Xorg segfault in nvidia_drv.so after Xid 69 (902d SET_PIXELS_FROM_MEMORY_DST_X0 = -10) when a WM frame is placed partly off-screen

[riagentic]

Posted as a discussion: the crash is in the closed X driver (nvidia_drv.so),
so it does not belong in this repo's issue tracker. The kernel side (Xid 69
reporting) works as it should. Filing it here so it is findable next to the
open modules; a report on the NVIDIA Linux forum follows.

Summary

An ordinary client window whose window-manager frame lies partly left of the
screen (frame x = -10) makes the X driver submit a 2D-engine blit with a
negative destination X. The GPU rejects it (Xid 69), and on 595.99.02 the DDX
then segfaults inside nvidia_drv.so: Xorg aborts and the whole session dies.
Off-screen window geometry is legal X11 (any user can drag a window past the
edge; window managers do it for invisible resize borders), so the DDX should
clip, not pass a negative coordinate to the hardware — and must not crash.

System

• GPU: NVIDIA RTX PRO 4000 Blackwell (GB203GL-A), 2 cards (one drives the
  display), plus an AMD iGPU
• Driver: 595.99.02 (open kernel modules) — Xorg crashes. Also seen on
  610.57.04 (same Xid; Xorg died once there too)
• Xorg 1.21.1.11, Ubuntu 24.04 base (Linux Mint, Cinnamon/muffin, composited,
  unredirect-fullscreen-windows=true)
• 2 monitors: 2560x1440 at +0+486, 1440x2560 rotated left at +2560+0 (DP MST)

Kernel log (every occurrence identical)

NVRM: Xid (PCI:0000:01:00): 69, name=Xorg, Class Error: channel 0x00000003,
Class 0000902d, Offset 000008b0, Data fffffff6, ErrorCode 00000004

Class 902d Fermi 2D, 0x08b0 = NV902D_SET_PIXELS_FROM_MEMORY_DST_X0,
Data 0xfffffff6 = -10.

Xorg log

(EE) Backtrace:
(EE) 0: /usr/lib/xorg/Xorg (OsLookupColor+0x14c)
(EE) 1: libc.so.6 (__sigaction+0x50)
(EE) 2: nvidia_drv.so (nvidiaUnlock+0x75dcf)
(EE) 3: nvidia_drv.so (nvidiaUnlock+0x7764d)
(EE) 4: nvidia_drv.so (nvidiaUnlock+0x78f44)
(EE) 5: nvidia_drv.so (nvidiaUnlock+0x790b9)
(EE) 6: nvidia_drv.so (nvidiaUnlock+0x705cb)
(EE) 7: nvidia_drv.so (nvidiaUnlock+0x72dc8)
(EE) 8: nvidia_drv.so (nvidiaUnlock+0x6fb25)
(EE) 9: nvidia_drv.so (nvidiaUnlock+0x819b9)
(EE) 10: nvidia_drv.so (nvidiaUnlock+0x6e399)
(EE) 11: nvidia_drv.so (nvidiaUnlock+0x1b420a)
(EE) Segmentation fault at address 0x2c
Fatal server error: Caught signal 11 (Segmentation fault). Server aborting

Trigger (recorded with an X event logger)

An Electron 44 window created at client position (0,0), then maximized right
after mapping. muffin reparents it into a frame with a 10 px invisible border
and a 37 px title bar:

config <client> 10,45 2559x1439
config <frame>  -10,-45 2579x1494     <- frame 10 px left of the screen
config <frame>  0,-37 2559x1476       <- ~50 ms later, after maximize

The Xid lands within ~1 s of such a map. It is intermittent (a race with the
transient frame), more likely under load; 7 occurrences in 5 days, 4 of them
fatal to Xorg. Windows whose frame stays at x >= 0 never trigger it.

Expected

The DDX clips blits to the destination (or the screen) before programming the
2D engine; a rejected method never takes Xorg down.

Workaround in the application

Keep every window (and therefore its frame) at least 64 px inside the work
area. This avoids the trigger but not the bug: any user dragging a window to
the left edge can produce the same geometry.