Ubuntu
mesa package

[G45] reproducible Xorg crash running glean/makeCurrent (EXA and UXA)

Bug #333748 reported by Martin Olsson
8
Affects Status Importance Assigned to Milestone
X.Org X server
Fix Released
Critical
mesa (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

100% reproducible crash

Note: I'm seeing this using EXA and UXA and I have an intel G45 chipset (8086:2e22).

to trigger the bug:
1. git clone the piglit open gl test suite (available at cgit.freedesktop.org)
2. to the setup steps from README (for example the "ccmake ." stuff etc)
3. run "./piglit-run.py tests/all.tests result_dir"
4. once it gets to the blendFunc test press ctrl-c once in the terminal to skip that test because it takes ages to run
4. after that it runs another few tests and then boom segv in xorg

ProblemType: Crash
Architecture: amd64
DistroRelease: Ubuntu 9.04
ExecutablePath: /usr/bin/Xorg
Package: xserver-xorg-core 2:1.5.99.902-0ubuntu7
ProcAttrCurrent: unconfined
ProcCmdline: /usr/X11R6/bin/X :0 -br -audit 0 -auth /var/lib/gdm/:0.Xauth -nolisten tcp vt7
ProcEnviron:
 PATH=(custom, no user)
 LANG=en_US.UTF-8
ProcVersion: Linux version 2.6.28-8-generic (buildd@yellow) (gcc version 4.3.3 (Ubuntu 4.3.3-3ubuntu5) ) #25-Ubuntu SMP Tue Feb 24 01:50:03 UTC 2009
Signal: 11
SourcePackage: xorg-server
StacktraceTop:
 dri2GetBuffers (driDrawable=<value optimized out>,
 intel_update_renderbuffers ()
 intelMakeCurrent () from /usr/lib/dri/i965_dri.so
 ?? () from /usr/lib/dri/i965_dri.so
 __glXForceCurrent (cl=0x1a30300,
Title: Xorg crashed with SIGSEGV in dri2GetBuffers()
Uname: Linux 2.6.28-8-generic x86_64
UserGroups:

[lspci]
00:00.0 Host bridge [0600]: Intel Corporation 4 Series Chipset DRAM Controller [8086:2e20] (rev 03)
     Subsystem: Giga-byte Technology Device [1458:5000]
00:02.0 VGA compatible controller [0300]: Intel Corporation 4 Series Chipset Integrated Graphics Controller [8086:2e22] (rev 03)
     Subsystem: Giga-byte Technology Device [1458:d000]

See original description

Related branches

lp:ubuntu/karmic/mesa
Revision history for this message
In , Martin Olsson (mnemo) wrote :

I just installed the 29-rc6 kernel on the G45 machine that the bug repros using that config as well.

Revision history for this message
In , Gordon Jin (gordon-jin) wrote :

This is covered in bug#19177.

*** This bug has been marked as a duplicate of bug 19177 ***

Revision history for this message
In , Martin Olsson (mnemo) wrote :

I just found out that this bug repros using EXA as well.

I didn't notice first because pretty often the xserver doesn't SEGV on the first time the test case is run but if you run it 2-3 times you are almost certain so see the crash using EXA+G45 as well (this goes both for the .29-rc6 and the ubuntu stock kernels).

Gordon, because this bug also repros on G45+EXA (perhaps you can try to verify this), I don't think it should be lumped up with the other glean failures. What if the glean failures get postponed again? Ubuntu really needs stable EXA for the April jaunty release.

Revision history for this message
In , Martin Olsson (mnemo) wrote :

When I repro the bug in EXA, the stack is different of course:

Program received signal SIGSEGV, Segmentation fault.
0x00007ff647512d51 in ?? () from /usr/lib/dri/i965_dri.so
(gdb) bt
#0 0x00007ff647512d51 in ?? () from /usr/lib/dri/i965_dri.so
#1 0x00007ff658ebc936 in __glXForceCurrent (cl=0x3155710, tag=<value optimized out>, error=0x7fff63eab92c) at ../../glx/glxext.c:394
#2 0x00007ff658ebaaae in DoMakeCurrent (cl=0x3155710, drawId=<value optimized out>, readId=73400327, contextId=<value optimized out>, tag=1)
    at ../../glx/glxcmds.c:605
#3 0x00007ff658ebcea2 in __glXDispatch (client=0x37b2540) at ../../glx/glxext.c:523
#4 0x000000000044e1d4 in Dispatch () at ../../dix/dispatch.c:437
#5 0x0000000000433c5d in main (argc=10, argv=0x7fff63eabb48, envp=<value optimized out>) at ../../dix/main.c:397
(gdb) bt full
#0 0x00007ff647512d51 in ?? () from /usr/lib/dri/i965_dri.so
No symbol table info available.
#1 0x00007ff658ebc936 in __glXForceCurrent (cl=0x3155710, tag=<value optimized out>, error=0x7fff63eab92c) at ../../glx/glxext.c:394
 cx = (__GLXcontext *) 0x708b780
#2 0x00007ff658ebaaae in DoMakeCurrent (cl=0x3155710, drawId=<value optimized out>, readId=73400327, contextId=<value optimized out>, tag=1)
    at ../../glx/glxcmds.c:605
 client = (ClientPtr) 0x37b2540
 reply = {type = 96 '`', unused = 219 '�', sequenceNumber = 125, length = 0, contextTag = 0, pad2 = 0, pad3 = 8248216, pad4 = 0,
  pad5 = 1487362742, pad6 = 32758}
 glxc = (__GLXcontext *) 0x64a86d0
 prevglxc = (__GLXcontext *) 0x708b780
 drawPriv = (__GLXdrawable *) 0x21cc350
 readPriv = (__GLXdrawable *) 0x21cc350
 error = <value optimized out>
 mask = <value optimized out>
 __PRETTY_FUNCTION__ = "DoMakeCurrent"
#3 0x00007ff658ebcea2 in __glXDispatch (client=0x37b2540) at ../../glx/glxext.c:523
 stuff = (xGLXSingleReq *) 0x4dc63e8
 opcode = <value optimized out>
 cl = (__GLXclientState *) 0x3155710
 retval = 1
#4 0x000000000044e1d4 in Dispatch () at ../../dix/dispatch.c:437
 result = <value optimized out>
 client = (ClientPtr) 0x37b2540
 nready = 0
 start_tick = 7200
#5 0x0000000000433c5d in main (argc=10, argv=0x7fff63eabb48, envp=<value optimized out>) at ../../dix/main.c:397
 i = 1
 alwaysCheckForInput = {0, 1}
(gdb)

