Bug 66742

Summary:	[sna] Memory leak in commit "sna: Flush blt copies if no operations pending"
Product:	xorg	Reporter:	Andreas Reis <andreas.reis>
Component:	Driver/intel	Assignee:	Chris Wilson <chris>
Status:	RESOLVED FIXED	QA Contact:	Intel GFX Bugs mailing list <intel-gfx-bugs>
Severity:	major
Priority:	medium	CC:	mike
Version:	git
Hardware:	x86-64 (AMD64)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:

Description Andreas Reis 2013-07-09 15:25:28 UTC

The commit "sna: Flush blt copies if no operations pending" (8751c0f5a) introduced (or exacerbated) a memory leak of vast proportions.

It's so huge that within less than two minutes of watching an ordinary YouTube video the X server (git, mesa also git) will exhaust all of my 16GB RAM.

With it reverted, the server remains at 0.3-0.6% again.

Comment 1 Chris Wilson 2013-07-09 15:37:09 UTC

Odd, very, very odd. What's the exact procedure for reproducing? (Watching youtube is a pretty common activity. So what is special about your machine and sequence?)

Comment 2 Andreas Reis 2013-07-09 16:05:02 UTC

No idea. All I have to do for it to occur is boot, start Chromium, and watch a video. (Though that's only the fastest way, it will gradually happen without video playback — or Chromium — as well.)

Machine is a Haswell 4770, no dedicated video card.

Comment 3 Andreas Reis 2013-07-09 16:31:30 UTC

Could it be the "kgem_bo_destroy(kgem, op->src.bo);" in sna_blt.c's "convert_done" that gets skipped when the return in the newly introduced if is hit?

Bit more info: Arch Linux x64 with xmonad, xorg dependencies as found in their repos.

Comment 4 Mike Lothian 2013-07-09 19:16:35 UTC

I thought I'd chime in with - me too - I'm on a Gentoo system however

Could it have anything to do with using gcc 4.8.1?

I've temporarily switched back to UXA - watching youtube videos would consume ~1% of memory per second and would take out X within 2 minutes

This was with Chromium 29.0.1547.0 & Pepper Flash 11.8.800.96

Would you like me to retest with other video players / regular flash?

Comment 5 Chris Wilson 2013-07-09 19:28:43 UTC

(In reply to comment #3)
> Could it be the "kgem_bo_destroy(kgem, op->src.bo);" in sna_blt.c's
> "convert_done" that gets skipped when the return in the newly introduced if
> is hit?

Yes. I had just noticed it, and saw that you had beaten me to it!

Comment 6 Chris Wilson 2013-07-09 19:47:24 UTC

commit d935912d9c13ec8cf4f641c55846714d4e9ba929
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Tue Jul 9 20:38:32 2013 +0100

    sna: Free the source reference after performing a BLT composite
    
    Fixes regression from
    commit 8751c0f5ad202850bdd56dbb4eedb211c023cf23
    Author: Chris Wilson <chris@chris-wilson.co.uk>
    Date:   Fri Jul 5 17:55:10 2013 +0100
    
        sna: Flush blt copies if no operations pending
    
    Reported-by: Andreas Reis <andreas.reis@gmail.com>
    Reported-by: Mike Lothian <mike@fireburn.co.uk>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=66742
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.