Bug 43899 - Crash in kgem_trim_vma_cache [SNA]
Summary: Crash in kgem_trim_vma_cache [SNA]
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Driver/intel (show other bugs)
Version: git
Hardware: Other All
: medium normal
Assignee: Chris Wilson
QA Contact: Xorg Project Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-12-16 14:25 UTC by Clemens Eisserer
Modified: 2011-12-17 13:37 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments

Description Clemens Eisserer 2011-12-16 14:25:49 UTC
When browsing web-pages which contain a lot of images (e.g. google's image search) I get frequent crashes with the following backtrace:

#0  kgem_trim_vma_cache (kgem=0x8c9fee8) at kgem.c:1920
#1  0x00444eaf in kgem_bo_map (kgem=0x8c9fee8, bo=0xd892298, prot=3) at kgem.c:1943
#2  0x0046cdf8 in sna_replace (sna=0x8c9fdb0, pixmap=0xa6bb718, bo=0xd892298, src=0xde65040, stride=748) at sna_io.c:455
#3  0x00457860 in sna_pixmap_move_to_gpu (pixmap=0xa6bb718) at sna_accel.c:1173
#4  0x0045c11f in sna_pixmap_force_to_gpu (pixmap=0xa6bb718) at sna_accel.c:1112
#5  0x0046d908 in sna_render_pixmap_bo (sna=0x8c9fdb0, channel=0xbf81c7e8, pixmap=0xa6bb718, x=278, y=65, w=187, 
    h=<optimized out>, dst_x=555, dst_y=0) at sna_render.c:504
#6  0x0048aded in gen3_composite_picture (sna=0x8c9fdb0, picture=0xdd28a00, op=0xbf81c7bc, channel=0xbf81c7e8, x=278, y=65, 
    w=184, h=8, dst_x=555, dst_y=0) at gen3_render.c:2128
#7  0x00492a99 in gen3_render_composite (tmp=0xbf81c7bc, height=8, width=184, dst_y=0, dst_x=555, mask_y=0, mask_x=0, 
    src_y=<optimized out>, src_x=278, dst=0xa6bc5b0, mask=0x0, src=0xdd28a00, op=1 '\001', sna=0x8c9fdb0)
    at gen3_render.c:2414
#8  gen3_render_composite (sna=0x8c9fdb0, op=1 '\001', src=0xdd28a00, mask=0x0, dst=0xa6bc5b0, src_x=278, src_y=65, 
    mask_x=0, mask_y=0, dst_x=555, dst_y=0, width=184, height=8, tmp=0xbf81c7bc) at gen3_render.c:2339
#9  0x004615b9 in sna_composite (op=1 '\001', src=0xdd28a00, mask=0x0, dst=0xa6bc5b0, src_x=278, src_y=65, mask_x=0, 
    mask_y=0, dst_x=555, dst_y=0, width=184, height=8) at sna_composite.c:462
#10 0x08156aaf in damageComposite (op=1 '\001', pSrc=0xdd28a00, pMask=0x0, pDst=0xa6bc5b0, xSrc=278, ySrc=65, xMask=0, 
    yMask=0, xDst=555, yDst=0, width=184, height=8) at damage.c:569
#11 0x0814965b in CompositePicture (op=<optimized out>, pSrc=0xdd28a00, pMask=0x0, pDst=0xa6bc5b0, xSrc=278, ySrc=65, 
    xMask=0, yMask=0, xDst=555, yDst=0, width=184, height=8) at picture.c:1647
#12 0x0814ec1b in ProcRenderComposite (client=0x8f9cd58) at render.c:728
#13 0x08149ed4 in ProcRenderDispatch (client=0x8f9cd58) at render.c:2063
#14 0x080760f5 in Dispatch () at dispatch.c:447
#15 0x0806433a in main (argc=6, argv=0xbf81cbc4, envp=0xbf81cbe0) at main.c:287

intel i945GM
intel-git (2.17.0-130-g19c184b)
libdrm-2.4.29
linux-3.1.5
xorg 1.11.1
Comment 1 Chris Wilson 2011-12-16 17:28:08 UTC
I've been chasing this with valgrind, no luck so far but I have found a couple of other issues to fix...
Comment 2 Chris Wilson 2011-12-17 13:37:37 UTC
Finally found a way to reliably reproduce it.

commit 3320b459d6fe90d1145e3874c840b95279fb16c8
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Sat Dec 17 12:08:24 2011 +0000

    sna: Clean up caches stored upon the batch bo
    
    Until the advent of the VMA cache, we were safe to reap the batch bo by
    hand. However, as we continue to add additional data to the bo, it is
    wise to use the common free function.
    
    Reported-by: Clemens Eisserer <linuxhippy@gmail.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=43899
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.