Compiz crash in compiz::opengl::bindTexImageGLX

[Jussi Pakkanen]

This bug is not a duplicate of bug 1060327. It claims to have been fixed in newest version of Compiz but this happens to me even in the fixed version. The symptoms are also slightly different.

Compiz crashes reliably and quite fast whenever I open more than 4 windows. It also crashes with fewer windows but less often. Here's the backtrace:

Program received signal SIGSEGV, Segmentation fault.
_wordcopy_fwd_aligned (dstp=215107264, srcp=140338144575488, len=831)
    at wordcopy.c:70
70 wordcopy.c: No such file or directory.
(gdb) bt
#0 _wordcopy_fwd_aligned (dstp=215107264, srcp=140338144575488, len=831)
    at wordcopy.c:70
#1 0x00007fbfd33347c5 in __memmove_sse2 (dest=<optimized out>,
    src=<optimized out>, len=6648) at ../string/memmove.c:75
#2 0x00007fbfc5c8c774 in ?? ()
   from /usr/lib/nvidia-current/libnvidia-glcore.so.304.43
#3 0x00007fbfc5b88aac in ?? ()
   from /usr/lib/nvidia-current/libnvidia-glcore.so.304.43
#4 0x00007fbfc5962b71 in ?? ()
   from /usr/lib/nvidia-current/libnvidia-glcore.so.304.43
#5 0x00007fbfc5c3ce21 in ?? ()
   from /usr/lib/nvidia-current/libnvidia-glcore.so.304.43
#6 0x00007fbfc5a3d7fb in ?? ()
   from /usr/lib/nvidia-current/libnvidia-glcore.so.304.43
#7 0x00007fbfc5b8ffad in ?? ()
   from /usr/lib/nvidia-current/libnvidia-glcore.so.304.43
#8 0x00007fbfc6f08a15 in glXBindTexImageEXT ()
   from /usr/lib/nvidia-current/libGL.so.1
#9 0x00007fbfc71eca6a in compiz::opengl::bindTexImageGLX(ServerGrabInterface*, unsigned long, unsigned long, boost::function<bool (unsigned long)> const&, boost::function<void (unsigned long)> const&, boost::function<void ()> const&, compiz::opengl::_PixmapSource) () from /usr/lib/compiz/libopengl.so
#10 0x00007fbfc71e6c39 in TfpTexture::bindTexImage(unsigned long const&) ()
   from /usr/lib/compiz/libopengl.so
#11 0x00007fbfc71e7e91 in TfpTexture::bindPixmapToTexture(unsigned long, int, int, int, compiz::opengl::_PixmapSource) () from /usr/lib/compiz/libopengl.so
#12 0x00007fbfc71e1879 in boost::detail::function::function_invoker5<GLTexture::List (*)(unsigned long, int, int, int, compiz::opengl::_PixmapSource), GLTexture::List, unsigned long, int, int, int, compiz::opengl::_PixmapSource>::invoke(boost::detail::function::function_buffer&, unsigned long, int, int, int, compiz::opengl::_PixmapSource) () from /usr/lib/compiz/libopengl.so
#13 0x00007fbfc71e7982 in GLTexture::bindPixmapToTexture(unsigned long, int, int, int, compiz::opengl::_PixmapSource) () from /usr/lib/compiz/libopengl.so
#14 0x00007fbfc71d1221 in GLWindow::bind() () from /usr/lib/compiz/libopengl.so
#15 0x00007fbfc71d65ba in GLWindow::glDraw(GLMatrix const&, GLWindowPaintAttrib const&, CompRegion const&, unsigned int) () from /usr/lib/compiz/libopengl.so
#16 0x00007fbfc449b829 in DecorWindow::glDraw(GLMatrix const&, GLWindowPaintAttrib const&, CompRegion const&, unsigned int) () from /usr/lib/compiz/libdecor.so
#17 0x00007fbfc71d6557 in GLWindow::glDraw(GLMatrix const&, GLWindowPaintAttrib const&, CompRegion const&, unsigned int) () from /usr/lib/compiz/libopengl.so
#18 0x00007fbfb67f0d1e in UnityMTGrabHandlesWindow::glDraw(GLMatrix const&, GLWindowPaintAttrib const&, CompRegion const&, unsigned int) ()
   from /usr/lib/compiz/libunitymtgrabhandles.so
#19 0x00007fbfc71d6557 in GLWindow::glDraw(GLMatrix const&, GLWindowPaintAttrib const&, CompRegion const&, unsigned int) () from /usr/lib/compiz/libopengl.so
