Bug 21512

Created attachment 25345 [details]
dmesg - uxa/kms - freeze loading firefox case

Created attachment 25346 [details]
backtrace - uxa/kms - freeze loading firefox case

Created attachment 25347 [details]
intel_gpu_dump output - uxa/kms - freeze loading firefox case

Created attachment 25348 [details]
intel_reg_dumper output - uxa/kms - freeze loading firefox case

Created attachment 25350 [details]
intel_gpu_dump output - uxa/kms gnome-terminal crash case

Created attachment 25351 [details]
intel_reg_dumper output - uxa/kms gnome-terminal crash case

Created attachment 25352 [details]
dmesg - uxa/kms gnome-terminal crash case

Created attachment 25353 [details]
Xorg.0.log - uxa/kms gnome-terminal crash case

Backtrace from the gnome-terminal crash-


#0  0xb8033430 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb7cabea9 in ioctl () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#2  0xb7920d0d in drmIoctl (fd=8, request=25688, arg=0x0)
    at ../../libdrm/xf86drm.c:187
        ret = -1
#3  0xb7921112 in drmCommandNone (fd=8, drmCommandIndex=24)
    at ../../libdrm/xf86drm.c:2313
No locals.
#4  0xb78ecb3f in I830DRI2CopyRegion (pDraw=0x8e769e0, pRegion=0x90bf780,
    pDstBuffer=0x8edba70, pSrcBuffer=0x8edba88) at ../../src/i830_dri.c:1783
        srcPrivate = <value optimized out>
        dstPrivate = <value optimized out>
        pScreen = <value optimized out>
        pScrn = (ScrnInfoPtr) 0x8caf538
        pI830 = (I830Ptr) 0x8cafbd8
        pSrcPixmap = (PixmapPtr) 0x8e76d20
        pDstPixmap = (PixmapPtr) 0x8e769e0
        pCopyClip = (RegionPtr) 0x8f8caa8
        pGC = (GCPtr) 0x8cef858
#5  0xb793fdf3 in DRI2CopyRegion (pDraw=0x8e769e0, pRegion=0x90bf780, dest=0,
    src=1) at ../../../../hw/xfree86/dri2/dri2.c:186
        pPriv = <value optimized out>
        pDestBuffer = (DRI2BufferPtr) 0x8edba70
        pSrcBuffer = (DRI2BufferPtr) 0x8edba88
        i = 25688
#6  0xb79406a2 in ProcDRI2Dispatch (client=0x8e7fc88)
    at ../../../../hw/xfree86/dri2/dri2ext.c:251
        stuff = <value optimized out>
#7  0x0808d57f in Dispatch () at ../../dix/dispatch.c:437
        result = <value optimized out>
        client = (ClientPtr) 0x8e7fc88
        nready = 0
        start_tick = 26380
#8  0x080722ed in main (argc=10, argv=0xbf8505c4, envp=Cannot access memory at a
ddress 0x6460
)
    at ../../dix/main.c:397
        i = <value optimized out>
        alwaysCheckForInput = {0, 1}

As of -
xf86-driver-intel 8255cca2c9092f7ecb798944aa8f03fa3efcfa6c
mesa/drm 68103b2758029b3c1fbfcf995baa758bfd2676de
mesa 7.6 986d4a9ec60ee52067b2d6f81c05f8ec3b8dc8b1
this problem seems to be gone and I'm finally stable in UXA.

Robert, thanks for filing this.

Carl, I'm CCing you because I'm not sure if this fixed issue is related to other firefox/opera bugs you own.

Unfortunately, I have found a website that can reproduce the crash every time now even though it has been stable in every other way since I reported it fixed.

http://www.woodtv.com

Created attachment 25610 [details]
Backtrace - uxa/kms - freeze loading www.woodtv.com every time.

