Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 501286 - media-libs/mesa crashes x11-drivers/xf86-video-ati[glamor] with SIGFPE with large textures (when firefox loads a specific website)
Summary: media-libs/mesa crashes x11-drivers/xf86-video-ati[glamor] with SIGFPE with l...
Status: RESOLVED TEST-REQUEST
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Library (show other bugs)
Hardware: All Linux
: Normal normal with 1 vote (vote)
Assignee: Gentoo X packagers
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-14 11:19 UTC by jospezial
Modified: 2015-11-23 06:53 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
full backtrace (xorg_glamor-0.6.0_crashdebug.txt,10.85 KB, text/plain)
2014-02-16 19:04 UTC, jospezial
Details
working patch (gallium_r600_cheight.patch,736 bytes, patch)
2014-02-16 22:01 UTC, jospezial
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description jospezial 2014-02-14 11:19:40 UTC
I can reproduce a crash of X when surfing with Firefox nightly 64bit (30.0a1 (2014-02-13)) to the site

http://www.overclock.net/t/1395490/ati-hd-7950-7970-bios-mod-thread/560

I can't find something useful in the log files but I try to go deeper in it.

This is what I see in /var/log/messages:

Feb 14 10:46:04 jlgentoo polkitd[1215]: Unregistered Authentication Agent for unix-session:/org/free
desktop/ConsoleKit/Session1 (system bus name :1.11, object path /org/gnome/PolicyKit1/Authentication
Agent, locale de_DE.UTF-8) (disconnected from bus)
Feb 14 10:46:04 jlgentoo kdm[1378]: X server for display :0 terminated unexpectedly
Feb 14 10:46:04 jlgentoo kdm: :0[1496]: pam_unix(kde:session): session closed for user joerg

Downgrade dbus to 1.6.18-r1 did not help.
Reproducible from lxde and kde.

