Bug 22642

Created attachment 27430 [details]
My configuration file

Created attachment 27431 [details]
Session log file

*** Bug 22641 has been marked as a duplicate of this bug. ***

I just rebuilt the git/master xserver, this time with the default optimization flags (-O2 and -g).  
I get the same behavior, so I doubt that it's a compiler issue.  Also, it seems that I have to grab something with the mouse in order to trigger the problem.

One other thing (I suspect unrelated to the pixman issue).   I ran X remotely.   I starts and I have a blank screen and no mouse cursor (I can move the mouse around though).  Hitting ctrl-alt-backspace
gets me out of X, but leaves me with a messed up graphics screen.   

In the remote window I see:

Entering Restore TV
Restore TV PLL
Restore TVHV
Restore TV Restarts
Restore Timing Tables
Restore TV standard
Leaving Restore TV
error setting MTRR (base = 0xe0000000, size = 0x08000000, type = 1) Invalid argument (22)

I'm getting the same exact assertion. My setup:

linux: 2.6.31-rc2 with TTM and KMS
xserver: git
mesa: git:
libdrm: git
xf86-video-nouveau: git with EXA and KMS
pixman: git
gcc: 4.4.0, CFLAGS="-O0 -g"

Here's the backtrace of Xorg:

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7f81c55516f0 (LWP 5102)]
0x00007f81c2b702d5 in raise () from /lib/libc.so.6
(gdb) bt
#0  0x00007f81c2b702d5 in raise () from /lib/libc.so.6
#1  0x00007f81c2b7173a in abort () from /lib/libc.so.6
#2  0x00007f81c2b6918a in __assert_fail () from /lib/libc.so.6
#3  0x00007f81c4381c6b in pixman_region_copy (dst=0x1cbb690, src=0x1cc8fe0)
    at pixman-region.c:373
#4  0x00000000004789fc in miRegionCopy (dst=0x1cbb690, src=0x1cc8fe0)
    at miregion.c:404
#5  0x00007f81bff7e40f in exaHWCopyNtoN (pSrcDrawable=0xec6dc0, 
    pDstDrawable=0xec6dc0, pGC=0x0, pbox=0x1ccbb50, nbox=4, dx=7, dy=-4, 
    reverse=0, upsidedown=1) at exa_accel.c:412
#6  0x00007f81bff7eb90 in exaCopyNtoN (pSrcDrawable=0xec6dc0, 
    pDstDrawable=0xec6dc0, pGC=0x0, pbox=0x1ccbb50, nbox=4, dx=7, dy=-4, 
    reverse=0, upsidedown=1, bitplane=0, closure=0x0) at exa_accel.c:560
#7  0x00000000005fa06e in miCopyRegion (pSrcDrawable=0xec6dc0, 
    pDstDrawable=0xec6dc0, pGC=0x0, pDstRegion=0x7fffab01e1e0, dx=7, dy=-4, 
    copyProc=0x7f81bff7eaf6 <exaCopyNtoN>, bitPlane=0, closure=0x0)
    at micopy.c:138
#8  0x00007f81bff7fd43 in exaCopyWindow (pWin=0x1c76190, ptOldOrg=
      {x = 754, y = 380}, prgnSrc=0x1cca1d0) at exa_accel.c:943
#9  0x00007f81c207c215 in DRICopyWindow (pWin=0x1c76190, ptOldOrg=
      {x = 754, y = 380}, prgnSrc=0x1cca1d0) at dri.c:1952
#10 0x0000000000527b8c in damageCopyWindow (pWindow=0x1c76190, ptOldOrg=
      {x = 754, y = 380}, prgnSrc=0x1cca1d0) at damage.c:1774
---Type <return> to continue, or q <return> to quit---
#11 0x00000000006080c0 in miSpriteCopyWindow (pWindow=0x1c76190, ptOldOrg=
      {x = 754, y = 380}, prgnSrc=0x1cca1d0) at misprite.c:551
#12 0x00000000005a5566 in compCopyWindow (pWin=0x1c76190, ptOldOrg=
      {x = 754, y = 380}, prgnSrc=0x1cca1d0) at compwindow.c:584
#13 0x00000000005e8279 in miMoveWindow (pWin=0x1c76190, x=747, y=384, 
    pNextSib=0x1347a50, kind=VTMove) at miwindow.c:317
#14 0x00000000005a4bf8 in compMoveWindow (pWin=0x1c76190, x=747, y=384, 
    pSib=0x1347a50, kind=VTMove) at compwindow.c:370
#15 0x000000000043546b in ConfigureWindow (pWin=0x1c76190, mask=3, 
    vlist=0x12a328c, client=0x12bbae0) at window.c:2347
#16 0x000000000045e0a8 in ProcConfigureWindow (client=0x12bbae0)
    at dispatch.c:891
#17 0x000000000045cec2 in Dispatch () at dispatch.c:426
#18 0x000000000042682b in main (argc=6, argv=0x7fffab01e7c8, 
    envp=0x7fffab01e800) at main.c:283

