Bug 14884 – winex 20021123 segfaults with opengl app

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Arkadi Shishlov 2003-01-31 18:33:21 UTC]

Winex 20021123 is crashing at startup when asked to run OpenGL application with
ATI binary drivers. If application doesn't use OpenGL it works. Actually I have
only small command line tools to verify the theory, other applications are games
and all of them use OpenGL or Direct3D.
I've build winex with debug information using
DEBUGBUILD=true FEATURES="sandbox noclean noauto" emerge winex
to debug the problem. Unfortunatelly build process use -O2 flag which complicate
debuging, but here is some information I was able to extract.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 21387)]
0x400568b3 in RtlTryEnterCriticalSection (crit=0x40340770) at critsection.c:269
269             ret = TRUE;
(gdb) bt
#0  0x400568b3 in RtlTryEnterCriticalSection (crit=0x40340770) at critsection.c:269
#1  0x403292c0 in __libc_tsd_MALLOC_data () from /lib/libc.so.6
#2  0x400b8d32 in __pthread_mutex_trylock (mutex=0x40340770) at pthread.c:252
#3  0x402732f9 in calloc () from /lib/libc.so.6

Actually it is crashing at eip = 0x400568b3:

Dump of assembler code for function RtlTryEnterCriticalSection:
0x40056870 <RtlTryEnterCriticalSection>:        push   %ebp
0x40056871 <RtlTryEnterCriticalSection+1>:      xor    %ecx,%ecx
0x40056873 <RtlTryEnterCriticalSection+3>:      mov    %esp,%ebp
0x40056875 <RtlTryEnterCriticalSection+5>:      push   %esi
0x40056876 <RtlTryEnterCriticalSection+6>:      mov    0x8(%ebp),%esi
0x40056879 <RtlTryEnterCriticalSection+9>:      mov    $0xffffffff,%eax
0x4005687e <RtlTryEnterCriticalSection+14>:     lea    0x4(%esi),%edx
0x40056881 <RtlTryEnterCriticalSection+17>:     lock cmpxchg %ecx,(%edx)
0x40056885 <RtlTryEnterCriticalSection+21>:     inc    %eax
0x40056886 <RtlTryEnterCriticalSection+22>:     je     0x400568b3
<RtlTryEnterCriticalSection+67>
0x40056888 <RtlTryEnterCriticalSection+24>:     mov    %fs:0x24,%eax
0x4005688e <RtlTryEnterCriticalSection+30>:     cmp    %eax,0xc(%esi)
0x40056891 <RtlTryEnterCriticalSection+33>:     je     0x400568a0
<RtlTryEnterCriticalSection+48>
0x40056893 <RtlTryEnterCriticalSection+35>:     pop    %esi
0x40056894 <RtlTryEnterCriticalSection+36>:     mov    %ecx,%eax
0x40056896 <RtlTryEnterCriticalSection+38>:     pop    %ebp
0x40056897 <RtlTryEnterCriticalSection+39>:     ret    $0x4
0x4005689a <RtlTryEnterCriticalSection+42>:     lea    0x0(%esi),%esi
0x400568a0 <RtlTryEnterCriticalSection+48>:     mov    $0x1,%eax
0x400568a5 <RtlTryEnterCriticalSection+53>:     lock xadd %eax,(%edx)
0x400568a9 <RtlTryEnterCriticalSection+57>:     incl   0x8(%esi)
0x400568ac <RtlTryEnterCriticalSection+60>:     mov    $0x1,%ecx
0x400568b1 <RtlTryEnterCriticalSection+65>:     jmp    0x40056893
<RtlTryEnterCriticalSection+35>
0x400568b3 <RtlTryEnterCriticalSection+67>:     mov    %fs:0x24,%eax
0x400568b9 <RtlTryEnterCriticalSection+73>:     mov    %eax,0xc(%esi)
0x400568bc <RtlTryEnterCriticalSection+76>:     movl   $0x1,0x8(%esi)
0x400568c3 <RtlTryEnterCriticalSection+83>:     jmp    0x400568ac
<RtlTryEnterCriticalSection+60>

(gdb) info registers 
eax            0x0      0
ecx            0x0      0
edx            0x40340774       1077151604
ebx            0x400d6214       1074618900
esp            0x40892b04       0x40892b04
ebp            0x40892b08       0x40892b08
esi            0x40340770       1077151600
edi            0x403292c0       1077056192
eip            0x400568b3       0x400568b3
eflags         0x10256  66134
cs             0x23     35
ss             0x2b     43
ds             0x2b     43
es             0x2b     43
fs             0xffff   65535
gs             0x7      7
fctrl          0x27f    639
fstat          0x20     32
ftag           0xffff   65535
fiseg          0x23     35
fioff          0x4118243f       1092101183
foseg          0x2b     43
fooff          0x408a2bfc       1082797052
fop            0x35d    861
mxcsr          0x1f80   8064
orig_eax       0xffffffff       -1

