Bug #691653 “compiz crashes when using alt-tab (the radeon drive...” : Bugs : mesa package : Ubuntu

Bug Description

Binary package hint: compiz

While alt-tabbing with compiz (latest version, 1:0.9.2.1+glibmainloop3-0ubuntu4), i got this crasher.

I've noticed crashers like this for a while since i switched over to natty, but most of the time i was getting traces that were mostly "stack smashers" according to smspillaz.

Withi this one, i think i've put the finger on a more probable cause for the crasher. See stacktrace at http://pastebin.ubuntu.com/544957/ an excerpt of which being:

b#0 0x00fc230b in radeon_r300_winsys_buffer_from_handle () from /usr/lib/dri/r300_dri.so
(gdb) bt
#0 0x00fc230b in radeon_r300_winsys_buffer_from_handle () from /usr/lib/dri/r300_dri.so
#1 0x00fd272f in r300_texture_from_handle () from /usr/lib/dri/r300_dri.so
#2 0x00fdd2b4 in r300_resource_from_handle () from /usr/lib/dri/r300_dri.so
#3 0x00fc0958 in dri2_allocate_textures () from /usr/lib/dri/r300_dri.so
#4 0x00fc1797 in dri_st_framebuffer_validate () from /usr/lib/dri/r300_dri.so
#5 0x00fc1916 in dri_set_tex_buffer2 () from /usr/lib/dri/r300_dri.so
#6 0x008fc019 in dri2_bind_tex_image () from /usr/lib/mesa/libGL.so.1
#7 0x008d3cb6 in __glXBindTexImageEXT () from /usr/lib/mesa/libGL.so.1
#8 0x006c8a8a in TfpTexture::bindPixmapToTexture(unsigned long, int, int, int) () from /usr/lib/compiz/libopengl.so
#9 0x006c5b3e in boost::detail::function::function_invoker4<GLTexture::List (*)(unsigned long, int, int, int), GLTexture::List, unsigned long, int, int, int>::invoke(boost::detail::function::function_buffer&, unsigned long, int, int, int) () from /usr/lib/compiz/libopengl.so
#10 0x006c850a in GLTexture::bindPixmapToTexture(unsigned long, int, int, int) () from /usr/lib/compiz/libopengl.so
#11 0x00c88743 in DecorTexture::DecorTexture(unsigned long) () from /usr/lib/compiz/libdecor.so
...

dbarth@thinkpad:~$ apt-cache policy libgl1-mesa-dri
libgl1-mesa-dri:
  Installed: 7.9+repack-1ubuntu3
  Candidate: 7.9+repack-1ubuntu3
  Version table:
*** 7.9+repack-1ubuntu3 0
        500 http://archive.ubuntu.com/ubuntu/ natty/main i386 Packages
        100 /var/lib/dpkg/status

To reproduce: alt-tab, and sometimes that will crash

mipmap was enabled, though i've had identical crashers when it was disabled as well.
---
Architecture: i386
CompizPlugins: No value set for `/apps/compiz-1/general/allscreens/options/active_plugins'
CompositorRunning: compiz
DRM.card0.LVDS.1:
status: connected
enabled: enabled
dpms: On
modes: 1400x1050 1400x1050 1280x1024 1280x1024 1280x960 1280x854 1280x800 1280x720 1152x768 1024x768 1024x768 800x600 800x600 848x480 720x480 640x480 640x480
edid-base64: AP///////wAwriJAAAAAAAAPAQOAHBV46q9AlVZKjyUgUFQhCACBgAEBAQEBAQEBAQEBAQEBMCp4IFEaEEAwcBMAHdYQAAAZJSN4IFEaEEAwcBMAHdYQAAAZAAAADwCQQzKQQygPAQAJ5QAAAAAA/gBIVDE0UDEyLTEwMAogAD8=
DRM.card0.VGA.1:
status: disconnected
enabled: disabled
dpms: On
modes:
edid-base64:
DistUpgraded: Yes, recently upgraded Log time: 2010-11-25 10:04:35.555639
DistroCodename: natty
DistroRelease: Ubuntu 11.04
DistroVariant: ubuntu
GraphicsCard: Subsystem: Lenovo ThinkPad T60p [17aa:2007]
MachineType: LENOVO 200783U
Package: mesa (not installed)
PackageArchitecture: all
PccardctlIdent:
Socket 0:
no product info available
PccardctlStatus:
Socket 0:
no card
PciDisplay: 01:00.0 VGA compatible controller [0300]: ATI Technologies Inc M56GL [Mobility FireGL V5200] [1002:71c4] (prog-if 00 [VGA controller])
ProcEnviron:
LANGUAGE=en_US.UTF-8:en
PATH=(custom, user)
LANG=en_US.UTF-8
LC_MESSAGES=en_AG.utf8
SHELL=/bin/bash
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-2.6.37-11-generic root=UUID=d71a3bd3-9679-4649-b4ac-ce425d0e5bed ro vt.handoff=7 quiet splash bootchart=disable
ProcKernelCmdLine_: BOOT_IMAGE=/boot/vmlinuz-2.6.37-11-generic root=UUID=d71a3bd3-9679-4649-b4ac-ce425d0e5bed ro vt.handoff=7 quiet splash bootchart=disable
ProcVersionSignature: Ubuntu 2.6.37-11.25-generic 2.6.37-rc7
ProcVersionSignature_: Ubuntu 2.6.37-11.25-generic 2.6.37-rc7
RelatedPackageVersions:
xserver-xorg 1:7.5+6ubuntu6
libgl1-mesa-glx 7.9+repack-1ubuntu3
libdrm2 2.4.22-2ubuntu1
xserver-xorg-video-intel 2:2.13.901-2ubuntu2
xserver-xorg-video-ati 1:6.13.2-1ubuntu2
Renderer: Hardware acceleration
Tags: natty running-unity natty running-unity natty ubuntu
Uname: Linux 2.6.37-11-generic i686
UnitySupportTest:

UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare
XorgConf: Error: [Errno 2] No such file or directory: '/etc/X11/xorg.conf'
dmi.bios.date: 09/12/2008
dmi.bios.vendor: LENOVO
dmi.bios.version: 79ETE3WW (2.23 )
dmi.board.name: 200783U
dmi.board.vendor: LENOVO
dmi.board.version: Not Available
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Not Available
dmi.modalias: dmi:bvnLENOVO:bvr79ETE3WW(2.23):bd09/12/2008:svnLENOVO:pn200783U:pvrThinkPadT60p:rvnLENOVO:rn200783U:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable:
dmi.product.name: 200783U
dmi.product.version: ThinkPad T60p
dmi.sys.vendor: LENOVO
system: distro = Ubuntu, architecture = i686, kernel = 2.6.37-11-generic
version.libdrm2: libdrm2 2.4.22-2ubuntu1
version.libgl1-mesa-glx: libgl1-mesa-glx 7.9+repack-1ubuntu3
version.xserver-xorg: xserver-xorg 1:7.5+6ubuntu6
version.xserver-xorg-video-ati: xserver-xorg-video-ati 1:6.13.2-1ubuntu2
version.xserver-xorg-video-intel: xserver-xorg-video-intel 2:2.13.901-2ubuntu2
version.xserver-xorg-video-nouveau: xserver-xorg-video-nouveau 1:0.0.16+git20100805+b96170a-0ubuntu1

See original description

Tags: Edit Tag help

Related branches

lp:ubuntu/natty/mesa

Bryce Harrington (bryce) wrote on 2010-12-17:

Please run 'apport-collect 691653', so that it captures your X logs and pci ids and so on.

Also, collect another backtrace using 'bt full' in gdb. That should list out line numbers for the GL calls.

Offhand I wonder if this might be an r300 vs. r300g issue...

tags:	added: natty
Changed in mesa (Ubuntu):
status:	New → Incomplete

David Barth (dbarth) wrote on 2011-01-04: BootDmesg.txt

BootDmesg.txt Edit (61.0 KiB, text/plain)

apport information

tags:	added: apport-collected running-unity ubuntu
description:	updated

David Barth (dbarth) wrote on 2011-01-04: CurrentDmesg.txt

CurrentDmesg.txt Edit (8.9 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: DRM.card0.DVI.I.1.txt

DRM.card0.DVI.I.1.txt Edit (107 bytes, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: Dependencies.txt

Dependencies.txt Edit (5.1 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: GconfCompiz.txt

GconfCompiz.txt Edit (34.6 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: GdmLog.txt

GdmLog.txt Edit (33.3 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: GdmLog1.txt

GdmLog1.txt Edit (33.4 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: GdmLog2.txt

GdmLog2.txt Edit (36.9 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: Lspci.txt

#10

Lspci.txt Edit (13.9 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: Lsusb.txt

