Bug 56503

Summary: Chrome causes crash of Xserver
Product: xorg Reporter: JS <js314592>
Component: Driver/RadeonAssignee: xf86-video-ati maintainers <xorg-driver-ati>
Status: RESOLVED WORKSFORME QA Contact: Xorg Project Team <xorg-team>
Severity: normal    
Priority: medium    
Version: unspecified   
Hardware: Other   
OS: All   
Whiteboard:
i915 platform: i915 features:
Attachments:
Description Flags
Xorg.log none

Description JS 2012-10-28 18:42:46 UTC
Chrome 23.0.1271.52 beta causes random crash of Xserver

Radeon 9600XT AR (AGP) 256 MB RV350
OpenSUSE 12.2 XFCE
XServer 1.12.3
xf86-video-ati 6.14.4-4.1.2
can't reproduce on system with Intel GPU
Comment 1 Michel Dänzer 2012-10-29 16:28:04 UTC
Please attach (as opposed to paste) a Xorg log file showing a crash.
Comment 2 JS 2012-10-29 17:10:54 UTC
installed debuginfo packages, but still can't get backtrace

[ 24102.511] Backtrace:
[ 24102.511]
[ 24102.511] Backtrace:
Comment 3 Michel Dänzer 2012-10-29 17:17:12 UTC
(In reply to comment #2)
> installed debuginfo packages, but still can't get backtrace

To get a full backtrace, it's best to attach gdb from a remote login to the Xorg process. See http://wiki.x.org/wiki/Development/Documentation/ServerDebugging

Meanwhile, please attach the Xorg log file anyway.
Comment 4 JS 2012-10-29 17:34:40 UTC
Created attachment 69243 [details]
Xorg.log

It is old backup machine which I'm only using when main machine doesn't work.
Comment 5 Michel Dänzer 2012-10-30 09:59:59 UTC
The log file doesn't show an actual X server crash. Please describe the symptoms a bit more.
Comment 6 JS 2012-10-30 17:55:02 UTC
got some core dump