==========================================================================

(gdb) bt f
#0  0x00007f81c2b702d5 in raise () from /lib/libc.so.6
No symbol table info available.
#1  0x00007f81c2b7173a in abort () from /lib/libc.so.6
No symbol table info available.
#2  0x00007f81c2b6918a in __assert_fail () from /lib/libc.so.6
No symbol table info available.
#3  0x00007f81c4381c6b in pixman_region_copy (dst=0x1cbb690, src=0x1cc8fe0)
    at pixman-region.c:373
	__PRETTY_FUNCTION__ = "pixman_region_copy"
#4  0x00000000004789fc in miRegionCopy (dst=0x1cbb690, src=0x1cc8fe0)
    at miregion.c:404
No locals.
#5  0x00007f81bff7e40f in exaHWCopyNtoN (pSrcDrawable=0xec6dc0, 
    pDstDrawable=0xec6dc0, pGC=0x0, pbox=0x1ccbb50, nbox=4, dx=7, dy=-4, 
    reverse=0, upsidedown=1) at exa_accel.c:412
	i = 4
	pExaScr = (ExaScreenPrivPtr) 0xe8ff10
	pSrcPixmap = (PixmapPtr) 0xec6dc0
	pDstPixmap = (PixmapPtr) 0xec6dc0
	pSrcExaPixmap = (ExaPixmapPrivPtr) 0x8
	pDstExaPixmap = (ExaPixmapPrivPtr) 0x200000003
	src_off_x = 0
	src_off_y = 0
---Type <return> to continue, or q <return> to quit---
	dst_off_x = 0
	dst_off_y = 0
	pixmaps = {{as_dst = -1425938496, as_src = 32767, pPix = 0x0, 
    pReg = 0x0}, {as_dst = -1027914450, as_src = 32641, pPix = 0x7fffab01e0b0, 
    pReg = 0x1c761f0}}
	srcregion = (RegionPtr) 0x1cc8fe0
	dstregion = (RegionPtr) 0x1cbb690
	rects = (xRectangle *) 0x1ccbda0
	ret = 1
#6  0x00007f81bff7eb90 in exaCopyNtoN (pSrcDrawable=0xec6dc0, 
    pDstDrawable=0xec6dc0, pGC=0x0, pbox=0x1ccbb50, nbox=4, dx=7, dy=-4, 
    reverse=0, upsidedown=1, bitplane=0, closure=0x0) at exa_accel.c:560
	pExaScr = (ExaScreenPrivPtr) 0xe8ff10
#7  0x00000000005fa06e in miCopyRegion (pSrcDrawable=0xec6dc0, 
    pDstDrawable=0xec6dc0, pGC=0x0, pDstRegion=0x7fffab01e1e0, dx=7, dy=-4, 
    copyProc=0x7f81bff7eaf6 <exaCopyNtoN>, bitPlane=0, closure=0x0)
    at micopy.c:138
	careful = 1
	reverse = 0
	upsidedown = 1
	pbox = (BoxPtr) 0x1ccbb50
	nbox = 4
	pboxNew1 = (BoxPtr) 0x1ccbb50
---Type <return> to continue, or q <return> to quit---
	pboxNew2 = (BoxPtr) 0x0
	pboxBase = (BoxPtr) 0x1ccbaf8
	pboxNext = (BoxPtr) 0x1ccbaf8
	pboxTmp = (BoxPtr) 0x1ccbb08
#8  0x00007f81bff7fd43 in exaCopyWindow (pWin=0x1c76190, ptOldOrg=
      {x = 754, y = 380}, prgnSrc=0x1cca1d0) at exa_accel.c:943
	rgnDst = {extents = {x1 = 747, y1 = 384, x2 = 1337, y2 = 772}, 
  data = 0x1ccbaf0}
	dx = 7
	dy = -4
	pPixmap = (PixmapPtr) 0xec6dc0
	pExaScr = (ExaScreenPrivPtr) 0xe8ff10
#9  0x00007f81c207c215 in DRICopyWindow (pWin=0x1c76190, ptOldOrg=
      {x = 754, y = 380}, prgnSrc=0x1cca1d0) at dri.c:1952
	pScreen = (ScreenPtr) 0xe78900
	pDRIPriv = (DRIScreenPrivPtr) 0xe78fe0
#10 0x0000000000527b8c in damageCopyWindow (pWindow=0x1c76190, ptOldOrg=
      {x = 754, y = 380}, prgnSrc=0x1cca1d0) at damage.c:1774
	pScreen = (ScreenPtr) 0xe78900
	pScrPriv = (DamageScrPrivPtr) 0xe90350
#11 0x00000000006080c0 in miSpriteCopyWindow (pWindow=0x1c76190, ptOldOrg=
      {x = 754, y = 380}, prgnSrc=0x1cca1d0) at misprite.c:551
	pScreen = (ScreenPtr) 0xe78900
---Type <return> to continue, or q <return> to quit---
	pScreenPriv = (miSpriteScreenPtr) 0xe903b0
