[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

Michel D?nzer  changed:

   What|Removed |Added

   Assignee|dri-devel at lists.freedesktop |mesa-dev at 
lists.freedesktop.
   |.org|org
 CC||deathsimple at vodafone.de
  Component|Drivers/Gallium/r600|Mesa core

--- Comment #16 from Michel D?nzer  ---
Okay, looks like it's crashing in st_texture_release_all_sampler_views(),
specifically on this line of pipe_sampler_view_reference():

  old_view->context->sampler_view_destroy(old_view->context, old_view);

Maybe old_view->context is no longer a valid context.

(In reply to comment #14)
> I have some difficulties getting bt (don't know why):

That looks like a different crash. Or maybe this is actually part of the normal
operation of the JavaScript JIT; what happens if you run 'continue' when this
happens?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #15 from Eugene  ---
There are only two r600_dri.so files:

locate r600_dri.so
/usr/lib/i386-linux-gnu/dri/r600_dri.so
/usr/lib/x86_64-linux-gnu/dri/r600_dri.so

And trying the one in i386-linux-gnu directory gives nothing. Only x86_64
version gives something
(https://crash-stats.mozilla.com/report/index/b964df8c-1a33-4302-ba89-686422140811):

addr2line 0x1ee641 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so 
/build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/mesa/../../../../src/gallium/auxiliary/util/u_inlines.h:151

addr2line 0x1c0669 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so 
/build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/mesa/../../../../src/mesa/state_tracker/st_cb_texture.c:157

addr2line 0x14da8d -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so 
/build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/mesa/../../../../src/mesa/main/shared.c:298

addr2line 0x940bb -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so 
/build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/mesa/../../../../src/mesa/main/context.c:1255

addr2line 0x1c47e0 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so 
/build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/mesa/../../../../src/mesa/state_tracker/st_context.c:333

addr2line 0x29adce -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so 
/build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/gallium/state_trackers/dri/../../../../../../src/gallium/state_trackers/dri/dri_context.c:194

addr2line 0x2977f2 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so 
/build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/mesa/drivers/dri/common/../../../../../../../src/mesa/drivers/dri/common/dri_util.c:487

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #14 from Eugene  ---
I have some difficulties getting bt (don't know why):

Starting program: /usr/lib/firefox/firefox 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffe9be4700 (LWP 4870)]
[Thread 0x7fffe9be4700 (LWP 4870) exited]
[New Thread 0x7fffe9be4700 (LWP 4873)]
[New Thread 0x7fffe2eff700 (LWP 4874)]
[New Thread 0x7fffe1ee6700 (LWP 4875)]
[New Thread 0x7fffe16e5700 (LWP 4876)]
[New Thread 0x7fffe0aff700 (LWP 4877)]
[New Thread 0x7fffdeed0700 (LWP 4880)]
[New Thread 0x7fffde4ff700 (LWP 4881)]
[New Thread 0x7fffe3030700 (LWP 4882)]
[New Thread 0x7fffdd5ff700 (LWP 4883)]
[New Thread 0x7fffdc7ff700 (LWP 4884)]
[New Thread 0x7fffe0ee4700 (LWP 4885)]
[New Thread 0x7fffde6cf700 (LWP 4886)]
[New Thread 0x7fffddcfe700 (LWP 4887)]
[New Thread 0x7fffdcdfe700 (LWP 4888)]
[New Thread 0x7fffc17ff700 (LWP 4889)]
[New Thread 0x7fffc09ff700 (LWP 4890)]
[New Thread 0x7fffc03ff700 (LWP 4891)]
[New Thread 0x7fffbfbfe700 (LWP 4892)]
[New Thread 0x7fffbf3fd700 (LWP 4893)]
[New Thread 0x7fffbebfc700 (LWP 4894)]
[New Thread 0x7fffbe1ff700 (LWP 4895)]
[New Thread 0x7fffbd9fe700 (LWP 4896)]
[Thread 0x7fffdc7ff700 (LWP 4884) exited]
[New Thread 0x7fffbcfff700 (LWP 4897)]
[Thread 0x7fffbf3fd700 (LWP 4893) exited]
[Thread 0x7fffbebfc700 (LWP 4894) exited]
[New Thread 0x7fffbc7fe700 (LWP 4898)]
[New Thread 0x7fffdc7ff700 (LWP 4899)]
[New Thread 0x7fffbf3fd700 (LWP 4900)]
[Thread 0x7fffdc7ff700 (LWP 4899) exited]
[Thread 0x7fffbfbfe700 (LWP 4892) exited]
[Thread 0x7fffbf3fd700 (LWP 4900) exited]
[New Thread 0x7fffbf3fd700 (LWP 4901)]
[Thread 0x7fffbf3fd700 (LWP 4901) exited]
[New Thread 0x7fffbf3fd700 (LWP 4902)]
[Thread 0x7fffbc7fe700 (LWP 4898) exited]
[New Thread 0x7fffbc7fe700 (LWP 4903)]
[New Thread 0x7fffdc7ff700 (LWP 4904)]
[Thread 0x7fffbf3fd700 (LWP 4902) exited]
[Thread 0x7fffbc7fe700 (LWP 4903) exited]
[New Thread 0x7fffbf3fd700 (LWP 4905)]
[New Thread 0x7fffbc7fe700 (LWP 4906)]
[New Thread 0x7fffbfbfe700 (LWP 4907)]

