Bug 70137 - SIGABRT in sna_composite_rectangles [SNA]
Summary: SIGABRT in sna_composite_rectangles [SNA]
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Driver/intel (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: Chris Wilson
QA Contact: Intel GFX Bugs mailing list
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-10-04 14:47 UTC by Clemens Eisserer
Modified: 2013-10-04 15:31 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
Xorg log (27.13 KB, text/plain)
2013-10-04 15:00 UTC, Clemens Eisserer
no flags Details

Description Clemens Eisserer 2013-10-04 14:47:30 UTC
When working with Eclipse' autocomplete feature, I frequently run into SIGABRT in sna_composite_rectangles.

Hope the backtrace is conclusive:

#5  0x00007f242cb3d519 in sna_composite_rectangles (op=<optimized out>,
    dst=<optimized out>, color=<optimized out>, num_rects=<optimized out>,
    rects=<optimized out>) at sna_composite.c:1014
        tmp = {extents = {x1 = 21648, y1 = 129, x2 = 0, y2 = 0},
          data = 0x466e8c <WaitForSomething+2300>}
        bo = 0x12af050
        damage = 0x0
        region = {extents = {x1 = 400, y1 = 364, x2 = 402, y2 = 379},
data = 0x0}
        stack_boxes = {{x1 = 400, y1 = 364, x2 = 402, y2 = 379}, {x1 =
0, y1 = 0,
            x2 = 0, y2 = 0}, {x1 = 2496, y1 = -22718, x2 = 32767, y2 =
0}, {x1 = 2488,
---Type <return> to continue, or q <return> to quit---
            y1 = -22718, x2 = 32767, y2 = 0}, {x1 = 0, y1 = 0, x2 = 0,
y2 = 0}, {
            x1 = 2496, y1 = -22718, x2 = 32767, y2 = 0}, {x1 = 0, y1 =
0, x2 = 0,
            y2 = 0}, {x1 = 14983, y1 = 4, x2 = 0, y2 = 0}, {x1 = 0, y1
= 0, x2 = 0,
            y2 = 0}, {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, {x1 = 0, y1 = 0, x2 = 0,
            y2 = 0}, {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, {x1 = 0, y1 = 0, x2 = 0,
            y2 = 0}, {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, {x1 = 0, y1 = 0, x2 = 0,
            y2 = 0}, {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, {x1 = 0, y1 = 0, x2 = 0,
            y2 = 0}, {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, {x1 = 120, y1 =
0, x2 = 0,
            y2 = 0}, {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, {x1 = 24, y1 = 0, x2 = 0,
            y2 = 0}, {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, {x1 = 0, y1 = 0, x2 = 0,
            y2 = 0}, {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, {x1 = 30928, y1
= 393, x2 = 0,
            y2 = 0}, {x1 = 30932, y1 = 393, x2 = 0, y2 = 0}, {x1 =
5152, y1 = 297,
            x2 = 0, y2 = 0}, {x1 = -7010, y1 = 11441, x2 = 32548, y2 = 0}, {
            x1 = 31032, y1 = 393, x2 = 0, y2 = 0}, {x1 = -4496, y1 =
295, x2 = 0,
            y2 = 0}, {x1 = -5808, y1 = 295, x2 = 0, y2 = 0}, {x1 =
-6929, y1 = 11441,
            x2 = 32548, y2 = 0}, {x1 = 2800, y1 = -22718, x2 = 32767, y2 = 0}, {
            x1 = -1759, y1 = 81, x2 = 0, y2 = 0}, {x1 = 9200, y1 = 89, x2 = 0,
            y2 = 0}, {x1 = 16, y1 = 0, x2 = 48, y2 = 0}, {x1 = 2960,
y1 = -22718,
            x2 = 32767, y2 = 0}, {x1 = 2752, y1 = -22718, x2 = 32767, y2 = 0}, {
            x1 = 5152, y1 = 297, x2 = 0, y2 = 0}, {x1 = -22656, y1 =
31995, x2 = 54,
---Type <return> to continue, or q <return> to quit---
            y2 = 0}, {x1 = 120, y1 = 0, x2 = 0, y2 = 0}, {x1 = -22656,
y1 = 31995,
            x2 = 54, y2 = 0}, {x1 = 24, y1 = 0, x2 = 0, y2 = 0}, {x1 = -10816,
            y1 = 128, x2 = 0, y2 = 0}, {x1 = 5747, y1 = 864, x2 = 0, y2 = 0}, {
            x1 = 30928, y1 = 393, x2 = 0, y2 = 0}, {x1 = 22264, y1 =
128, x2 = 0,
            y2 = 0}, {x1 = 92, y1 = 31944, x2 = 54, y2 = 0}, {x1 =
5747, y1 = 864,
            x2 = 0, y2 = 0}, {x1 = 27656, y1 = 344, x2 = 0, y2 = 0},
{x1 = 64, y1 = 0,
            x2 = 0, y2 = 0}, {x1 = -27012, y1 = 69, x2 = 0, y2 = 0},
{x1 = 27, y1 = 0,
            x2 = 0, y2 = 0}, {x1 = -14864, y1 = 385, x2 = 0, y2 = 0},
{x1 = 30928,
            y1 = 393, x2 = 0, y2 = 0}, {x1 = 9024, y1 = 293, x2 = 0, y2 = 0}, {
            x1 = 57, y1 = 0, x2 = 0, y2 = 0}, {x1 = 3508, y1 = 392, x2
= 0, y2 = 0}, {
            x1 = 1, y1 = 0, x2 = 0, y2 = 0}, {x1 = 13007, y1 = 81, x2
= 0, y2 = 0}, {
            x1 = 30928, y1 = 393, x2 = 0, y2 = 0}, {x1 = 24825, y1 = 81, x2 = 0,
            y2 = 0}, {x1 = 30928, y1 = 393, x2 = 0, y2 = 0}, {x1 =
25853, y1 = 81,
            x2 = 0, y2 = 0}}
        boxes = <optimized out>
        b = <optimized out>
        dst_x = <optimized out>
        dst_y = <optimized out>
        i = 0
        num_boxes = 1
---Type <return> to continue, or q <return> to quit---
        error = 0
        hint = <optimized out>
#6  0x000000000051a561 in ProcRenderFillRectangles ()
Comment 1 Chris Wilson 2013-10-04 14:56:44 UTC
Can you please attach the Xorg.0.log as well? Or do you know which commit you are testing, so I can tally the assert with the code?
Comment 2 Clemens Eisserer 2013-10-04 14:58:46 UTC
the version tested was: 2.99.903-25-ga0476ee
Comment 3 Clemens Eisserer 2013-10-04 15:00:25 UTC
Created attachment 87128 [details]
Xorg log
Comment 4 Clemens Eisserer 2013-10-04 15:02:34 UTC
ok, here is a complete bt:

#0  0x000000367cc35a19 in raise () from /lib64/libc.so.6
#1  0x000000367cc37128 in abort () from /lib64/libc.so.6
#2  0x000000367cc75d47 in __libc_message () from /lib64/libc.so.6
#3  0x000000367cc7bc17 in malloc_printerr () from /lib64/libc.so.6
#4  0x000000368ac5e2de in pixman_region_intersect () from /lib64/libpixman-1.so.0#5  0x00007f242cb3d519 in sna_composite_rectangles (op=<optimized out>,
    dst=<optimized out>, color=<optimized out>, num_rects=<optimized out>,    rects=<optimized out>) at sna_composite.c:1014
#6  0x000000000051a561 in ProcRenderFillRectangles ()
#7  0x0000000000436f97 in Dispatch ()
#8  0x00000000004264aa in main ()
Comment 5 Chris Wilson 2013-10-04 15:04:58 UTC
Ah, that makes more sense. I was looking for one of my assert()s rather than a malloc error.
Comment 6 Chris Wilson 2013-10-04 15:16:56 UTC
While there may very well be another memory corruption elsewhere, this is the primary suspect:

commit 20afd7263f65f29128fbbdbd5894a49594cda669
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Oct 4 16:12:17 2013 +0100

    sna: Tidy up FillRectangles intersection with complex clip
    
    Lesson 1: do not accidentally overwrite the loop count inside the loop.
    
    Reported-by: Clemens Eisserer <linuxhippy@gmail.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70137
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Comment 7 Clemens Eisserer 2013-10-04 15:25:04 UTC
Ok, now something different pops up:

Program received signal SIGSEGV, Segmentation fault.
0x000000368ac5e1c6 in pixman_region_intersect ()
   from /lib64/libpixman-1.so.0
(gdb) bt
#0  0x000000368ac5e1c6 in pixman_region_intersect ()
   from /lib64/libpixman-1.so.0
#1  0x00007f6c0b33a50a in sna_composite_rectangles (
    op=<optimized out>, dst=<optimized out>, color=<optimized out>,
    num_rects=<optimized out>, rects=<optimized out>)
    at sna_composite.c:1014
#2  0x000000000051a561 in ProcRenderFillRectangles ()
#3  0x0000000000436f97 in Dispatch ()
Comment 8 Chris Wilson 2013-10-04 15:29:18 UTC
commit 898087014c36c757f8d2e0087e63467192a52837
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Oct 4 16:12:17 2013 +0100

    sna: Fix FillRectangles intersection with complex clip
    
    Lesson 2: Use the right variables.
    
    Reported-by: Clemens Eisserer <linuxhippy@gmail.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70137
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Comment 9 Clemens Eisserer 2013-10-04 15:31:59 UTC
fixed, thanks!


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.