	pDev = (DeviceIntPtr) 0x0
	pCursorInfo = (miCursorInfoPtr) 0x10f0960
#12 0x00000000005a5566 in compCopyWindow (pWin=0x1c76190, ptOldOrg=
      {x = 754, y = 380}, prgnSrc=0x1cca1d0) at compwindow.c:584
	pScreen = (ScreenPtr) 0xe78900
	cs = (CompScreenPtr) 0xe94870
	dx = 0
	dy = 0
	__PRETTY_FUNCTION__ = "compCopyWindow"
#13 0x00000000005e8279 in miMoveWindow (pWin=0x1c76190, x=747, y=384, 
    pNextSib=0x1347a50, kind=VTMove) at miwindow.c:317
	pParent = (WindowPtr) 0xecb3a0
	WasViewable = 1
	bw = 0
	oldRegion = (RegionPtr) 0x1cca1d0
	oldpt = {x = 754, y = 380}
	anyMarked = 1
	pScreen = (ScreenPtr) 0xe78900
	windowToValidate = (WindowPtr) 0x1c76190
	pLayerWin = (WindowPtr) 0x1c76190
#14 0x00000000005a4bf8 in compMoveWindow (pWin=0x1c76190, x=747, y=384, 
    pSib=0x1347a50, kind=VTMove) at compwindow.c:370
---Type <return> to continue, or q <return> to quit---
	pScreen = (ScreenPtr) 0xe78900
	cs = (CompScreenPtr) 0xe94870
#15 0x000000000043546b in ConfigureWindow (pWin=0x1c76190, mask=3, 
    vlist=0x12a328c, client=0x12bbae0) at window.c:2347
	pSib = (WindowPtr) 0x1347a50
	pParent = (WindowPtr) 0xecb3a0
	sibwid = 0
	index2 = 19542656
	tmask = 0
	pVlist = (XID *) 0x12a3294
	x = 747
	y = 384
	beforeX = 754
	beforeY = 380
	w = 590
	h = 388
	bw = 0
	rc = -1425938880
	action = 1
	smode = 0
	event = {u = {u = {type = 22 '\026', detail = 0 '\0', 
      sequenceNumber = 762}, keyButtonPointer = {pad00 = 49938454, time = 208, 
      root = 20972066, event = 20972033, child = 25166571, rootX = 590, 
---Type <return> to continue, or q <return> to quit---
      rootY = 388, eventX = 0, eventY = 0, state = 0, sameScreen = 0 '\0', 
      pad1 = 0 '\0'}, enterLeave = {pad00 = 49938454, time = 208, 
      root = 20972066, event = 20972033, child = 25166571, rootX = 590, 
      rootY = 388, eventX = 0, eventY = 0, state = 0, mode = 0 '\0', 
      flags = 0 '\0'}, focus = {pad00 = 49938454, window = 208, mode = 34 '"', 
      pad1 = 2 '\002', pad2 = 64 '@', pad3 = 1 '\001'}, expose = {
      pad00 = 49938454, window = 208, x = 546, y = 320, width = 513, 
      height = 320, count = 747, pad2 = 384}, graphicsExposure = {
      pad00 = 49938454, drawable = 208, x = 546, y = 320, width = 513, 
      height = 320, minorEvent = 747, count = 384, majorEvent = 78 'N', 
      pad1 = 2 '\002', pad2 = 132 '\204', pad3 = 1 '\001'}, noExposure = {
      pad00 = 49938454, drawable = 208, minorEvent = 546, majorEvent = 64 '@', 
      bpad = 1 '\001'}, visibility = {pad00 = 49938454, window = 208, 
      state = 34 '"', pad1 = 2 '\002', pad2 = 64 '@', pad3 = 1 '\001'}, 
    createNotify = {pad00 = 49938454, parent = 208, window = 20972066, 
      x = 513, y = 320, width = 747, height = 384, borderWidth = 590, 
      override = 132 '\204', bpad = 1 '\001'}, destroyNotify = {
      pad00 = 49938454, event = 208, window = 20972066}, unmapNotify = {
      pad00 = 49938454, event = 208, window = 20972066, 
      fromConfigure = 1 '\001', pad1 = 2 '\002', pad2 = 64 '@', 
      pad3 = 1 '\001'}, mapNotify = {pad00 = 49938454, event = 208, 
      window = 20972066, override = 1 '\001', pad1 = 2 '\002', pad2 = 64 '@', 
