Comment 0 for bug 355742

Forwarded from launchpad:

https://bugs.launchpad.net/ubuntu/+source/mesa/+bug/355742

There is a new crash in i915_dri.so after updating Jaunty to the mesa-7.4 packages. I'm encountering it using the online Java-based game "Runescape" (which uses JOGL -- Java OpenGL bindings).

Steps to reproduce (no Runescape account needed):
   1. Using Ubuntu Jaunty i386 updated to the mesa-7.4 packages, and the Intel Q35 graphics chipset (other Intel chipsets likely share the same issue).
   2. Visit http://www.runescape.com/game.ws?m=1&j=1
   3. Enable HD (High-Detail) mode if not already enabled. No need to log on, the crash should happen within a few seconds.

Attached is a backtrace after recompiling the mesa-7.4 packages with extra debug info (-g3). The backtrace was taken while using Sun Java JRE 6u12, but the Java version does not seem to matter.

This particular crash does not occur on another machine with an ATI graphics card, but other crashes do, such as when you move the Firefox window, or when Firefox loses focus. It is very touchy.

Program received signal SIGSEGV, Segmentation fault.
_mesa_sse_transform_points3_2d_no_rot () at x86/sse_xform3.S:413
413 MOVLPS( S(0), XMM0 ) /* oy | ox */
Current language: auto; currently asm
#0 _mesa_sse_transform_points3_2d_no_rot () at x86/sse_xform3.S:413
No locals.
#1 0xad25bd5f in run_vertex_stage (ctx=0x9860d60, stage=0x98cf8ac) at tnl/t_vb_vertex.c:144
No locals.
#2 0xad251884 in _tnl_run_pipeline (ctx=0x9860d60) at tnl/t_pipeline.c:158
 tnl = (TNLcontext *) 0x98cf758
 __tmp = 639
 i = 0
 mask = 63
#3 0xad1a46b9 in intelRunPipeline (ctx=0x9860d60) at intel_tris.c:1079
No locals.
#4 0xad251df5 in _tnl_draw_prims (ctx=0x9860d60, arrays=0x98bde60, prim=0xabf274e0, nr_prims=1, ib=0x0, min_index=0, max_index=3) at tnl/t_draw.c:402
 bo = {0x9d49a88, 0xad2163ce, 0xb7f9305c, 0x84c4063, 0x9b65de0, 0x0, 0x1, 0x0, 0x48c, 0xad38eff4, 0x9860d60, 0x0, 0xabf27468, 0xad22d93d, 0x8b8cbe0, 0x0, 0x0, 0xad38eff4, 0x9860d60, 0xad38eff4, 0xabf27488, 0xad2168c2, 0x9860d60, 0xabf2747c, 0x9b5cf00, 0xad1e0238, 0xad38eff4, 0x9860d60, 0xabf274a8, 0xad2e2840, 0x9860d60, 0x9860d60, 0xabf274b8}
 nr_bo = 1
 tnl = (TNLcontext *) 0x98cf758
#5 0xad24a420 in vbo_exec_DrawArrays (mode=6, start=0, count=4) at vbo/vbo_exec_array.c:267
 ctx = (GLcontext *) 0x9860d60
 prim = {{mode = 6, indexed = 0, begin = 1, end = 1, weak = 0, pad = 0, start = 0, count = 4}}
#6 0xad170425 in intel_clear_tris (ctx=0x9860d60, mask=2) at intel_clear.c:225
 this_mask = 4294967293
 color_bit = <value optimized out>
 vertices = {{0, 0, 1}, {1165, 0, 1}, {1165, 662, 1}, {0, 662, 1}}
 color = {{0.788235307, 0.819607854, 0.819607854, 0}, {0.788235307, 0.819607854, 0.819607854, 0}, {0.788235307, 0.819607854, 0.819607854, 0}, {0.788235307, 0.819607854, 0.819607854, 0}}
 dst_z = 1165
 fb = (struct gl_framebuffer *) 0x9b5c248
 saved_fp_enable = 0 '\0'
 saved_vp_enable = 0 '\0'
 saved_shader_program = 0
 saved_active_texture = 0
 __PRETTY_FUNCTION__ = "intel_clear_tris"
#7 0xad1708de in intelClear (ctx=0x9860d60, mask=258) at intel_clear.c:372
 tri_mask = 2
 blit_mask = <value optimized out>
 swrast_mask = 0
 fb = (struct gl_framebuffer *) 0x9b5c248
 i = 162907228
#8 0xad1c27a9 in _mesa_Clear (mask=16640) at main/clear.c:182
 bufferMask = 258
 ctx = (GLcontext *) 0x9860d60
#9 0xab7bab77 in Java_com_sun_opengl_impl_GLImpl_glClear () from /home/tim/.jagex_cache_32/runescape/libjogl.so