Revision history for this message
In , Martin Olsson (mnemo) wrote :

Here is the EXA stack with mesa dbg symbols installed properly:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fd7b03e16f0 (LWP 7707)]
0x00007fd79ba9f000 in ?? () from /usr/lib/dri/i965_dri.so
(gdb) bt
#0 0x00007fd79ba9f000 in ?? () from /usr/lib/dri/i965_dri.so
#1 0x00007fd79bb3695d in _mesa_delete_texture_image () from /usr/lib/dri/i965_dri.so
#2 0x00007fd79bb3d1d1 in _mesa_delete_texture_object () from /usr/lib/dri/i965_dri.so
#3 0x00007fd79bad7dfc in ?? () from /usr/lib/dri/i965_dri.so
#4 0x00007fd79bad8bbd in _mesa_free_context_data () from /usr/lib/dri/i965_dri.so
#5 0x00007fd79ba78a40 in ?? () from /usr/lib/dri/i965_dri.so
#6 0x00007fd7ad42c8b9 in __glXDRIcontextDestroy (baseContext=0x4652360) at ../../glx/glxdri.c:290
#7 0x00007fd7ad422bac in __glXFreeContext (cx=0x4652360) at ../../glx/glxext.c:160
#8 0x00007fd7ad422bf3 in ContextGone (cx=0x61bb090, id=4294967294) at ../../glx/glxext.c:109
#9 0x0000000000435fcb in FreeClientResources (client=0x4650ea0) at ../../dix/resource.c:807
#10 0x0000000000448840 in CloseDownClient (client=0x4650ea0) at ../../dix/dispatch.c:3433
#11 0x000000000044e068 in Dispatch () at ../../dix/dispatch.c:448
#12 0x0000000000433c5d in main (argc=10, argv=0x7fffb840f0a8, envp=<value optimized out>) at ../../dix/main.c:397
(gdb) bt full
#0 0x00007fd79ba9f000 in ?? () from /usr/lib/dri/i965_dri.so
No symbol table info available.
#1 0x00007fd79bb3695d in _mesa_delete_texture_image () from /usr/lib/dri/i965_dri.so
No symbol table info available.
#2 0x00007fd79bb3d1d1 in _mesa_delete_texture_object () from /usr/lib/dri/i965_dri.so
No symbol table info available.
#3 0x00007fd79bad7dfc in ?? () from /usr/lib/dri/i965_dri.so
No symbol table info available.
#4 0x00007fd79bad8bbd in _mesa_free_context_data () from /usr/lib/dri/i965_dri.so
No symbol table info available.
#5 0x00007fd79ba78a40 in ?? () from /usr/lib/dri/i965_dri.so
No symbol table info available.
#6 0x00007fd7ad42c8b9 in __glXDRIcontextDestroy (baseContext=0x4652360) at ../../glx/glxdri.c:290
No locals.
#7 0x00007fd7ad422bac in __glXFreeContext (cx=0x4652360) at ../../glx/glxext.c:160
No locals.
#8 0x00007fd7ad422bf3 in ContextGone (cx=0x61bb090, id=4294967294) at ../../glx/glxext.c:109
No locals.
#9 0x0000000000435fcb in FreeClientResources (client=0x4650ea0) at ../../dix/resource.c:807
 rtype = 56
 resources = <value optimized out>
 this = (ResourcePtr) 0x4ab8160
 j = 13
#10 0x0000000000448840 in CloseDownClient (client=0x4650ea0) at ../../dix/dispatch.c:3433
 really_close_down = 1
#11 0x000000000044e068 in Dispatch () at ../../dix/dispatch.c:448
 result = 8203840
 client = (ClientPtr) 0x4650ea0
 nready = 0
 start_tick = 1640
#12 0x0000000000433c5d in main (argc=10, argv=0x7fffb840f0a8, envp=<value optimized out>) at ../../dix/main.c:397
 i = 1
 alwaysCheckForInput = {0, 1}

