Summary: | media-libs/mesa crashes x11-drivers/xf86-video-ati[glamor] with SIGFPE with large textures (when firefox loads a specific website) | ||
---|---|---|---|
Product: | Gentoo Linux | Reporter: | jospezial <jospezial> |
Component: | [OLD] Library | Assignee: | Gentoo X packagers <x11> |
Status: | RESOLVED TEST-REQUEST | ||
Severity: | normal | CC: | alexander, linux.gnu |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
See Also: |
https://bugs.freedesktop.org/show_bug.cgi?id=73781 https://bugs.gentoo.org/show_bug.cgi?id=531414 |
||
Whiteboard: | |||
Package list: | Runtime testing required: | --- | |
Attachments: |
full backtrace
working patch |
Description
jospezial
2014-02-14 11:19:40 UTC
Please attach the relevant Xorg log to this bug report. If the X server crashes (and not e.g. your desktop environment) you will get a stack trace printed to /var/log/Xorg.0.log (which will be renamed to Xorg.0.log.old on next X server start). This I found in Xorg.0.log.old : [ 498.806] (II) RADEON(0): Modeline "1280x1024"x0.0 108.00 1280 1328 1440 1688 1024 1025 1028 1066 +hsync +vsync (64.0 kHz e) [ 498.806] (II) RADEON(0): Modeline "1280x960"x0.0 108.00 1280 1376 1488 1800 960 961 964 1000 +hsync +vsync (60.0 kHz e) [ 914.779] (EE) [ 914.779] (EE) Backtrace: [ 914.788] (EE) 0: /usr/bin/X (xorg_backtrace+0x48) [0x588128] [ 914.788] (EE) 1: /usr/bin/X (0x400000+0x18be99) [0x58be99] [ 914.788] (EE) 2: /lib64/libpthread.so.0 (0x7f59e6f5b000+0x10230) [0x7f59e6f6b230] [ 914.788] (EE) 3: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x35756f) [0x7f59e1c9856f] [ 914.788] (EE) 4: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x358748) [0x7f59e1c99748] [ 914.788] (EE) 5: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x1ad1b5) [0x7f59e1aee1b5] [ 914.788] (EE) 6: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x13fff5) [0x7f59e1a80ff5] [ 914.788] (EE) 7: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x18875e) [0x7f59e1ac975e] [ 914.788] (EE) 8: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x18922b) [0x7f59e1aca22b] [ 914.788] (EE) 9: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x12e694) [0x7f59e1a6f694] [ 914.788] (EE) 10: /usr/lib64/dri/r600_dri.so (0x7f59e1941000+0x12fb30) [0x7f59e1a70b30] [ 914.788] (EE) 11: /usr/lib64/libglamor.so.0 (0x7f59e4432000+0x1e6a8) [0x7f59e44506a8] [ 914.788] (EE) 12: /usr/lib64/libglamor.so.0 (0x7f59e4432000+0x1ecba) [0x7f59e4450cba] [ 914.788] (EE) 13: /usr/lib64/libglamor.so.0 (0x7f59e4432000+0x1fc2b) [0x7f59e4451c2b] [ 914.788] (EE) 14: /usr/lib64/libglamor.so.0 (0x7f59e4432000+0xdbf8) [0x7f59e443fbf8] [ 914.788] (EE) 15: /usr/lib64/libglamor.so.0 (0x7f59e4432000+0xdcb2) [0x7f59e443fcb2] [ 914.789] (EE) 16: /usr/bin/X (0x400000+0x114b02) [0x514b02] [ 914.789] (EE) 17: /usr/bin/X (0x400000+0x32ca9) [0x432ca9] [ 914.789] (EE) 18: /usr/bin/X (0x400000+0x35fbe) [0x435fbe] [ 914.789] (EE) 19: /usr/bin/X (0x400000+0x39dfa) [0x439dfa] [ 914.789] (EE) 20: /lib64/libc.so.6 (__libc_start_main+0xf5) [0x7f59e5bdca45] [ 914.789] (EE) 21: /usr/bin/X (0x400000+0x24ece) [0x424ece] [ 914.789] (EE) [ 914.789] (EE) Floating point exception at address 0x7f59e1c9856f [ 914.789] (EE) Fatal server