      pad3 = 1 '\001'}, mapRequest = {pad00 = 49938454, parent = 208, 
---Type <return> to continue, or q <return> to quit---
      window = 20972066}, reparent = {pad00 = 49938454, event = 208, 
      window = 20972066, parent = 20972033, x = 747, y = 384, 
      override = 78 'N', pad1 = 2 '\002', pad2 = 132 '\204', pad3 = 1 '\001'}, 
    configureNotify = {pad00 = 49938454, event = 208, window = 20972066, 
      aboveSibling = 20972033, x = 747, y = 384, width = 590, height = 388, 
      borderWidth = 0, override = 0 '\0', bpad = 0 '\0'}, configureRequest = {
      pad00 = 49938454, parent = 208, window = 20972066, sibling = 20972033, 
      x = 747, y = 384, width = 590, height = 388, borderWidth = 0, 
      valueMask = 0, pad1 = 0}, gravity = {pad00 = 49938454, event = 208, 
      window = 20972066, x = 513, y = 320, pad1 = 25166571, pad2 = 25428558, 
      pad3 = 0, pad4 = 0}, resizeRequest = {pad00 = 49938454, window = 208, 
      width = 546, height = 320}, circulate = {pad00 = 49938454, event = 208, 
      window = 20972066, parent = 20972033, place = 235 '�', pad1 = 2 '\002', 
      pad2 = 128 '\200', pad3 = 1 '\001'}, property = {pad00 = 49938454, 
      window = 208, atom = 20972066, time = 20972033, state = 235 '�', 
      pad1 = 2 '\002', pad2 = 384}, selectionClear = {pad00 = 49938454, 
      time = 208, window = 20972066, atom = 20972033}, selectionRequest = {
      pad00 = 49938454, time = 208, owner = 20972066, requestor = 20972033, 
      selection = 25166571, target = 25428558, property = 0}, 
    selectionNotify = {pad00 = 49938454, time = 208, requestor = 20972066, 
      selection = 20972033, target = 25166571, property = 25428558}, 
    colormap = {pad00 = 49938454, window = 208, colormap = 20972066, 
      new = 1 '\001', state = 2 '\002', pad1 = 64 '@', pad2 = 1 '\001'}, 
---Type <return> to continue, or q <return> to quit---
    mappingNotify = {pad00 = 49938454, request = 208 '�', 
      firstKeyCode = 0 '\0', count = 0 '\0', pad1 = 0 '\0'}, clientMessage = {
      pad00 = 49938454, window = 208, u = {l = {type = 20972066, 
          longs0 = 20972033, longs1 = 25166571, longs2 = 25428558, longs3 = 0, 
          longs4 = 0}, s = {type = 20972066, shorts0 = 513, shorts1 = 320, 
          shorts2 = 747, shorts3 = 384, shorts4 = 590, shorts5 = 388, 
          shorts6 = 0, shorts7 = 0, shorts8 = 0, shorts9 = 0}, b = {
          type = 20972066, 
          bytes = "\001\002@\001�\002\200\001N\002\204\001\000\000\000\000\000\000\000"}}}}}
#16 0x000000000045e0a8 in ProcConfigureWindow (client=0x12bbae0)
    at dispatch.c:891
	pWin = (WindowPtr) 0x1c76190
	stuff = (xConfigureWindowReq *) 0x12a3280
	result = 0
	len = 2
	rc = 0
#17 0x000000000045cec2 in Dispatch () at dispatch.c:426
	clientReady = (int *) 0x1255cf0
	result = 0
	client = (ClientPtr) 0x12bbae0
	nready = 0
	icheck = (HWEventQueuePtr *) 0x878a70
---Type <return> to continue, or q <return> to quit---
	start_tick = 220
#18 0x000000000042682b in main (argc=6, argv=0x7fffab01e7c8, 
    envp=0x7fffab01e800) at main.c:283
	i = 1
	alwaysCheckForInput = {0, 1}
(gdb) 

