[G45] xserver and/or python2.6 crashed with SIGSEGV

[Martin Olsson]

Binary package hint: python2.6

i was working on a python program that uses the pigment library (same one as elisa uses). I added a line that loaded another picture using gdk pixbuf (my program already loads several other images into pixbufs but after I added this one it crashes). the stack contains python stuff, pigment stuff, opengl stuff and intel driver stuff (this machine has an integrated intel G45 chipset).

I was able to reduce my program down to a minimal testcase. Steps to repro the bug:
1. run intel G45 (probably worsk on GM45 and other intel chipsets as well)
2. run "python main.py"

If you're in UXA mode you will get a SEGV in python2.6
if you're in EXA mode you will get an xserver SEGV

ProblemType: Crash
Architecture: amd64
Dependencies:
 libgcc1 1:4.3.3-5ubuntu4
 zlib1g 1:1.2.3.3.dfsg-12ubuntu2
 gcc-4.3-base 4.3.3-5ubuntu4
 findutils 4.4.0-2ubuntu3
 libc6 2.9-4ubuntu5
DistroRelease: Ubuntu 9.04
ExecutablePath: /usr/bin/python2.6
Package: python2.6-minimal 2.6.1-1ubuntu10
ProcCmdline: python main.py
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: python2.6
StacktraceTop:
 *__GI___libc_free (mem=0x401) at malloc.c:3599
 intel_miptree_set_level_info ()
 i945_miptree_layout_2d ()
 brw_miptree_layout () from /usr/lib/dri/i965_dri.so
 ?? () from /usr/lib/dri/i965_dri.so
Title: python2.6 crashed with SIGSEGV in *__GI___libc_free()
Uname: Linux 2.6.28-11-generic x86_64
UserGroups: adm admin cdrom dialout fuse lpadmin plugdev sambashare

[Martin Olsson (mnemo)]

Here is the testcase:
http://temp.minimum.se/pigment-python_testcase.tgz

[Martin Olsson (mnemo)]

There is lots of useful info regarding this bug available in the downstream bug report:
https://bugs.launchpad.net/ubuntu/+bug/355137

[Martin Olsson (mnemo)]

Created an attachment (id=24547)
dmesg (UXA_kernel2.6.29_libdrm2.4.6git20090403_ubuntumesa7.4_intelDDX2.6.99.1git20090402)

[Martin Olsson (mnemo)]

Created an attachment (id=24548)
gpu regs (UXA_kernel2.6.29_libdrm2.4.6git20090403_ubuntumesa7.4_intelDDX2.6.99.1git20090402)

[Martin Olsson (mnemo)]

Created an attachment (id=24549)
gem_objects (UXA_kernel2.6.29_libdrm2.4.6git20090403_ubuntumesa7.4_intelDDX2.6.99.1git20090402)

[Martin Olsson (mnemo)]

Created an attachment (id=24550)
gem_interrupts (UXA_kernel2.6.29_libdrm2.4.6git20090403_ubuntumesa7.4_intelDDX2.6.99.1git20090402)

[Martin Olsson (mnemo)]

Created an attachment (id=24551)
exact package versions (UXA_kernel2.6.29_libdrm2.4.6git20090403_ubuntumesa7.4_intelDDX2.6.99.1git20090402)

[Martin Olsson (mnemo)]

Created an attachment (id=24552)
xorg conf (UXA_kernel2.6.29_libdrm2.4.6git20090403_ubuntumesa7.4_intelDDX2.6.99.1git20090402)

[Martin Olsson (mnemo)]

Created an attachment (id=24553)
xorg.log.old (UXA_kernel2.6.29_libdrm2.4.6git20090403_ubuntumesa7.4_intelDDX2.6.99.1git20090402)

[Martin Olsson (mnemo)]

Created an attachment (id=24554)
xorg.log (UXA_kernel2.6.29_libdrm2.4.6git20090403_ubuntumesa7.4_intelDDX2.6.99.1git20090402)

[Martin Olsson (mnemo)]

Created an attachment (id=24555)
xsession-errors (UXA_kernel2.6.29_libdrm2.4.6git20090403_ubuntumesa7.4_intelDDX2.6.99.1git20090402)

[Martin Olsson (mnemo)]

Here is the stacktrace I'm seeing inside python2.6 when running the testcase in UXA with the above config i.e. kernel2.6.29_libdrm2.4.6git20090403_ubuntumesa7.4_intelDDX2.6.99.1git20090402

