Created attachment 29177 [details]
fbo memory corruption test prog

I've found some kind of gem memory manager bug that causes rendering to an FBO to write to (random?) regions of memory.  This either causes screen corruption or GPU lock-up.

The attached test program exercises the bug.  The main loop is basically:

while (1) {
   Create a small texture and an FBO that renders into it.
   Clear the FBO to red or green on alternate frames.
   Render a purple cube into the FBO.
   Blit the FBO image to the window.
   Destroy the texture/FBO.
   SwapBuffers()
}

Compile, run and press 's'.  At some point, the purple cube rendering stops; you'll just see blank red or green background rects.  Then, it may recover, or the screen corruption will appear, or the GPU will lock up.  When the screen gets currupted the bad pixels are purple which tells me that the cube's rendering is not going to the FBO.


I enabled intel_bufmgr's debug output and noticed that just before the problem occurs, there's a very long stream of:

bo_unreference final: 251 (SS_SURF_BIND)
bo_unreference final: 254 (SS_SURF_BIND)
bo_unreference final: 1331 (SS_SURF_BIND)
bo_unreference final: 308 (SS_SURF_BIND)
bo_unreference final: 158 (SS_SURF_BIND)
bo_unreference final: 1043 (SS_SURF_BIND)
[about 1400 of them]


Also, in brw_update_renderbuffer_surface(), I noticed that the FBO region's bo's "offset" switches from always begin zero to something like 161230848.