error: [ 914.789] (EE) Caught signal 8 (Floating point exception). Server aborting [ 914.789] (EE) [ 914.790] (EE) It does not crash if I disable Option "AccelMethod" "glamor" and Load "glamoregl" in Xorg.conf Then EXA is used. Yes, this looks like a problem in mesa and/or glamor. Apart from that, it would be good if you report this bug also upstream at https://bugs.freedesktop.org/ and to get a full stack trace. Build mesa, xorg-server and glamor with CFLAGS=-g and FEATURES=splitdebug, and follow the instructions at http://www.x.org/wiki/Development/Documentation/ServerDebugging/ to obtain it via gdb. (In reply to Chí-Thanh Christopher Nguyễn from comment #5) > Yes, this looks like a problem in mesa and/or glamor. > > Apart from that, it would be good if you report this bug also upstream at > https://bugs.freedesktop.org/ and to get a full stack trace. > > Build mesa, xorg-server and glamor with CFLAGS=-g and FEATURES=splitdebug, > and follow the instructions at > http://www.x.org/wiki/Development/Documentation/ServerDebugging/ to obtain > it via gdb. Ok I will do my best. Info from now before changing for debug. ================================================================= Package Settings ================================================================= x11-libs/glamor-0.6.0 was built with the following: USE="xv -gles -static-libs" media-libs/mesa-9.2.5 was built with the following: USE="classic egl gallium gbm llvm llvm-shared-libs nptl opencl openvg osmesa r600-llvm-compiler vdpau xa xorg xvmc -bindist -debug -gles1 -gles2 -pax_kernel -pic (-selinux) -wayland" ABI_X86="64 -32 -x32" VIDEO_CARDS="r600 radeon -freedreno -i915 -i965 -ilo -intel -nouveau -r100 -r200 -r300 -radeonsi -vmware" x11-base/xorg-server-1.15.0 was built with the following: USE="ipv6 nptl suid udev xorg xvfb -dmx -doc -kdrive -minimal (-selinux) -static-libs -tslib -unwind -xnest" LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,lazy" Created attachment 370578 [details]
full backtrace
(gdb) cont Continuing. Program received signal SIGFPE, Arithmetic exception. 0x00007f26dabf1448 in r600_dma_copy_tile (rctx=0xe963c0, dst=0x1f687a0, dst_level=0, dst_x=0, dst_y=0, dst_z=0, src=0x1f69630, src_level=0, src_x=0, src_y=0, src_z=0, copy_height=6, pitch=32768, bpp=4) at r600_state.c:3097 3097 r600_state.c: Datei oder Verzeichnis nicht gefunden. (gdb) bt f #0 0x00007f26dabf1448 in r600_dma_copy_tile (rctx=0xe963c0, dst=0x1f687a0, dst_level=0, dst_x=0, dst_y=0, dst_z=0, src=0x1f69630, src_level=0, src_x=0, src_y=0, src_z=0, copy_height=6, pitch=32768, bpp=4) at r600_state.c:3097 cs = 0xec8ae0 rsrc = 0x1f69630 rdst = 0x1f687a0 array_mode = 2 lbpp = 2 pitch_tile_max = 1023 slice_tile_max = 1023 size = 32767 ncopy = 1016458352 height = 6 cheight = 0 detile = 0 i = 0 x = 0 y = 0 z = 0 src_mode = 0 dst_mode = 2 base = 0 addr = 0 #1 0x00007f26dabf1acc in r600_dma_blit (ctx=0xe963c0, dst=0x1f687a0, dst_level=0, dst_x=0, dst_y=0, dst_z=0, src=0x1f69630, src_level=0, src_box=0x7fff3c95edb0) at r600_state.c:3192 rctx = 0xe963c0 rsrc = 0x1f69630 rdst = 0x1f687a0 dst_pitch = 32768 src_pitch = 32768 bpp = 4 dst_mode = 2 src_mode = 0 ---Type <return> to continue, or q <return> to quit--- copy_height = 6 src_w = 8192 dst_w = 8192 src_x = 0 src_y = 0 #2 0x00007f26dabf2b30 in r600_copy_from_staging_texture (ctx=0xe963c0, rtransfer=0x1d28f40) at r600_texture.c:110 rctx = 0xe963c0 transfer = 0x1d28f40 dst = 0x1f687a0 src = 0x1f69630 sbox = {x = 0, y = 0, z = 0, width = 8192, height = 6, depth = 1} #3 0x00007f26dabf523e in r600_texture_transfer_unmap (ctx=0xe963c0, transfer=0x1d28f40) at r600_texture.c:977 rtransfer = 0x1d28f40 rctx = 0xe963c0 buf = 0x1eeb8b0 texture = 0x1f687a0 rtex = 0x1f687a0 #4 0x00007f26dab16f2c in u_transfer_unmap_vtbl (pipe=0xe963c0, transfer=0x1d28f40) at util/u_transfer.c:138 ur = 0x1f687a0 #5 0x00007f26da9d5772 in pipe_transfer_unmap (context=0xe963c0, transfer=0x1d28f40) at ../../src/gallium/auxiliary/util/u_inlines.h:446 No locals. #6 0x00007f26da9d5c62 in st_texture_image_unmap (st=0xf31630, stImage=0x1eeb840) at ../../src/mesa/state_tracker/st_texture.c:273 pipe = 0xe963c0 #7 0x00007f26da9adc49 in st_UnmapTextureImage (ctx=0xeee120, texImage=0x1eeb840, slice=0) at ../../src/mesa/state_tracker/st_cb_texture.c:226 st = 0xf31630 stImage = 0x1eeb840 #8 0x00007f26da93906c in store_texsubimage (ctx=0xeee120, texImage=0x1eeb840, xoffset=0, yoffset=0, zoffset=0, width=8192, height=6, depth=1, format=32993, type=33639, pixels=0x1f2de10, packing=0xefd240, caller=0x7f26dac88f9a "glTexSubImage") at ../../src/mesa/main/texstore.c:4029 ---Type <return> to continue, or q <return> to quit--- dstMap = 0x7f26d63f2000 <error: Cannot access memory at address 0x7f26d63f2000> dstRowStride = 32768 mapMode = 6 target = 3553 success = 1 '\001' dims = 2 slice = 0 numSlices = 1 sliceOffset = 0 srcImageStride = 0 src = 0x1f2de10 "\324\324\324\377" #9 0x00007f26da939239 in _mesa_store_texsubimage (ctx=0xeee120, dims=2, texImage=0x1eeb840, xoffset=0, yoffset=0, zoffset=0, width=8192, height=6, depth=1, format=32993, type=33639, pixels=0x1f2de10, packing=0xefd240) at ../../src/mesa/main/texstore.c:4086 No locals. This is with glamor-0.6.0. That bug is discussed there: https://bugs.freedesktop.org/show_bug.cgi?id=73781 I will test if that patch helps me.: .......................... diff --git a/src/gallium/drivers/r600/r600_state.c b/src/gallium/drivers/r600/r600_state.c index a0d527b..8690849 100644 --- a/src/gallium/drivers/r600/r600_state.c +++ b/src/gallium/drivers/r600/r600_state.c @@ -3095,7 +3095,8 @@ static boolean r600_dma_copy_tile(struct r600_context *rctx, /* It's a r6xx/r7xx limitation, the blit must be on 8 boundary for number * line in the blit. Compute max 8 line we can copy in the size limit */ - cheight = ((0x0000ffff << 2) / pitch) & 0xfffffff8; + cheight = ((0x0000ffff << 2) / pitch) > 0x00000008 ? + ((0x0000ffff << 2) / pitch) & 0xfffffff8 : ((0x0000ffff << 2) / pitch); ncopy = (copy_height / cheight) + !!(copy_height % cheight); r600_need_dma_space(rctx, ncopy * 7); ......................... btw, with glamor-9999 I get crashes too on the same crash websites. But different output in full backtrace . another bug? discussed there: https://bugs.freedesktop.org/show_bug.cgi?id=74733 Created attachment 370592 [details, diff]
working patch
The patch applies and I can't reproduce the crash.
