer+118>:       mov    %eax,%r12d
0x00007f13ef6dce79 <dfb_surface_lock_buffer+121>:       callq 
0x7f13ef68df10 <fusion_skirmish_dismiss at plt>
0x00007f13ef6dce7e <dfb_surface_lock_buffer+126>:       mov    %r12d,%eax
0x00007f13ef6dce81 <dfb_surface_lock_buffer+129>:       mov   
0x8(%rsp),%rbx
0x00007f13ef6dce86 <dfb_surface_lock_buffer+134>:       mov   
0x10(%rsp),%rbp
0x00007f13ef6dce8b <dfb_surface_lock_buffer+139>:       mov   
0x18(%rsp),%r12
0x00007f13ef6dce90 <dfb_surface_lock_buffer+144>:       mov   
0x20(%rsp),%r13
0x00007f13ef6dce95 <dfb_surface_lock_buffer+149>:       mov   
0x28(%rsp),%r14
0x00007f13ef6dce9a <dfb_surface_lock_buffer+154>:       mov   
0x30(%rsp),%r15
0x00007f13ef6dce9f <dfb_surface_lock_buffer+159>:       add    $0x38,%rsp
0x00007f13ef6dcea3 <dfb_surface_lock_buffer+163>:       retq
End of assembler dump.