#11

Lsusb.txt Edit (513 bytes, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: ProcCpuinfo.txt

#12

ProcCpuinfo.txt Edit (1.4 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: ProcCpuinfo_.txt

#13

ProcCpuinfo_.txt Edit (1.4 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: ProcInterrupts.txt

#14

ProcInterrupts.txt Edit (1.9 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: ProcInterrupts_.txt

#15

ProcInterrupts_.txt Edit (1.9 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: ProcModules.txt

#16

ProcModules.txt Edit (2.8 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: ProcModules_.txt

#17

ProcModules_.txt Edit (2.8 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: UdevDb.txt

#18

UdevDb.txt Edit (99.1 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: UdevLog.txt

#19

UdevLog.txt Edit (244.5 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: UdevLog_.txt

#20

UdevLog_.txt Edit (244.5 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: XorgLog.txt

#21

XorgLog.txt Edit (41.5 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: XorgLogOld.txt

#22

XorgLogOld.txt Edit (43.8 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: XorgLogOld_.txt

#23

XorgLogOld_.txt Edit (43.8 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: XorgLog_.txt

#24

XorgLog_.txt Edit (42.4 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: Xrandr.txt

#25

Xrandr.txt Edit (5.1 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: XsessionErrors.txt

#26

XsessionErrors.txt Edit (13.5 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: glxinfo.txt

#27

glxinfo.txt Edit (23.5 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: monitors.xml.txt

#28

monitors.xml.txt Edit (7.7 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: monitors.xml_.txt

#29

monitors.xml_.txt Edit (7.7 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: peripherals.txt

#30

peripherals.txt Edit (2.1 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04: xdpyinfo.txt

#31

xdpyinfo.txt Edit (25.0 KiB, text/plain)

apport information

David Barth (dbarth) wrote on 2011-01-04:

#32

I can't get a full trace again, and i don't have the last core handy. I'll keep trying today.

Bryce Harrington (bryce) wrote on 2011-01-04:

#33

This appears to be a more complete backtrace, found via Google:
https://bugzilla.redhat.com/attachment.cgi?id=464327

Bryce Harrington (bryce) wrote on 2011-01-04:

#34

Ok, that backtrace makes it pretty plain what's gone wrong:

Code:
_buf = radeon_drm_bufmgr_create_buffer_from_handle(ws->kman, whandle->handle);

    if (stride)
        *stride = whandle->stride;
    if (size)
        *size = _buf->base.size;

State:
#0 radeon_r300_winsys_buffer_from_handle (rws=<value optimized out>, whandle=0x7fffe69964b0, stride=0x7fffe69963f4, size=0x7fffe69963f0) at radeon_r300.c:123
ws = <value optimized out>
_buf = 0x0

So, it's a simple null pointer dereference. Now we have two questions:

* How/why did radeon_drm_bufmgr_create_buffer_from_handle() give us a null pointer?
* If that is a permissible return value, the code should check for it. Should it still call radeon_libdrm_winsys_buffer() in this case, or just return?

Bryce Harrington (bryce) wrote on 2011-01-05:

#35

winsys_buffer_nullptr.patch Edit (510 bytes, text/plain)

Well, this is a pretty simpleminded check, but it looks like it might prevent it from crashing at least.

Still doesn't answer why the null pointer got in there to begin with.

We've got a new mesa release coming soon. I poked through the git tree looking for an obvious fix for this issue but didn't spot it. Still, I think the next step would be to test a newer mesa to verify it still has this bug, and then test out if this patch solves it, or just shifts the issue to some other bit of code. (Guessing the latter).

Bryce Harrington (bryce) wrote on 2011-01-05:

#36

Browsed through the last month's worth of changes to the 7.10 branch for mesa and didn't spot an obvious fix for this issue, however there were several buffer validation patches for radeon, so it wouldn't surprise me if the bug goes away in newer mesa.

If you'd like to test it now, you could install xorg-edgers, which has a packaged snapshot of today's mesa:

https://edge.launchpad.net/~xorg-edgers

After testing, you can use ppa-purge to restore your system to its pre-edgers state.

Or if you'd prefer, we anticipate the 7.10 final release immanently and expect to have it in natty within the next couple weeks or so.

Bryce Harrington (bryce) on 2011-01-05

Changed in mesa (Ubuntu):
status:	Incomplete → In Progress

Brian Murray (brian-murray) on 2011-01-05

tags:

added: patch