Bug 77053

Summary:

segfault in sna_set_cursor_position with PRIME + opengl compositing

Product:

xorg

Reporter:

Christoph Haag <haagch>

Component:

Driver/intel

Assignee:

Chris Wilson <chris>

Status:

RESOLVED FIXED

QA Contact:

Intel GFX Bugs mailing list <intel-gfx-bugs>

Severity:

normal

Priority:

medium

Version:

git

Hardware:

All

OS:

Linux (All)

Whiteboard:

i915 platform:

i915 features:

Attachments:

Description	Flags
gdb with bt and bt full	none

Description Christoph Haag 2014-04-04 14:09:52 UTC

Created attachment 96902 [details]
gdb with bt and bt full

00:02.0 VGA compatible controller: Intel Corporation 3rd Gen Core processor Graphics Controller (rev 09)
01:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Wimbledon XT [Radeon HD 7970M] (rev ff)

mesa, xf86-video-ati and xf86-video-intel from latest git, xorg 1.15 stable.

It only happens in relatively specific circumstances.

I have reproduced it with wine + space engine, wine + furmark (both times with a virtual 1920x1080 wine desktop) and antichamber (native version from humble bundle).

With xrender compositing everything is fine. With OpenGL compositing I get this segfault.

With OpenGL compositing and PRIME there is sometimes this bug: https://bugs.freedesktop.org/show_bug.cgi?id=69101 (there are multiple issues described, I am talking about the window content not being rendered initially, but only after resizing the window/minimizing+restoring etc.). It might or might not be related but I believe in every instance the crash happened the initial rendering didn't work. Strangely the usual workaround of minimizing and restoring a window doesn't seem to "fix" the rendering now.

For wine+space engine this happens every time: I start it with DRI_PRIME=1 GALLIUM_HUD=fps wine SpaceEngine.exe, wait a bit until the menu should be loaded, but the screen is blank. I hit the shortcut for minimizing the window, X crashes. This only happens since recently I believe, but I have not yet investigated since when.

For antichamber it's kind of the opposite, as minimizing works and the crash happened as soon as I managed to get it to render the contents.

Anyway, attached is "bt" and "bt full" from gdb.

The variable "cursor" is a null pointer.

From how I see it the cursor variable gets initialized with NULL, but never set.

It looks like f98b2e164637292c2425f6e6d2c22bd9a2800f8e broke it by removing 		cursor = __sna_get_cursor(sna, crtc); among some other changes, so perhaps this is just some leftover stuff that was forgotten to be changed.

http://cgit.freedesktop.org/xorg/driver/xf86-video-intel/commit/?id=f98b2e164637292c2425f6e6d2c22bd9a2800f8e

Comment 1 Chris Wilson 2014-04-04 15:07:10 UTC

The bug is actually dependent upon the CRTC being transformed, which should not be an artefact of OpenGL compositing... That's something to look into as to why the RandR configuration is different.

Many thanks,

commit 02862faeae21bd445d61006c9aeb966fbe6a7670
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Apr 4 16:03:08 2014 +0100

    sna: Remove unitialized use of 'cursor'
    
    The earlier query of cursor (simply to find out the hw size) was
    replaced by an invariant determined when the cursor was first set.
    However, not all uses of cursor->size were fixed.
    
    Fixes regression from
    commit f98b2e164637292c2425f6e6d2c22bd9a2800f8e
    Author: Chris Wilson <chris@chris-wilson.co.uk>
    Date:   Wed Apr 2 08:36:14 2014 +0100
    
        sna: Prevent signal re-entrancy into cursor update routines
    
    Reported-by: Christoph Haag <haagch.christoph@googlemail.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=77053
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.