Revision history for this message
Martin Olsson (mnemo) wrote : [UXA] reproducible Xorg crash: SIGSEGV in dri2GetBuffers()

100% reproducible crash

Note: I'm using UXA and I have an intel G45 chipset (8086:2e22). I've not yet tested the repro steps on EXA.

to trigger the bug:
1. git clone the piglit open gl test suite (available at cgit.freedesktop.org)
2. to the setup steps from README (for example the "ccmake ." stuff etc)
3. run "./piglit-run.py tests/all.tests result_dir"
4. once it gets to the blendFunc test press ctrl-c once in the terminal to skip that test because it takes ages to run
4. after that it runs another few tests and then boom segv in xorg

ProblemType: Crash
Architecture: amd64
DistroRelease: Ubuntu 9.04
ExecutablePath: /usr/bin/Xorg
Package: xserver-xorg-core 2:1.5.99.902-0ubuntu7
ProcAttrCurrent: unconfined
ProcCmdline: /usr/X11R6/bin/X :0 -br -audit 0 -auth /var/lib/gdm/:0.Xauth -nolisten tcp vt7
ProcEnviron:
 PATH=(custom, no user)
 LANG=en_US.UTF-8
ProcVersion: Linux version 2.6.28-8-generic (buildd@yellow) (gcc version 4.3.3 (Ubuntu 4.3.3-3ubuntu5) ) #25-Ubuntu SMP Tue Feb 24 01:50:03 UTC 2009
Signal: 11
SourcePackage: xorg-server
StacktraceTop:
 dri2GetBuffers (driDrawable=<value optimized out>,
 intel_update_renderbuffers ()
 intelMakeCurrent () from /usr/lib/dri/i965_dri.so
 ?? () from /usr/lib/dri/i965_dri.so
 __glXForceCurrent (cl=0x1a30300,
Title: Xorg crashed with SIGSEGV in dri2GetBuffers()
Uname: Linux 2.6.28-8-generic x86_64
UserGroups:

Revision history for this message
Martin Olsson (mnemo) wrote :
Revision history for this message
Martin Olsson (mnemo) wrote :

the test case inside piglit that triggers the xorg crash is called glean/makeCurrent, and thus a faster way to repro the crash is to run just that test case:

./piglit-run.py -t glean/makeCurrent tests/all.tests result_dir

Revision history for this message
Martin Olsson (mnemo) wrote :

If I run this test case under EXA it does not crash the xserver but the test case fails. The error printed in piglit's HTML summary is:

time 0.328694105148
errors

    * X Error of failed request: GLXBadContextState
    * Major opcode of failed request: 154 (GLX)
    * Minor opcode of failed request: 5 (X_GLXMakeCurrent)
    * Serial number of failed request: 111
    * Current serial number in output stream: 111

info

Returncode: 1

Errors:
X Error of failed request: GLXBadContextState
  Major opcode of failed request: 154 (GLX)
  Minor opcode of failed request: 5 (X_GLXMakeCurrent)
  Serial number of failed request: 111
  Current serial number in output stream: 111

Output:
----------------------------------------------------------------------
This test sanity-checks the ability to use multiple rendering
contexts. It creates several contexts with differing
characteristics (e.g., some are direct-rendering and some
are indirect-rendering, if the window system binding supports
that distinction). Then it runs through all pairs of contexts,
making each one "current" in turn and verifying that simple
rendering succeeds.

makeCurrent: PASS rgba8, db, z24, s8, win+pmap, id 33�

Revision history for this message
Apport retracing service (apport) wrote : Symbolic stack trace

StacktraceTop:dri2GetBuffers (driDrawable=<value optimized out>,
intel_update_renderbuffers ()
intelMakeCurrent () from /usr/lib/dri/i965_dri.so
?? () from /usr/lib/dri/i965_dri.so
__glXForceCurrent (cl=0x1a30300,

Revision history for this message
Apport retracing service (apport) wrote : Symbolic threaded stack trace
Revision history for this message
Martin Olsson (mnemo) wrote : Re: [UXA] reproducible Xorg crash: SIGSEGV in dri2GetBuffers()

This bug also repros on 965+UXA so it's not specific to G45.

Revision history for this message
Martin Olsson (mnemo) wrote :

upstreamed at http://bugs.freedesktop.org/show_bug.cgi?id=20291

Bug Watch Updater (bug-watch-updater)
Changed in xorg-server:
status: Unknown → Confirmed
Martin Olsson (mnemo)
Changed in xorg-server:
status: Confirmed → Unknown
Bug Watch Updater (bug-watch-updater)
Changed in xorg-server:
status: Unknown → Confirmed
Revision history for this message
Martin Olsson (mnemo) wrote :

When the bug repro's on EXA the stack looks like this (obviously no DRI2 stuff in there):

