Bug 73856 - Server terminates with sna_do_copy: damage box is beyond the drawable
Summary: Server terminates with sna_do_copy: damage box is beyond the drawable
Status: RESOLVED FIXED
Alias: None
Product: xorg
Classification: Unclassified
Component: Driver/intel (show other bugs)
Version: unspecified
Hardware: x86-64 (AMD64) Linux (All)
: medium critical
Assignee: Chris Wilson
QA Contact: Intel GFX Bugs mailing list
URL:
Whiteboard:
Keywords:
Depends on: 70905
Blocks:
  Show dependency treegraph
 
Reported: 2014-01-21 01:09 UTC by Janusz
Modified: 2014-01-22 11:53 UTC (History)
4 users (show)

See Also:
i915 platform:
i915 features:


Attachments
Xorg log following sna: Include serial numbers in ValidateGC DBG (137.84 KB, text/plain)
2014-01-21 01:09 UTC, Janusz
no flags Details
Xorg.0.log-2.99.907-44-g720d131 (131.62 KB, text/plain)
2014-01-21 12:59 UTC, Janusz
no flags Details
Restore gc->serialNumber correctly after fallback (1.46 KB, patch)
2014-01-21 22:41 UTC, Chris Wilson
no flags Details | Splinter Review

Description Janusz 2014-01-21 01:09:16 UTC
Created attachment 92496 [details]
Xorg log following sna: Include serial numbers in ValidateGC DBG

+++ This bug was initially created as a clone of Bug #70905 +++

I was trying to trigger page flip error with 2.99.907-31-gde0797e --enable-debug=full build with no effect. Tried Spotify client (running in wine), got X Server termination with:

(EE) sna_copy_boxes: damage box is beyond the pixmap: box=(1, 1), (32, 33), pixmap=(32, 32)

Hence a new bug report, following:
commit 50f6701aa5ce8be96e216a942880a8db967c7a6a
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Mon Jan 20 20:47:15 2014 +0000

    sna: Include serial numbers in ValidateGC DBG
    
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Oddly, attached Xorg.0.log shows no obvious error indication now. Checked twice with similar effect.

Current Operating System: Linux 3.12.7-gentoo-gnu
Integrated Graphics Chipset: Intel(R) GM45
Comment 1 Chris Wilson 2014-01-21 09:27:46 UTC
Right, that confirms that is the gc->pCompositeClip that is screwed up.

More debugging, hopefully a step in the right direction:

commit b9ebb016833df5b70336c66993a871e850fd0f61
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Tue Jan 21 09:05:54 2014 +0000

    sna: More assertions for tracking gc->pCompositeClip
    
    Tracking down who leaves it modified...
    
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Comment 2 Chris Wilson 2014-01-21 10:39:44 UTC
Sadly that was a bogus assert. However, there was a bit of extra DBG that should should still be useful. (Baby steps.)
Comment 3 Janusz 2014-01-21 12:59:43 UTC
Created attachment 92516 [details]
Xorg.0.log-2.99.907-44-g720d131

Just to be sure, it's a bug that resides inside a driver and not an effect of some misconfiguration, i.e. in kernel/xorg, on my side? Sometimes I learn to have too much power over my config the hard way.
Comment 4 Chris Wilson 2014-01-21 22:31:40 UTC
(In reply to comment #3) 
> Just to be sure, it's a bug that resides inside a driver and not an effect
> of some misconfiguration, i.e. in kernel/xorg, on my side? Sometimes I learn
> to have too much power over my config the hard way.

It is definitely a bug in the driver/xserver. For some reason it believes that the gc has already been validated for the drawable, but it still have the clip from the previous drawable.
Comment 5 Chris Wilson 2014-01-21 22:40:00 UTC
Ok, I think this is the culprit:

diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index 4a2b614..b1744ae 100644
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -4021,7 +4021,8 @@ static bool must_check sna_gc_move_to_cpu(GCPtr gc,
        } else
                changes &= ~GCClipMask;
 
-       if (changes || drawable->serialNumber != sgc->serial) {
+       if (changes || drawable->serialNumber != (sgc->serial & DRAWABLE_SERIAL_BITS)) {
+               long tmp = gc->serialNumber;
                gc->serialNumber = sgc->serial;
 
                if (fb_gc(gc)->bpp != drawable->bitsPerPixel) {
@@ -4042,8 +4043,7 @@ static bool must_check sna_gc_move_to_cpu(GCPtr gc,
                }
 
                fbValidateGC(gc, changes, drawable);
-
-               sgc->serial = drawable->serialNumber;
+               gc->serialNumber = tmp;
        }
        sgc->changes = 0;
 
@@ -15733,6 +15733,7 @@ sna_validate_gc(GCPtr gc, unsigned long changes, DrawablePtr drawable)
        assert(RegionNil(gc->pCompositeClip) || gc->pCompositeClip->extents.y2 - drawable->y <= drawable->height);
 
        sna_gc(gc)->changes |= changes;
+       sna_gc(gc)->serial = gc->serialNumber;
 }
 
 static const GCFuncs sna_gc_funcs = {
Comment 6 Chris Wilson 2014-01-21 22:41:23 UTC
Created attachment 92550 [details] [review]
Restore gc->serialNumber correctly after fallback
Comment 7 Janusz 2014-01-22 11:50:49 UTC
Applied patch over current git. Looks like the bug is pinned - it made Bruce Springsteen sing. ;)
Comment 8 Chris Wilson 2014-01-22 11:53:41 UTC
Thank you very much for your bug report and help,

commit 29e11e2e6f80f6485ed69ea72e09e8d9b31fd8e8
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Tue Jan 21 22:40:11 2014 +0000

    sna: Restore gc->serialNumber correctly after falling back
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=73856
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.