System Environment: -------------------------- Arch: i386 Platform: huronriver Libdrm: (master)2.4.28-4-gdd9a5b4f7fb07c78db4e7481bedca1b981030e3f Mesa: (7.11)7a18f005ed311b4d57ad863a08392160aa0d7c83 Xserver: (server-1.11-branch)xorg-server-1.11.1 Xf86_video_intel: (master)2.17.0-52-g101942d41df7efaa6103e31e738775fafdb63159 Kernel: (drm-intel-fixes)5be93ad2ebb975df8ba01f6c76b541ff4e9929f4 Bug detailed description: ------------------------- It segfaults on ironlake and sandybridge. Bisect shows c549a777c1b6227a724942c64aa5cd181eb93c6c is the first bad commit. commit c549a777c1b6227a724942c64aa5cd181eb93c6c Author: Chris Wilson <chris@chris-wilson.co.uk> AuthorDate: Mon Dec 5 10:14:34 2011 +0000 Commit: Chris Wilson <chris@chris-wilson.co.uk> CommitDate: Mon Dec 5 10:25:53 2011 +0000 intel: Unmap buffers during drm_intel_gem_bo_unmap We cannot afford to cache the vma per open bo as this may exhaust the per-process limits. References: https://bugs.freedesktop.org/show_bug.cgi?id=43075 References: https://bugs.freedesktop.org/show_bug.cgi?id=40066 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> (gdb) bt #0 0x00000037f7034085 in raise () from /lib64/libc.so.6 #1 0x00000037f7035a36 in abort () from /lib64/libc.so.6 #2 0x00000037f702c8c5 in __assert_fail () from /lib64/libc.so.6 #3 0x00007ffff69cc480 in drm_intel_gem_bo_map_gtt (bo=0x2631c00) at intel_bufmgr_gem.c:1168 #4 0x00007ffff6c3413d in intel_bufferobj_map (ctx=0x7ffff7fda010, target=<value optimized out>, access=35001, obj=0x2631b40) at intel_buffer_objects.c:344 #5 0x00007ffff6cfada1 in _mesa_map_pbo_dest (ctx=<value optimized out>, pack=<value optimized out>, dest=0x0) at main/pbo.c:240 #6 0x00007ffff6cfc5c6 in _mesa_GetnPixelMapfvARB (map=3190, bufSize=2147483647, values=0x0) at main/pixel.c:360 #7 0x00000000009a5bac in conform::ApiError::Test_NegativeglGetPixelMap() () #8 0x000000000098ce5e in conform::ApiError::RunSubcase(conform::ApiError::SubcaseInfo const*) () #9 0x000000000098cfa6 in ApiErrorTestExec(testParameters*) () #10 0x0000000001090a29 in callFunctionHandleExceptionsInner(long (*)(testParameters*), testParameters*, char*) () #11 0x0000000001090b5f in callFunctionHandleExceptions(long (*)(testParameters*), testParameters*) () #12 0x000000000108f691 in DriverExec(long (*)(testParameters*), testParameters*) () #13 0x0000000001075367 in Driver(std::vector<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > const&, std::vector<driverRec*, std::allocator<driverRec*> > const&, std::vector<boost::shared_ptr<PrePostTestAction>, std::allocator<boost::shared_ptr<PrePostTestAction> > > const&, std::vector<boost::shared_ptr<PrePostTestcaseAction>, std::allocator<boost::shared_ptr<PrePostTestcaseAction> > > const&) () #14 0x0000000001075718 in (anonymous namespace)::MyMessagePump::idle() () #15 0x0000000001045220 in MessagePump::process_messages() () #16 0x000000000107623c in ExecutionManager::execute_schedules() () #17 0x0000000001000030 in tkShellExecute(std::vector<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > const&, std::vector<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > const&) () #18 0x0000000001008c1b in main () Reproduce steps: ---------------- 1. start X 2. ./oglconform -z -s -suite all -v 2 -D 122 -test api-error negative.glGetPixelMap
Note that the bug is in fact the mapping of a bo into two coherency domains and attempting to use both simultaneously. Eric has fixed this whilst refactoring MapRenderbuffer.
Fixed by the following commit: commit 015286f03e871ccf49af9f2ceef7f5e04c8d61ca Author: Chris Wilson Date: Sun Dec 11 17:35:06 2011 +0000 intel: Remove the fresh assertions used to debug the vma cacheing Hopefully all the bugs in the callers have been found, so time to handle the failures "gracefully" again.
Verified with mesa master commit cb96b06130c7728fe5838845325571ed18f6e983.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.