Bug 60182

Created attachment 74078 [details]
Log of terminated X.Org Server

Created attachment 74079 [details]
dmesg

Also a little bit info, just in case:
Exact GPU model: 1002:6741 Advanced Micro Devices [AMD] nee ATI BeaverCreek [Mobility Radeon HD 6620G]
VLC version: 2.0.5.

If I need to provide any additional information, please let me know.

The attached log ends abruptly. Is there more information in the kdm log file?

> Is there more information in the kdm log file?
I use LightDM-KDE. I'll look into LightDM log next time.

Created attachment 74183 [details]
Possible "Band-Aid" to get you going.

I have just posted a patch that may help at least prevent the crash. I have seen this bug on my end too, but I though that I locally introduced it with my own hacks. The patch does not solve the root cause (i.e. buffer double-free), but if it prevents the crash, maybe we can apply it to get people going until we find the real solution.

So since you find root case, LightDM log is not necessary now, I am correct?

(In reply to comment #8)
> So since you find root case, LightDM log is not necessary now, I am correct?

No, I didn't find the root cause. I am only assuming (based on the last message in your Xorg.0.log file) that you are seeing the same kind of a crash that I have been seeing recently.

So I would like you to test if the patch that I posted fixes the problem for you. If it does, then there are two open issues that remain: a) should we push my patch upstream (i.e. to at least prevent the crash of affected users like you) and b) what really causes the double-free. The latter is what we have no idea about yet.

Any additional logs that you can produce in the meantime would be useful.

> So I would like you to test if the patch that I posted fixes the problem for you. 
Unfortunately, I am not developer, I can't check this patch.

> Any additional logs that you can produce in the meantime would be useful.
Ok.

Created attachment 74462 [details]
lightdm.log after crash

Created attachment 74464 [details]
x-0.log LightDM log after crash

LightDM logs in right-after-crash state attached.

Created attachment 82065 [details]
X crashlog

I got hit by the same bug... Xorg crashes when closing glxgears (simply press X and expect X to crash sometimes...). GPU is HD 6520g.

I built the driver in ubuntu (13.04, amd64, KDE/LXDE) this way (skip if you don't care, I'm posting this to show you how I did it, to be sure it's done correctly, and finally, for my own record...):

I took the instructions from the buildlog in the PPA: https://launchpadlibrarian.net/141183209/buildlog_ubuntu-raring-amd64.xserver-xorg-video-ati_1%3A7.1.99%2Bgit20130531.bd2557ea-0ubuntu0sarvatt~raring_UPLOADING.txt.gz

mkdir temp && cd temp && apt-get source xserver-xorg-video-ati=1:7.1.99+git20130531.bd2557ea-0ubuntu0sarvatt~raring
sudo apt-get -s build-dep xserver-xorg-video-ati
cd xserver-xorg-video-ati-7.1.99+git20130531.bd2557ea/
(edited src/radeon_dri2.c, patched manually)
/usr/bin/fakeroot debian/rules clean
debian/rules build-arch
/usr/bin/fakeroot debian/rules binary-arch

last message I got is:  "dpkg-deb: building package `xserver-xorg-video-radeon-dbg' in `../xserver-xorg-video-radeon-dbg_7.1.99+git20130531.bd2557ea-0ubuntu0sarvatt~raring_amd64.deb'."

so, I installed that package... and I got the crash showed in the logs, and then the X server restarted.
This is the relevant part:

[  4161.932] (WW) Attempted to destroy previously destroyed buffer. This is a programming error
[  4161.932] (WW) Attempted to destroy previously destroyed buffer. This is a programming error
[  4165.699] (EE) 
[  4165.699] (EE) Backtrace:
[  4165.700] (EE) 0: /usr/bin/X (xorg_backtrace+0x36) [0x7fcd2ef63516]
[  4165.700] (EE) 1: /usr/bin/X (0x7fcd2edb3000+0x1b4359) [0x7fcd2ef67359]
[  4165.700] (EE) 2: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7fcd2deb6000+0xfbd0) [0x7fcd2dec5bd0]
[  4165.700] (EE) 3: /usr/lib/xorg/modules/drivers/radeon_drv.so (0x7fcd2b521000+0x4017c) [0x7fcd2b56117c]
[  4165.700] (EE) 4: /usr/lib/xorg/modules/drivers/radeon_drv.so (0x7fcd2b521000+0x40cb0) [0x7fcd2b561cb0]
[  4165.700] (EE) 5: /usr/bin/X (_CallCallbacks+0x34) [0x7fcd2ee105d4]
[  4165.700] (EE) 6: /usr/bin/X (CloseDownClient+0x54) [0x7fcd2ee0afb4]
[  4165.700] (EE) 7: /usr/bin/X (0x7fcd2edb3000+0x58b35) [0x7fcd2ee0bb35]
[  4165.700] (EE) 8: /usr/bin/X (0x7fcd2edb3000+0x475aa) [0x7fcd2edfa5aa]
[  4165.700] (EE) 9: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xf5) [0x7fcd2cb02ea5]
[  4165.700] (EE) 10: /usr/bin/X (0x7fcd2edb3000+0x478f1) [0x7fcd2edfa8f1]
[  4165.700] (EE) 
[  4165.700] (EE) Segmentation fault at address 0x0
[  4165.700] 
Fatal server error:
[  4165.700] Caught signal 11 (Segmentation fault). Server aborting


I hope this helps.

so I forgot to install the -dbg packages, but... X server will not crash with these, so it won't help anyway :/ (and I tried to make it crash a lot of times after installing the -dbg packages). from what I've read, this is a common bug in C/C++ programming... 

here's another backtrace:

reporting 8 3 8 60
(EE) 
(EE) Backtrace:
(EE) 0: /usr/bin/X (xorg_backtrace+0x36) [0x7fb36816e516]
(EE) 1: /usr/bin/X (0x7fb367fbe000+0x1b4359) [0x7fb368172359]
(EE) 2: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7fb3670c1000+0xfbd0) [0x7fb3670d0bd0]
(EE) 3: /usr/lib/xorg/modules/drivers/radeon_drv.so (0x7fb36472c000+0x426f2) [0x7fb36476e6f2]
(EE) 4: /usr/bin/X (BlockHandler+0x44) [0x7fb36801abc4]
(EE) 5: /usr/bin/X (WaitForSomething+0x114) [0x7fb36816b894]
(EE) 6: /usr/bin/X (0x7fb367fbe000+0x58841) [0x7fb368016841]
(EE) 7: /usr/bin/X (0x7fb367fbe000+0x475aa) [0x7fb3680055aa]
(EE) 8: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xf5) [0x7fb365d0dea5]
(EE) 9: /usr/bin/X (0x7fb367fbe000+0x478f1) [0x7fb3680058f1]
(EE) 
(EE) Segmentation fault at address 0x0

Fatal server error:
Caught signal 11 (Segmentation fault). Server aborting

(EE) 
Please consult the The X.Org Foundation support 
         at http://wiki.x.org
 for help. 
(EE) Please also check the log file at "/var/log/Xorg.0.log" for additional information.
(EE) 
Server terminated with error (1). Closing log file.
Sessions still open, not unmounting

Does the patch in comment 6 help?

(In reply to comment #15)
> Does the patch in comment 6 help?

yes, the patch helped a bit... it made it hard to crash xserver, but it crashes twice after applying it. although, I'm not sure it's just one bug

I got a core dump. here's a backtrace from gdb: http://pastebin.com/T3Vih0ND . does it make sense?

sorry, I meant "but it crashed twice" in the previous post.
Yet another backtrace:  http://pastebin.com/aVq5Uhyf

Can someone who can reproduce the problem attach gdb to the X server process and set a breakpoint where it would print 'Attempted to destroy previously destroyed buffer.'? Then when it triggers, attach the output of 'bt full' at the gdb prompt.

Hi!
This error is happening here also...
Slackware64 linux on AMD Phenom II 1055T, with XFX Radeon HD6850 and open source drivers radeon.

The X server crash after second close of programs... The first execution goes fine... Then second crashes...