Program received signal SIGSEGV, Segmentation fault.
0x00007ff647512d51 in ?? () from /usr/lib/dri/i965_dri.so
(gdb) bt
#0 0x00007ff647512d51 in ?? () from /usr/lib/dri/i965_dri.so
#1 0x00007ff658ebc936 in __glXForceCurrent (cl=0x3155710, tag=<value optimized
out>, error=0x7fff63eab92c) at ../../glx/glxext.c:394
#2 0x00007ff658ebaaae in DoMakeCurrent (cl=0x3155710, drawId=<value optimized
out>, readId=73400327, contextId=<value optimized out>, tag=1)
    at ../../glx/glxcmds.c:605
#3 0x00007ff658ebcea2 in __glXDispatch (client=0x37b2540) at
../../glx/glxext.c:523
#4 0x000000000044e1d4 in Dispatch () at ../../dix/dispatch.c:437
#5 0x0000000000433c5d in main (argc=10, argv=0x7fff63eabb48, envp=<value
optimized out>) at ../../dix/main.c:397
(gdb) bt full
#0 0x00007ff647512d51 in ?? () from /usr/lib/dri/i965_dri.so
No symbol table info available.
#1 0x00007ff658ebc936 in __glXForceCurrent (cl=0x3155710, tag=<value optimized
out>, error=0x7fff63eab92c) at ../../glx/glxext.c:394
        cx = (__GLXcontext *) 0x708b780
#2 0x00007ff658ebaaae in DoMakeCurrent (cl=0x3155710, drawId=<value optimized
out>, readId=73400327, contextId=<value optimized out>, tag=1)
    at ../../glx/glxcmds.c:605
        client = (ClientPtr) 0x37b2540
        reply = {type = 96 '`', unused = 219 '�', sequenceNumber = 125,
length = 0, contextTag = 0, pad2 = 0, pad3 = 8248216, pad4 = 0,
  pad5 = 1487362742, pad6 = 32758}
        glxc = (__GLXcontext *) 0x64a86d0
        prevglxc = (__GLXcontext *) 0x708b780
        drawPriv = (__GLXdrawable *) 0x21cc350
        readPriv = (__GLXdrawable *) 0x21cc350
        error = <value optimized out>
        mask = <value optimized out>
        __PRETTY_FUNCTION__ = "DoMakeCurrent"
#3 0x00007ff658ebcea2 in __glXDispatch (client=0x37b2540) at
../../glx/glxext.c:523
        stuff = (xGLXSingleReq *) 0x4dc63e8
        opcode = <value optimized out>
        cl = (__GLXclientState *) 0x3155710
        retval = 1
#4 0x000000000044e1d4 in Dispatch () at ../../dix/dispatch.c:437
        result = <value optimized out>
        client = (ClientPtr) 0x37b2540
        nready = 0
        start_tick = 7200
#5 0x0000000000433c5d in main (argc=10, argv=0x7fff63eabb48, envp=<value
optimized out>) at ../../dix/main.c:397
        i = 1
        alwaysCheckForInput = {0, 1}
(gdb)

description: updated
Revision history for this message
In , Gordon Jin (gordon-jin) wrote :

Jian, can you reproduce this on G45 with EXA and UXA?
I think we'd just directly use the case from glean repository instead of from piglit.

Revision history for this message
Chris Jones (cmsj) wrote :

It looks like this is in the intel driver, so re-assigning it to that

Revision history for this message
Marc Kaplan (marc-kaplan) wrote :

I'm having a similar issue, but I'm not using the Intel Driver...rather the nVidia driver with an nVidia card.

I've filed the bug here:

https://bugs.launchpad.net/bugs/333040

I am not sure if they are related or not.

Please let me know what I can do to help troubleshoot/give more data.

Revision history for this message
In , Jian-j-zhao (jian-j-zhao) wrote :

We can reproduce it on G45-64bit but only with UXA. I can run it more than 10 times consecutively with EXA.

Revision history for this message
In , Gordon Jin (gordon-jin) wrote :

martin,

Could you try the glean case from the original glean CVS instead of from
piglit?

Yes, we use piglit. But for glean, we prefer to use the original repository.

Revision history for this message
In , Jian-j-zhao (jian-j-zhao) wrote :

We can reproduce it on G45-64bit but only with UXA. I can run it more than 10 times consecutively with EXA.

Bryce Harrington (bryce)
description: updated
Revision history for this message
Bryce Harrington (bryce) wrote :

Hi mnemo,

Could you please collect a full backtrace from when this crash occurs? Directions on collecting full backtraces are at https://wiki.ubuntu.com/X/Backtracing

[This is an automated message. Apologies if it has reached you inappropriately; please just reply to this message indicating so.]

Changed in xserver-xorg-video-intel:
status: New → Incomplete
Revision history for this message
In , Martin Olsson (mnemo) wrote :
Download full text (3.2 KiB)

Using this version:

cvs -z3 -d:pserver:<email address hidden>:/cvsroot/glean co -P glean

I put these lines into a .sh script:
GLEAN_ROOT=`pwd` ; export GLEAN_ROOT
cd src
make install

And then I just ran GLEAN_ROOT/bin/glean -r makeCurrent

This crashes for me using EXA. However, with piglit the crash comes really fast but with pure glean like above it opens and closes a window lots of times, prints some status messages along the way and then it crashes.

