Bug 56180

Can you double check you have the right debug symbols? That stack trace isn't lineing up neatly to the code.

Spotted one path that could result in the tmp.damage != NULL and tmp.dst.bo == NULL:

commit 299232bdb69c8c2b6231905e0f45e9cfe74fe09a
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Oct 19 15:02:00 2012 +0100

    sna: Reorder final checks for using the BO and setting the damage pointer
    
    When we return NULL from sna_drawable_use_bo(), the expectation is that
    the damage pointer is also NULL. However, one SHM path leaked.
    
    References: https://bugs.freedesktop.org/show_bug.cgi?id=56180
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Hi Chris,

right gdb debug symbols don't seem to be in alignment with the code. But I have no idea how that could have happened. There are no other versions of the intel_drv.so lying around somewhere.
I checked it again and even with your latest patch X still dies. Debug still seems to be out of alignment. Any Idea what could have caused this? I am remote debugging since the localhost console is dead too after X dies.

Program received signal SIGABRT, Aborted.
0x00007f7a12e39fa5 in raise () from /lib/libc.so.6
(gdb) backtrace full
#0  0x00007f7a12e39fa5 in raise () from /lib/libc.so.6
No symbol table info available.
#1  0x00007f7a12e3b428 in abort () from /lib/libc.so.6
No symbol table info available.
#2  0x00007f7a12e32f92 in __assert_fail_base () from /lib/libc.so.6
No symbol table info available.
#3  0x00007f7a12e33042 in __assert_fail () from /lib/libc.so.6
No symbol table info available.
#4  0x00007f7a11b75509 in sna_damage_add (region=<optimized out>, 
    damage=<optimized out>) at sna_damage.h:48
No locals.
#5  0x00007f7a11bd7693 in sna_composite (op=1 '\001', src=0xf5d4b0, mask=0x0, 
    dst=<optimized out>, src_x=0, src_y=0, mask_x=0, mask_y=0, dst_x=0, 
    dst_y=0, width=12, height=10) at sna_composite.c:540
        x = <optimized out>
        y = <optimized out>
        pixmap = 0x7fff4f357a10
        sna = 0x7f7a14db2010
        priv = 0x8
        tmp = {blt = 0x7f7a11bcf420 <blt_put_composite__cpu>, 
          box = 0x7f7a11bcf380 <blt_put_composite_box__cpu>, 
          boxes = 0x7f7a11bcf2c0 <blt_put_composite_boxes__cpu>, 
          done = 0x7f7a11bcf750 <nop_done>, damage = 0xe45ca0, op = 0, dst = {
            pixmap = 0xf56350, format = 537004168, bo = 0x0, x = 0, y = 0, 
            width = 12, height = 916}, src = {bo = 0x0, transform = 0x0, 
            width = 0, height = 0, pict_format = 0, card_format = 0, 
            filter = 0, repeat = 0, is_affine = 0, is_solid = 0, 
            is_linear = 0, is_opaque = 0, alpha_fixup = 0, rb_reversed = 0, 
            offset = {0, 0}, scale = {0, 0}, embedded_transform = {matrix = {{
                  0, 0, 0}, {0, 0, 0}, {0, 0, 0}}}, u = {gen2 = {pixel = 0, 
                linear_dx = 0, linear_dy = 0, linear_offset = 0}, gen3 = {
                type = 0, mode = 0, constants = 0}}}, mask = {bo = 0x0, 
            transform = 0x0, width = 0, height = 0, pict_format = 0, 
            card_format = 0, filter = 0, repeat = 0, is_affine = 0, 
            is_solid = 0, is_linear = 0, is_opaque = 0, alpha_fixup = 0, 
            rb_reversed = 0, offset = {0, 0}, scale = {0, 0}, 
            embedded_transform = {matrix = {{0, 0, 0}, {0, 0, 0}, {0, 0, 0}}}, 
            u = {gen2 = {pixel = 0, linear_dx = 0, linear_dy = 0, 
                linear_offset = 0}, gen3 = {type = 0, mode = 0, 
                constants = 0}}}, is_affine = 0, has_component_alpha = 0, 
          need_magic_ca_pass = 0, rb_reversed = 0, floats_per_vertex = 0, 
          floats_per_rect = 0, prim_emit = 0x0, redirect = {real_bo = 0x0, 
            real_damage = 0x0, damage = 0x0, box = {x1 = 0, y1 = 0, x2 = 0, 
              y2 = 0}}, u = {blt = {src_pixmap = 0xefe5f0, sx = 0, sy = 0, 
              inplace = 0, overwrites = 0, bpp = 0, cmd = 0, br13 = 0, 
              pitch = {0, 0}, pixel = 0, bo = {0x0, 0x0}}, gen3 = {
              constants = {2.20311696e-38, 0, 0, 0, 0, 0, 0, 0}, 
              num_constants = 0}, gen4 = {wm_kernel = 15721968, ve_id = 0}, 
            gen5 = {wm_kernel = 15721968, ve_id = 0}, gen6 = {
              flags = 15721968}, gen7 = {flags = 15721968}}, priv = 0x0}
        flags = <optimized out>
        region = {extents = {x1 = 0, y1 = 0, x2 = 12, y2 = 10}, data = 0x0}
        dx = <optimized out>
        dy = 0
#6  0x0000000000514eb9 in damageComposite ()
No symbol table info available.
#7  0x000000000050de44 in ProcRenderComposite ()
No symbol table info available.
#8  0x000000000043b241 in Dispatch ()
No symbol table info available.
#9  0x0000000000429e6a in main ()
No symbol table info available.
(gdb) cont
Continuing.

Regards
Nic

Either gcc is being too aggressive and the dwarf info no longer matches, or there is a residual debug.so that gdb is picking up. Can you see if you can reproduce with --enable-debug=full?

Ho hum, and try

diff --git a/src/sna/sna_blt.c b/src/sna/sna_blt.c
index 7410eb1..fd97255 100644
--- a/src/sna/sna_blt.c
+++ b/src/sna/sna_blt.c
@@ -1899,6 +1899,7 @@ put:
                                if (tmp->dst.bo == priv->cpu_bo) {
                                        DBG(("%s: forcing the stall to overwrite
                                        tmp->dst.bo = NULL;
+                                       tmp->damage = NULL;
                                }
                        }
                }

commit f4c32af48b0c92a48131090886a6a6b6c45dbe34
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Oct 19 16:29:19 2012 +0100

    sna: Clear the damage along with the BO when forcing the stall for inplace BLT
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=56180
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Any progress?

Hi Chris,

so far I haven't been able to reproduce the crash using the --enable-debug=full switch. However your latest patch seems to fix the issue even without hitting the debug switch. I'll give it a try for a couple of days and if I don't see any more related crashes I'll mark this bug resolved, ok?

Thx and Regards
Nic

One step ahead of you :)

Considering that those paths would be timing critical, it is understandable that running debug=full would mask the issue. However, I'm pretty sure that I understood the issue and with the extra assertions in place, the bug has to commit f4c32af48b0c92a48131090886a6a6b6c45dbe34
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Oct 19 16:29:19 2012 +0100

    sna: Clear the damage along with the BO when forcing the stall for inplace BLT

Between sna_drawable_use_bo() and sna_damage_add(), the damage must have become reduced and that is only possible by an intervening move-to-cpu/-gpu. Of which the above is the only guilty party.