Crash with EXA and HD5770

Thu Nov 11 13:34:35 PST 2010

Hello Alex and radeon driver developers,

first I have to say thanks for your work on Evergreen acceleration. The
CPU load for video scalling seem to be 50-70% lower with Xv.

Now the bad news, it crashes my X server sometimes. It's pretty
reproducible with DDD and graphical variable display; double-clicking a
pointer brings the X server down instead of showing buble with the pointed
contents.

I am using a git snapshot from yesterday built with Xorg 1.9 from Debian
Experimental, on a Sid/amd64 system.

A quick backtrace result is attached. Let me know if you need the whole
core dump. AFAICS radeon_vbo_space returns a NULL pointer which is never
checked. No idea why it gets NULL in the first place, maybe the gdb log
helps finding the cause.

Regards,
Eduard.

Core was generated by `/usr/bin/X :0 vt7 -nolisten tcp -core -auth /var/lib/xdm/authdir/authfiles/A:0-'.
Program terminated with signal 6, Aborted.
#0  0x00007fbbf59dc165 in raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64	../nptl/sysdeps/unix/sysv/linux/raise.c: Datei oder Verzeichnis nicht gefunden.
	in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) bt
#0  0x00007fbbf59dc165 in raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007fbbf59def70 in abort () at abort.c:92
#2  0x00000000004648be in OsAbort () at ../../os/utils.c:1260
#3  0x000000000047032d in ddxGiveUp () at ../../../../hw/xfree86/common/xf86Init.c:940
#4  0x000000000045b85d in AbortServer () at ../../os/log.c:424
#5  0x000000000045c030 in FatalError (f=0x578758 "Caught signal %d (%s). Server aborting\n") at ../../os/log.c:552
#6  0x000000000045f9de in OsSigHandler (signo=11, sip=0x0, unused=<value optimized out>) at ../../os/osinit.c:156
#7  <signal handler called>
#8  0x00007fbbf39aac94 in EVERGREENSolid (pPix=0x1dc2450, x1=6, y1=890, x2=1260, y2=908) at evergreen_exa.c:334
#9  0x00007fbbf3252075 in exaFillRegionSolid (pDrawable=0x2144190, pRegion=<value optimized out>, pixel=<value optimized out>, planemask=<value optimized out>, alu=<value optimized out>, 
    clientClipType=<value optimized out>) at ../../exa/exa_accel.c:1038
#10 0x00007fbbf32532b1 in exaPolyFillRect (pDrawable=0x2144190, pGC=0x1dc4540, nrect=<value optimized out>, prect=0x2250f60) at ../../exa/exa_accel.c:819
#11 0x00000000004d52dd in damagePolyFillRect (pDrawable=0x2144190, pGC=0x1dc4540, nRects=1, pRects=0x3) at ../../../miext/damage/damage.c:1396
#12 0x000000000045921a in miPaintWindow (pWin=<value optimized out>, prgn=0x7fffb4650ec0, what=<value optimized out>) at ../../mi/miexpose.c:670
#13 0x000000000056fedd in miClearToBackground (pWin=0x2144190, x=<value optimized out>, y=<value optimized out>, w=<value optimized out>, h=<value optimized out>, generateExposures=0) at ../../mi/miwindow.c:119
#14 0x0000000000430e71 in ProcClearToBackground (client=0x2139aa0) at ../../dix/dispatch.c:1620
#15 0x00000000004340a9 in Dispatch () at ../../dix/dispatch.c:432
