Bug 13921 - [i965] Glean crash X
[i965] Glean crash X
Status: VERIFIED FIXED
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/i965
unspecified
Other Linux (All)
: high critical
Assigned To: haihao
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2008-01-03 23:35 UTC by Shuang He
Modified: 2008-10-12 19:11 UTC (History)
2 users (show)

See Also:


Attachments
xorg conf (3.59 KB, text/plain)
2008-01-03 23:37 UTC, Shuang He
Details
xorg log (23.54 KB, text/plain)
2008-01-03 23:38 UTC, Shuang He
Details
Server configuration (1.40 KB, text/plain)
2008-01-05 18:16 UTC, Gary Wong
Details
Server log (22.02 KB, text/plain)
2008-01-05 18:17 UTC, Gary Wong
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Shuang He 2008-01-03 23:35:10 UTC
System Environment:
--------------------------
--Platform: FC6
--xserver:cd0603c2dc5ee000ebce66056bc1a72f99bfb617
--Xf86_video_intel:83d304c61ad5fdc58b0a9309dbd1e5a3f6cd9b01
--Mesa:15653b5d88c0f88f49c2d5497b4fb9e045f53560
--DRM:78d6649069a40c5c30ecc482eea803a5dc89c080
--Kernel:2.6.23

Bug detailed description:
--------------------------
this issue doesn't happen on i915
this issue happens whether or not INTEL_NO_TTM is set.

Running glean will crash X, with following output:
FAILURE: glUniform[1234]f failed (at tapi2.cpp:573)
0.156863 0.019608 0.000000 0.000000
FAILURE: glUniform[1234]i failed (at tapi2.cpp:677)
0.000000 0.000000 0.000000 0.000000
api2:  FAIL rgba8, db, z24, s8, win+pmap, id 33
        7 tests passed, 2 tests failed.
FAILURE: glUniform[1234]f failed (at tapi2.cpp:573)
0.156863 0.019608 0.000000 0.000000
FAILURE: glUniform[1234]i failed (at tapi2.cpp:677)
0.000000 0.000000 0.000000 0.000000
api2:  FAIL rgba8, db, z24, s8, win+pmap, id 34
        7 tests passed, 2 tests failed.

basic:  PASS rgba8, db, z24, s8, win+pmap, id 33
basic:  PASS rgba8, db, z24, s8, win+pmap, id 34
basic:  PASS rgba8, win+pmap, id 82

basicPerf:  PASS rgba8, db, z24, s8, win+pmap, id 33
        Average = 0.103775      Range = [0.103773, 0.103778]
basicPerf:  PASS rgba8, db, z24, s8, win+pmap, id 34
        Average = 0.103778      Range = [0.103777, 0.103779]
basicPerf:  PASS rgba8, win+pmap, id 82
        Average = 0.103919      Range = [0.103915, 0.103922]

makeCurrent:  PASS rgba8, db, z24, s8, win+pmap, id 33
makeCurrent:  PASS rgba8, db, z24, s8, win+pmap, id 34
makeCurrent:  PASS rgba8, win+pmap, id 82

blendFunc:  PASS rgba8, db, z24, s8, win+pmap, id 33
blendFunc:  PASS rgba8, db, z24, s8, win+pmap, id 34
blendFunc:  PASS rgba8, win+pmap, id 82

