Bug 16243

Summary: [batchbuffer] X crashed when run rendercheck
Product: xorg Reporter: WuNian <nian.wu>
Component: Server/Acceleration/EXAAssignee: Xorg Project Team <xorg-team>
Status: VERIFIED FIXED QA Contact: Xorg Project Team <xorg-team>
Severity: major    
Priority: medium CC: hong.liu, jbarnes
Version: git   
Hardware: x86 (IA32)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:
Bug Depends on:    
Bug Blocks: 10101    
Attachments:
Description Flags
dmesg log after X crashed
none
xorg log
none
Possible fix
none
Possible fix none

Description WuNian 2008-06-05 19:58:26 UTC
Created attachment 16939 [details]
dmesg log after X crashed

X crashed when run rendercheck

Reproduce steps:
1, modprobe drm debug=1
2, modprobe i915 modeset=1
3, X &
4, xterm &
5, rendercheck -t fill

My platform: Intel Q35

source:
xserver - master tip commit 26e7e69ab893d1f2b35213250ada40ec90944f62
drm - modesetting-101 03bf1fba67413f381d2a548fe08bd634a48fcc48
xf86-video-intel - intel-kernelmode 95fb4ac2ea326ee67f472e33ba4202942f246df1

Backtrace info:
Program received signal SIGSEGV, Segmentation fault.
exaGetPixmapFirstPixel (pPixmap=0x83d2dd0) at exa_unaccel.c:396
396             pixel = *(CARD32 *)fb;
(gdb) bt
#0  exaGetPixmapFirstPixel (pPixmap=0x83d2dd0) at exa_unaccel.c:396
#1  0xb79dad3e in exaComposite (op=1 '\001', pSrc=0x83f1c28, pMask=0x0,
    pDst=0x83f4268, xSrc=0, ySrc=0, xMask=0, yMask=0, xDst=0, yDst=0,
    width=40, height=40) at exa_render.c:285
#2  0x0817c381 in damageComposite (op=1 '\001', pSrc=0x83f1c28, pMask=0x0,
    pDst=0x83f4268, xSrc=0, ySrc=0, xMask=0, yMask=0, xDst=0, yDst=0,
    width=40, height=40) at damage.c:576
#3  0x081628f0 in CompositePicture (op=1 '\001', pSrc=0x83f1c28, pMask=0x0,
    pDst=0x83f4268, xSrc=0, ySrc=0, xMask=0, yMask=0, xDst=0, yDst=0,
    width=40, height=40) at picture.c:1661
#4  0x0816707f in ProcRenderComposite (client=0x83f45d0) at render.c:729
#5  0x081643b5 in ProcRenderDispatch (client=0x0) at render.c:2086
#6  0x0808c404 in Dispatch () at dispatch.c:448
#7  0x080718f5 in main (argc=1, argv=0xbfb47db4, envp=Cannot access memory at address 0x8
) at main.c:415
Comment 1 WuNian 2008-06-05 19:59:50 UTC
Created attachment 16940 [details]
xorg log
Comment 2 Jesse Barnes 2008-06-05 21:23:03 UTC
Nian, I wonder if this one is actually a batchbuffer problem... does it also occur on just the batchbuffer branch?
Comment 3 Michel Dänzer 2008-06-06 00:24:11 UTC
Created attachment 16946 [details] [review]
Possible fix

Does this xserver patch fix it?
Comment 4 Michel Dänzer 2008-06-06 00:24:46 UTC
Created attachment 16947 [details] [review]
Possible fix

Does this xserver patch fix it?
Comment 5 Michel Dänzer 2008-06-06 00:26:44 UTC
Comment on attachment 16946 [details] [review]
Possible fix

Whoops, forgot to clean up the patch on first attempt.
Comment 6 WuNian 2008-06-06 00:48:13 UTC
The patch works for me. 

With intel-batchbuffer branch, the bug also exists. So this is not modesetting bug.
Comment 7 Michel Dänzer 2008-06-06 02:05:07 UTC
Fix pushed to xserver master, see below. Leaving open and making 7.4 blocker so it'll hopefully get merged to the 1.5 branch as well.

commit 6b96281100f2118fe9d99536c33d48298a5bce7b
Author: Michel Dänzer <michel@tungstengraphics.com>
Date:   Fri Jun 6 11:01:03 2008 +0200

    EXA: Fix exaGetPixmapFirstPixel() crash if the driver has a CreatePixmap hook.
Comment 8 Adam Jackson 2008-06-17 07:31:49 UTC
Cherry-picked to 1.5, closing.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.