Created attachment 18015 [details] Kernel log Following the commit of a3afa6f2fb80489f7b6a88d12def09281d32ed94 "EXA: Optimize GXcopy tiled fills." to the xserver, the nouveau driver (git HEAD of both ddx and drm) will crash on certain webpages, with [drm] PGRAPH_ERROR - nSource: LIMIT_COLOR, nStatus: PROTECTION_FAULT [drm] PGRAPH_ERROR - Ch 1/6 Class 0x009f Mthd 0x0308 Data 0x00000003:0x00f304f8 in the kernel log and a fifo lockup in the ddx log -- both attached. A simple reproducible case is using Firefox (2.0.0.16) on http://people.freedesktop.org/~stuart/pgraph_limit_color/crash.html Going back to the previous xserver commit "EXA: Replace open coded CopyArea logic with GC op call.", the page does not cause the driver error, nor a crash. black.png used in the page was simply created in the GIMP using a new image and a bucket fill. I suspect the size of the background image is a factor, as tests using a 200x200 PNG did not crash.
Created attachment 18016 [details] Xorg log
Michel, I would think the following changes are required -width = min(pBox[i].x2 - dstX, width * 2); +width = min(pBox[i].x2 - dstX, min(width * 2, tileWidth)); -height = min(pBox[i].y2 - dstY, height * 2); +height = min(pBox[i].y2 - dstY, min(height * 2, tileHeight)); That doesn't solve our issue though.
Scrap my last comment, I'm too tired. Don't scrap the bug though :)
So, there seems to be some issue with the first width/height computation ; something like this helps: -int width = min(pBox[i].x2 - pBox[i].x1, tileWidth); -int height = min(pBox[i].y2 - pBox[i].y1, tileHeight); +int width = min(pBox[i].x2 - pBox[i].x1 - tileWidth, tileWidth); +int height = min(pBox[i].y2 - pBox[i].y1 - tileHeight, tileHeight); Otherwise you start the 2nd copy (first one in the while loop) with the full tile size, and this can be bigger than the total size.
Some things tried as detailed in http://people.freedesktop.org/~marcheu/irclogs/nouveau-2008-07-31 Last attempt replacing the width and height defintions/instantiations with: int width = min(pBox[i].x2 - pBox[i].x1 - tileWidth, tileWidth); int height = min(pBox[i].y2 - pBox[i].y1 - tileHeight, tileHeight); fixed the test case, but lead to other problems shortly after -- xorg log with the arguments to *pExaScr->info->Copy() printed at http://people.freedesktop.org/~stuart/Xorg.0.log.old-big.txt shows some huge negative widths and heights being passed, before an endless succession of calls with height=0.
I think this is a duplicate, please reopen otherwise. *** This bug has been marked as a duplicate of bug 16908 ***
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.