jlgentoo ~ # emerge --info xorg-server xf86-video-ati polkit
Portage 2.2.8-r1 (default/linux/amd64/13.0, gcc-4.8.2, glibc-2.18-r1, 3.14.0-rc2 x86_64)
=================================================================
                         System Settings
=================================================================
System uname: Linux-3.14.0-rc2-x86_64-AMD_Athlon-tm-_64_X2_Dual_Core_Processor_4400+-with-gentoo-2.2
KiB Mem:     3598900 total,   1757972 free
KiB Swap:    9369592 total,   9369592 free
Timestamp of tree: Fri, 14 Feb 2014 09:15:01 +0000
ld GNU ld (GNU Binutils) 2.24
ccache version 3.1.9 [enabled]
app-shells/bash:          4.2_p45-r1
dev-java/java-config:     2.2.0
dev-lang/python:          2.7.6, 3.3.3
dev-util/ccache:          3.1.9-r3
dev-util/cmake:           2.8.12.2
dev-util/pkgconfig:       0.28
sys-apps/baselayout:      2.2
sys-apps/openrc:          0.12.4
sys-apps/sandbox:         2.6-r1
sys-devel/autoconf:       2.13, 2.69
sys-devel/automake:       1.10.3, 1.11.6, 1.12.6, 1.14.1
sys-devel/binutils:       2.24-r2
sys-devel/gcc:            4.8.2-r1
sys-devel/gcc-config:     1.8
sys-devel/libtool:        2.4.2
sys-devel/make:           4.0-r1
sys-kernel/linux-headers: 3.13 (virtual/os-headers)
sys-libs/glibc:           2.18-r1
Repositories: gentoo overlay_jl
ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="*"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=native -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CXXFLAGS="-march=native -O2 -pipe"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--autounmask-write=y --keep-going --quiet-build=y"
FCFLAGS="-march=native -O2 -pipe"
FEATURES="assume-digests binpkg-logs ccache config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-march=native -O2 -pipe"
GENTOO_MIRRORS="http://distfiles.gentoo.org"
LANG="de_DE.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://rsync.de.gentoo.org/gentoo-portage"
USE="3dnow 3dnowext 64bit X Xaw3d a52 aac aacplus aacs aalib ace acl acpi activefilter ads aften alsa amd64 ap apm apng archive async audacious audiofile automount avcodec bash-completion bazaar berkdb binary-drivers binfilter blender-game bluray boost bzip2 bzr cairo canusb ccache cdda cddb cdio cdparanoia cdr cdrdao cdrom cgi charconv chm chroot city cjk clang cleartype cli colordiff colors compress consolekit corefonts cpio cracklib crypt css cue cups curl curlwrappers cvs cxx daemon dbus declarative demo device-mapper dga dhcp doom doomsday dos dri dts dv dvb dvd dvdnav eap eap-sim eap-tls ebook egl emerald emoticon enca encode enscript equalizer exif extensions extras faac faad fam farsight farstream fat fax fbcon fdformat ffmpeg fftw firefox flac fluidsynth fontconfig foomatic foomaticdb fortran freedoom ftp fts3 fuse g3dvl gallium gbm gd gdbm gdu geoip gif gimp git glamor glib glut gme gnutls gphoto2 gpm graphite gsm gstreamer gtk gtk3 gudev gui gzip hddtemp hdf hdf5 heretic hexen highlight hwdb iconv icq icu id3 id3tag idn imagemagick introspection ios ipc ipod ipv6 irc java javascript jit jpeg jpeg2k kde keymap ladspa lame laptop lcms ldap lensfun lha libass libcaca libcanberra libkms libnl libnotify libsamplerate libssh2 libv4l libv4l2 libwww live llvm llvm-shared-libs lm_sensors logrotate lua lxde lzma lzo mad madwifi magic man matroska md5sum metalink midi mikmod mime minizip mixer mjpeg mmap mms mmx mmxext mng mobi mod modplug modules mono mouse mozilla mp3 mp4 mpeg mplayer mtp mudflap multilib multislot musepack musicbrainz nano-syntax ncat ncurses ndiff network nfs nfsidmap nfsv3 nfsv4 nfsv41 nls nmap nmap-update nokia normalize nowlistening nping nptl nsplugin nss ntfs ntfsprogs ntp nvidia nvram obex ocr ogg ogm openal opencl opengl openmp openvg optimized-qmake oscar osdmenu osmesa otr p2p pam pango panorama parport parse-clocks pcap pci pcre pdf pdfimport phonon pipes plasma plugins pm-utils pmu png policykit postscript ppds privacy projectm projectx pulseaudio pvr python3 qalculate qt3support qt4 quicktime r600-llvm-compiler radio rar raw rdesktop readline recording redeyes reiser4 reiserfs remote-access remoteosd replaygain resources rpm rtc rtmp rtsp rubberband samba sbsms scanner schroedinger sdl secure-delete semantic-desktop sensord session sftp sha512 shorten shout skins slang smbclient smi sndfile snowberry sockets sound soundtouch speex spell sql sqlite sqlite3 sse sse2 sse3 ssh ssl startup-notification statistics stk stream subtitles subversion svg swat symlink syslog szip taglib tcpd texteffect tftp theora threads thumbnail tiff translator truetype twolame udev udisks unicode upower urlpicpreview usb v4l vaapi vamp vboxwebsrv vcd vcdx vdpau video videos vidmode vim-syntax virtualbox vlm vnc vorbis vpx vroot vst wad wav wavpack webgl webkit webm webpresence wifi winbind winpopup wireshark wmf wps wxwidgets x264 xa xattr xcb xcomposite xfs xine xinerama xinetd xml xmp xorg xosd xpm xrandr xscreensaver xv xvfb xvid xvmc zip zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="de" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_3 python3_3" RUBY_TARGETS="ruby19 ruby20 ruby21" USERLAND="GNU" VIDEO_CARDS="fbdev vesa svga vga radeon v4l modesetting r600" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  CPPFLAGS, CTARGET, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON

=================================================================
                        Package Settings
=================================================================

x11-base/xorg-server-1.15.0 was built with the following:
USE="ipv6 nptl suid udev xorg xvfb -dmx -doc -kdrive -minimal (-selinux) -static-libs -tslib -unwind -xnest"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,lazy"


x11-drivers/xf86-video-ati-7.3.0 was built with the following:
USE="glamor udev"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,lazy"


sys-auth/polkit-0.112-r1 was built with the following:
USE="gtk introspection kde nls pam -examples (-selinux) -systemd"
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2014-02-14 11:48:31 UTC
Please attach the relevant Xorg log to this bug report.
Comment 2 Chí-Thanh Christopher Nguyễn gentoo-dev 2014-02-14 13:00:25 UTC
If the X server crashes (and not e.g. your desktop environment) you will get a stack trace printed to /var/log/Xorg.0.log (which will be renamed to Xorg.0.log.old on next X server start).
Comment 3 jospezial 2014-02-14 15:34:41 UTC
This I found in Xorg.0.log.old :


[   498.806] (II) RADEON(0): Modeline "1280x1024"x0.0  108.00  1280 1328 1440 1688  1024 1025 1028 1066 +hsync +vsync (64.0 kHz e)
[   498.806] (II) RADEON(0): Modeline "1280x960"x0.0  108.00  1280 1376 1488 1800  960 961 964 1000 +hsync +vsync (60.0 kHz e)
[   914.779] (EE) 
[   914.779] (EE) Backtrace:
[   914.788] (EE) 0: /usr/bin/X (xorg_backtrace+0x48) [0x588128]
[   914.788] (EE) 1: /usr/bin/X (0x400000+0x18be99) [0x58be99]
[   914.788] (EE) 2: /lib64/libpthread.so.0 (0x7f59e6f5b000+0x10230) [0x7f59e6f6b230]
[   914.788] (EE) 3: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x35756f) [0x7f59e1c9856f]
[   914.788] (EE) 4: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x358748) [0x7f59e1c99748]
[   914.788] (EE) 5: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x1ad1b5) [0x7f59e1aee1b5]
[   914.788] (EE) 6: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x13fff5) [0x7f59e1a80ff5]
[   914.788] (EE) 7: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x18875e) [0x7f59e1ac975e]
[   914.788] (EE) 8: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x18922b) [0x7f59e1aca22b]
[   914.788] (EE) 9: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x12e694) [0x7f59e1a6f694]
[   914.788] (EE) 10: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x12fb30) [0x7f59e1a70b30]
[   914.788] (EE) 11: /usr/lib64/libglamor.so.0 (0x7f59e4432000+0x1e6a8) [0x7f59e44506a8]
[   914.788] (EE) 12: /usr/lib64/libglamor.so.0 (0x7f59e4432000+0x1ecba) [0x7f59e4450cba]
[   914.788] (EE) 13: /usr/lib64/libglamor.so.0 (0x7f59e4432000+0x1fc2b) [0x7f59e4451c2b]
[   914.788] (EE) 14: /usr/lib64/libglamor.so.0 (0x7f59e4432000+0xdbf8) [0x7f59e443fbf8]
[   914.788] (EE) 15: /usr/lib64/libglamor.so.0 (0x7f59e4432000+0xdcb2) [0x7f59e443fcb2]
[   914.789] (EE) 16: /usr/bin/X (0x400000+0x114b02) [0x514b02]
[   914.789] (EE) 17: /usr/bin/X (0x400000+0x32ca9) [0x432ca9]
[   914.789] (EE) 18: /usr/bin/X (0x400000+0x35fbe) [0x435fbe]
[   914.789] (EE) 19: /usr/bin/X (0x400000+0x39dfa) [0x439dfa]
[   914.789] (EE) 20: /lib64/libc.so.6 (__libc_start_main+0xf5) [0x7f59e5bdca45]
[   914.789] (EE) 21: /usr/bin/X (0x400000+0x24ece) [0x424ece]
[   914.789] (EE) 
[   914.789] (EE) Floating point exception at address 0x7f59e1c9856f
[   914.789] (EE) 
Fatal server error:
[   914.789] (EE) Caught signal 8 (Floating point exception). Server aborting
[   914.789] (EE) 
[   914.790] (EE)
Comment 4 jospezial 2014-02-14 15:46:54 UTC
It does not crash if I disable