Please also mention in the upstream bug that the patch worked for you. Per Michel Daenzer on IRC, it seems that this patch was already rejected upstream: http://lists.freedesktop.org/archives/mesa-dev/2014-February/053091.html The patch is still needed in mesa-9.2.5-r1. I don't see anything about a fix in http://cgit.freedesktop.org/mesa/mesa/log/src/gallium/drivers/r600/r600_state.c or http://cgit.freedesktop.org/mesa/mesa/log/src/gallium/drivers/r600/r600_state.c?h=9.2 I can't reproduce the crash with latest git version of ffmpeg 10.x (ffmpeg-9999.ebuild). I don't wanna go back to ffmpeg 9 . About 10.0.4 and 10.1 I don't know whether these releases crash now. btw, today I had to remove 2 lines in /var/tmp/portage/media-video/ffmpeg-9999/work/ffmpeg-9999/libavcodec/libx265.c because of api: drop param.vui.bEnableVuiParametersPresentFlag and bEnableAspectRatioIdc https://bitbucket.org/multicoreware/x265/commits/c1300ae4e7ba8d503f6772bfa0253da9f643658a my quick change to make ffmpeg compile: diff /var/tmp/portage/media-video/ffmpeg-9999/work/ffmpeg-9999/libavcodec/libx265.c /sich/libx265.c 118,119d117 < ctx->params->vui.bEnableVuiParametersPresentFlag = 1; < ctx->params->vui.bEnableAspectRatioIdc = 1; I don't think we need an extra bug for this because this will be fixed the next days upstream, I hope. Sorry, I mixed up mesa and ffmpeg. This mesa bug still crashes X and the patch still helps as reported upstream for media-libs/mesa-10.1.0 . So forget what I wrote about unrelated ffmpeg in #c13. A fix has been committed upstream at 8ad57c288d5ba6478ac9653e43c10545a6bafae1, however it does not apply cleanly to 0.6.0. I can't reproduce this bug with mesa-10.1.4 . https://bugs.gentoo.org/show_bug.cgi?id=531414 [ 1532.091] (EE) 0: /usr/bin/X0 (xorg_backtrace+0x86) [0x1f4b7c92f56] [ 1532.091] (EE) 1: /usr/bin/X0 (0x1f4b7ab0000+0x1e7990) [0x1f4b7c97990] [ 1532.091] (EE) 2: /lib64/libpthread.so.0 (0x769982b00000+0x11120) [0x769982b11120] [ 1532.091] (EE) 3: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x3dd36e) [0x76997d25836e] [ 1532.091] (EE) 4: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x3df1a7) [0x76997d25a1a7] [ 1532.091] (EE) 5: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x3c05c1) [0x76997d23b5c1] [ 1532.091] (EE) 6: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x18b6b2) [0x76997d0066b2] [ 1532.091] (EE) 7: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x194e30) [0x76997d00fe30] [ 1532.091] (EE) 8: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x1975d4) [0x76997d0125d4] [ 1532.091] (EE) 9: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x11d2d4) [0x76997cf982d4] [ 1532.091] (EE) 10: /usr/lib64/dri/radeonsi_dri.so (0x76997ce7b000+0x11e87f) [0x76997cf9987f] [ 1532.091] (EE) 11: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x2a659) [0x76997e658659] [ 1532.091] (EE) 12: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x2b02b) [0x76997e65902b] [ 1532.091] (EE) 13: /usr/lib64/libglamor.so.0 (glamor_create_pixmap+0x2e3) [0x76997e632bb3] [ 1532.091] (EE) 14: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x190df) [0x76997e6470df] [ 1532.091] (EE) 15: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x14eb2) [0x76997e642eb2] [ 1532.091] (EE) 16: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x15068) [0x76997e643068] [ 1532.091] (EE) 17: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x163e9) [0x76997e6443e9] [ 1532.091] (EE) 18: /usr/lib64/libglamor.so.0 (0x76997e62e000+0x16a8e) [0x76997e644a8e] [ 1532.091] (EE) 19: /usr/bin/X0 (0x1f4b7ab0000+0x15ce5f) [0x1f4b7c0ce5f] [ 1532.091] (EE) 20: /usr/bin/X0 (0x1f4b7ab0000+0x150927) [0x1f4b7c00927] [ 1532.091] (EE) 21: /usr/bin/X0 (0x1f4b7ab0000+0x55b5e) [0x1f4b7b05b5e] [ 1532.091] (EE) 22: /usr/bin/X0 (0x1f4b7ab0000+0x5a56a) [0x1f4b7b0a56a] [ 1532.091] (EE) 23: /lib64/libc.so.6 (__libc_start_main+0x11b) [0x76998175ee5b] [ 1532.091] (EE) 24: /usr/bin/X0 (0x1f4b7ab0000+0x41d89) [0x1f4b7af1d89] [ 1532.091] (EE) [ 1532.091] (EE) Segmentation fault at address 0x10 Please try xorg-server[glamor]-1.18, xf86-video-ati-7.6.1, and mesa-11.0.4. (https://bugs.gentoo.org/show_bug.cgi?id=531414#c15) says this can be closed) I can't found any ebuild for xorg-server[glamor]-1.18 ... |