(gdb) bt f
#0  pixmanBltsse2 (src_bits=0xa2107000, dst_bits=0x9a107000, src_stride=1408,
   dst_stride=1408, src_bpp=32, dst_bpp=32, src_x=0, src_y=0, dst_x=0,
   dst_y=0, width=1299, height=15000)
   at /usr/lib/gcc/i486-linux-gnu/4.4.0/include/emmintrin.h:685
       w = 4684
       s = (uint8_t *) 0xa21961c0 <Address 0xa21961c0 out of bounds>
       d = <value optimized out>
       src_bytes = (uint8_t *) 0xa2196000 <Address 0xa2196000 out of bounds>
       dst_bytes = (uint8_t *) 0x9a196000 <Address 0x9a196000 out of bounds>
       byte_width = 5196
#1  0xb7f0555a in pixman_blt (src_bits=0xa2107000, dst_bits=0x9a107000,
   src_stride=1408, dst_stride=1408, src_bpp=32, dst_bpp=32, src_x=0,
   src_y=0, dst_x=0, dst_y=0, width=1299, height=15000)
   at ../../pixman/pixman-utils.c:51
No locals.
#2  0xb795c897 in fbCopyNtoN (pSrcDrawable=0x964cfd0, pDstDrawable=0x972d510,
   pGC=0x98b4600, pbox=DWARF-2 expression error: DW_OP_reg operations
must be used either alone or in conjuction with DW_OP_piece.
) at ../../fb/fbcopy.c:64
       alu = 3 '\003'
       pm = 4294967295
       src = (FbBits *) 0xa2107000
       srcStride = 1408
       srcBpp = 32
       srcXoff = 0
       srcYoff = 0
       dst = (FbBits *) 0x9a107000
       dstStride = 1408
       dstBpp = 32
       dstXoff = 0
       dstYoff = 0
#3  0xb79e1ed6 in uxa_copy_n_to_n (pSrcDrawable=0x964cfd0,
   pDstDrawable=0x972d510, pGC=0x98b4600, pbox=0xbf8c9720, nbox=1, dx=0,
   dy=0, reverse=0, upsidedown=0, bitplane=0, closure=0x0)
   at ../../uxa/uxa-accel.c:477
       src_off_x = <value optimized out>
       src_off_y = <value optimized out>
       dst_off_x = <value optimized out>
       dst_off_y = <value optimized out>
       pSrcPixmap = (PixmapPtr) 0x964cfd0
       pDstPixmap = (PixmapPtr) 0x972d510
       __FUNCTION__ = "uxa_copy_n_to_n"
#4  0xb795b796 in fbCopyRegion (pSrcDrawable=0x964cfd0,
   pDstDrawable=0x972d510, pGC=0x98b4600, pDstRegion=0xbf8c9720, dx=0, dy=0,
   copyProc=0xb79e1780 <uxa_copy_n_to_n>, bitPlane=0, closure=0x0)
   at ../../fb/fbcopy.c:396
       reverse = <value optimized out>
       upsidedown = <value optimized out>
       pbox = (BoxPtr) 0xbf8c9720
       nbox = 1
       pboxNew1 = <value optimized out>
       pboxNew2 = <value optimized out>
       pboxBase = <value optimized out>
       pboxNext = <value optimized out>
       pboxTmp = <value optimized out>
#5  0xb795bd73 in fbDoCopy (pSrcDrawable=0x964cfd0, pDstDrawable=0x972d510,
   pGC=0x98b4600, xIn=0, yIn=0, widthSrc=1299, heightSrc=15000, xOut=0,
   yOut=0, copyProc=0xb79e1780 <uxa_copy_n_to_n>, bitPlane=0, closure=0x0)
   at ../../fb/fbcopy.c:596
       prgnSrcClip = (RegionPtr) 0x0
       freeSrcClip = 0
       prgnExposed = <value optimized out>
       rgnDst = {extents = {x1 = 0, y1 = 0, x2 = 1299, y2 = 15000},
 data = 0x0}
       dx = 0
       dy = 0
       box_x1 = <value optimized out>
       box_y1 = 0
       box_x2 = <value optimized out>
       box_y2 = <value optimized out>
       fastSrc = 1
       fastDst = 1
       fastExpose = 1
#6  0xb79e1728 in uxa_copy_area (pSrcDrawable=0x964cfd0,
   pDstDrawable=0x972d510, pGC=0x98b4600, srcx=0, srcy=0, width=1299,
   height=15000, dstx=0, dsty=0) at ../../uxa/uxa-accel.c:496
No locals.
#7  0x081823a2 in damageCopyArea (pSrc=0x964cfd0, pDst=0x972d510,
   pGC=0x98b4600, srcx=0, srcy=0, width=1299, height=15000, dstx=0, dsty=0)
   at ../../../miext/damage/damage.c:949
       ret = <value optimized out>
       pGCPriv = (DamageGCPrivPtr) 0x957ef58
       oldFuncs = (GCFuncs *) 0x81eca80
#8  0x0808b869 in ProcCopyArea (client=0x9858958) at ../../dix/dispatch.c:1555
       pDst = (DrawablePtr) 0x972d510
       pSrc = (DrawablePtr) 0x964cfd0
       pGC = (GC *) 0x98b4600
       pRgn = <value optimized out>
       rc = 4684
#9  0x0808d57f in Dispatch () at ../../dix/dispatch.c:437
       result = <value optimized out>
       client = (ClientPtr) 0x9858958
       nready = 0
       start_tick = 246280
#10 0x080722ed in main (argc=10, argv=0xbf8c9984, envp=Cannot access
memory at address 0x1454
)
   at ../../dix/main.c:397
       i = <value optimized out>
       alwaysCheckForInput = {0, 1}

Created attachment 25611 [details]
intel_gpu_dump output - uxa/kms - freeze loading www.woodtv.com every time.

This bug I'm hitting now is the same as this one -
https://bugs.freedesktop.org/show_bug.cgi?id=20152

The pages listed in comment #29 give the same results and the backtraces look the same as the one I just posted when they crash. If any more detailed info is needed please let me know. 

Let Carl to decide if marking dup with bug#20152.

Adjusting severity: crashes & hangs should be marked critical.

The fixes for #20152 also fixed this on the 945 I was testing on.  Thanks for opening your own bug for it, though.


*** This bug has been marked as a duplicate of bug 20152 ***