For this test I used an upstream 2.6.29-rc8 kernel compiled with ubuntu's kernel config, and then userspace bits from the xorg-edgers PPA:

xserver-xorg-core 2:1.6.0-0ubuntu3
xserver-xorg-core-dbg 2:1.6.0-0ubuntu3
libdrm-intel1 2.4.5+git20090314.82eac806-0ubuntu0tormod2
libdrm-intel1-dbg 2.4.5+git20090314.82eac806-0ubuntu0tormod2
xserver-xorg-video-intel 2:2.6.99.1+git20090319.bedc894a-0ubuntu0tormod
xserver-xorg-video-intel-dbg 2:2.6.99.1+git20090319.bedc894a-0ubuntu0tormod
libgl1-mesa-dev 7.3+git20090312+mesa-7-4-branch.a6f7e909-0ubuntu0tormod
libgl1-mesa-dri 7.3+git20090312+mesa-7-4-branch.a6f7e909-0ubuntu0tormod
libgl1-mesa-dri-dbg 7.3+git20090312+mesa-7-4-branch.a6f7e909-0ubuntu0tormod
libgl1-mesa-glx 7.3+git20090312+mesa-7-4-branch.a6f7e909-0ubuntu0tormod
libglu1-mesa 7.3+git20090312+mesa-7-4-branch.a6f7e909-0ubuntu0tormod
libglu1-mesa-dev 7.3+git20090312+mesa-7-4-branch.a6f7e909-0ubuntu0tormod
mesa-common-dev 7.3+git20090312+mesa-7-4-branch.a6f7e909-0ubuntu0tormod
mesa-utils 7.3+git20090312+mesa-7-4-branch.a6f7e909-0ubuntu0tormod
xlibmesa-gl-dev 1:7.4~5ubuntu16
libdrm-dev 2.4.5+git20090314.82eac806-0ubuntu0tormod2
libdrm-intel1 2.4.5+git20090314.82eac806-0ubuntu0tormod2
libdrm-intel1-dbg 2.4.5+git20090314.82eac806-0ubuntu0tormod2
libdrm-nouveau1 2.4.5+git20090314.82eac806-0ubuntu0tormod2
libdrm2 2.4.5+git20090314.82eac806-0ubuntu0tormod2
libdrm2-dbg 2.4.5+git20090314.82eac806-0ubuntu0tormod2
compiz 1:0.8.2-0ubuntu5
compiz-core 1:0.8.2-0ubuntu5
compiz-dev 1:0.8.2-0ubuntu5
compiz-fusion-plugins-extra 0.8.2-0ubuntu1
compiz-fusion-plugins-main 0.8.2-0ubuntu1
compiz-gnome 1:0.8.2-0ubuntu5
compiz-kde 1:0.8.2-0ubuntu5
compiz-plugins 1:0.8.2-0ubuntu5
compiz-wrapper 1:0.8.2-0ubuntu5
compizconfig-backend-gconf 0.8.2-0ubuntu1
compizconfig-backend-kconfig 0.8.2-0ubuntu1
compizconfig-settings-manager ...

Read more...

Revision history for this message
In , Martin Olsson (mnemo) wrote :

The last thing CVS glean prints before crashing is:

basicPerf: PASS rgba8, db, z24, s8, accrgba16, win+pmap, slow, id 168
          AVERAGE = 0.1000036 Range = [0.100033, 0.100038]

Revision history for this message
In , Martin Olsson (mnemo) wrote :

When I repro this using EXA with gdb attached, I see the following stack:

(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fe043d75700 (LWP 4250)]
driBindContext (pcp=0x7b9c160, pdp=0x502fc0, prp=0x502fc0) at ../common/dri_util.c:178
178 ../common/dri_util.c: No such file or directory.
 in ../common/dri_util.c
(gdb) bt
#0 driBindContext (pcp=0x7b9c160, pdp=0x502fc0, prp=0x502fc0) at ../common/dri_util.c:178
#1 0x00007fe0405f0876 in __glXForceCurrent (cl=0x696fe20, tag=<value optimized out>, error=0x7fff4bda6abc) at ../../glx/glxext.c:394
#2 0x00007fe0405ee9ee in DoMakeCurrent (cl=0x696fe20, drawId=<value optimized out>, readId=62914831, contextId=<value optimized out>, tag=1)
    at ../../glx/glxcmds.c:605
#3 0x00007fe0405f0de2 in __glXDispatch (client=0x5dcaf00) at ../../glx/glxext.c:523
#4 0x000000000044e354 in Dispatch () at ../../dix/dispatch.c:437
#5 0x0000000000433ddd in main (argc=10, argv=0x7fff4bda6cd8, envp=<value optimized out>) at ../../dix/main.c:397
(gdb) bt full
#0 driBindContext (pcp=0x7b9c160, pdp=0x502fc0, prp=0x502fc0) at ../common/dri_util.c:178
 psp = (__DRIscreenPrivate *) 0x3eb46f0
#1 0x00007fe0405f0876 in __glXForceCurrent (cl=0x696fe20, tag=<value optimized out>, error=0x7fff4bda6abc) at ../../glx/glxext.c:394
 cx = (__GLXcontext *) 0xb52dd50
#2 0x00007fe0405ee9ee in DoMakeCurrent (cl=0x696fe20, drawId=<value optimized out>, readId=62914831, contextId=<value optimized out>, tag=1)
    at ../../glx/glxcmds.c:605
 client = (ClientPtr) 0x5dcaf00
 reply = {type = 128 '\200', unused = 226 '�', sequenceNumber = 125, length = 0, contextTag = 0, pad2 = 0, pad3 = 8250040, pad4 = 0,
  pad5 = 1075485366, pad6 = 32736}
 glxc = (__GLXcontext *) 0x7c02590
 prevglxc = (__GLXcontext *) 0xb52dd50
 drawPriv = (__GLXdrawable *) 0x79ab750
 readPriv = (__GLXdrawable *) 0x79ab750
 error = <value optimized out>
 mask = <value optimized out>
 __PRETTY_FUNCTION__ = "DoMakeCurrent"
#3 0x00007fe0405f0de2 in __glXDispatch (client=0x5dcaf00) at ../../glx/glxext.c:523
 stuff = (xGLXSingleReq *) 0x6554008
 opcode = <value optimized out>
 cl = (__GLXclientState *) 0x696fe20
 retval = 1
#4 0x000000000044e354 in Dispatch () at ../../dix/dispatch.c:437
 result = <value optimized out>
 client = (ClientPtr) 0x5dcaf00
 nready = 0
 start_tick = 720
#5 0x0000000000433ddd in main (argc=10, argv=0x7fff4bda6cd8, envp=<value optimized out>) at ../../dix/main.c:397
 i = 1
 alwaysCheckForInput = {0, 1}
(gdb)