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f47f5a50950 (LWP 7855)]
*__GI___libc_free (mem=0x13d51) at malloc.c:3599
3599 malloc.c: No such file or directory.
 in malloc.c
(gdb) bt
#0 *__GI___libc_free (mem=0x13d51) at malloc.c:3599
#1 0x00007f47f4df449d in intel_miptree_set_level_info () from /usr/lib/dri/i965_dri.so
#2 0x00007f47f4e0df5c in i945_miptree_layout_2d () from /usr/lib/dri/i965_dri.so
#3 0x00007f47f4e22a0d in brw_miptree_layout () from /usr/lib/dri/i965_dri.so
#4 0x00007f47f4df46e2 in ?? () from /usr/lib/dri/i965_dri.so
#5 0x00007f47f4df4810 in intel_miptree_create () from /usr/lib/dri/i965_dri.so
#6 0x00007f47f4e0d8e5 in ?? () from /usr/lib/dri/i965_dri.so
#7 0x00007f47f4e0dd3d in intelTexImage2D () from /usr/lib/dri/i965_dri.so
#8 0x00007f47f4ea8e4a in _mesa_TexImage2D () from /usr/lib/dri/i965_dri.so
#9 0x00007f47f62f974e in do_rgb_create (texture=0x2726130) at pgmtexture.c:141
#10 0x00007f47f62fa7bd in flush_task_queue (context=0x27b8000, queue=<value optimized out>) at pgmcontext.c:1083
#11 0x00007f47f62fca98 in immediate_io_cb (source=<value optimized out>, condition=<value optimized out>, data=0x27b8000) at pgmcontext.c:1104
#12 0x00007f48024880ca in IA__g_main_context_dispatch (context=0x2318800) at /build/buildd/glib2.0-2.20.0/glib/gmain.c:1814
#13 0x00007f480248b7a0 in g_main_context_iterate (context=0x2318800, block=1, dispatch=1, self=<value optimized out>)
    at /build/buildd/glib2.0-2.20.0/glib/gmain.c:2448
#14 0x00007f480248bc6d in IA__g_main_loop_run (loop=0x27b6fe0) at /build/buildd/glib2.0-2.20.0/glib/gmain.c:2656
#15 0x00007f47f62fc32c in render_loop (data=<value optimized out>) at pgmcontext.c:1421
#16 0x00007f48024b1954 in g_thread_create_proxy (data=0x2318ac0) at /build/buildd/glib2.0-2.20.0/glib/gthread.c:635
#17 0x00007f4804a363ba in start_thread (arg=<value optimized out>) at pthread_create.c:297
#18 0x00007f4803efefcd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#19 0x0000000000000000 in ?? ()

[Martin Olsson (mnemo)]

Created an attachment (id=24556)
xserver "bt full" for the SEGV that's triggered in EXA

I will now attach similar logs recorded with the exact same package versions but in EXA (in this case the xserver hits a SEGV). First off, here is the backtrace from the xserver:

Program received signal SIGSEGV, Segmentation fault.
*__GI___libc_free (mem=0x21) at malloc.c:3599
3599 malloc.c: No such file or directory.
 in malloc.c
#0 *__GI___libc_free (mem=0x21) at malloc.c:3599
#1 0x00007fa79270449d in intel_miptree_set_level_info () from /usr/lib/dri/i965_dri.so
#2 0x00007fa79271df5c in i945_miptree_layout_2d () from /usr/lib/dri/i965_dri.so
#3 0x00007fa792732a0d in brw_miptree_layout () from /usr/lib/dri/i965_dri.so
#4 0x00007fa7927046e2 in ?? () from /usr/lib/dri/i965_dri.so
#5 0x00007fa792704810 in intel_miptree_create () from /usr/lib/dri/i965_dri.so
#6 0x00007fa79271d8e5 in ?? () from /usr/lib/dri/i965_dri.so
#7 0x00007fa79271dd3d in intelTexImage2D () from /usr/lib/dri/i965_dri.so
#8 0x00007fa7927b8e4a in _mesa_TexImage2D () from /usr/lib/dri/i965_dri.so
#9 0x00007fa7a416c07a in __glXDisp_TexImage2D (pc=0x7fa78b83c018 "") at ../../glx/indirect_dispatch.c:1153
#10 0x00007fa7a418efbd in __glXDisp_RenderLarge (cl=0x681ffa0, pc=0x736a8f0 "") at ../../glx/glxcmds.c:1984
#11 0x00007fa7a4192de2 in __glXDispatch (client=0x6938c40) at ../../glx/glxext.c:523
#12 0x000000000044e304 in Dispatch () at ../../dix/dispatch.c:437
#13 0x0000000000433d8d in main (argc=10, argv=0x7fffaf948b08, envp=<value optimized out>) at ../../dix/main.c:397

[Martin Olsson (mnemo)]

Created an attachment (id=24557)
dmesg (EXA)

[Martin Olsson (mnemo)]

Created an attachment (id=24558)
gpu regs (EXA)

[Martin Olsson (mnemo)]

Created an attachment (id=24559)
gem_objects (EXA)

[Martin Olsson (mnemo)]

Created an attachment (id=24560)
gem_interrupts (EXA)

[Martin Olsson (mnemo)]

Created an attachment (id=24561)
xorg conf (EXA)

[Martin Olsson (mnemo)]

Created an attachment (id=24562)
xorg.log.old (EXA)

[Martin Olsson (mnemo)]

Created an attachment (id=24563)
xorg.log (EXA)

[Martin Olsson (mnemo)]

Created an attachment (id=24564)
xsession-errors (EXA)

[Martin Olsson (mnemo)]

The most interesting part in all the EXA logs (imo), is the following line from the bottom of xorg.log:

(EE) DoSwapInterval: cx = 0x6905be0, GLX screen = 0x39ff080

[Martin Olsson (mnemo)]

Binary package hint: python2.6

i was working on a python+gtk program... I added a line that loaded a picture using gdk pixbuf (my program already loads several other images into pixbufs but after I added this one it crashes).

