Probem with some drawing ops falling back to software

[Michael]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

I have a driver for a graphics device which doesn't let me map the  
framebuffer ( at least not in a form usable by the Xserver as it is ),  
so the driver attempts to do all drawing operations by hardware. This  
used to work fine in 1.4.2  but in 1.6 some operations started falling  
back to software. The reason for this appears to be, that at some  
point a Drawable is created from what X thinks is the visible screen  
but its type is set to DRAWABLE_PIXMAP so fallback drawing ops are  
used and fail. For some reason this happens when xterm tries to draw  
its border as a series of narrow rectangles. The other operations seem  
to use the right drawing ops.
Any idea where to start digging? This doesn't seem to be XAA's fault  
since as far as XAA can tell the drawable is in memory so falling back  
to software is what it's supposed to do. The question is why do we end  
up with a drawable with the wrong type here?

The resulting stack trace looks like this:
Program received signal SIGBUS, Bus error.
fast_path_fill (imp=<value optimized out>, bits=0x7c3d0000,
     stride=<value optimized out>, bpp=<value optimized out>, x=0, y=0,
     width=486, height=1, xor=0)
     at /usr/xsrc/external/mit/pixman/dist/pixman/pixman-fast-path.c: 
1320
1320                bits[i] = xor;
(gdb) bt
#0  fast_path_fill (imp=<value optimized out>, bits=0x7c3d0000,
     stride=<value optimized out>, bpp=<value optimized out>, x=0, y=0,
     width=486, height=1, xor=0)
     at /usr/xsrc/external/mit/pixman/dist/pixman/pixman-fast-path.c: 
1320
#1  0x7dea3980 in pixman_fill (bits=0x7c3d0000, stride=1280, bpp=32,  
x=0, y=0,
     width=486, height=1, xor=0)
     at /usr/xsrc/external/mit/pixman/dist/pixman/pixman.c:185
#2  0x00638710 in fbFill (pDrawable=0x7d20d790, pGC=<value optimized  
out>,
     x=0, y=0, width=486, height=1)
     at /usr/xsrc/external/mit/xorg-server/dist/fb/fbfill.c:48
#3  0x0062d474 in fbPolyFillRect (pDrawable=0x7d20d790, pGC=0x7d266260,
     nrect=3, prect=0x7bbacda0)
     at /usr/xsrc/external/mit/xorg-server/dist/fb/fbfillrect.c:77
#4  0x7ce57bb8 in XAAPolyFillRectPixmap (pDraw=0x7d20d790,  
pGC=0x7d266260,
     nrectFill=4, prectInit=0x7bbacda0)
     at /usr/xsrc/external/mit/xorg-server/dist/hw/xfree86/xaa/xaaGC.c: 
523
#5  0x00573530 in cwPolyFillRect (pDst=<value optimized out>,  
pGC=0x7d266260,
     nrects=4, pRects=0x7bbacda0)
     at /usr/xsrc/external/mit/xorg-server/dist/miext/cw/cw_ops.c:345
#6  0x00568bc4 in damagePolyFillRect (pDrawable=0x7d20d790,  
pGC=0x7d266260,
     nRects=4, pRects=0x7bbacda0)
     at /usr/xsrc/external/mit/xorg-server/dist/miext/damage/damage.c: 
1404
#7  0x0051b688 in miPaintWindow (pWin=<value optimized out>,  
prgn=0x7bbacd6c,
     what=<value optimized out>)
     at /usr/xsrc/external/mit/xorg-server/dist/mi/miexpose.c:629
#8  0x00515ab4 in miHandleValidateExposures (pWin=0x7d2511a0)
     at /usr/xsrc/external/mit/xorg-server/dist/mi/miwindow.c:243
#9  0x004378a0 in MapWindow (pWin=0x7d251470, client=0x7d210600)
     at /usr/xsrc/external/mit/xorg-server/dist/dix/window.c:2706
#10 0x004617c8 in ProcMapWindow (client=0x7d266260)
     at /usr/xsrc/external/mit/xorg-server/dist/dix/dispatch.c:675
#11 0x0046244c in Dispatch ()
     at /usr/xsrc/external/mit/xorg-server/dist/dix/dispatch.c:439
#12 0x004441e4 in main (argc=1, argv=0x7fffd814, envp=<value optimized  
out>)
     at /usr/xsrc/external/mit/xorg-server/dist/dix/main.c:397

The SIGBUS is not the bug - I intntionally hand the Xserver a write- 
protected buffer to catch attempts to scribble into framebuffer memory.
Also, the DAMAGE extension is disabled, why is it still being called?

In fast_path_fill() the bits parameter points at my fake framebuffer,  
the pDrawable and pGC in fbPolyFillRect() look like this:
(gdb) print *pDrawable
$17 = {type = 1 '\001', class = 0 '\0', depth = 24 '\030',
   bitsPerPixel = 32 ' ', id = 0, x = 0, y = 0, width = 1280, height =  
1024,
   pScreen = 0x7d23c180, serialNumber = 2}
(gdb) print *pGC
$18 = {pScreen = 0x7d23c180, depth = 24 '\030', alu = 3 '\003',  
lineWidth = 0,
   dashOffset = 0, numInDashList = 2, dash = 0x6b3990 "\004\004",
   lineStyle = 0, capStyle = 1, joinStyle = 0, fillStyle = 0, fillRule  
= 0,
   arcMode = 0, subWindowMode = 0, graphicsExposures = 0,  
clientClipType = 0,
   miTranslate = 1, tileIsPixel = 1, fExpose = 1, freeCompClip = 1,
   unused = 189, planemask = 4294967295, fgPixel = 0, bgPixel = 1,  
tile = {
     pixmap = 0x0, pixel = 0}, stipple = 0x0, patOrg = {x = 0, y = 0},
   font = 0x0, clipOrg = {x = 0, y = 0}, lastWinOrg = {x = 0, y = 0},
   clientClip = 0x0, stateChanges = 0, serialNumber = 2, funcs =  
0x6b2a4c,
   ops = 0x6b2a6c, devPrivates = 0x7d224480, pRotatedPixmap = 0x0,
   pCompositeClip = 0x7bb41be0}

Any ideas?

have fun
Michael

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)

iQEVAwUBSrAgvspnzkX8Yg2nAQIeEAf/aiWpLnapAyIqgVjxgc7U1jbY7B4owidz
wkKV6S21Qrq8O4YrVAObFwDqKj9cOcRNvb39MTYcbeENQEkqYWhb4hl6pq8FVzfJ
6NX8GlVXlO9f3oruw+XjQv6vRn0PTg5UQGutl08JMP6BzSPuLJPTPiHjU6XkFokq
GCEYFfo3sTa5E8S9ZAfef7G3IvCC4aJcOQUXTgk1wY8FW4efTRl5byNPfV+UMlSP
M4cJFZSHuwlYfK/YtQ0sijag5IueCaMsScWrioREAqRk3XQEQk6Wuuh40laqkiPy
0CyxzNEZrNTPVyrjB+EqhWTSXyiKqVuLM1u1Xv1RjbwmBkD+JtRgdw==
=E322
-----END PGP SIGNATURE-----