[i965] xorg-edgers regression: blender-bin crashed with SIGSEGV in _swrast_ReadPixels()

[Wolfgang Kufner]

Binary package hint: libgl1-mesa-dri

Trying to open the window type selection menue of the main 3D window right after startup in windowed mode blender crashed 2 out of 2 times. Put another way: I opened blender, left clicked on the window type selector and crash.

This is on karmic with xorg-edgers all freshly updated today.
libgl1-mesa-dri (7.6.0+git20090908.e589a37f-0ubuntu0tormod) to 7.7.0~git20090910.18882f4d-0ubuntu0tormod was part of the upgrade.

Tried to upgrade the other notebook, an acer extensa 5630z: only upgraded libgl1-mesa-dri from yesterday (20090909) to current (20090910) xorg-edgers. From synaptic history:
Commit Log for Fri Sep 11 08:21:58 2009
Upgraded the following packages:
libgl1-mesa-dri (7.7.0~git20090909.4d85a6b3-0ubuntu0tormod) to 7.7.0~git20090910.18882f4d-0ubuntu0tormod
Same crash. Moreover it does not seem to be too important what I do to crash it. Mousing over the buttons or trying to open some menu is enough for a crash.

Extreme Tux Racer is running perfectly fine on both test notebooks.

00:02.0 VGA compatible controller [0300]: Intel Corporation Mobile 4 Series Chipset Integrated Graphics Controller [8086:2a42] (rev 07)
reproduced on two different subsystems

ProblemType: Crash
Architecture: amd64
Date: Fri Sep 11 07:49:33 2009
Disassembly: 0x0: Cannot access memory at address 0x0
DistroRelease: Ubuntu 9.10
ExecutablePath: /usr/bin/blender-bin
Package: blender 2.49a+dfsg-0ubuntu2
ProcCmdline: blender-bin -w
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-10.31-generic
SegvAnalysis:
 Segfault happened at: 0x0: Cannot access memory at address 0x0
 PC (0x00000000) not located in a known VMA region (needed executable region)!
SegvReason: executing NULL VMA
Signal: 11
SourcePackage: blender
StacktraceTop:
 ?? ()
 ?? () from /usr/lib/dri/i965_dri.so
 _swrast_ReadPixels () from /usr/lib/dri/i965_dri.so
 _mesa_ReadPixels () from /usr/lib/dri/i965_dri.so
 ?? ()
Title: blender-bin crashed with SIGSEGV in _swrast_ReadPixels()
Uname: Linux 2.6.31-10-generic x86_64
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

[Wolfgang Kufner (wolfgangkufner)]

Binary package hint: blender

Trying to open the window type selection menue of the main 3D window right after startup in windowed mode blender crashed 2 out of 2 times. Put another way: I opened blender, left clicked on the window type selector and crash.

This is on karmic with xorg-edgers all freshly updated today.
libgl1-mesa-dri (7.6.0+git20090908.e589a37f-0ubuntu0tormod) to 7.7.0~git20090910.18882f4d-0ubuntu0tormod was part of the upgrade.

I will try to investigate this some more, but with my skills there is only so much I can do.

ProblemType: Crash
Architecture: amd64
Date: Fri Sep 11 07:49:33 2009
Disassembly: 0x0: Cannot access memory at address 0x0
DistroRelease: Ubuntu 9.10
ExecutablePath: /usr/bin/blender-bin
Package: blender 2.49a+dfsg-0ubuntu2
ProcCmdline: blender-bin -w
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-10.31-generic
SegvAnalysis:
 Segfault happened at: 0x0: Cannot access memory at address 0x0
 PC (0x00000000) not located in a known VMA region (needed executable region)!
SegvReason: executing NULL VMA
Signal: 11
SourcePackage: blender
StacktraceTop:
 ?? ()
 ?? () from /usr/lib/dri/i965_dri.so
 _swrast_ReadPixels () from /usr/lib/dri/i965_dri.so
 _mesa_ReadPixels () from /usr/lib/dri/i965_dri.so
 ?? ()
Title: blender-bin crashed with SIGSEGV in _swrast_ReadPixels()
Uname: Linux 2.6.31-10-generic x86_64
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

[Apport retracing service (apport)]

StacktraceTop:?? ()
_swrast_write_rgba_span ()
?? ()
?? ()
?? ()

[Apport retracing service (apport)]

Thank you for your report!

However, processing it in order to get sufficient information for the
developers failed (it does not generate an useful symbolic stack trace). This
might be caused by some outdated packages which were installed on your system
at the time of the report:

libglu1-mesa: installed version 7.7.0~git20090910.18882f4d-0ubuntu0tormod, latest version: 7.6.0~git20090817.7c422387-0ubuntu3
libgl1-mesa-glx: installed version 7.7.0~git20090910.18882f4d-0ubuntu0tormod, latest version: 7.6.0~git20090817.7c422387-0ubuntu3

Please upgrade your system to the latest package versions. If you still
encounter the crash, please file a new report.