ProblemType: Crash
Architecture: amd64
Dependencies:
 libgcc1 1:4.3.3-5ubuntu4
 zlib1g 1:1.2.3.3.dfsg-12ubuntu2
 gcc-4.3-base 4.3.3-5ubuntu4
 findutils 4.4.0-2ubuntu3
 libc6 2.9-4ubuntu5
DistroRelease: Ubuntu 9.04
ExecutablePath: /usr/bin/python2.6
Package: python2.6-minimal 2.6.1-1ubuntu10
ProcCmdline: python main.py
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: python2.6
StacktraceTop:
 *__GI___libc_free (mem=0x401) at malloc.c:3599
 intel_miptree_set_level_info ()
 i945_miptree_layout_2d ()
 brw_miptree_layout () from /usr/lib/dri/i965_dri.so
 ?? () from /usr/lib/dri/i965_dri.so
Title: python2.6 crashed with SIGSEGV in *__GI___libc_free()
Uname: Linux 2.6.28-11-generic x86_64
UserGroups: adm admin cdrom dialout fuse lpadmin plugdev sambashare

[Martin Olsson (mnemo)]

The most interesting thing inside the dmesg+xorglog etc files I'm attaching is the following line (seen at the end of the xorg.log):

(EE) DoSwapInterval: cx = 0x4bafc90, GLX screen = 0x37b7bc0

[Martin Olsson (mnemo)]

#0 *__GI___libc_free (mem=0x21) at malloc.c:3599
#1 0x00007feb62b4b49d in intel_miptree_set_level_info () from /usr/lib/dri/i965_dri.so
#2 0x00007feb62b64f5c in i945_miptree_layout_2d () from /usr/lib/dri/i965_dri.so
#3 0x00007feb62b79a0d in brw_miptree_layout () from /usr/lib/dri/i965_dri.so
#4 0x00007feb62b4b6e2 in ?? () from /usr/lib/dri/i965_dri.so
#5 0x00007feb62b4b810 in intel_miptree_create () from /usr/lib/dri/i965_dri.so
#6 0x00007feb62b648e5 in ?? () from /usr/lib/dri/i965_dri.so
#7 0x00007feb62b64d3d in intelTexImage2D () from /usr/lib/dri/i965_dri.so
#8 0x00007feb62bffe4a in _mesa_TexImage2D () from /usr/lib/dri/i965_dri.so
#9 0x00007feb745af07a in __glXDisp_TexImage2D (pc=0x7feb5d3c6018 "") at ../../glx/indirect_dispatch.c:1153
#10 0x00007feb745d1fbd in __glXDisp_RenderLarge (cl=0x4b9f3a0, pc=0x67116d0 "") at ../../glx/glxcmds.c:1984
#11 0x00007feb745d5de2 in __glXDispatch (client=0x4b9dcf0) at ../../glx/glxext.c:523
#12 0x000000000044e304 in Dispatch () at ../../dix/dispatch.c:437
#13 0x0000000000433d8d in main (argc=10, argv=0x7fff7fd8c248, envp=<value optimized out>) at ../../dix/main.c:397

[Matthias Klose (doko)]

unlikely a python bug, but rather a bug in the bindings?

[Martin Olsson (mnemo)]

I switched to 2.6.29 kernel plus xorg-edgers and it still repros. I recorded logs using that config into the following upstream bug (I also gave them the repro testcase ofc):
http://bugs.freedesktop.org/show_bug.cgi?id=21054

[Apport retracing service (apport)]

StacktraceTop:*__GI___libc_free (mem=0x401) at malloc.c:3599
intel_miptree_set_level_info ()
i945_miptree_layout_2d ()
brw_miptree_layout () from /usr/lib/dri/i965_dri.so
?? () from /usr/lib/dri/i965_dri.so

[Martin Olsson (mnemo)]

On top of the versions I used for EXA testing, if I installing mesa git HEAD as of April 4th 2009, this is what I see:

for UXA, the scenario is fixed (image now loads and renders fine)

for EXA, the xserver does not SEGV anymore but the app is extremely buggy, hogging CPU, runs in all constant "grayed out unresponsive" state, shows many rendering defects etc (even when minimized it keeps blurbing stuff to the screen).

[Eric Anholt (eric-anholt)]

Reported fixed with DRI2 at this point, so closing.

[Martin Olsson (mnemo)]

Uptream has WONTFIX'ed this bug for EXA (and git master works for UXA now).

[Bryce Harrington (bryce)]

Alright, then now that we're switched to UXA by default we can consider that the fix for this issue.

[dino99 (9d9)]

This version is outdated and no more supported