Bug 24335

Created attachment 30098 [details]
backtrace from the crash

Today I had a couple of apparently random crashes when using Firefox 3.5.3; when I found a web page who could reliably trigger the problem (http://blogs.gentoo.org/index.php/2009/10/04/review-progress?blog=86) I recompiled part of the X stack (xserver, mesa, libdrm, xf86-video-ati) disabling compiler optimizations (-O0 -ggdb) and with full debugging symbols; the backtrace from the crash (full version attached) points out to a problem in the radeon_drv driver:

#0  0xf7a1eed7 in radeon_cs_flush_indirect (pScrn=0x9e93948) at radeon_kms.c:78
#1  0xf79e4730 in RadeonCompositeTileCP (pScrn=0x9e93948, info=0x9e93e30, pDst=0xd07b1008, srcX=0, srcY=0, maskX=-3980, maskY=460, dstX=100, dstY=460, w=20, h=20)
    at radeon_exa_render.c:2182
#2  0xf79e74c8 in RadeonCompositeCP (pDst=0xd07b1008, srcX=0, srcY=0, maskX=-4080, maskY=0, dstX=0, dstY=0, width=865, height=487) at radeon_exa_render.c:2426
#3  0xf773eb3c in exaTryDriverComposite (op=1 '\001', pSrc=0xb4ccbf0, pMask=0x0, pDst=0xb4ccb10, xSrc=0, ySrc=0, xMask=-4080, yMask=0, xDst=0, yDst=0, width=865, height=487)
    at exa_render.c:688
#4  0xf773f3e9 in exaComposite (op=1 '\001', pSrc=0xb4ccbf0, pMask=0x0, pDst=0xb4ccb10, xSrc=0, ySrc=0, xMask=0, yMask=0, xDst=0, yDst=0, width=865, height=487)
    at exa_render.c:883
#5  0x081b8bbe in damageComposite (op=1 '\001', pSrc=0xb4ccbf0, pMask=0x0, pDst=0xb4ccb10, xSrc=0, ySrc=0, xMask=0, yMask=0, xDst=0, yDst=0, width=865, height=487)
    at damage.c:643
#6  0x081a8fce in CompositePicture (op=1 '\001', pSrc=0xb4ccbf0, pMask=0x0, pDst=0xb4ccb10, xSrc=0, ySrc=0, xMask=0, yMask=0, xDst=0, yDst=0, width=865, height=487)
    at picture.c:1675
#7  0x081ab0f6 in ProcRenderComposite (client=0xa0dbf30) at render.c:723
#8  0x081aead8 in ProcRenderDispatch (client=0xa0dbf30) at render.c:2089
#9  0x08084ec8 in Dispatch () at dispatch.c:456
#10 0x0806b20d in main (argc=9, argv=0xffeaadb4, envp=0xffeaaddc) at main.c:397

I'm currently using xorg-server 1.6.4 (with the patch fixing the DGA crash) libdrm 2.4.14, mesa from mesa_7_6_branch (commit 79892e7976fbb91ae426f5868d5f453e977c1f17) and xf86-video-ati from git master (commit 457646d734558672402b6bcd15cadb66741edbed).