#20 0x00007fbfb45d71af in unity::UnityWindow::glDraw(GLMatrix const&, GLWindowPa---Type <return> to continue, or q <return> to quit---
intAttrib const&, CompRegion const&, unsigned int) ()
   from /usr/lib/compiz/libunityshell.so
#21 0x00007fbfc71d6557 in GLWindow::glDraw(GLMatrix const&, GLWindowPaintAttrib const&, CompRegion const&, unsigned int) () from /usr/lib/compiz/libopengl.so
#22 0x00007fbfb8972a29 in WallWindow::glPaint(GLWindowPaintAttrib const&, GLMatrix const&, CompRegion const&, unsigned int) () from /usr/lib/compiz/libwall.so
#23 0x00007fbfc71d673d in GLWindow::glPaint(GLWindowPaintAttrib const&, GLMatrix const&, CompRegion const&, unsigned int) () from /usr/lib/compiz/libopengl.so
#24 0x00007fbfb45c50c2 in unity::UnityWindow::glPaint(GLWindowPaintAttrib const&, GLMatrix const&, CompRegion const&, unsigned int) ()
   from /usr/lib/compiz/libunityshell.so
#25 0x00007fbfc71d673d in GLWindow::glPaint(GLWindowPaintAttrib const&, GLMatrix const&, CompRegion const&, unsigned int) () from /usr/lib/compiz/libopengl.so
#26 0x00007fbfc71d6aa3 in PrivateGLScreen::paintOutputRegion(GLMatrix const&, CompRegion const&, CompOutput*, unsigned int) ()
   from /usr/lib/compiz/libopengl.so
#27 0x00007fbfc71d7350 in GLScreen::glPaintOutput(GLScreenPaintAttrib const&, GLMatrix const&, CompRegion const&, CompOutput*, unsigned int) ()
   from /usr/lib/compiz/libopengl.so
#28 0x00007fbfb896d19f in WallScreen::glPaintOutput(GLScreenPaintAttrib const&, GLMatrix const&, CompRegion const&, CompOutput*, unsigned int) ()
   from /usr/lib/compiz/libwall.so
#29 0x00007fbfc71d727e in GLScreen::glPaintOutput(GLScreenPaintAttrib const&, GL---Type <return> to continue, or q <return> to quit---
Matrix const&, CompRegion const&, CompOutput*, unsigned int) ()
   from /usr/lib/compiz/libopengl.so
#30 0x00007fbfb45d72a3 in unity::UnityScreen::glPaintOutput(GLScreenPaintAttrib const&, GLMatrix const&, CompRegion const&, CompOutput*, unsigned int) ()
   from /usr/lib/compiz/libunityshell.so
#31 0x00007fbfc71d727e in GLScreen::glPaintOutput(GLScreenPaintAttrib const&, GLMatrix const&, CompRegion const&, CompOutput*, unsigned int) ()
   from /usr/lib/compiz/libopengl.so
#32 0x00007fbfc71dd93b in PrivateGLScreen::paintOutputs(std::list<CompOutput*, std::allocator<CompOutput*> >&, unsigned int, CompRegion const&) ()
   from /usr/lib/compiz/libopengl.so
#33 0x00007fbfcc0baff5 in CompositeScreen::paint(std::list<CompOutput*, std::allocator<CompOutput*> >&, unsigned int) () from /usr/lib/compiz/libcomposite.so
#34 0x00007fbfcc0bc8e8 in CompositeScreen::handlePaintTimeout() ()
   from /usr/lib/compiz/libcomposite.so
#35 0x00007fbfd3c0729c in CompTimer::triggerCallback() ()
   from /usr/lib/libcompiz_core.so.ABI-20121130
#36 0x00007fbfd3c0733f in CompTimeoutSource::callback() ()
   from /usr/lib/libcompiz_core.so.ABI-20121130
#37 0x00007fbfd3c0682d in CompTimeoutSource::dispatch(sigc::slot_base*) ()
   from /usr/lib/libcompiz_core.so.ABI-20121130
#38 0x00007fbfd20ecebf in Glib::Source::dispatch_vfunc(_GSource*, int (*)(void*), void*) () from /usr/lib/x86_64-linux-gnu/libglibmm-2.4.so.1
---Type <return> to continue, or q <return> to quit---
#39 0x00007fbfd1bf1a95 in g_main_context_dispatch ()
   from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#40 0x00007fbfd1bf1dc8 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#41 0x00007fbfd1bf21c2 in g_main_loop_run ()
   from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#42 0x00000000004023cb in main ()