Looks like it doesn't like a region create by EXA with RECTS_TO_REGION(). It would be interesting if you could trace in pixman_region_selfcheck what exactly is the problem with the region.

*** Bug 22646 has been marked as a duplicate of this bug. ***

Any pointers as to how to get X reasonably started from gdb?  [I normally run startx or xinit, but I don't think that works]

(In reply to comment #9)
> Any pointers as to how to get X reasonably started from gdb?  [I normally run
> startx or xinit, but I don't think that works]

I usually find it easier to attach gdb to the running X process. See http://xorg.freedesktop.org/wiki/Development/Documentation/ServerDebugging for more information about X server debugging.

Unfortunately attaching GDB isn't an option as now it crashes before I can do anything.  [Gnome starts, various apps start, and then boom].

(In reply to comment #11)
> Unfortunately attaching GDB isn't an option as now it crashes before I can do
> anything.  [Gnome starts, various apps start, and then boom].

gdm prompt doesn't work either? Note that you'll have to run gdb from a remote login anyway...

Alternatively, you could modify pixman_region_selfcheck() to print out the reason why it returns FALSE.

In hindsight I guess I should have expected this, but I reverted xserver to before July 1 (where I know it didn't have this problem).   I get the same the crash (I turned on IgnoreABI), so I guess the issue really is in pixman.   

As to comment #11:  I realized that gdb has to be run from a remote console, it's just that X crashes before I can get it attached.  [I'm slow typing].  I'm going to play with pixman a bit.

(In reply to comment #13)
> I realized that gdb has to be run from a remote console, it's just that X crashes before I can get it attached.  [I'm slow typing].