When mplayer -vo gl2 exits or when I try to execute my own Open GL programs using SDL calls. The error dont occur with the game warzone 2100, with I think is strange.

Ill try gdb the X server... If I succeed Ill post the logs.
Thanks!

[  9852.952] (WW) RADEON(0): Attempted to destroy previously destroyed buffer. This is a programming error
[  9852.952] 
[  9852.952] Backtrace:
[  9852.953] 0: /usr/bin/X (xorg_backtrace+0x36) [0x55d526]
[  9852.953] 1: /usr/bin/X (0x400000+0x160ee9) [0x560ee9]
[  9852.953] 2: /lib64/libpthread.so.0 (0x7fc155cf6000+0xf4e0) [0x7fc155d054e0]
[  9852.953] 3: /usr/lib64/xorg/modules/drivers/radeon_drv.so (0x7fc152ce1000+0xd12e6) [0x7fc152db22e6]
[  9852.953] 4: /usr/lib64/xorg/modules/drivers/radeon_drv.so (0x7fc152ce1000+0xd1c19) [0x7fc152db2c19]
[  9852.953] 5: /usr/bin/X (_CallCallbacks+0x34) [0x439434]
[  9852.953] 6: /usr/bin/X (CloseDownClient+0x52) [0x434212]
[  9852.953] 7: /usr/bin/X (0x400000+0x34d95) [0x434d95]
[  9852.953] 8: /usr/bin/X (0x400000+0x23f05) [0x423f05]
[  9852.953] 9: /lib64/libc.so.6 (__libc_start_main+0xf5) [0x7fc1540cda95]
[  9852.953] 10: /usr/bin/X (0x400000+0x241dd) [0x4241dd]
[  9852.953] 
[  9852.953] Segmentation fault at address 0x18
[  9852.953] 
Fatal server error:
[  9852.953] Caught signal 11 (Segmentation fault). Server aborting
[  9852.953] 
[  9852.953] 
Please consult the The X.Org Foundation support 
	 at http://wiki.x.org
 for help.

Here is what Ive got!
If this dont help, please give me more details and I will try my best!
Thanks in advance!
xf86-video-ati 6.14.4
xorg-server 1.12.4

Program received signal SIGSEGV, Segmentation fault.
0x00007ff17f1ad465 in radeon_dri2_destroy_buffer (drawable=0x343bbb0, 
    buffers=0x342cc40) at radeon_dri2.c:419
419	            xf86DrvMsg(scrn->scrnIndex, X_WARNING, 
(gdb) bt f
#0  0x00007ff17f1ad465 in radeon_dri2_destroy_buffer (drawable=0x343bbb0, 
    buffers=0x342cc40) at radeon_dri2.c:419
        scrn = 0x0
        pScreen = 0x30a0300
        private = 0x343d8f0
#1  0x00007ff17f1ad845 in radeon_dri2_unref_buffer (buffer=0x342cc40)
    at radeon_dri2.c:585
        private = 0x343d8f0
#2  0x00007ff17f1ad8ec in radeon_dri2_client_state_changed (
    ClientStateCallback=0x860c20 <ClientStateCallback>, data=0x0, 
    calldata=0x7fff2094cb90) at radeon_dri2.c:610
        pClientEventsPriv = 0x345a4d0
        ref = 0x353ca60
        clientinfo = 0x7fff2094cb90
        pClient = 0x345a410
#3  0x000000000043fd67 in _CallCallbacks (pcbl=0x860c20 <ClientStateCallback>, 
    call_data=0x7fff2094cb90) at dixutils.c:715
        cbl = 0x2880a40
        cbr = 0x2881050
        pcbr = 0x0
#4  0x00000000004311fb in CallCallbacks (pcbl=0x860c20 <ClientStateCallback>, 
    call_data=0x7fff2094cb90) at ../include/callback.h:83
No locals.
#5  0x000000000043926b in CloseDownClient (client=0x345a410) at dispatch.c:3380
        clientinfo = {client = 0x345a410, prefix = 0x0, setup = 0x0}
        really_close_down = 1
#6  0x00000000004317ab in Dispatch () at dispatch.c:402
        clientReady = 0x2ff5ee0
        result = -1
        client = 0x345a410
        nready = 0
        icheck = 0x860c30 <checkForInput>
        start_tick = 320
#7  0x0000000000422911 in main (argc=4, argv=0x7fff2094cd58, 
    envp=0x7fff2094cd80) at main.c:288
        i = 2
        alwaysCheckForInput = {0, 1}

Hello!
I think I found a workaround!

