Bug 58814 - [IVB] segfault after client disconnect with TearFree
Summary: [IVB] segfault after client disconnect with TearFree
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Driver/intel (show other bugs)
Version: git
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Chris Wilson
QA Contact: Intel GFX Bugs mailing list
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-12-27 18:34 UTC by xlinuxro
Modified: 2013-01-06 17:27 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
stacktrace from the crash (6.25 KB, text/plain)
2012-12-27 18:34 UTC, xlinuxro
no flags Details
Xorg log (29.38 KB, text/plain)
2012-12-27 18:36 UTC, xlinuxro
no flags Details

Description xlinuxro 2012-12-27 18:34:50 UTC
Created attachment 72196 [details]
stacktrace from the crash

Reproduction steps:
  enable sna & TearFree
  start Xorg in gdb on an empty VT
  start xterm on the new display (no window manager)
  start glxgears from the xterm
  use ctrl-c in the xterm to abort glxgears
  continue relaunching and aborting glxgears until Xorg crashes.

I am attaching a couple of gdb generated stacktraces obtained using those steps.  The crash also occurs in a normal X session but I don't have a log for that.  Also it does not happen if TearFree is disabled.

This was observed while using the following versions:
  xserver:    1.13.99.901
  xf86-video-intel: 2.20.16-48-g52fd223
  libdrm: 2.4.40-3-g0980633

$ uname -a
Linux namdle 3.8.0-rc1-namdle+ #1 SMP Fri Dec 21 22:46:59 EST 2012 x86_64 GNU/Linux
Comment 1 xlinuxro 2012-12-27 18:36:27 UTC
Created attachment 72197 [details]
Xorg log
Comment 2 xlinuxro 2013-01-03 05:08:32 UTC
Here is some more information about the crash.  When compiled with a debug build on version 2.20.17-38-gfc702cd, one of these two assertions will occur.

./xf86-video-intel/src/sna/kgem.c:4171: kgem_add_reloc: Assertion `bo->refcnt' failed.
./xf86-video-intel/src/sna/sna_accel.c:2822: sna_drawable_use_bo: Assertion `priv->gpu_bo->refcnt' failed.

Also, a git bisect finds 5c3ea9cf6900855502fcd56214a1b9e180265ff5 as the first bad commit.
Comment 3 Chris Wilson 2013-01-06 17:27:33 UTC
Sorry for the delay, I was contemplating a bigger overhaul to the TearFree code to avoid the synchronising copy.


commit 27550e81482229007fa9e0e9769fdd20f3616b23
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Sun Jan 6 17:29:19 2013 +0000

    sna/dri: Transfer the DRI2 reference to the new TearFree pixmap
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=58814
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.