Revision history for this message
In , Martin Olsson (mnemo) wrote :

Created an attachment (id=24086)
dmesg (EXA makeCurrent SEGV, logs captured while GDB had just stopped at SIGSEGV)

Revision history for this message
In , Martin Olsson (mnemo) wrote :

Created an attachment (id=24087)
gpu registers (EXA makeCurrent SEGV, logs captured while GDB had just stopped at SIGSEGV)

Revision history for this message
In , Martin Olsson (mnemo) wrote :

Created an attachment (id=24088)
proc_gem_objects (EXA makeCurrent SEGV, logs captured while GDB had just stopped at SIGSEGV)

Revision history for this message
In , Martin Olsson (mnemo) wrote :

Created an attachment (id=24089)
gem_interrupts (EXA makeCurrent SEGV, logs captured while GDB had just stopped at SIGSEGV)

Revision history for this message
In , Martin Olsson (mnemo) wrote :

Created an attachment (id=24090)
package versions and exact kernel version used (EXA makeCurrent SEGV, logs captured while GDB had just stopped at SIGSEGV)

Revision history for this message
In , Martin Olsson (mnemo) wrote :

Created an attachment (id=24091)
xorg conf (EXA makeCurrent SEGV, logs captured while GDB had just stopped at SIGSEGV)

Revision history for this message
In , Martin Olsson (mnemo) wrote :

Created an attachment (id=24092)
xorg.log.old (EXA makeCurrent SEGV, logs captured while GDB had just stopped at SIGSEGV)

Revision history for this message
In , Martin Olsson (mnemo) wrote :

Created an attachment (id=24093)
xorg.log (EXA makeCurrent SEGV, logs captured while GDB had just stopped at SIGSEGV)

Revision history for this message
In , Martin Olsson (mnemo) wrote :

Created an attachment (id=24094)
xsession-errors (EXA makeCurrent SEGV, logs captured while GDB had just stopped at SIGSEGV)

Revision history for this message
In , Martin Olsson (mnemo) wrote :

The logs above was captured while gdb had first stopped inside GDB with the SIGSEG signal. _After_ I let it continue I get back to gdm of course and then I login. At this point, if I open the xorg.log.old file, the following backtrace has also been printed (but this is probably just a poor version of the gdb backtrace I pasted before I attached all the logs).

Backtrace:
0: /usr/X11R6/bin/X(xorg_backtrace+0x26) [0x4f1976]
1: /usr/X11R6/bin/X(xf86SigHandler+0x41) [0x485a91]
2: /lib/libc.so.6 [0x7fe0418d6040]
3: /usr/lib/dri/i965_dri.so [0x7fe02eb51d51]
4: /usr/lib/xorg/modules/extensions//libglx.so(__glXForceCurrent+0x96) [0x7fe0405f0876]
5: /usr/lib/xorg/modules/extensions//libglx.so [0x7fe0405ee9ee]
6: /usr/lib/xorg/modules/extensions//libglx.so [0x7fe0405f0de2]
7: /usr/X11R6/bin/X(Dispatch+0x364) [0x44e354]
8: /usr/X11R6/bin/X(main+0x3bd) [0x433ddd]
9: /lib/libc.so.6(__libc_start_main+0xe6) [0x7fe0418c15a6]
10: /usr/X11R6/bin/X [0x433269]
Saw signal 11. Server aborting.
[ 545.546298] (II) Razer Reclusa Keyboard: Close
[ 545.546340] (II) UnloadModule: "evdev"
[ 545.562149] (II) Razer Reclusa Keyboard: Close
[ 545.562183] (II) UnloadModule: "evdev"
[ 545.594244] (II) Macintosh mouse button emulation: Close
[ 545.594268] (II) UnloadModule: "evdev"
[ 545.617308] (II) Microsoft Microsoft 5-Button Mouse with IntelliEye(TM): Close
[ 545.617346] (II) UnloadModule: "evdev"
[ 545.617370] (II) AIGLX: Suspending AIGLX clients for VT switch
[ 545.832855] (II) intel(0): xf86UnbindGARTMemory: unbind key 0
 ddxSigGiveUp: Closing log

Martin Olsson (mnemo)
Changed in xorg-server:
status: Confirmed → Unknown
Revision history for this message
Martin Olsson (mnemo) wrote :

I'm working closely with upstream on this one, intel QA staff have confirmed it in UXA but they can't repro it in EXA yet (even though I can repro it using EXA even with .29-rc8 kernel and xorg-edgers userspace as of today).