Option   "AccelMethod"      "glamor"
and
Load            "glamoregl"

in Xorg.conf

Then EXA is used.
Comment 5 Chí-Thanh Christopher Nguyễn gentoo-dev 2014-02-14 15:49:42 UTC
Yes, this looks like a problem in mesa and/or glamor.

Apart from that, it would be good if you report this bug also upstream at https://bugs.freedesktop.org/ and to get a full stack trace.

Build mesa, xorg-server and glamor with CFLAGS=-g and FEATURES=splitdebug, and follow the instructions at http://www.x.org/wiki/Development/Documentation/ServerDebugging/ to obtain it via gdb.
Comment 6 jospezial 2014-02-14 15:55:56 UTC
(In reply to Chí-Thanh Christopher Nguyễn from comment #5)
> Yes, this looks like a problem in mesa and/or glamor.
> 
> Apart from that, it would be good if you report this bug also upstream at
> https://bugs.freedesktop.org/ and to get a full stack trace.
> 
> Build mesa, xorg-server and glamor with CFLAGS=-g and FEATURES=splitdebug,
> and follow the instructions at
> http://www.x.org/wiki/Development/Documentation/ServerDebugging/ to obtain
> it via gdb.

Ok I will do my best.
Info from now before changing for debug.

=================================================================
                        Package Settings
=================================================================

x11-libs/glamor-0.6.0 was built with the following:
USE="xv -gles -static-libs"


media-libs/mesa-9.2.5 was built with the following:
USE="classic egl gallium gbm llvm llvm-shared-libs nptl opencl openvg osmesa r600-llvm-compiler vdpau xa xorg xvmc -bindist -debug -gles1 -gles2 -pax_kernel -pic (-selinux) -wayland" ABI_X86="64 -32 -x32" VIDEO_CARDS="r600 radeon -freedreno -i915 -i965 -ilo -intel -nouveau -r100 -r200 -r300 -radeonsi -vmware"


x11-base/xorg-server-1.15.0 was built with the following:
USE="ipv6 nptl suid udev xorg xvfb -dmx -doc -kdrive -minimal (-selinux) -static-libs -tslib -unwind -xnest"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,lazy"
Comment 7 jospezial 2014-02-16 19:04:09 UTC
Created attachment 370578 [details]
full backtrace
Comment 8 jospezial 2014-02-16 19:22:23 UTC
(gdb) cont
Continuing.