#0  x86_fallback_frame_state (fs=0xbfd057e0, context=<optimized out>) at ./md-unwind-support.h:131
#1  uw_frame_state_for (context=context@entry=0xbfd05760, fs=fs@entry=0xbfd057e0) at ../../../libgcc/unwind-dw2.c:1187
#2  0xb71909ea in _Unwind_Backtrace (trace=0xb733fbe0 <backtrace_helper>, trace_argument=0xbfd058dc) at ../../../libgcc/unwind.inc:290
#3  0xb733fce5 in __GI___backtrace (array=array@entry=0xbfd05950, size=size@entry=64) at ../sysdeps/i386/backtrace.c:127
#4  0x081bc9c9 in xorg_backtrace () at backtrace.c:50
#5  0x081c0636 in OsSigHandler (sip=0xbfd05a9c, signo=11, unused=<optimized out>) at osinit.c:128
#6  OsSigHandler (signo=11, sip=0xbfd05a9c, unused=0xbfd05b1c) at osinit.c:107
#7  <signal handler called>
#8  x86_fallback_frame_state (fs=0xbfd05f00, context=<optimized out>) at ./md-unwind-support.h:131
#9  uw_frame_state_for (context=context@entry=0xbfd05e80, fs=fs@entry=0xbfd05f00) at ../../../libgcc/unwind-dw2.c:1187
#10 0xb71909ea in _Unwind_Backtrace (trace=0xb733fbe0 <backtrace_helper>, trace_argument=0xbfd05ffc) at ../../../libgcc/unwind.inc:290
#11 0xb733fce5 in __GI___backtrace (array=array@entry=0xbfd06070, size=size@entry=64) at ../sysdeps/i386/backtrace.c:127
#12 0x081bc9c9 in xorg_backtrace () at backtrace.c:50
#13 0x0819b29b in mieqEnqueue (pDev=pDev@entry=0x8652be0, e=e@entry=0xb7140948) at mieq.c:281
#14 0x08090725 in queueEventList (device=0x8652be0, device@entry=0x2, events=<optimized out>, nevents=2) at getevents.c:1002
#15 0x08092958 in QueuePointerEvents (device=0x2, device@entry=0x8652be0, type=type@entry=6, buttons=buttons@entry=0, flags=10, mask=mask@entry=0x86539e8) at getevents.c:1262
#16 0x080ca9bb in xf86PostMotionEventM (mask=0x86539e8, is_absolute=0, device=0x8652be0) at xf86Xinput.c:1161
#17 xf86PostMotionEventM (device=0x8652be0, is_absolute=is_absolute@entry=0, mask=0x86539e8) at xf86Xinput.c:1146
#18 0xb5d71e3d in EvdevPostRelativeMotionEvents (pInfo=pInfo@entry=0x862f470, num_v=0, num_v@entry=1, first_v=0, first_v@entry=1, v=v@entry=0xbfd062f0) at evdev.c:898
#19 0xb5d73546 in EvdevProcessSyncEvent (pInfo=0x862f470, ev=<optimized out>) at evdev.c:1010
#20 EvdevProcessEvent (ev=0xbfd06390, pInfo=0x862f470) at evdev.c:1052
#21 EvdevReadInput (pInfo=0x862f470) at evdev.c:1131
#22 0x080b9eb1 in xf86SigioReadInput (fd=16, closure=0x862f470) at xf86Events.c:312
#23 0x080dfe25 in xf86SIGIO (sig=29) at ../shared/sigio.c:108
#24 <signal handler called>
#25 __memcpy_ia32 () at ../sysdeps/i386/i686/memcpy.S:75
#26 0x006aa400 in ?? ()
#27 0xb6d4e0ad in memcpy (__len=7680, __src=0xb22fe400, __dest=0xb2b72408) at /usr/include/bits/string3.h:52
#28 RADEONCopySwap (dst=dst@entry=0xb2b72408 "", src=0xb22fe400 <Address 0xb22fe400 out of bounds>, size=size@entry=7680, swap=swap@entry=0) at radeon_accel.c:994
#29 0xb6dc0974 in RADEONDownloadFromScreenCS (pSrc=pSrc@entry=0x87ab4a8, x=0, y=y@entry=0, w=7680, h=<optimized out>, dst=0xb2b72408 "", dst_pitch=7680) at radeon_exa_funcs.c:665
#30 0xb6cf53a2 in exaCopyDirty (migrate=migrate@entry=0xbfd06c90, pValidDst=0x87ab508, pValidSrc=0x87ab514, transfer=transfer@entry=0xb6dc0820 <RADEONDownloadFromScreenCS>, fallback_index=fallback_index@entry=1, sync=sync@entry=0xb6cf3f90 <exaWaitSync>)
    at exa_migration_classic.c:220
#31 0xb6cf5770 in exaCopyDirtyToSys (migrate=migrate@entry=0xbfd06c90) at exa_migration_classic.c:285
#32 0xb6cf7ac7 in exaPrepareAccessReg_mixed (pPixmap=0x87ab4a8, index=0, pReg=0xbfd06d64) at exa_migration_mixed.c:254
#33 0xb6d01eb6 in ExaPrepareCompositeReg (height=1154, width=12, yDst=0, xDst=1908, yMask=0, xMask=1908, ySrc=24, xSrc=1908, pDst=0x880e2c8, pMask=0x0, pSrc=0x87c7a68, op=1 '\001', pScreen=0x8484560) at exa_unaccel.c:577
#34 ExaCheckComposite (op=op@entry=1 '\001', pSrc=pSrc@entry=0x87c7a68, pMask=pMask@entry=0x0, pDst=pDst@entry=0x880e2c8, xSrc=xSrc@entry=1908, ySrc=ySrc@entry=24, xMask=xMask@entry=1908, yMask=yMask@entry=0, xDst=1908, yDst=0, width=width@entry=12, 
    height=height@entry=1154) at exa_unaccel.c:600
#35 0xb6cfe6ae in exaComposite (op=1 '\001', pSrc=0x87c7a68, pMask=0x0, pDst=0x880e2c8, xSrc=<optimized out>, ySrc=<optimized out>, xMask=1908, yMask=0, xDst=<optimized out>, yDst=<optimized out>, width=12, height=1154) at exa_render.c:1039
#36 0x08145772 in damageComposite (op=1 '\001', pSrc=0x87c7a68, pMask=0x0, pDst=0x880e2c8, xSrc=1908, ySrc=24, xMask=1908, yMask=0, xDst=1908, yDst=0, width=12, height=1154) at damage.c:562
#37 0x08139b99 in CompositePicture (op=<optimized out>, pSrc=0x87c7a68, pMask=pMask@entry=0x0, pDst=0x880e2c8, xSrc=1908, ySrc=24, xMask=1908, yMask=0, xDst=1908, yDst=0, width=12, height=1154) at picture.c:1578
#38 0x0813e34d in ProcRenderComposite (client=0x87abf00) at render.c:707
#39 0x0813a25e in ProcRenderDispatch (client=0x87abf00) at render.c:1988
#40 0x0807b5d5 in Dispatch () at dispatch.c:428
#41 0x08069165 in main (argc=8, argv=0xbfd07174, envp=0xbfd07198) at main.c:288
Comment 7 JS 2012-10-30 18:12:09 UTC
another backtrace, it is crashing every 5 minutes

