Bug 55789

Created attachment 68310 [details]
sample application to play videos[MP4 with H264 codec] from current directory. It has scrpit file to build and run.

Hardware:-
 Using x86_64 kernel and user land.
 CPU and GPU: Intel(R) Core(TM) i3-2105 CPU i965 chipset
 OS vanilla 3.5.0 linux kernel

Packages used :-
  packages are used from  http://intellinuxgraphics.org/2012.07.html .
  Driver name: intel-driver
  Driver source code repository: http://cgit.freedesktop.org/vaapi/intel-driver/
  Driver version: 1.0.18 (latest stable).

Note:-
This crash is observed after changing the intel-driver code for below issue [intel_bufmgr_gem.c:1116: drm_intel_gem_bo_unreference: Assertion`((&bo_gem->refcount)->atomic) > 0' failed] .Please see the following link for more details
https://bugs.freedesktop.org/show_bug.cgi?id=55282

With original intel-driver it crashes with the above issue.

Crash Details
              when we run the sample application[wall] to play videos with hw accelerated support for decoding [gst-vaapi] and render through cluttersink, the application crashes randomly with segmentation fault in drm_intel_bo_unreference() function of intel_bufmgr.c at the below line
                     bo->bufmgr->bo_reference(bo);
Sample application takes .mp4 files with [H264 codec] from the current directory and plays one by one repeatedly.

Note:- Intel driver 1.0.18 is used by applying the patch mentioned in the above link.

coredump:-

Program terminated with signal 11, Segmentation fault.
#0  0x00007f43878acd74 in drm_intel_bo_unreference (bo=0x7f43455ef330) at intel_bufmgr.c:103
103           bo->bufmgr->bo_unreference(bo);
Traceback (most recent call last):
  File "/storage/intel/install/share/gdb/auto-load/storage/intel/install/lib64/libgobject-2.0.so.0.3200.3-gdb.py", line 9, in <module>
    from gobject import register
  File "/storage/intel/install/share/glib-2.0/gdb/gobject.py", line 3, in <module>
    import gdb.backtrace
ImportError: No module named backtrace
(gdb) bt
#0  0x00007f43878acd74 in drm_intel_bo_unreference (bo=0x7f43455ef330) at intel_bufmgr.c:103
#1  0x00007f437e72c719 in gen6_mfd_free_avc_surface (data=0x7f437000dc18) at gen6_mfd.c:187
#2  0x00007f437e73c08a in i965_PutSurface (ctx=0x7f437000ae10, surface=67108869, draw=<optimized out>, srcx=0, srcy=0, srcw=1366, srch=768, destx=0, desty=0, destw=1366, desth=
    768, cliprects=0x0, number_cliprects=0, flags=0) at i965_drv_video.c:2374
#3  0x00007f4382892547 in associate_surface (flags=<optimized out>, surface=67108869, pSurfaceGLX=0x145ecfb0, ctx=0x7f437000ae10) at va_glx_impl.c:940
#4  copy_surface (flags=<optimized out>, surface=67108869, pSurfaceGLX=0x145ecfb0, ctx=0x7f437000ae10) at va_glx_impl.c:1003
#5  vaCopySurfaceGLX_impl_libva (flags=<optimized out>, surface=67108869, gl_surface=0x145ecfb0, ctx=0x7f437000ae10) at va_glx_impl.c:1038
#6  vaCopySurfaceGLX_impl_libva (ctx=0x7f437000ae10, gl_surface=0x145ecfb0, surface=67108869, flags=<optimized out>) at va_glx_impl.c:1022
#7  0x00007f4382a9927a in _gst_vaapi_texture_put_surface (flags=0, surface=0x7f432feac0a0, texture=0x7f435faf6650) at gstvaapitexture.c:585
#8  gst_vaapi_texture_put_surface (texture=0x7f435faf6650, surface=0x7f432feac0a0, flags=0) at gstvaapitexture.c:682
#9  0x00007f43949c204f in clutter_gst_hw_upload (sink=<optimized out>, buffer=0x7f431c97a5a0) at ./clutter-gst-video-sink.c:1114
#10 0x00007f43949c2e1e in clutter_gst_source_dispatch (source=source@entry=0x14607810, callback=<optimized out>, user_data=<optimized out>) at ./clutter-gst-video-sink.c:584
#11 0x00007f438fa8865c in g_main_dispatch (context=0x321f030) at gmain.c:2539
#12 g_main_context_dispatch (context=context@entry=0x321f030) at gmain.c:3075
#13 0x00007f438fa8892b in g_main_context_iterate (context=0x321f030, block=block@entry=1, dispatch=dispatch@entry=1,
    self=<error reading variable: Unhandled dwarf expression opcode 0xfa>) at gmain.c:3146
#14 0x00007f438fa88c97 in g_main_loop_run (loop=0x467b2e0) at gmain.c:3340
#15 0x00007f439370fdbe in clutter_main () at ./clutter-main.c:945
#16 0x0000000000405233 in main (argc=1, argv=0x2537950) at wall.c:694

Observation:-
          It is observed that sometimes bo->bufmgr is NULL or having corrupt values like[ 0x10,0x20 ] .