test.sh: line 10:  3280 Segmentation fault      (core dumped) ./glean -r test
[root@x-q965 glean]# Error in I830WaitLpRing(), timeout for 2 seconds
pgetbl_ctl: 0x3ff80001 pgetbl_err: 0x0
ipeir: 0 iphdr: 2000003
LP ring tail: 1e6c8 head: 1e658 len: 1f001 start 0
Err ID (eir): 0 Err Status (esr): 0 Err Mask (emr): ffffffdf
instdone: ffc5f8fd instdone_1: fffff
instpm: 0
memmode: 0 instps: 8001e025
HW Status mask (hwstam): fffecffe
IRQ enable (ier): 2 imr: fffe0000 iir: 10f0
acthd: 38021bc dma_fadd_p: 3802240
ecoskpd: 307 excc: 0
cache_mode: 6800/180
mi_arb_state: 44
IA_VERTICES_COUNT_QW 0/0
IA_PRIMITIVES_COUNT_QW 0/0
VS_INVOCATION_COUNT_QW 0/0
GS_INVOCATION_COUNT_QW 0/0
GS_PRIMITIVES_COUNT_QW 0/0
CL_INVOCATION_COUNT_QW 0/0
CL_PRIMITIVES_COUNT_QW 1/0
PS_INVOCATION_COUNT_QW 1104/0
PS_DEPTH_COUNT_QW 45218/0
WIZ_CTL 0
TS_CTL 0  TS_DEBUG_DATA 64efde48
TD_CTL 0 / 0
space: 130952 wanted 131064

Fatal server error:
lockup


Backtrace:
0: X(xf86SigHandler+0x79) [0x80ac449]
1: [0xffffe420]
2: /opt/X11R7/lib/xorg/modules/drivers//intel_drv.so [0xb7d7d08d]
3: /opt/X11R7/lib/xorg/modules/extensions//libglx.so [0xb7df9ca9]
4: X(AbortDDX+0x79) [0x809eb19]
5: X(AbortServer+0x28) [0x8130708]
6: X(FatalError+0x66) [0x8130c16]
7: /opt/X11R7/lib/xorg/modules/drivers//intel_drv.so(I830WaitLpRing+0x161) [0xb7d723c1]
8: /opt/X11R7/lib/xorg/modules/drivers//intel_drv.so(I830Sync+0x100) [0xb7d72610]
9: /opt/X11R7/lib/xorg/modules/drivers//intel_drv.so [0xb7d9047a]
10: /opt/X11R7/lib/xorg/modules//libexa.so(exaWaitSync+0x7a) [0xb7c09b5a]
11: /opt/X11R7/lib/xorg/modules//libexa.so(ExaDoPrepareAccess+0x9b) [0xb7c0aa2b]
12: /opt/X11R7/lib/xorg/modules//libexa.so(exaPrepareAccessReg+0x6c) [0xb7c0ab9c]
13: /opt/X11R7/lib/xorg/modules//libexa.so [0xb7c0b9e7]
14: X [0x81690bd]
15: X [0x816a39b]
16: X(doImageText+0x1cd) [0x808741d]
17: X(ImageText+0x74) [0x80875d4]
18: X(ProcImageText16+0x110) [0x8081bd0]
19: X [0x814bd1e]
20: X(Dispatch+0x2d1) [0x80847d1]
21: X(main+0x485) [0x806b485]
22: /lib/libc.so.6(__libc_start_main+0xdc) [0x469397e4]
23: X(FontFileCompleteXLFD+0x95) [0x806a891]

FatalError re-entered, aborting
Caught signal 11.  Server aborting

xterm:  fatal IO error 32 (Broken pipe) or KillClient on X server ":0.0"

[1]-  Aborted                 (core dumped) X
[2]+  Exit 84                 xterm