#0  x86_fallback_frame_state (fs=0xbfb810d0, context=<optimized out>) at ./md-unwind-support.h:131
#1  uw_frame_state_for (context=context@entry=0xbfb81050, fs=fs@entry=0xbfb810d0) at ../../../libgcc/unwind-dw2.c:1187
#2  0xb72329ea in _Unwind_Backtrace (trace=0xb73e1be0 <backtrace_helper>, trace_argument=0xbfb811cc) at ../../../libgcc/unwind.inc:290
#3  0xb73e1ce5 in __GI___backtrace (array=array@entry=0xbfb81240, size=size@entry=64) at ../sysdeps/i386/backtrace.c:127
#4  0x081bc9c9 in xorg_backtrace () at backtrace.c:50
#5  0x081c0636 in OsSigHandler (sip=0xbfb8138c, signo=11, unused=<optimized out>) at osinit.c:128
#6  OsSigHandler (signo=11, sip=0xbfb8138c, unused=0xbfb8140c) at osinit.c:107
#7  <signal handler called>
#8  x86_fallback_frame_state (fs=0xbfb817f0, context=<optimized out>) at ./md-unwind-support.h:131
#9  uw_frame_state_for (context=context@entry=0xbfb81770, fs=fs@entry=0xbfb817f0) at ../../../libgcc/unwind-dw2.c:1187
#10 0xb72329ea in _Unwind_Backtrace (trace=0xb73e1be0 <backtrace_helper>, trace_argument=0xbfb818ec) at ../../../libgcc/unwind.inc:290
#11 0xb73e1ce5 in __GI___backtrace (array=array@entry=0xbfb81960, size=size@entry=64) at ../sysdeps/i386/backtrace.c:127
#12 0x081bc9c9 in xorg_backtrace () at backtrace.c:50
#13 0x0819b29b in mieqEnqueue (pDev=pDev@entry=0x8d10bd0, e=e@entry=0xb71e2948) at mieq.c:281
#14 0x08090725 in queueEventList (device=0x8d10bd0, device@entry=0x2, events=<optimized out>, nevents=2) at getevents.c:1002
#15 0x08092958 in QueuePointerEvents (device=0x2, device@entry=0x8d10bd0, type=type@entry=6, buttons=buttons@entry=0, flags=10, mask=mask@entry=0x8d119d8) at getevents.c:1262
#16 0x080ca9bb in xf86PostMotionEventM (mask=0x8d119d8, is_absolute=0, device=0x8d10bd0) at xf86Xinput.c:1161
#17 xf86PostMotionEventM (device=0x8d10bd0, is_absolute=is_absolute@entry=0, mask=0x8d119d8) at xf86Xinput.c:1146
#18 0xb5e13e3d in EvdevPostRelativeMotionEvents (pInfo=pInfo@entry=0x8ced460, num_v=0, num_v@entry=1, first_v=0, first_v@entry=1, v=v@entry=0xbfb81be0) at evdev.c:898
#19 0xb5e15546 in EvdevProcessSyncEvent (pInfo=0x8ced460, ev=<optimized out>) at evdev.c:1010
#20 EvdevProcessEvent (ev=0xbfb81c80, pInfo=0x8ced460) at evdev.c:1052
#21 EvdevReadInput (pInfo=0x8ced460) at evdev.c:1131
#22 0x080b9eb1 in xf86SigioReadInput (fd=16, closure=0x8ced460) at xf86Events.c:312
#23 0x080dfe25 in xf86SIGIO (sig=29) at ../shared/sigio.c:108
#24 <signal handler called>
#25 __memcpy_ia32 () at ../sysdeps/i386/i686/memcpy.S:75
#26 0x003d8600 in ?? ()
#27 0xb6df00ad in memcpy (__len=7680, __src=0xb2099600, __dest=0xb2963608) at /usr/include/bits/string3.h:52
#28 RADEONCopySwap (dst=dst@entry=0xb2963608 "", src=0xb2099600 <Address 0xb2099600 out of bounds>, size=size@entry=7680, swap=swap@entry=0) at radeon_accel.c:994
#29 0xb6e62974 in RADEONDownloadFromScreenCS (pSrc=pSrc@entry=0x8e788f8, x=0, y=y@entry=0, w=7680, h=<optimized out>, dst=0xb2963608 "", dst_pitch=7680) at radeon_exa_funcs.c:665
