All of lore.kernel.org
 help / color / mirror / Atom feed
* [Bug 34336] New: r300g: segfault in r300_draw_arrays_immediate
@ 2011-02-16 13:38 bugzilla-daemon
  2011-02-16 21:51 ` [Bug 34336] " bugzilla-daemon
                   ` (5 more replies)
  0 siblings, 6 replies; 7+ messages in thread
From: bugzilla-daemon @ 2011-02-16 13:38 UTC (permalink / raw)
  To: dri-devel

https://bugs.freedesktop.org/show_bug.cgi?id=34336

           Summary: r300g: segfault in r300_draw_arrays_immediate
           Product: Mesa
           Version: git
          Platform: x86-64 (AMD64)
        OS/Version: Linux (All)
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Drivers/Gallium/r300
        AssignedTo: dri-devel@lists.freedesktop.org
        ReportedBy: wixorpeek@gmail.com
                CC: maraeo@gmail.com


A bug was introduced between 5a01361ceaf29 and dc578188fae099 causing
reproducible segmentation fault with latest svn Blender (the code excercices
fixed-function pipeline and draws a handful of primitives with begin-end).

Core was generated by `./blender'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007f5b484c2785 in memcpy () from /lib/libc.so.6
(gdb) bt
#0  0x00007f5b484c2785 in memcpy () from /lib/libc.so.6
#1  0x00007f5b40def53f in r300_draw_arrays_immediate (r300=<value optimized
out>, mode=<value optimized out>, start=<value optimized out>, 
    count=<value optimized out>) at r300_render.c:430
#2  0x00007f5b40df15c6 in r300_draw_vbo (pipe=0x256a5e0, info=0x7ffff8ef3d70)
at r300_render.c:803
#3  0x00007f5b40ead410 in st_draw_vbo (ctx=<value optimized out>, arrays=<value
optimized out>, prims=<value optimized out>, nr_prims=8, ib=0x0, 
    index_bounds_valid=<value optimized out>, min_index=0, max_index=14) at
state_tracker/st_draw.c:715
#4  0x00007f5b40eaa702 in vbo_exec_vtx_flush (exec=0x2620b00, unmap=1 '\001')
at vbo/vbo_exec_draw.c:383
#5  0x00007f5b40ea7afc in vbo_exec_FlushVertices_internal (ctx=<value optimized
out>, unmap=28 '\034') at vbo/vbo_exec_api.c:912
#6  0x00007f5b40ea7b4a in vbo_exec_FlushVertices (ctx=0x2577b28, flags=1) at
vbo/vbo_exec_api.c:946
#7  0x00007f5b40e5315e in _mesa_MultMatrixf (m=0x260cb94) at main/matrix.c:383
#8  0x00000000006a72f9 in ED_view3d_init_mats_rv3d (ob=<value optimized out>,
rv3d=0x25f4728) at source/blender/editors/space_view3d/space_view3d.c:174
#9  0x00000000006c1d4d in draw_object (scene=<value optimized out>, ar=<value
optimized out>, v3d=<value optimized out>, base=<value optimized out>, 
    flag=<value optimized out>) at
source/blender/editors/space_view3d/drawobject.c:5743
#10 0x000000000069f3f6 in view3d_main_area_draw (C=<value optimized out>,
ar=0x25f45b8) at source/blender/editors/space_view3d/view3d_draw.c:2428
#11 0x0000000000842865 in ED_region_do_draw (C=0x21c1b28, ar=0x25f45b8) at
source/blender/editors/screen/area.c:340
#12 0x000000000066e59e in wm_method_draw_overlap_all (C=0x21c1b28,
win=0x25dd0d8, exchange=0) at source/blender/windowmanager/intern/wm_draw.c:244
#13 0x000000000066ede5 in wm_draw_triple_fail (C=0x21c1b28) at
source/blender/windowmanager/intern/wm_draw.c:418
#14 wm_method_draw_triple (C=0x21c1b28) at
source/blender/windowmanager/intern/wm_draw.c:578
#15 wm_draw_update (C=0x21c1b28) at
source/blender/windowmanager/intern/wm_draw.c:769
#16 0x0000000000674008 in WM_main (C=0x21c1b28) at
source/blender/windowmanager/intern/wm.c:348
#17 0x00000000006611ea in main (argc=1, argv=0x7ffff8ef4628) at
source/creator/creator.c:1266

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

^ permalink raw reply	[flat|nested] 7+ messages in thread

* [Bug 34336] r300g: segfault in r300_draw_arrays_immediate
  2011-02-16 13:38 [Bug 34336] New: r300g: segfault in r300_draw_arrays_immediate bugzilla-daemon
@ 2011-02-16 21:51 ` bugzilla-daemon
  2011-02-17 13:17 ` bugzilla-daemon
                   ` (4 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: bugzilla-daemon @ 2011-02-16 21:51 UTC (permalink / raw)
  To: dri-devel

https://bugs.freedesktop.org/show_bug.cgi?id=34336

--- Comment #1 from Marek Olšák <maraeo@gmail.com> 2011-02-16 13:51:46 PST ---
I can't reproduce it with Blender 2.49. Could you possibly bisect?

