solarwinds crashed with SIGFPE in vbo_exec_vtx_flush()

[Martin Olsson]

Binary package hint: rss-glx

crash

I was running in UXA mode using xorg-edgers as of march 20th and a vanilla 2.6.29-rc8 kernel compiled with ubuntu's kernel config.

ProblemType: Crash
Architecture: amd64
CrashCounter: 1
DistroRelease: Ubuntu 9.04
ExecutablePath: /usr/lib/xscreensaver/solarwinds
Package: rss-glx 0.8.2-1ubuntu3
ProcCmdline: solarwinds -r
ProcEnviron:
 PATH=(custom, no user)
 LANG=en_US.UTF-8
Signal: 8
SourcePackage: rss-glx
StacktraceTop:
 vbo_exec_vtx_flush (exec=0x18a4a40, unmap=0 '\0')
 ?? ()
 ?? ()
 ?? ()
 ?? ()
Title: solarwinds crashed with SIGFPE in vbo_exec_vtx_flush()
Uname: Linux 2.6.29-020629rc8-generic x86_64
UserGroups: adm admin cdrom dialout fuse lpadmin plugdev sambashare

[Apport retracing service (apport)]

StacktraceTop:?? () from /usr/lib/dri/i965_dri.so
wind::update ()
hack_draw ()
mainLoop ()
main ()

[Daniel Hermansson (daniel.h)]

Also happens on ati (radeon-kms ppa)

[Tormod Volden (tormodvolden)]

Can you please try again with Karmic?

[Martin Olsson (mnemo)]

Yes I just repro'd it on karmic. I just had to open the screensaver dialog and then I selected solarwinds and press "Preview". I let the apport crash submit from karmic and I marked that bug (417855) as a duplicate of this one in case the fresh logs contains additional clues.

As of right now, Karmic still has "mesa 7.5-1ubuntu1" though. I wonder if this repros on the 7.6 branch (I don't have time to check this right now though).

[Martin Olsson (mnemo)]

Here is a gdb log showing /usr/lib/xscreensaver/solarwinds being executing succesfully a couple of times in karmic-as-of-aug-23rd and then on the 4th time the program is started, it hits a SIGFPE almost right away. The log includes "bt full" and "info registers".

[Tormod Volden (tormodvolden)]

Thanks. The 7.6 snapshot should get into the archive within the next days, so let's see then.

[Tormod Volden (tormodvolden)]

In fact I can reproduce it on r300 also (M26 card) with 7.6.0~git20090817.7c422387-0ubuntu0sarvatt.
Presets 2, 3 and 4 are crashing here: /usr/lib/xscreensaver/solarwinds --preset 2

[Tormod Volden (tormodvolden)]

It seems that vbo_exec_vtx_flush gets called with exec->vtx.vertex_size=0 and we get a division by zero. Not sure I understand this, but since this happens when linelist[i][1] = -1 in wind::update, I thought it was a bit strange that an empty GL_LINES block is run. This patch seems to avoid the crash at least.

[Tormod Volden (tormodvolden)]

I am pretty sure this just exposes a bug in mesa though.

[Bugzi09-fdo-tormod (bugzi09-fdo-tormod)]

Created an attachment (id=28886)
test case

If for instance,
       glBegin(GL_LINES);
       glEnd();
is repeated (64 times here) mesa will crash with

Program received signal SIGFPE, Arithmetic exception.
0x0109d5a0 in vbo_exec_vtx_flush (exec=0x809fc98, unmap=0 '\0')

because exec->vtx.vertex_size = 0 and we get a division by zero. Not that this is a useful construct, but it happens in some programs and did not crash before. http://www.opengl.org/documentation/specs/man_pages/hardcopy/GL/html/gl/begin.html says "Lines, triangles, quadrilaterals, and polygons that are incompletely specified are not drawn."

The attached test program demonstrates the crash (it is based on the example in http://glprogramming.com/red/chapter01.html :) )

[Brian-paul (brian-paul)]

Fixed with commit b9b04872d526ed7955f647542399e110ace0325c.
This'll be in Mesa 7.5.1 and later.

[Martin Olsson (mnemo)]

Wow.. great work narrowing that down Tormod!

[Tormod Volden (tormodvolden)]

Fixed upstream in http://cgit.freedesktop.org/mesa/mesa/commit/?id=93aa0fd81c44c7a5f29f30e8f730e060597b06ad

[Bugzi09-fdo-tormod (bugzi09-fdo-tormod)]

*** Bug 20850 has been marked as a duplicate of this bug. ***

[Tormod Volden (tormodvolden)]

My patch above was sent to and accepted by the upstream rss-glx author, so we might consider applying it until we have it through an upstream release. When it comes to SRU, the rss-glx workaround is trivial, whereas we might be more cautious about touching the mesa libraries.

[spbrereton (simon-brereton)]

I suppose it makes sense for me to add I'm on a MacBook Pro 2.2 - and running Karmic..

[Bryce Harrington (bryce)]

Confirmed that the fix for the mesa aspect of this bug is already present in Karmic now.

[resolv_25 (elcondor1008-hotmail)]

Problem with this screensaver (actually, the other screensaver from the same package), system gets frozen, and brute force restart is the only way out.
This is on Natty Ubuntu - 32-bit.
Version of rss-glx is 0.9.1-3ubuntu1