The fdo bug already got backtrace, dmesg, xorg.log so this bug report is to be considered "a tracking item only" I guess (marking as confirmed).

As far as classification goes, I think it's an intel DRI bug so I'm changing it to mesa for now. For example, the top frames of the SEGV bt in EXA looks like this:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fe043d75700 (LWP 4250)]
driBindContext (pcp=0x7b9c160, pdp=0x502fc0, prp=0x502fc0) at
../common/dri_util.c:178
178 ../common/dri_util.c: No such file or directory.
        in ../common/dri_util.c
(gdb) bt
#0 driBindContext (pcp=0x7b9c160, pdp=0x502fc0, prp=0x502fc0) at
../common/dri_util.c:178
#1 0x00007fe0405f0876 in __glXForceCurrent (cl=0x696fe20, tag=<value optimized
out>, error=0x7fff4bda6abc) at ../../glx/glxext.c:394
#2 0x00007fe0405ee9ee in DoMakeCurrent (cl=0x696fe20, drawId=<value optimized
out>, readId=62914831, contextId=<value optimized out>, tag=1)
    at ../../glx/glxcmds.c:605
#3 0x00007fe0405f0de2 in __glXDispatch (client=0x5dcaf00) at
../../glx/glxext.c:523
...

Changed in xserver-xorg-video-intel:
status: Incomplete → Confirmed
Bug Watch Updater (bug-watch-updater)
Changed in xorg-server:
status: Unknown → Confirmed
Revision history for this message
In , Gordon Jin (gordon-jin) wrote :

I have to reassign this to Eric since I can't reproduce this with EXA, and only see the problem with UXA (reported in bug#19177).

Revision history for this message
Marc Kaplan (marc-kaplan) wrote :

Not sure if recent update to xserver-xorg-nv was supposed to work, but it did not. Attached Xorg log from recent failure to help for bug tracking.

Revision history for this message
Martin Olsson (mnemo) wrote :

Marc, this issue is about a bug in the intel driver. If you have an issue related to an NVidia card then it's 100% certainly not related to this bug.

Revision history for this message
Timo Aaltonen (tjaalton) wrote :

Please try mesa 7.4 from my ppa:

https://edge.launchpad.net/~tjaalton/+archive/ppa

Changed in mesa (Ubuntu):
status: Confirmed → Incomplete
Revision history for this message
Martin Olsson (mnemo) wrote :

Hi Timo. This bug still repros in both UXA and in EXA with the mesa7.4 you uploaded today. This is not that surprising to me though because I repro'd it with 2.6.29rc8+xorg_edgers a while back (see upstream bug report if you want to see exact version numbers).

Changed in mesa (Ubuntu):
status: Incomplete → Confirmed
Revision history for this message
In , Martin Olsson (mnemo) wrote :

*** Bug 21193 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Martin Olsson (mnemo) wrote :

Information from duplicate bug 21193: user liuhaien <email address hidden> was able to repro this bug (in UXA) using Fedora 9 plus the following versions from GIT.

System Environment:
--------------------------
Host: x-945gm
Arch: i386
Platform: 945GM
OSD: Fedora release 9 (Sulphur)
Kernel_version: 2.6.29.1
Libdrm: (master)07646002c6835537c6ae44ef9b3f8480762279b8
Mesa: (mesa_7_4_branch)de197cf991416f0cd65ad2e2d2ca9aa599b52075
Xserver: (server-1.6-branch)60c161545af80eb78eb790a05bde79409dfdf16e
Xf86_video_intel: (2.7)121bd7ff7cfd9a43fbb61fa56f06ba2d2b55035e
Kernel: (drm-intel-2.6.29)0aa7e8a61658193f90198d579c5ef8297b45be9b
Bug detailed description:
-------------------------
startx with uxa, then run glean case makeCurrent,X will crash soon.the
backtrace from gdb is as below:
#0 0xb7eb3d1b in DRI2GetBuffers (pDraw=0x0, width=0x9754f04,
    height=0x9754f08, attachments=0xbff0c478, count=4, out_count=0xbff0c4a4)
    at dri2.c:139
#1 0xb7e51295 in dri2GetBuffers (driDrawable=0x9754ee0, width=0x9754f04,
    height=0x9754f08, attachments=0xbff0c478, count=4, out_count=0xbff0c4a4,
    loaderPrivate=0x9754e38) at glxdri2.c:363
#2 0xa7a4be10 in intel_update_renderbuffers (context=0x93ce2d0,
    drawable=0x9754ee0) at intel_context.c:235
#3 0xa7a4c261 in intelMakeCurrent (driContextPriv=0x93ce2d0,
    driDrawPriv=0x9754ee0, driReadPriv=0x9754ee0) at intel_context.c:837
#4 0xa7a272be in driBindContext (pcp=0x93ce2d0, pdp=0x9754ee0, prp=0x9754ee0)
    at ../common/dri_util.c:203
#5 0xb7e5113c in __glXDRIcontextForceCurrent (baseContext=0x93d3350)
    at glxdri2.c:202
#6 0xb7e46356 in __glXForceCurrent (cl=0x93cf2d0, tag=1, error=0xbff0c5a8)
    at glxext.c:394
#7 0xb7e43fe7 in DoMakeCurrent (cl=0x93cf2d0, drawId=<value optimized out>,
    readId=0, contextId=0, tag=1) at glxcmds.c:605
#8 0xb7e46876 in __glXDispatch (client=0x93ebec8) at glxext.c:523
#9 0x0808672f in Dispatch () at dispatch.c:437
#10 0x0806c65d in main (argc=2, argv=0xbff0c724, envp=0x9754e38) at main.c:397