Reproduce steps:
----------------
start X
./glean -r runlog


Current result:
----------------
glean crash X


Expected result:
----------------
glean should run normally
Comment 1 Shuang He 2008-01-03 23:35:42 UTC
X backtrace:
(gdb) bt
#0  0xffffe410 in __kernel_vsyscall ()
#1  0x4694c159 in raise () from /lib/libc.so.6
#2  0x4694d6e3 in abort () from /lib/libc.so.6
#3  0x08130c2b in FatalError (f=Variable "f" is not available.
) at log.c:554
#4  0x080ac4b9 in xf86SigHandler (signo=11) at xf86Events.c:766
#5  <signal handler called>
#6  DRILock (pScreen=0x824d448, flags=0) at dri.c:2181
#7  0xb7d7d08d in I830LeaveVT (scrnIndex=0, flags=0) at i830_driver.c:3043
#8  0xb7df9ca9 in glxDRILeaveVT (index=0, flags=0) at glxdri.c:811
#9  0x0809eb19 in AbortDDX () at xf86Init.c:1315
#10 0x08130708 in AbortServer () at log.c:406
#11 0x08130c16 in FatalError (f=0xb7d9e0dc "lockup\n") at log.c:552
#12 0xb7d723c1 in I830WaitLpRing (pScrn=0x82200a0, n=131064, timeout_millis=0) at i830_accel.c:150
#13 0xb7d72610 in I830Sync (pScrn=0x82200a0) at i830_accel.c:201
#14 0xb7d9047a in I830EXASync (pScreen=0x824d448, marker=0) at i830_exa.c:154
#15 0xb7c09b5a in exaWaitSync (pScreen=0x824d448) at exa.c:985
#16 0xb7c0aa2b in ExaDoPrepareAccess (pDrawable=0x85b4750, index=0) at exa.c:473
#17 0xb7c0ab9c in exaPrepareAccessReg (pDrawable=0x85b4750, index=0, pReg=0x8347064) at exa.c:498
#18 0xb7c0b9e7 in exaImageGlyphBlt (pDrawable=0x85b4750, pGC=0x85b4430, x=8, y=14, nglyph=20, ppciInit=0x85b4c30,
    pglyphBase=0x0) at exa_accel.c:979
#19 0x081690bd in damageText (pDrawable=0x85b4750, pGC=0x85b4430, x=8, y=13, count=20, chars=0x85b2c58 "",
    fontEncoding=Linear16Bit, textType=3) at damage.c:1414
#20 0x0816a39b in damageImageText16 (pDrawable=0x85b4750, pGC=0x85b4430, x=8, y=13, count=20, chars=0x85b2c58)
    at damage.c:1495
#21 0x0808741d in doImageText (client=0x85b2a88, c=0xbf96ac60) at dixfonts.c:1554
#22 0x080875d4 in ImageText (client=0x85b2a88, pDraw=0x85b4750, pGC=0x85b4430, nChars=20, data=0x85b2c58 "", xorg=8,
    yorg=13, reqType=77, did=2097183) at dixfonts.c:1605
#23 0x08081bd0 in ProcImageText16 (client=0x85b2a88) at dispatch.c:2458
#24 0x0814bd1e in XaceCatchDispatchProc (client=0x85b2a88) at xace.c:288
#25 0x080847d1 in Dispatch () at dispatch.c:467
#26 0x0806b485 in main (argc=1, argv=0xbf96ae64, envp=0x830d108) at main.c:448
Comment 2 Shuang He 2008-01-03 23:37:36 UTC
Created attachment 13509 [details]
xorg conf
Comment 3 Shuang He 2008-01-03 23:38:01 UTC
Created attachment 13510 [details]
xorg log
Comment 4 Gary Wong 2008-01-05 18:14:53 UTC
I can reproduce what I think is the same bug on another system.  Kernel is also Linux 2.6.23 (x86-64), and:

mesa: e7044d552c6d16389447880b8744a51de1cf0199
xserver: 57468a696e1259c1e1c185fc60230e1d195defb7
driver/xf86-video-intel: 71143200ed66cb9dcc1f9edf98128be80b05619c
drm: f5e5e5c0ea7d7a69f7bf16c718bf757fbb4b541d

glxinfo works, but pretty much any non-trivial DRI rendering is likely to corrupt the display (almost immediately) and lock up the server (before too long).  Running glxgears and resizing the window seems to reliably cause a lockup.
Comment 5 Gary Wong 2008-01-05 18:16:39 UTC
Created attachment 13545 [details]
Server configuration
Comment 6 Gary Wong 2008-01-05 18:17:04 UTC
Created attachment 13546 [details]
Server log
Comment 7 haihao 2008-01-06 17:48:53 UTC
Shuang, 
Could you identify which commit caused this issue with git-bisect
Comment 8 Shuang He 2008-01-06 20:54:48 UTC
this issue has gone with latest mesa, 2d driver, and xserver
Comment 9 Shuang He 2008-10-12 19:11:17 UTC
verified