Program received signal SIGFPE, Arithmetic exception.
0x00007f26dabf1448 in r600_dma_copy_tile (rctx=0xe963c0, dst=0x1f687a0, dst_level=0, dst_x=0, dst_y=0, dst_z=0, 
    src=0x1f69630, src_level=0, src_x=0, src_y=0, src_z=0, copy_height=6, pitch=32768, bpp=4) at r600_state.c:3097
3097    r600_state.c: Datei oder Verzeichnis nicht gefunden.
(gdb) bt f
#0  0x00007f26dabf1448 in r600_dma_copy_tile (rctx=0xe963c0, dst=0x1f687a0, dst_level=0, dst_x=0, dst_y=0, dst_z=0, 
    src=0x1f69630, src_level=0, src_x=0, src_y=0, src_z=0, copy_height=6, pitch=32768, bpp=4) at r600_state.c:3097
        cs = 0xec8ae0
        rsrc = 0x1f69630
        rdst = 0x1f687a0
        array_mode = 2
        lbpp = 2
        pitch_tile_max = 1023
        slice_tile_max = 1023
        size = 32767
        ncopy = 1016458352
        height = 6
        cheight = 0
        detile = 0
        i = 0
        x = 0
        y = 0
        z = 0
        src_mode = 0
        dst_mode = 2
        base = 0
        addr = 0
#1  0x00007f26dabf1acc in r600_dma_blit (ctx=0xe963c0, dst=0x1f687a0, dst_level=0, dst_x=0, dst_y=0, dst_z=0, 
    src=0x1f69630, src_level=0, src_box=0x7fff3c95edb0) at r600_state.c:3192
        rctx = 0xe963c0
        rsrc = 0x1f69630
        rdst = 0x1f687a0
        dst_pitch = 32768
        src_pitch = 32768
        bpp = 4
        dst_mode = 2
        src_mode = 0
---Type <return> to continue, or q <return> to quit---
        copy_height = 6
        src_w = 8192
        dst_w = 8192
        src_x = 0
        src_y = 0
#2  0x00007f26dabf2b30 in r600_copy_from_staging_texture (ctx=0xe963c0, rtransfer=0x1d28f40) at r600_texture.c:110
        rctx = 0xe963c0
        transfer = 0x1d28f40
        dst = 0x1f687a0
        src = 0x1f69630
        sbox = {x = 0, y = 0, z = 0, width = 8192, height = 6, depth = 1}
#3  0x00007f26dabf523e in r600_texture_transfer_unmap (ctx=0xe963c0, transfer=0x1d28f40) at r600_texture.c:977
        rtransfer = 0x1d28f40
        rctx = 0xe963c0
        buf = 0x1eeb8b0
        texture = 0x1f687a0
        rtex = 0x1f687a0
#4  0x00007f26dab16f2c in u_transfer_unmap_vtbl (pipe=0xe963c0, transfer=0x1d28f40) at util/u_transfer.c:138
        ur = 0x1f687a0
#5  0x00007f26da9d5772 in pipe_transfer_unmap (context=0xe963c0, transfer=0x1d28f40)
    at ../../src/gallium/auxiliary/util/u_inlines.h:446
No locals.
#6  0x00007f26da9d5c62 in st_texture_image_unmap (st=0xf31630, stImage=0x1eeb840)
    at ../../src/mesa/state_tracker/st_texture.c:273
        pipe = 0xe963c0
#7  0x00007f26da9adc49 in st_UnmapTextureImage (ctx=0xeee120, texImage=0x1eeb840, slice=0)
    at ../../src/mesa/state_tracker/st_cb_texture.c:226
        st = 0xf31630
        stImage = 0x1eeb840
#8  0x00007f26da93906c in store_texsubimage (ctx=0xeee120, texImage=0x1eeb840, xoffset=0, yoffset=0, zoffset=0, 
    width=8192, height=6, depth=1, format=32993, type=33639, pixels=0x1f2de10, packing=0xefd240, 
    caller=0x7f26dac88f9a "glTexSubImage") at ../../src/mesa/main/texstore.c:4029
---Type <return> to continue, or q <return> to quit---
        dstMap = 0x7f26d63f2000 <error: Cannot access memory at address 0x7f26d63f2000>
        dstRowStride = 32768
        mapMode = 6
        target = 3553
        success = 1 '\001'
        dims = 2
        slice = 0
        numSlices = 1
        sliceOffset = 0
        srcImageStride = 0
        src = 0x1f2de10 "\324\324\324\377"
#9  0x00007f26da939239 in _mesa_store_texsubimage (ctx=0xeee120, dims=2, texImage=0x1eeb840, xoffset=0, yoffset=0, 
    zoffset=0, width=8192, height=6, depth=1, format=32993, type=33639, pixels=0x1f2de10, packing=0xefd240)
    at ../../src/mesa/main/texstore.c:4086
No locals.