#16 0x000000000042573b in main (argc=8, argv=0x7fffb46510f8, envp=<value optimized out>) at ../../dix/main.c:291
(gdb) print pScrn
$1 = (ScrnInfoPtr) 0x1d6fe30
(gdb) print *pScrn
$2 = {driverVersion = 6304867, driverName = 0x7fbbf39de2cb "radeon", pScreen = 0x1d80530, scrnIndex = 0, configured = 1, origIndex = 0, imageByteOrder = 0, bitmapScanlineUnit = 32, bitmapScanlinePad = 32, bitmapBitOrder = 0, numFormats = 0, formats = {{depth = 0 '\000', bitsPerPixel = 0 '\000', scanlinePad = 0 '\000'}, {depth = 0 '\000', bitsPerPixel = 0 '\000', scanlinePad = 0 '\000'}, {depth = 0 '\000', bitsPerPixel = 0 '\000', scanlinePad = 0 '\000'}, {depth = 0 '\000', bitsPerPixel = 0 '\000', scanlinePad = 0 '\000'}, {depth = 0 '\000', bitsPerPixel = 0 '\000', scanlinePad = 0 '\000'}, {depth = 0 '\000', bitsPerPixel = 0 '\000', scanlinePad = 0 '\000'}, {depth = 0 '\000', bitsPerPixel = 0 '\000', scanlinePad = 0 '\000'}, {depth = 0 '\000', bitsPerPixel = 0 '\000', scanlinePad = 0 '\000'}}, fbFormat = {depth = 24 '\030', bitsPerPixel = 32 ' ', scanlinePad = 32 ' '}, bitsPerPixel = 32, pixmap24 = Pix24Use32, depth = 24, depthFrom = X_CONFIG, bitsPerPixelFrom = X_PROBED, weight = {red = 8, green = 8, blue = 8}, mask = {red = 16711680, green = 65280, blue = 255}, offset = {red = 16, green = 8, blue = 0}, rgbBits = 8, gamma = {red = 1, green = 1, blue = 1}, defaultVisual = 4, maxHValue = 0, maxVValue = 0, virtualX = 1280, virtualY = 1024, xInc = 0, virtualFrom = X_PROBED, displayWidth = 1280, frameX0 = 0, frameY0 = 0, frameX1 = 1279, frameY1 = 1023, zoomLocked = 0, modePool = 0x0, modes = 0x1d7f020, currentMode = 0x1d7f020, confScreen = 0x1d59cc0, monitor = 0x1d518d0, display = 0x1d58bb0, entityList = 0x1d70430, numEntities = 1, widthmm = 0, heightmm = 0, xDpi = 96, yDpi = 96, name = 0x7fbbf39de21f "RADEON", driverPrivate = 0x1d73700, privates = 0x1d6fd60, drv = 0x1d691f0, module = 0x1d703c0, colorKey = 0, overlayFlags = 0, chipset = 0x7fbbf39ebfbb "ATI Radeon HD 5700 Series", ramdac = 0x0, clockchip = 0x0, progClock = 0, numClocks = 0, clock = {0 <repeats 128 times>}, videoRam = 0, biosBase = 0, memPhysBase = 0, fbOffset = 0, domainIOBase = 0, memClk = 0, textClockFreq = 0, flipPixels = 0, options = 0x1d74430, chipID = 0, chipRev = 0, vtSema = 0, pixmapPrivate = {ptr = 0x0, val = 0, uval = 0, fptr = 0}, silkenMouse = 1, clockRanges = 0x0, adjustFlags = 0, reservedInt = {0 <repeats 16 times>}, entityInstanceList = 0x1d70450, vgaDev = 0x1d65f00, reservedPtr = {0x0 <repeats 14 times>}, Probe = 0, PreInit = 0x7fbbf39c77d3 <RADEONPreInit_KMS>, ScreenInit = 0x7fbbf39c8405 <RADEONScreenInit_KMS>, SwitchMode = 0x547060 <xf86CursorSwitchMode>, AdjustFrame = 0x526740 <xf86XVAdjustFrame>, EnterVT = 0x490eb0 <xf86RandR12EnterVT>, LeaveVT = 0x5261f0 <xf86XVLeaveVT>, FreeScreen = 0x7fbbf39c838e <RADEONFreeScreen_KMS>, ValidMode = 0x7fbbf38e3079 <RADEONValidMode>, EnableDisableFBAccess = 0x5477e0 <xf86CursorEnableDisableFBAccess>, SetDGAMode = 0x46e120 <xf86SetDGAMode>, ChangeGamma = 0x490250 <xf86RandR12ChangeGamma>, PointerMoved = 0x490fb0 <xf86RandR12PointerMoved>, PMEvent = 0, DPMSSet = 0x4875f0 <xf86DPMSSet>, LoadPalette = 0, SetOverscan = 0, DriverFunc = 0, reservedFuncs = {0 <repeats 11 times>}}