[Sam Spilsbury (smspillaz)]

This feels like a driver misbehaviour to me:

#13 0x00007fbfc71e7982 in GLTexture::bindPixmapToTexture(unsigned long, int, int, int, compiz::opengl::_PixmapSource) () from /usr/lib/compiz/libopengl.so
#14 0x00007fbfc71d1221 in GLWindow::bind() () from /usr/lib/compiz/libopengl.so
#15 0x00007fbfc71d65ba in GLWindow::glDraw(GLMatrix const&, GLWindowPaintAttrib const&, CompRegion const&, unsigned int) () from /usr/lib/compiz/libopengl.so

We never free the window pixmap while a texture is still bound to it. I checked pixmapbinding.cpp and for window pixmaps, we are always guaranteed to have a new valid pixmap for the window before we call GLTexture::List::clear and later call glXBindTexImageEXT on that pixmap.

The only thing I can think of is that the loose binding behaviour in the driver has changed to immediately release pixmap contents upon window destruction for redirected windows whose pixmaps were obtained with XCompositeNameWindowPixmap. I don't think that behaviour would be very smart though, for a number of reasons, so I'll double check with Pierre the next time I get a chance to talk to him.

This is definitely not dupe of bug 1060327 though. The problem there is the potential race condition involving externally managed pixmaps being freed, and then that same handle being used to bind an invalid color buffer to a texture later.

This bug is also about an invalid pixmap being bound to a texture, but in this instance we definitely have a valid reference to the texture, which is why I think the fact that the bind operation fails indicates that something else is causing that reference to be invalid when it shouldn't be.

[Daniel van Vugt (vanvugt)]

Sorry but humour me... Where is the evidence that Jussi has the fix for bug 1060327 already? He needs compiz r3511 or later. So that would be a daily build of 0.9.9 from about 7 December or later. But no earlier.

[Jussi Pakkanen (jpakkane)]

Bug 1060327 says the following:

This bug was fixed in the package compiz - 1:0.9.9~daily12.12.05-0ubuntu2

Which is what I have according to aptitude:

Version: 1:0.9.9~daily12.12.05-0ubuntu2

[Sam Spilsbury (smspillaz)]

I already said this is not a duplicate of bug 106327 . If one cared to read the stacktrace, one would quickly realize that.

As I mentioned, it is likely this is undocumented behaviour in the driver. I am contacting NVIDIA to find out more.

[Jussi Pakkanen (jpakkane)]

Apport-collect refuses to add data to this bug, but you can get this machine's information in bug 974307.