At this file:
https://github.com/RAOF/xf86-video-ati/blob/master/src/radeon_dri2.c

At line 608:
Changed from:
            xorg_list_for_each_entry(ref, &pClientEventsPriv->reference_list, link) {
                ref->valid = FALSE;
                radeon_dri2_unref_buffer(ref->front);
                radeon_dri2_unref_buffer(ref->back);
            }

Replaced by:
            xorg_list_for_each_entry(ref, &pClientEventsPriv->reference_list, link) {
		if (ref->valid) {
                	ref->valid = FALSE;
                	radeon_dri2_unref_buffer(ref->front);
                	radeon_dri2_unref_buffer(ref->back);
		}
            }

I just checked valid before the calls, but I still cannot find what is making double calls...

Maybe its because I have two boards? Onboard HD4250 e PCIE HD6850?

Thanks!
Weber Kai

bash-4.2# lspci
01:05.0 VGA compatible controller: Advanced Micro Devices [AMD] nee ATI RS880 [Radeon HD 4250]
01:05.1 Audio device: Advanced Micro Devices [AMD] nee ATI RS880 HDMI Audio [Radeon HD 4200 Series]
02:00.0 VGA compatible controller: Advanced Micro Devices [AMD] nee ATI Barts PRO [ATI Radeon HD 6800 Series]
02:00.1 Audio device: Advanced Micro Devices [AMD] nee ATI Barts HDMI Audio [Radeon HD 6800 Series]

Can you try a vanilla xf86-video-ati rather than the ubuntu version?  This looks like it may be specific to their version.

Hi!

Ive found that (for me) this layout is causing the error:
Section "ServerLayout"
  Identifier     "My X Server"
  Screen      0  "LeftScreen" 0 0
  Screen      1  "RightScreen" RightOf "LeftScreen"
    InputDevice "Mouse1" "CorePointer"
    InputDevice "Keyboard1" "CoreKeyboard"
EndSection

If I remove "Screen 1" then the error dont occur... Both devices are using radeon driver...

I cannot test if the error occur only when both devices are radeon, or if having two Screens of any type...

I think the destroy buffer is called twice because of two screens...

Anyway, the workaround of checking "valid" value fixes this issue for me...

Sorry, I cant test vanilla, I am using Slackware64... Ive downloaded the source DVD and changed x11.SlackBuild... Only changed CFLAGS to -O0 -g3 and removed "strip" symbols...

Thanks...
Weber Kai

Looking at neuromancer Xorg log, I found out:
[     7.278] (--) RADEON(0): Chipset: "SUMO" (ChipID = 0x9641)
[     7.548] (--) RADEON(G0): Chipset: "TURKS" (ChipID = 0x6741)

I think its a problem only with two devices with radeon driver...
After closing client, the destroy buffer is called twice, and causes the error...

I can workaround, but I cant fix it the right way... I have no experience with Xorg or radeon driver... I dont know either how to edit the subject of the bug...

Please... Help us...

Thanks in advance!
Weber Kai

Yes, this, aparently, only happens in dual AMD graphics laptops (with llano)... and I found a workaround:
you have to disable the second (discrete) GPU:

echo OFF > /sys/kernel/debug/vgaswitcheroo/switch

and it will not crash anymore... Sadly, vgaswitcheroo throws a big warning in dmesg: http://pastebin.com/rXj8rrZa (I'm using kernel 3.11.0-6 from ubuntu's proposed repos) , after which "/sys/kernel/debug/vgaswitcheroo/" disappears completely and I'm not able to use the dGPU until the next boot. I will have to report this.. dunno where though. (and also, I always get a black screen after resume from suspend to RAM).

as I said before, the patch "helped", i.e., made it harder to crash, but apps (glxgears, vlc, mplayer + gl) will crash nonetheless.