(gdb) print accel_state
$3 = (struct radeon_accel_state *) 0x1d7fb00
(gdb) print *accel_state
$4 = {fifo_slots = 0, dp_gui_master_cntl = 0, dp_gui_master_cntl_clip = 0, trans_color = 0, xdir = 0, ydir = 0, dst_pitch_offset = 0, texW = {0, 0}, texH = {0, 0}, XInited3D = 0, num_gb_pipes = 0, has_tcl = 1, exa = 0x1d927e0, exaSyncMarker = 267422, exaMarkerSynced = 0, engineMode = 0, composite_op = 0, dst_pic = 0x0, msk_pic = 0x21eb750, src_pic = 0x0, dst_pix = 0x0, msk_pix = 0x0, src_pix = 0x0, is_transform = {0, 0}, transform = {0x2256f40, 0x0}, need_src_tile_x = 0, need_src_tile_y = 0, src_tile_width = 0, src_tile_height = 0, draw_header = 0x0, vtx_count = 0, num_vtx = 0, vsync = 0, ib = 0x0, vbo = {vb_offset = 0, vb_mc_addr = 0, vb_total = 16384, vb_ptr = 0x0, vb_size = 24, vb_op_vert_size = 8, vb_start_op = 0, vb_bo = 0x2280d40, verts_per_op = 3}, cbuf = {vb_offset = 256, vb_mc_addr = 0, vb_total = 16384, vb_ptr = 0x0, vb_size = 0, vb_op_vert_size = 256, vb_start_op = 0, vb_bo = 0x2299940, verts_per_op = 1}, ib_reset_op = 0, bo_free = {next = 0x2269250, prev = 0x228d000, bo = 0x0, expire_counter = 10788}, bo_wait = {next = 0x2269a10, prev = 0x228abe0, bo = 0x0, expire_counter = 0}, bo_reserved = {next = 0x228d340, prev = 0x2287a90, bo = 0x0, expire_counter = 0}, use_vbos = 1, finish_op = 0x7fbbf39b796d <evergreen_finish_op>, shaders = 0x0, shaders_bo = 0x1d94090, solid_vs_offset = 0, solid_ps_offset = 512, copy_vs_offset = 1024, copy_ps_offset = 1536, comp_vs_offset = 2048, comp_ps_offset = 2560, xv_vs_offset = 3072, xv_ps_offset = 3584, solid_vs_const_offset = 0, solid_ps_const_offset = 0, copy_vs_const_offset = 0, copy_ps_const_offset = 0, comp_vs_const_offset = 0, comp_ps_const_offset = 0, comp_mask_ps_const_offset = 0, xv_vs_const_offset = 0, xv_ps_const_offset = 0, src_obj = {{pitch = 0, width = 0, height = 0, offset = 0, bpp = 0, domain = 0, bo = 0x0}, {pitch = 0, width = 0, height = 0, offset = 0, bpp = 0, domain = 0, bo = 0x0}}, dst_obj = {pitch = 1280, width = 1280, height = 1024, offset = 0, bpp = 32, domain = 4, bo = 0x1d92ad0}, src_size = {0, 0}, dst_size = 5242880, vs_size = 512, vs_mc_addr = 0, ps_size = 512, ps_mc_addr = 512, scratch = 0x0, copy_area = 0x0, copy_area_bo = 0x2286160, same_surface = 0, rop = 3, planemask = 4294967295, component_alpha = 1, src_alpha = 0, vline_crtc = 0x0, vline_y1 = -1, vline_y2 = 0, accel = 0x0, scratch_buffer = {0x0}, scratch_save = 0x0, scanline_x = 0, scanline_y = 0, scanline_w = 0, scanline_h = 0, scanline_h_w = 0, scanline_words = 0, scanline_direct = 0, scanline_bpp = 0, scanline_fg = 0, scanline_bg = 0, scanline_hpass = 0, scanline_x1clip = 0, scanline_x2clip = 0, dashLen = 0, dashPattern = 0, dash_fg = 0, dash_bg = 0, RenderTex = 0x0, RenderCallback = 0, RenderTimeout = 0, XAAForceTransBlit = 0}
(gdb) print vb
$6 = (float *) 0x0