Thank you for your understanding, and sorry for the inconvenience!

[Tormod Volden (tormodvolden)]

I think this might be related: http://cgit.freedesktop.org/mesa/mesa/commit/?id=9e6ae75cc8d6bff139aa21bda0aa682755ab7a7c

[Tormod Volden (tormodvolden)]

Thanks for your report. It is very valuable that you are testing these daily builds, as it helps to discover regressions as quickly as possible, and it should be easy to pin-point what went wrong.

Please install libgl1-mesa-dri-dbg from the PPA to get a better backtrace. Can you please file a bug on bugs.freedesktop.org (Mesa)?

[Wolfgang Kufner (wolfgangkufner)]

This could be the same bug that I have observed and described in https://bugs.launchpad.net/ubuntu/+source/mesa/+bug/427712 although here it does really not matter much what button in blender I click or even only mouse over.

Anyway, this regression appeared between commits 4d85a6b3 and 18882f4d.
file: libgl1-mesa-dri

I attach my gdb log of the crash.

please let me know if you need further information

[Wolfgang Kufner (wolfgangkufner)]

Created an attachment (id=29426)
blender crash on button push

[Sven Arvidsson (sa)]

(In reply to comment #1)
> This could be the same bug that I have observed and described in
> https://bugs.launchpad.net/ubuntu/+source/mesa/+bug/427712 although here it
> does really not matter much what button in blender I click or even only mouse
> over.

Doh! Indeed, almost any button will cause a segfault.

[Sven Arvidsson (sa)]

Bisecting leads to this:

36dd53a3cded9d003ec418732b7fc93c1476aa9b is first bad commit
commit 36dd53a3cded9d003ec418732b7fc93c1476aa9b
Author: Eric Anholt <email address hidden>
Date: Thu Sep 10 09:26:38 2009 -0700

    intel: Don't forget to map the depth read buffer in spans.

    This broke BlitFramebufferEXT(GL_DEPTH_BUFFER_BIT).

:040000 040000 549d8f39d7717322b09dc656a5129f46162471f3 53fb80a11730f3ecfdf03231418e8dee0f7e984b M src

[Wolfgang Kufner (wolfgangkufner)]

Thank you for your encouraging answer.

I have made a duplicate of this bug report ( Bug #427831 ) with libgl1-mesa-dri-dbg installed. That way apport did all the work and I am not so sure which of those files are really interesting or how to get them without filing a bug report with apport.
I will file a bug report on freedesktop.org in the next few hours.

[Tormod Volden (tormodvolden)]

apport doesn't really succeed, can you please try manually with gdb? See https://wiki.ubuntu.com/Backtrace

[Wolfgang Kufner (wolfgangkufner)]

Thanks for the link for gdb. I did try that and attached the result here. It looks however pretty similar to the backtrace I attached to the duplicate Bug #427831. Just to be sure, you did mean the output attached over there when you said apport doesn't really succeed?

[Tormod Volden (tormodvolden)]

Yes, I looked at the apport output in that report. Your gdb results have more information.

[Wolfgang Kufner (wolfgangkufner)]

Oh, good then. I will attach the gdb results to my bugreport on freedesktop.org now.

[Tormod Volden (tormodvolden)]

I think https://bugs.freedesktop.org/show_bug.cgi?id=23862 can be the same, so maybe you can attach your gdb log there instead, and tell them it appeared between commits e589a37f and 18882f4d.

[Wolfgang Kufner (wolfgangkufner)]

Thanks for the suggestion. I have done so now.

[Sven Arvidsson (sa)]

Might be the same as bug 23871

[Gordon Jin (gordon-jin)]

Please retest with mesa master:

Branch: master
Commit: 8ec456c68cc69349c2506ce64047d06c7113780c
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=8ec456c68cc69349c2506ce64047d06c7113780c

Author: Brian Paul <email address hidden>
Date: Mon Sep 14 12:40:53 2009 -0600

intel: fix renderbuffer map/unmap regression

Commit 36dd53a3cded9d003ec418732b7fc93c1476aa9b caused a few regressions
because the glReadBuffer() buffer wasn't getting mapped when GL_READ_BUFFER
!= GL_DRAW_BUFFER.

[Wolfgang Kufner (wolfgangkufner)]

Yes, this bug is indeed fixed. :-)

I checked with fresh packages from ubuntu xorg-edgers ppa:
mesa (7.7.0~git20090914.d3f5a2e5-0ubuntu0tormod)
  * Checkout from git 20090914 (master branch) up to commit
    d3f5a2e5ab413ec0dab1efa8135705e5312d361d