Looking at the source wine/dlls/ntdll/critsection.c RtlTryEnterCriticalSection()
it seems that wine is crashing at GetCurrentThreadId() which use gs register.
Further debuging is beyond my capabilities.
Same wine (optimized) build worked with NVIDIA drivers (31.28( w/o problems.
Kernels are gentoo-sources 2.4.19-r10,.20-r1 and vanilla-sources-2.4.20. All
kernels exhibit same behavior. Probably we can raise this issue to ATI if it is
obviously that theirs driver clobber the fs register? A small test to determine
if 0xffff is a common value for fs with non-OpenGL programs shows that 0x2007 is
assigned to fs.
BTW, can we make Bugzilla Details box slightly larger?

Reproducible: Always
Steps to Reproduce:
1. emerge winex ati-drivers
2. winex any-opengl-app.exe




Computer is P3 600MHz, i440BX, 512MB, Sapphire Radeon8500LE 128MB AGP.

[Comment 1 SpanKY 2003-01-31 18:38:32 UTC]

actually this started happening to me with my opengl on nvidia too ... it *used* to work 
but now it just segfautls :/ 
 
as for the bugzilla bug, file a new bug to make that happen 

[Comment 2 Arkadi Shishlov 2003-01-31 18:48:44 UTC]

Tomorrow I'll put NVIDIA in my box to check, but thinking logically, wine depends on:
kernel
glibc
libgcc
xfree86
I'm sure the only thing changed since opengl started to segfault is gcc.

[Comment 3 Arkadi Shishlov 2003-02-01 07:43:52 UTC]

I put my GeForce2 MX400 card back - no segfaults. Drivers are both 3123 and 4149, 16 and 24bpp. The only problem is with GLinfo.exe (delphi3d.net), it cannot initialize OpenGL with 4149. Games runs without problems.

[Comment 4 SpanKY 2003-02-01 11:32:26 UTC]

can you cite a really small opengl app that causes your ati to crash ? ill test the app 
over on my side too ... 
 
the prob is i really only use 1 or 2 opengl games ;) 

[Comment 5 Arkadi Shishlov 2003-02-01 11:41:47 UTC]

Try is one - http://www.delphi3d.net/hardware/glinfo2.zip (350kb).

[Comment 6 SpanKY 2003-02-01 17:21:47 UTC]

what CFLAGS did you use to compile glibc ? 
`cat /var/db/pkg/sys-libs/glibc-2.3.1-r3/CFLAGS` 

[Comment 7 Arkadi Shishlov 2003-02-01 17:45:13 UTC]

Mine is -r2:
-march=pentium3 -mcpu=pentium3  -pipe -O2

[Comment 8 SpanKY 2003-02-02 01:41:46 UTC]

ok, this is from Bug 14069 ... 
what happens when you run this test app ? 
 
#include <stdio.h> 
#include <math.h> 
int main(int argc, char *argv[]) { 
        double x = 17.12385, ix, rx; 
        rx = modf(x,&ix); 
        printf("modf(%lf): ix=%lf, rx=%lf\n",x,ix,rx); 
        return 0; 
} 
 
do you get this output: modf(17.123850): ix=17.000000, rx=0.123850 
 
or do you get this: modf(17.123850): ix=-0.000000, rx=17.123850 
 
if you get the 2nd one ... :) 
 
oh and i somehow fixed my segfaults cause games work again ;x 

[Comment 9 Arkadi Shishlov 2003-02-02 06:13:43 UTC]

The result is correct for me: modf(17.123850): ix=17.000000, rx=0.123850 with any CFLAGS.
Regarding your segfaults - nVidia drivers sometimes segfaults after heavy use for
a long time, sometimes kernel module doesn't free kernel memory allocated to
OpenGL and 512MB machine starts to swap for no reason..

[Comment 10 Arkadi Shishlov 2003-02-04 11:46:54 UTC]

Winex team know about the problem, sorry for the noise http://www.transgaming.com/showthread.php?news=55

[Comment 11 SpanKY 2003-02-04 19:08:15 UTC]

ok, so its just an ATI problem ... 
 
guess this is just something we'll let chill till its taken care of upstream 

[Comment 12 John Davis (zhen) (RETIRED) 2003-04-04 01:22:52 UTC]

db fix

[Comment 13 John Davis (zhen) (RETIRED) 2003-04-04 01:27:44 UTC]

db fix