From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NmpU6-0000uu-2P for qemu-devel@nongnu.org; Wed, 03 Mar 2010 09:23:34 -0500 Received: from [199.232.76.173] (port=37140 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NmpU5-0000ue-J1 for qemu-devel@nongnu.org; Wed, 03 Mar 2010 09:23:33 -0500 Received: from Debian-exim by monty-python.gnu.org with spam-scanned (Exim 4.60) (envelope-from ) id 1NmpU3-0004eu-Ds for qemu-devel@nongnu.org; Wed, 03 Mar 2010 09:23:33 -0500 Received: from mail-pv0-f173.google.com ([74.125.83.173]:37049) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1NmpU3-0004ek-1G for qemu-devel@nongnu.org; Wed, 03 Mar 2010 09:23:31 -0500 Received: by pvg12 with SMTP id 12so398377pvg.4 for ; Wed, 03 Mar 2010 06:23:29 -0800 (PST) Message-ID: <4B8E70DB.4080108@codemonkey.ws> Date: Wed, 03 Mar 2010 08:23:23 -0600 From: Anthony Liguori MIME-Version: 1.0 References: <20100221172358.GH4894@arachsys.com> <4B82462A.7050903@redhat.com> <4B82F8ED.6000303@codemonkey.ws> <20100301181416.GB15908@arachsys.com> In-Reply-To: <20100301181416.GB15908@arachsys.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] Re: Another VNC crash, qemu-kvm-0.12.3 List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Chris Webb Cc: qemu-devel@nongnu.org, kvm@vger.kernel.org On 03/01/2010 12:14 PM, Chris Webb wrote: > We've just seen another VNC related qemu-kvm crash, this time an arithmetic > exception at vnc.c:1424 in the newly release qemu-kvm 0.12.3. > > [...] > 1423 if (vs->absolute) { > 1424 kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1), > 1425 y * 0x7FFF / (ds_get_height(vs->ds) - 1), > 1426 dz, buttons); > 1427 } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) { > 1428 x -= 0x7FFF; > [...] > > and sure enough: > > (gdb) p vs->ds->surface->width > $1 = 9 > (gdb) p vs->ds->surface->height > $2 = 1 > > What a 9x1 display surface is doing on this guest is a mystery to me, but you > definitely can't divide by one less than its height! > Can you reproduce this reliably? If so, what's the procedure? BTW, I'd suggest filing this at http://bugs.launchpad.net/qemu Regards, Anthony Liguori > (gdb) p *vs > $3 = {csock = 19, ds = 0x1c60fa0, dirty = {{4294967295, 4294967295, 4294967295, 4294967295, > 4294967295}}, vd = 0x26a0110, need_update = 1, force_update = 0, features = 67, > absolute = 1, last_x = -1, last_y = -1, vnc_encoding = 5, tight_quality = 9 '\t', tight_compression = 9 '\t', > major = 3, minor = 8, challenge = "¹{\177\226\200kÕjéPñÄA¤o)", output = {capacity = 925115, offset = 0, > buffer = 0x28ba4b0 ""}, input = {capacity = 5120, offset = 6, buffer = 0x28b90a0 "\005"}, > write_pixels = 0x4bb9e0, send_hextile_tile = 0x4bcdf0, > clientds = {flags = 0 '\0', width = 800, height = 600, linesize = 3200, data = 0x7fcd00ab6010 "", pf = { > bits_per_pixel = 32 ' ', bytes_per_pixel = 4 '\004', depth = 24 '\030', rmask = 0, gmask = 0, bmask = 0, > amask = 0, rshift = 16 '\020', gshift = 8 '\b', bshift = 0 '\0', ashift = 24 '\030', rmax = 255 'ÿ', > gmax = 255 'ÿ', bmax = 255 'ÿ', amax = 255 'ÿ', rbits = 8 '\b', gbits = 8 '\b', bbits = 8 '\b', > abits = 8 '\b'}}, audio_cap = 0x0, as = {freq = 44100, nchannels = 2, fmt = AUD_FMT_S16, endianness = 0}, > read_handler = 0x4beac0, read_handler_expect = 6, modifiers_state = '\0', > zlib = {capacity = 0, offset = 0, buffer = 0x0}, zlib_tmp = {capacity = 0, offset = 0, buffer = 0x0}, > zlib_stream = {{next_in = 0x0, avail_in = 0, total_in = 0, next_out = 0x0, avail_out = 0, total_out = 0, msg = 0x0, > state = 0x0, zalloc = 0, zfree = 0, opaque = 0x0, data_type = 0, adler = 0, reserved = 0}, {next_in = 0x0, > avail_in = 0, total_in = 0, next_out = 0x0, avail_out = 0, total_out = 0, msg = 0x0, state = 0x0, zalloc = 0, > zfree = 0, opaque = 0x0, data_type = 0, adler = 0, reserved = 0}, {next_in = 0x0, avail_in = 0, total_in = 0, > next_out = 0x0, avail_out = 0, total_out = 0, msg = 0x0, state = 0x0, zalloc = 0, zfree = 0, opaque = 0x0, > data_type = 0, adler = 0, reserved = 0}, {next_in = 0x0, avail_in = 0, total_in = 0, next_out = 0x0, > avail_out = 0, total_out = 0, msg = 0x0, state = 0x0, zalloc = 0, zfree = 0, opaque = 0x0, data_type = 0, > adler = 0, reserved = 0}}, next = 0x0} > > (gdb) p *vs->ds > $4 = {surface = 0x1c81f40, opaque = 0x26a0110, gui_timer = 0x0, allocator = 0x8199d0, listeners = 0x1c95fa0, > mouse_set = 0, cursor_define = 0, next = 0x0} > > (gdb) p *vs->ds->surface > $5 = {flags = 2 '\002', width = 9, height = 1, linesize = 36, data = 0x7fcd00ab6010 "", pf = { > bits_per_pixel = 32 ' ', bytes_per_pixel = 4 '\004', depth = 24 '\030', rmask = 16711680, gmask = 65280, > bmask = 255, amask = 0, rshift = 16 '\020', gshift = 8 '\b', bshift = 0 '\0', ashift = 24 '\030', rmax = 255 'ÿ', > gmax = 255 'ÿ', bmax = 255 'ÿ', amax = 255 'ÿ', rbits = 8 '\b', gbits = 8 '\b', bbits = 8 '\b', abits = 8 '\b'}} > > Cheers, > > Chris. > -- > To unsubscribe from this list: send the line "unsubscribe kvm" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html >