#30 0xb6d973a2 in exaCopyDirty (migrate=migrate@entry=0xbfb82580, pValidDst=0x8e78958, pValidSrc=0x8e78964, transfer=transfer@entry=0xb6e62820 <RADEONDownloadFromScreenCS>, fallback_index=fallback_index@entry=1, sync=sync@entry=0xb6d95f90 <exaWaitSync>)
    at exa_migration_classic.c:220
#31 0xb6d97770 in exaCopyDirtyToSys (migrate=migrate@entry=0xbfb82580) at exa_migration_classic.c:285
#32 0xb6d99ac7 in exaPrepareAccessReg_mixed (pPixmap=0x8e788f8, index=0, pReg=0x0) at exa_migration_mixed.c:254
#33 0xb6da3eb6 in ExaPrepareCompositeReg (height=9, width=7, yDst=10, xDst=38, yMask=0, xMask=976, ySrc=10, xSrc=37, pDst=0x8e7ae48, pMask=0x8d37728, pSrc=0x8e78bf0, op=3 '\003', pScreen=0x8b42560) at exa_unaccel.c:577
#34 ExaCheckComposite (op=op@entry=3 '\003', pSrc=pSrc@entry=0x8e78bf0, pMask=pMask@entry=0x8d37728, pDst=pDst@entry=0x8e7ae48, xSrc=37, ySrc=10, xMask=976, yMask=0, xDst=38, yDst=10, width=7, height=9) at exa_unaccel.c:600
#35 0xb6da0234 in exaCompositeRects (op=<optimized out>, op@entry=3 '\003', pSrc=pSrc@entry=0x8e78bf0, pMask=0x8d37728, pDst=pDst@entry=0x8e7ae48, nrect=37, rects=0xbfb8278c) at exa_render.c:604
#36 0xb6d9e37a in exaGlyphsToDst (buffer=0xbfb82788, pDst=0x8e7ae48, pSrc=0x8e78bf0) at exa_glyphs.c:623
#37 exaGlyphs (op=3 '\003', pSrc=0x8e78bf0, pDst=0x8e7ae48, maskFormat=0x0, xSrc=36, ySrc=19, nlist=<optimized out>, list=0xbfb83d3c, glyphs=0xbfb840e4) at exa_glyphs.c:824
#38 0x081459e4 in damageGlyphs (op=3 '\003', pSrc=0x8e78bf0, pDst=0x8e7ae48, maskFormat=0x0, xSrc=36, ySrc=19, nlist=1, list=0xbfb83d30, glyphs=0xbfb84030) at damage.c:628
#39 0x08133b1e in CompositeGlyphs (op=3 '\003', pSrc=0x8e78bf0, pDst=0x8e7ae48, maskFormat=0x0, xSrc=36, ySrc=19, nlist=nlist@entry=1, lists=lists@entry=0xbfb83d30, glyphs=glyphs@entry=0xbfb84030) at glyph.c:560
#40 0x0813e859 in ProcRenderCompositeGlyphs (client=0x8e16480) at render.c:1389
#41 0x0813a25e in ProcRenderDispatch (client=0x8e16480) at render.c:1988
#42 0x0807b5d5 in Dispatch () at dispatch.c:428
#43 0x08069165 in main (argc=8, argv=0xbfb845c4, envp=0xbfb845e8) at main.c:288
Comment 8 Michel Dänzer 2012-10-31 15:38:44 UTC
AFAICT those aren't crashes but input event queue overflows. Those could happen e.g. because an input device is generating more events than the X server can handle in time, or because the GPU is hanging, ... That's why I asked you to describe the symptoms of the problem more. Why do you say the X server crashes?
Comment 9 JS 2012-11-06 20:46:18 UTC
Xserver crashes because there is core dump.
Fast mouse motion during page loading in Chrome crashes Xserver with 100% reliability.
Comment 10 Michel Dänzer 2012-11-07 09:09:46 UTC
(In reply to comment #9)
> Xserver crashes because there is core dump.

Then please attach a backtrace from gdb and the core dump, or at least a log file showing an actual crash.
Comment 11 JS 2012-11-15 15:08:23 UTC
machine is disconnected

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.