Bug 34501

Summary:	Crash in r300_draw_arrays_immediate when starting WarZone 2100
Product:	Mesa	Reporter:	Patrick Haller <patrick.haller>
Component:	Drivers/DRI/r300	Assignee:	Default DRI bug account <dri-devel>
Status:	RESOLVED DUPLICATE	QA Contact:
Severity:	normal
Priority:	medium
Version:	git
Hardware:	x86-64 (AMD64)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:

Description Patrick Haller 2011-02-20 09:14:02 UTC

Just starting WarZone 2100 is already sufficient, probably entering the menu to start a new game, to trigger a crash in r300_draw_arrays_immediate.

It seems that the background processing is creating and destroying threads
at a very high rate. Note: this is a single core CPU.


[setup]
AMD Athlon 64, single core
Using: r300g-git with debug info, compliled with gcc 4.4.5

Starting program: /usr/games/bin/warzone2100 
[Thread debugging using libthread_db enabled]
Traceback (most recent call last):
  File "/usr/share/gdb/auto-load/usr/lib64/gcc/x86_64-pc-linux-gnu/4.5.2/libstdc++.so.6.0.14-gdb.py", line 59, in <module>
    from libstdcxx.v6.printers import register_libstdcxx_printers
ImportError: No module named libstdcxx.v6.printers
[New Thread 0x7fffefccc700 (LWP 499)]
couldn't open libtxc_dxtn.so, software DXTn compression/decompression unavailable
r300: DRM version: 2.8.0, Name: ATI RV350, ID: 0x4152, GB: 1, Z: 1
r300: GART size: 125 MB, VRAM size: 128 MB
r300: AA compression: NO, Z compression: NO, HiZ: NO
Mesa warning: couldn't open libtxc_dxtn.so, software DXTn compression/decompression unavailable
[New Thread 0x7fffeed08700 (LWP 500)]
[Thread 0x7fffeed08700 (LWP 500) exited]
...

[backtrace]
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff4dfc196 in __memcpy_sse2 () from /lib/libc.so.6
(gdb) bt
#0  0x00007ffff4dfc196 in __memcpy_sse2 () from /lib/libc.so.6
#1  0x00007fffeef0e857 in r300_draw_arrays_immediate (r300=0x14e5270, mode=4294936848, start=0, count=4) at /usr/include/bits/string3.h:52
#2  0x00007fffeef0f0e6 in r300_draw_vbo (pipe=0x14e5270, info=0x7fffffff8ae0) at r300_render.c:773
#3  0x00007fffeefc368f in st_draw_vbo (ctx=0x1520500, arrays=<value optimized out>, prims=<value optimized out>, nr_prims=20, ib=0x0, 
    index_bounds_valid=<value optimized out>, min_index=0, max_index=79) at state_tracker/st_draw.c:717
#4  0x00007fffef06bab6 in vbo_exec_vtx_flush (exec=<value optimized out>, unmap=<value optimized out>) at vbo/vbo_exec_draw.c:383
#5  0x00007fffef0690fc in vbo_exec_FlushVertices_internal (ctx=<value optimized out>, unmap=<value optimized out>) at vbo/vbo_exec_api.c:912
#6  0x00007fffef06931a in vbo_exec_FlushVertices (ctx=<value optimized out>, flags=1) at vbo/vbo_exec_api.c:946
#7  0x00007fffeef48646 in _mesa_Flush () at main/context.c:1689
#8  0x00007ffff65a5940 in glXSwapBuffers (dpy=0x1458790, drawable=56623231) at glxcmds.c:734
#9  0x000000000060e08d in pie_ScreenFlip (clearMode=1) at piemode.c:109
#10 0x00000000005c350a in loadingScreenCallback () at wrappers.c:315
#11 0x0000000000654f13 in resDoResLoadCallback (pType=0x174f560 "TEXPAGE", pFile=0x169f130 "page-15-droid-hubs.png") at frameresource.c:62
#12 resLoadFile (pType=0x174f560 "TEXPAGE", pFile=0x169f130 "page-15-droid-hubs.png") at frameresource.c:498
#13 0x00000000006606a3 in res_parse () at resource_parser.y:117
#14 0x0000000000654679 in resLoad (pResFile=0x68196c "wrf/frontend.wrf", blockID=<value optimized out>) at frameresource.c:122
#15 0x00000000004f97d6 in frontendInitialise (ResourceFile=0x68196c "wrf/frontend.wrf") at init.c:623
#16 0x000000000051c693 in startTitleLoop (argc=<value optimized out>, argv=<value optimized out>) at main.c:677
#17 main (argc=<value optimized out>, argv=<value optimized out>) at main.c:1250