This is with glamor-0.6.0.
That bug is discussed there:
https://bugs.freedesktop.org/show_bug.cgi?id=73781
I will test if that patch helps me.:

..........................

diff --git a/src/gallium/drivers/r600/r600_state.c b/src/gallium/drivers/r600/r600_state.c
index a0d527b..8690849 100644
--- a/src/gallium/drivers/r600/r600_state.c
+++ b/src/gallium/drivers/r600/r600_state.c
@@ -3095,7 +3095,8 @@ static boolean r600_dma_copy_tile(struct r600_context *rctx,
 	/* It's a r6xx/r7xx limitation, the blit must be on 8 boundary for number
 	 * line in the blit. Compute max 8 line we can copy in the size limit
 	 */
-	cheight = ((0x0000ffff << 2) / pitch) & 0xfffffff8;
+	cheight = ((0x0000ffff << 2) / pitch) > 0x00000008 ? 
+		((0x0000ffff << 2) / pitch) & 0xfffffff8 : ((0x0000ffff << 2) / pitch);
 	ncopy = (copy_height / cheight) + !!(copy_height % cheight);
 	r600_need_dma_space(rctx, ncopy * 7);
 
.........................

btw, with glamor-9999 I get crashes too on the same crash websites. But different output in full backtrace . another bug?
discussed there:
https://bugs.freedesktop.org/show_bug.cgi?id=74733
Comment 9 jospezial 2014-02-16 22:01:10 UTC
Created attachment 370592 [details, diff]
working patch

The patch applies and I can't reproduce the crash.
Comment 10 Chí-Thanh Christopher Nguyễn gentoo-dev 2014-02-17 09:48:25 UTC
Please also mention in the upstream bug that the patch worked for you.
Comment 11 Chí-Thanh Christopher Nguyễn gentoo-dev 2014-02-17 10:01:31 UTC
Per Michel Daenzer on IRC, it seems that this patch was already rejected upstream: http://lists.freedesktop.org/archives/mesa-dev/2014-February/053091.html
Comment 12 jospezial 2014-02-25 06:21:48 UTC
The patch is still needed in mesa-9.2.5-r1.

I don't see anything about a fix in 

http://cgit.freedesktop.org/mesa/mesa/log/src/gallium/drivers/r600/r600_state.c

or

http://cgit.freedesktop.org/mesa/mesa/log/src/gallium/drivers/r600/r600_state.c?h=9.2
Comment 13 jospezial 2014-04-07 22:50:11 UTC
I can't reproduce the crash with latest git version of ffmpeg 10.x (ffmpeg-9999.ebuild).

I don't wanna go back to ffmpeg 9 .

About 10.0.4 and 10.1 I don't know whether these releases crash now.



btw, today I had to remove 2 lines in
/var/tmp/portage/media-video/ffmpeg-9999/work/ffmpeg-9999/libavcodec/libx265.c

because of api: drop param.vui.bEnableVuiParametersPresentFlag and bEnableAspectRatioIdc

https://bitbucket.org/multicoreware/x265/commits/c1300ae4e7ba8d503f6772bfa0253da9f643658a


my quick change to make ffmpeg compile:

diff /var/tmp/portage/media-video/ffmpeg-9999/work/ffmpeg-9999/libavcodec/libx265.c /sich/libx265.c 
118,119d117
<     ctx->params->vui.bEnableVuiParametersPresentFlag = 1;
<     ctx->params->vui.bEnableAspectRatioIdc           = 1;

I don't think we need an extra bug for this because this will be fixed the next days upstream, I hope.
Comment 14 jospezial 2014-04-07 23:55:27 UTC
Sorry, I mixed up mesa and ffmpeg.
Comment 15 jospezial 2014-04-08 02:28:50 UTC
This mesa bug still crashes X and the patch still helps as reported upstream for media-libs/mesa-10.1.0 .