Reproduce Steps:
------------------------
1.xinit& (with uxa)
2. run glean case makeCurrent

Revision history for this message
In , Gordon Jin (gordon-jin) wrote :

Please validate if below commit fixes:

Author: Brian Paul <email address hidden>
Date: Wed Jun 17 07:58:35 2009 -0600

GLX: attempt to fix glean makeCurrent test cases.

Two parts to this:

One we don't keep pointers to possibly freed memory anymore once we unbind the
drawables from the context. Brian I need to figure out what the comment
you made there, can we get a glean/piglit test so we can fix it properly?

If the new gc is the same as the oldGC, we call the unbind even though
we just bound it in that function. doh.

(cherry picked from master, commit 77506dac8e81e9548a7e9680ce367175fe5747af)

Revision history for this message
In , Martin Olsson (mnemo) wrote :

zhao jian, since you were able to repro can you check with UXA and the suggested patch? My G45 machine is packed in a moving box in another country, I will be only able to check the repro with the suggested patch after mid-August at the earliest.

Revision history for this message
In , Yu-dai (yu-dai) wrote :

I found the similar failure when running glean makeCurrent on Moblin2, Mesa 7.4 and xserver 1.6.2. I think it could be the same issue talking about here.

The root cause I believe is that Mesa tries to send a request to X to unbind a destroyed context. I have to check oldGC->xid. If None, then means it is destroyed and don't send request to X. I attach the patch. It works for my case. Hopefully it also resolve your issue and any comment is welcome.

Revision history for this message
In , Yu-dai (yu-dai) wrote :

Created an attachment (id=27179)
patch made for mesa/src/glx/x11/glxcurrent.c

The patch is based on mesa/gallium-mesa-7.4 branch

Revision history for this message
In , Yu-dai (yu-dai) wrote :

Add mesa-dev mailing list to review my previous patch for glean makeCurrent issue.

Revision history for this message
In , Eric Anholt (eric-anholt) wrote :

Appears to work now with current Mesa and X Server.

Bug Watch Updater (bug-watch-updater)
Changed in xorg-server:
status: Confirmed → Fix Released
Revision history for this message
In , Jian-j-zhao (jian-j-zhao) wrote :

Yes. I tried with the newest code on G45, it works well.
Libdrm: (master)de1ed01214874dcdd6116ff2587c8710d6ed4d2d
Mesa: (master)5e6b593d35156a0068dc0eb3e55dec086f1cadd3
Xserver: (master)3525d140567e0ad5f0184e4b37893c47239e1628
Xf86_video_intel: (master)1e4784bf26e3c154f5673f7b5add3ef7af3b1474

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package mesa - 7.5-1ubuntu1

---------------
mesa (7.5-1ubuntu1) karmic; urgency=low

  * Merge from Debian. Remaining Ubuntu changes:
    - debian/control
      + Change maintainer address to Ubuntu.
      + Drop lesstif-dev from Build-Depends.
      + Comment out GLw libs since it depends on lesstif-dev.
    - debian/rules
      + Unexport LDFLAGS (amd64 FTBFS).
      + Use --disable-glw for swx11 targets too.
      + Don't enable motif for swx11 targets.
      + Build .debs with lzma compression.
      + Serialize install phase as suggested by Julien Cristau,
        fixes amd64 FTBFS.
    - debian/patches
      + 101_ubuntu_hidden_glname.patch
      + 102_dont_vblank.patch
      + 107_glxgears_is_not_a_benchmark.patch
  * Dropped patches, applied upstream:
    - 108_bo_assertion.patch
  * Mesa 7.5 fixes the following Ubuntu bugs:
    - Fixes intelTexImage Assertion failed (LP: #358403)
    - Fixes segv during glean/makeCurrent (LP: #333748)

 -- Bryce Harrington <email address hidden> Tue, 21 Jul 2009 00:41:19 -0700

Changed in mesa (Ubuntu):
status: Confirmed → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in xorg-server:
importance: Unknown → Critical
Bug Watch Updater (bug-watch-updater)
Changed in xorg-server:
importance: Critical → Unknown
Bug Watch Updater (bug-watch-updater)
Changed in xorg-server:
importance: Unknown → Critical
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.