I hope this helps. And I want to thank the devs for their great job with the radeon FOSS driver!

During a test, I needed to issue 2 "cont" commands at gdb to advance just one frame at one breakpoint I trapped. And when closing the player, I issued twice "cont" at gdb, and only after the segfault occured.

I suspect the function "radeon_dri2_screen_init" at "radeon_dri2.c" is called twice, one for each Screen, and then this routine is scheduling the "radeon_dri2_client_state_changed" routine twice with "AddCallBack".

This way, when the client state is changed to gone, the "destroy buffers" routine is called twice either, and the error occur.

I also want to thank the devs for the radeon driver!
Thank you!

I think Ive got it! :)

Changed this file:
https://github.com/RAOF/xf86-video-ati/blob/master/src/radeon_dri2.c

Line 1404 from:
	    AddCallback(&ClientStateCallback, radeon_dri2_client_state_changed, 0);

Replaced by:
		if (pScrn->scrnIndex == 0) {
	    AddCallback(&ClientStateCallback, radeon_dri2_client_state_changed, 0);
		}

The callback is called only once, even if multiple screens! And the error is gone!
Please, can someone check if it need to be repeated in other parts as well?
If correct, can someone commit it?

Thank you very much! :)
Weber Kai

Sorry fellows... I my proposal was only a workaround...
Maybe if you have 2 cards, and only the second is radeon, then the callback will never be scheduled... :(
The solution needs to be adjusted a little more... Ill think about it...
Ill report if I find something new...
Thanks!

Created attachment 86051 [details] [review]
DRI2: Install client callback only once

Does this patch fix the problem?

(In reply to comment #29)
> Created attachment 86051 [details] [review] [review]
> DRI2: Install client callback only once
> 
> Does this patch fix the problem?

This, plus the patch in comment 6, fixed it for me (Lubuntu saucy, kernel 3.12-rc1 amd64, xserver-xorg-video-radeon 1:7.2.0-0ubuntu6 ).
Thanks people, thank you very much!

(In reply to comment #30)
> This, plus the patch in comment 6, fixed it for me [...]

Thanks, but please try without that other patch. If it's still necessary, something is still wrong.

Actually, just let us know if you still get any 'Attempted to destroy previously destroyed buffer.' messages.

(In reply to comment #32)
> Actually, just let us know if you still get any 'Attempted to destroy
> previously destroyed buffer.' messages.
None at all.
I only get   'XIO:  fatal IO error 11 (Resource temporarily unavailable) on X server ":0" after 6030 requests (6030 known processed) with 0 events remaining.' in the console when closing glxgears (alt+f4) (which AFAIK is normal, but didn't happen before).

(In reply to comment #33)
> (which AFAIK is normal, but didn't happen before).

Yes, that's normal and not related to this problem.

Note that the 'Attempted to destroy previously destroyed buffer.' messages would appear in the Xorg / LightDM log files, not in the terminal where you run the application.

(In reply to comment #34)
> (In reply to comment #33)
> > (which AFAIK is normal, but didn't happen before).
> 
> Yes, that's normal and not related to this problem.
> 
> Note that the 'Attempted to destroy previously destroyed buffer.' messages
> would appear in the Xorg / LightDM log files, not in the terminal where you
> run the application.

Yes. Sorry if I was not clear, I grep'd through Xorg.*.log, and was not there.
Anyway, please allow someone else to confirm that the patch works.

commit c45e728107269c6f51599dad4f6a02ccfef703f1
Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Wed Sep 18 10:57:52 2013 +0200

    DRI2: Install client callback only once

Hi!

Here RESOLVED.

Sorry for late response, I needed to upgrade my whole system to current for testing.

I have the same "new" glxgears messages if closed clicking in the close button. If press esc or with pkill then no error in the console. I think this is caused by the way glxgears implement main loop.

Thank you very much!