So forget what I wrote about unrelated ffmpeg in #c13.
Comment 16 Chí-Thanh Christopher Nguyễn gentoo-dev 2014-04-08 14:06:36 UTC
A fix has been committed upstream at 8ad57c288d5ba6478ac9653e43c10545a6bafae1, however it does not apply cleanly to 0.6.0.
Comment 17 jospezial 2014-05-27 19:43:23 UTC
I can't reproduce this bug with mesa-10.1.4 .
Comment 18 noc 2014-12-02 15:05:03 UTC
https://bugs.gentoo.org/show_bug.cgi?id=531414

[  1532.091] (EE) 0: /usr/bin/X0 (xorg_backtrace+0x86) [0x1f4b7c92f56]
[  1532.091] (EE) 1: /usr/bin/X0 (0x1f4b7ab0000+0x1e7990) [0x1f4b7c97990]
[  1532.091] (EE) 2: /lib64/libpthread.so.0 (0x769982b00000+0x11120) [0x769982b11120]
[  1532.091] (EE) 3: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x3dd36e) [0x76997d25836e]
[  1532.091] (EE) 4: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x3df1a7) [0x76997d25a1a7]
[  1532.091] (EE) 5: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x3c05c1) [0x76997d23b5c1]
[  1532.091] (EE) 6: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x18b6b2) [0x76997d0066b2]
[  1532.091] (EE) 7: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x194e30) [0x76997d00fe30]
[  1532.091] (EE) 8: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x1975d4) [0x76997d0125d4]
[  1532.091] (EE) 9: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x11d2d4) [0x76997cf982d4]
[  1532.091] (EE) 10: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x11e87f) [0x76997cf9987f]
[  1532.091] (EE) 11: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x2a659) [0x76997e658659]
[  1532.091] (EE) 12: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x2b02b) [0x76997e65902b]
[  1532.091] (EE) 13: /usr/lib64/libglamor.so.0 (glamor_create_pixmap+0x2e3) [0x76997e632bb3]
[  1532.091] (EE) 14: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x190df) [0x76997e6470df]
[  1532.091] (EE) 15: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x14eb2) [0x76997e642eb2]
[  1532.091] (EE) 16: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x15068) [0x76997e643068]
[  1532.091] (EE) 17: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x163e9) [0x76997e6443e9]
[  1532.091] (EE) 18: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x16a8e) [0x76997e644a8e]
[  1532.091] (EE) 19: /usr/bin/X0 (0x1f4b7ab0000+0x15ce5f) [0x1f4b7c0ce5f]
[  1532.091] (EE) 20: /usr/bin/X0 (0x1f4b7ab0000+0x150927) [0x1f4b7c00927]
[  1532.091] (EE) 21: /usr/bin/X0 (0x1f4b7ab0000+0x55b5e) [0x1f4b7b05b5e]
[  1532.091] (EE) 22: /usr/bin/X0 (0x1f4b7ab0000+0x5a56a) [0x1f4b7b0a56a]
[  1532.091] (EE) 23: /lib64/libc.so.6 (__libc_start_main+0x11b) [0x76998175ee5b]
[  1532.091] (EE) 24: /usr/bin/X0 (0x1f4b7ab0000+0x41d89) [0x1f4b7af1d89]
[  1532.091] (EE) 
[  1532.091] (EE) Segmentation fault at address 0x10
Comment 19 Matt Turner gentoo-dev 2015-11-17 17:52:36 UTC
Please try xorg-server[glamor]-1.18, xf86-video-ati-7.6.1, and mesa-11.0.4.

(https://bugs.gentoo.org/show_bug.cgi?id=531414#c15) says this can be closed)
Comment 20 noc 2015-11-23 06:53:44 UTC
I can't found any ebuild for xorg-server[glamor]-1.18 ...