You can type something like

    sudo gdb -p $(pidof Xorg)

ahead of time, then you only have to hit enter in time. :) (You may need 'X' instead of 'Xorg' depending on how X is started)

(In reply to comment #14)
> (In reply to comment #13)
> > I realized that gdb has to be run from a remote console, it's just that X crashes before I can get it attached.  [I'm slow typing].
> 
> You can type something like
> 
>     sudo gdb -p $(pidof Xorg)
> 
> ahead of time, then you only have to hit enter in time. :) (You may need 'X'
> instead of 'Xorg' depending on how X is started)
> 

When really desperate, you can also build a copy of Xorg with "sleep(60);" at
the start of main() - that's usually long enough for me to attach a debugger.

    I commented out the first failure in pixman-region.c ( good(dst)).   That fixes
    the problem, but now things crash further on: 

    X: pixman-region.c:1895: pixman_region_translate: Assertion
    `pixman_region_selfcheck (region)' failed.
    g

    I stopped the good test entirely by replacing the macro definition by:

    #define good(reg) if( !(PREFIX(_selfcheck) (reg)))fprintf(stderr,"\nselfcheck: 
    %s: %d\n", __FILE__, __LINE__)

    When I run X, things work, although 

    1) I see a large number of

    selfcheck:  pixman-region.c: 1899

    selfcheck:  pixman-region.c: 300

    selfcheck:  pixman-region.c: 300

    selfcheck:  pixman-region.c: 377

    Other than the assertion, X runs as I'd expect.

    2) I'm still left in a graphics video mode when I exit X.  (BTW is there a tool
    that can reset this?)

      

As to debugging, it looks like I'll have to build pixman with -g.  Will try adding more fprintf's 1st.

I'm mostly interested in which of the return statements in _selfcheck itself is returning FALSE.

OK I'm in the debugger, and get my 1st breakpoint 

PIXMAN_EXPORT pixman_bool_t
PREFIX(_copy) (region_type_t *dst, region_type_t *src)
{
    good(dst);
    good(src);  <==


  print *src
$1 = {extents = {x1 = 3, y1 = 33, x2 = 830, y2 = 29}, data = 0x883c678}

and

print *(src->data)
$3 = {size = 5, numRects = 5}

The problem (I think) is that y1 > y2.

Something in the server is generating a malformed region; this is what pixman_region_selfcheck() is complaining about. I'll turn off the assert in the next pixman release which will hide the symptom, but this is a real bug in the server that should be tracked down. 

It may be worth compiling the server with REGION_DEBUG enabled in miregion.c to see if the assert doesn't show up there as well - I think it will.

Created attachment 27541 [details]
gdb backtrace with DEBUG and REGION_DEBUG defined in miregion.c

FYI, as ssp suggested on irc #, "ssp: hax0r1337: If you replace CT_YXBANDED in exa_accel.c:405 with CT_UNSORTED, the problem may go away" fixes the problem for me at least ;)

Specifically, the boxes that miCopyRegion() produces are not necessarily YX banded. Note these comments in miregion.c:

    /* keep ordering in each band, reverse order of bands */

and

    /* reverse order of rects in each band */

Created attachment 27556 [details] [review]
Possible fix

Does this patch fix the problem?

(In reply to comment #23)

Yes! It does for me, thankyou very much :)
I will attach my Gentoo overlay files for anyone else who uses Gentoo.

Cheers!

Created attachment 27558 [details]
Gentoo overlay files including Michel's fix

The fix works for me as well.   The hack I made in comment #16 now never gets triggered.

Thanks!

Created attachment 27562 [details] [review]
Better fix

Can you try this patch instead? Upon closer review I think this is a better fix.

The new patch fails.  When I try to move a window, X crashes (leaving me with a graphics screen, although this now might because I have NoTrapSignals set to true).   I see


X: pixman-region.c:372: pixman_region_copy: Assertion `pixman_region_selfcheck (src)' failed.

Which is what I was getting before (I reverted pixman to the original code, so X aborts at this point).

Created attachment 27568 [details] [review]
Take three...

Oops, made a mistake in the logic... Also I think the blit direction logic is fine as is, and may save some exaCopyNtoNTwoDir() calls on hardware that can't handle mixed blit directions.

Please try this.

This one (3rd patch) works.

David

Fix pushed to Git and nominated on http://wiki.x.org/wiki/Server16Branch .

Thanks for all the testing.