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread

* [Bug 34336] r300g: segfault in r300_draw_arrays_immediate
  2011-02-16 13:38 [Bug 34336] New: r300g: segfault in r300_draw_arrays_immediate bugzilla-daemon
  2011-02-16 21:51 ` [Bug 34336] " bugzilla-daemon
@ 2011-02-17 13:17 ` bugzilla-daemon
  2011-02-18 13:35 ` bugzilla-daemon
                   ` (3 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: bugzilla-daemon @ 2011-02-17 13:17 UTC (permalink / raw)
  To: dri-devel

https://bugs.freedesktop.org/show_bug.cgi?id=34336

--- Comment #2 from Wiktor Janas <wixorpeek@gmail.com> 2011-02-17 05:17:12 PST ---
(In reply to comment #1)
> I can't reproduce it with Blender 2.49. Could you possibly bisect?

Well, the drawing code has changed much between 2.49 and 2.5x, you may want to
get the beta release from blender.org. The exact steps to reproduce are: start
blender and maximize (not fullscreen) the window. In the top-left corner there
is an combo box with a circled 'i' letter; open it and move the mouse quickly
around the menu for some time. It crashes after a second or so.
I have also spotted this on kwin cube-desktop-switch effect, crashes every time
after painting some dozen frames.

The exact commit introducing the bug is 45e1cd522bd ("interaction between
UNSYNCHRONIZED and DONTBLOCK"). I have introduced a debug statement into
radeon_bo_map_internal and this is what I found (the first column is timestamp
in nanoseconds, the parentheses contain bo->size, bo->name. bo->handle):

170745153: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170749993: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170754953: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170759793: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170764473: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170790113: bo = 0x2c4a310 (65536, 13, 0), flags = 00000600, cs = 0x2b8fe40
170809233: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170814913: bo = 0x2c4a310 (65536, 13, 0), flags = 00000600, cs = 0x2b8fe40
170827513: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170833233: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170838153: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172139113: bo = 0x441d610 (128, 3, 0), flags = 00000400, cs = 0x2b8fe40
172182793: bo = 0x441d610 (128, 3, 0), flags = 00000400, cs = 0x2b8fe40
172204593: bo = 0x2c4a310 (65536, 13, 0), flags = 00000600, cs = 0x2b8fe40
172250793: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172256993: bo = 0x2c4a310 (65536, 13, 0), flags = 00000600, cs = 0x2b8fe40
172276473: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172282353: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172287313: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172292113: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172296993: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172301793: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172306473: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172311353: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172316193: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172320913: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172325833: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172330673: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172335433: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172340353: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172345033: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172349873: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172354713: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172359553: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172364393: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172369193: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172373873: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172378713: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172383553: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172388233: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172392993: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172397833: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172425513: bo = 0x44ef860 (65536, 14, 0), flags = 00000600, cs = 0x2b8fe40
172485593: bo = 0x44ef860 (65536, 14, 0), flags = 00000400, cs = 0x2b8fe40
*boom*

Hope it means something.

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

^ permalink raw reply	[flat|nested] 7+ messages in thread

* [Bug 34336] r300g: segfault in r300_draw_arrays_immediate
  2011-02-16 13:38 [Bug 34336] New: r300g: segfault in r300_draw_arrays_immediate bugzilla-daemon
  2011-02-16 21:51 ` [Bug 34336] " bugzilla-daemon
  2011-02-17 13:17 ` bugzilla-daemon
@ 2011-02-18 13:35 ` bugzilla-daemon
  2011-02-19  9:39 ` bugzilla-daemon
                   ` (2 subsequent siblings)
  5 siblings, 0 replies; 7+ messages in thread
From: bugzilla-daemon @ 2011-02-18 13:35 UTC (permalink / raw)
  To: dri-devel

https://bugs.freedesktop.org/show_bug.cgi?id=34336

--- Comment #3 from Wiktor Janas <wixorpeek@gmail.com> 2011-02-18 05:35:08 PST ---
I have reverted 45e1cd522bd on top of latest git and blender seems to work
again, however still kwin crashes:

Application: KWin (kwin), signal: Segmentation fault
[KCrash Handler]
#6  0x00007feb74754796 in memcpy () from /lib/libc.so.6
#7  0x00007feb5c69fc8e in r300_draw_arrays_immediate (r300=<value optimized
out>, mode=<value optimized out>, start=<value optimized out>, count=<value
optimized out>) at r300_render.c:430
#8  0x00007feb5c6a1956 in r300_draw_vbo (pipe=0x154f700, info=0x7fffb083b240)
at r300_render.c:803
#9  0x00007feb5c75de50 in st_draw_vbo (ctx=<value optimized out>, arrays=<value
optimized out>, prims=<value optimized out>, nr_prims=1, ib=0x0,
index_bounds_valid=<value optimized out>, min_index=0, max_index=3) at
state_tracker/st_draw.c:715
#10 0x00007feb5c7f867d in vbo_save_playback_vertex_list (ctx=0x1598170,
data=<value optimized out>) at vbo/vbo_save_draw.c:289
#11 0x00007feb5c6e0272 in ext_opcode_execute (ctx=0x1598170, list=<value
optimized out>) at main/dlist.c:552
#12 execute_list (ctx=0x1598170, list=<value optimized out>) at
main/dlist.c:7123
#13 0x00007feb5c6e3082 in _mesa_CallList (list=2) at main/dlist.c:8440
#14 0x00007feb5bd290c6 in ?? () from /usr/lib/kde4/kwin4_effect_builtins.so
#15 0x00007feb74b07e9e in ?? () from
/usr/lib/kde4/libkdeinit/libkdeinit4_kwin.so
[...cut...]
#42 0x00007feb74a8a48a in kdemain () from
/usr/lib/kde4/libkdeinit/libkdeinit4_kwin.so
#43 0x00007feb746f3c4d in __libc_start_main () from /lib/libc.so.6
#44 0x00000000004006a9 in _start ()

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

^ permalink raw reply	[flat|nested] 7+ messages in thread

* [Bug 34336] r300g: segfault in r300_draw_arrays_immediate
  2011-02-16 13:38 [Bug 34336] New: r300g: segfault in r300_draw_arrays_immediate bugzilla-daemon
                   ` (2 preceding siblings ...)
  2011-02-18 13:35 ` bugzilla-daemon
@ 2011-02-19  9:39 ` bugzilla-daemon
  2011-02-19  9:41 ` bugzilla-daemon
  2011-02-20 17:59 ` bugzilla-daemon
  5 siblings, 0 replies; 7+ messages in thread
From: bugzilla-daemon @ 2011-02-19  9:39 UTC (permalink / raw)
  To: dri-devel

https://bugs.freedesktop.org/show_bug.cgi?id=34336

--- Comment #4 from Marek Olšák <maraeo@gmail.com> 2011-02-19 01:39:16 PST ---
I can't reproduce it with neither Blender 2.5x nor kwin.

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread

* [Bug 34336] r300g: segfault in r300_draw_arrays_immediate
  2011-02-16 13:38 [Bug 34336] New: r300g: segfault in r300_draw_arrays_immediate bugzilla-daemon
                   ` (3 preceding siblings ...)
  2011-02-19  9:39 ` bugzilla-daemon
@ 2011-02-19  9:41 ` bugzilla-daemon
  2011-02-20 17:59 ` bugzilla-daemon
  5 siblings, 0 replies; 7+ messages in thread
From: bugzilla-daemon @ 2011-02-19  9:41 UTC (permalink / raw)
  To: dri-devel

https://bugs.freedesktop.org/show_bug.cgi?id=34336

--- Comment #5 from Marek Olšák <maraeo@gmail.com> 2011-02-19 01:41:00 PST ---
Please try the latest Mesa master branch. Alternatively, you may try and set
either of these environment variables and see if it helps:

RADEON_THREAD=0
RADEON_DEBUG=noimmd

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread

* [Bug 34336] r300g: segfault in r300_draw_arrays_immediate
  2011-02-16 13:38 [Bug 34336] New: r300g: segfault in r300_draw_arrays_immediate bugzilla-daemon
                   ` (4 preceding siblings ...)
  2011-02-19  9:41 ` bugzilla-daemon
@ 2011-02-20 17:59 ` bugzilla-daemon
  5 siblings, 0 replies; 7+ messages in thread
From: bugzilla-daemon @ 2011-02-20 17:59 UTC (permalink / raw)
  To: dri-devel

https://bugs.freedesktop.org/show_bug.cgi?id=34336

Marek Olšák <maraeo@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |DUPLICATE

--- Comment #6 from Marek Olšák <maraeo@gmail.com> 2011-02-20 09:59:56 PST ---
Please follow bug 34418 instead.

*** This bug has been marked as a duplicate of bug 34418 ***

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2011-02-20 17:59 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-02-16 13:38 [Bug 34336] New: r300g: segfault in r300_draw_arrays_immediate bugzilla-daemon
2011-02-16 21:51 ` [Bug 34336] " bugzilla-daemon
2011-02-17 13:17 ` bugzilla-daemon
2011-02-18 13:35 ` bugzilla-daemon
2011-02-19  9:39 ` bugzilla-daemon
2011-02-19  9:41 ` bugzilla-daemon
2011-02-20 17:59 ` bugzilla-daemon

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.