[Registers]
(gdb) info registers
rax            0x14fd480	22008960
rbx            0x14e5270	21910128
rcx            0x40036	262198
rdx            0x8	8
rsi            0x8000f7e2d000	140741647192064
rdi            0x14fd480	22008960
rbp            0x7fffffff8a90	0x7fffffff8a90
rsp            0x7fffffff89d0	0x7fffffff89d0
r8             0x3	3
r9             0x2	2
r10            0x0	0
r11            0x7ffff4df66aa	140737301669546
r12            0x0	0
r13            0x7fffffff8ae0	140737488325344
r14            0xaaa	2730
r15            0x3	3
rip            0x7fffeef0f0e6	0x7fffeef0f0e6 <r300_draw_vbo+1974>
eflags         0x10202	[ IF RF ]
cs             0x33	51
ss             0x2b	43
ds             0x0	0
es             0x0	0
fs             0x0	0
gs             0x0	0

Comment 1 Patrick Haller 2011-02-20 09:36:34 UTC

Same seems to happen in Danger From The Deep:

(gdb) bt
#0  0x00007ffff61b7196 in __memcpy_sse2 () from /lib/libc.so.6
#1  0x00007ffff0454857 in r300_draw_arrays_immediate (r300=0x7e0820, mode=4294944512, start=0, count=4) at /usr/include/bits/string3.h:52
#2  0x00007ffff04550e6 in r300_draw_vbo (pipe=0x7e0820, info=0x7fffffffa8d0) at r300_render.c:773
#3  0x00007ffff050968f in st_draw_vbo (ctx=0x84eb60, arrays=<value optimized out>, prims=<value optimized out>, nr_prims=1, ib=0x0,
    index_bounds_valid=<value optimized out>, min_index=0, max_index=3) at state_tracker/st_draw.c:717
#4  0x00007ffff05b1ab6 in vbo_exec_vtx_flush (exec=<value optimized out>, unmap=<value optimized out>) at vbo/vbo_exec_draw.c:383
#5  0x00007ffff05af0fc in vbo_exec_FlushVertices_internal (ctx=<value optimized out>, unmap=<value optimized out>) at vbo/vbo_exec_api.c:912
#6  0x00007ffff05af31a in vbo_exec_FlushVertices (ctx=<value optimized out>, flags=1) at vbo/vbo_exec_api.c:946
#7  0x00007ffff04be523 in _mesa_PopMatrix () at main/matrix.c:283
#8  0x000000000049ee38 in moon::display(vector3t<double> const&, vector3t<double> const&, double) const ()
#9  0x0000000000499ce7 in sky::display(game const&, vector3t<double> const&, double, bool) const ()
#10 0x000000000044807f in freeview_display::draw_view(game&, vector3t<double> const&) const ()
#11 0x0000000000447343 in freeview_display::display(game&) const ()
#12 0x00000000004ee838 in user_interface::display() const ()
#13 0x00000000004ac924 in submarine_interface::display() const ()
#14 0x000000000040f5aa in game__exec(game&, user_interface&) ()
#15 0x0000000000412c25 in run_game(std::auto_ptr<game>) ()
#16 0x000000000041461c in create_convoy_mission() ()
#17 0x0000000000508849 in widget::process_input(std::list<SDL_Event, std::allocator<SDL_Event> > const&) ()
#18 0x0000000000512b82 in widget::run(unsigned int, bool, widget*) ()
#19 0x000000000040a5e0 in menu_single_mission() ()
#20 0x0000000000508849 in widget::process_input(std::list<SDL_Event, std::allocator<SDL_Event> > const&) ()
#21 0x0000000000512b82 in widget::run(unsigned int, bool, widget*) ()
#22 0x000000000041b694 in mymain(std::list<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) ()
#23 0x000000000041d6c6 in call_mymain(std::list<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) ()

Comment 2 Marek Olšák 2011-02-20 09:59:05 UTC


*** This bug has been marked as a duplicate of bug 34418 ***

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.