Program received signal SIGSEGV, Segmentation fault.
PatchJump (label=..., jump=...) at
/build/buildd/firefox-31.0+build1/js/src/jit/x64/Assembler-x64.h:716
716/build/buildd/firefox-31.0+build1/js/src/jit/x64/Assembler-x64.h: ?
?? ? ??? .
Quit
#0  PatchJump (label=..., jump=...) at
/build/buildd/firefox-31.0+build1/js/src/jit/x64/Assembler-x64.h:716
No locals.
#1  js::jit::JitRuntime::patchIonBackedges (this=, rt=, target=target at entry=js::jit::JitRuntime::BackedgeLoopHeader) at
/build/buildd/firefox-31.0+build1/js/src/jit/Ion.cpp:412
iter = {iter = 0x7fffbaaec5e0}
#2  0x732cab85 in js::jit::InterruptCheck (cx=0x7fffde553480) at
/build/buildd/firefox-31.0+build1/js/src/jit/VMFunctions.cpp:523
No locals.
#3  0x77e5627a in ?? ()
No symbol table info available.
#4  0x7fff78b8 in ?? ()
No symbol table info available.
#5  0x7fff7840 in ?? ()
No symbol table info available.
#6  0x754f0840 in DeepCloneObjectLiteralInfo () from
/usr/lib/firefox/libxul.so
No symbol table info available.
#7  0x7fffe0d34880 in ?? ()
No symbol table info available.
#8  0x7fffdb8e8b59 in ?? ()
No symbol table info available.
#9  0x0601 in ?? ()
No symbol table info available.
#10 0x7fff78b8 in ?? ()
No symbol table info available.
#11 0xfffbe0b77700 in ?? ()
No symbol table info available.
#12 0xfffbdb721b00 in ?? ()
No symbol table info available.
#13 0x24a0f352d0012900 in ?? ()
No symbol table info available.
#14 0x7fff7990 in ?? ()
No symbol table info available.
#15 0xfff88058 in ?? ()
No symbol table info available.
#16 0x7fffdb730a80 in ?? ()
No symbol table info available.
#17 0x in ?? ()
No symbol table info available.
Quit


P.S. libgl1-mesa-dri-dbg and firefox-dbg is definitely installed.

Any suggestions ?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #13 from Michel D?nzer  ---
You didn't do anything particularly wrong (though note that for the frames that
say libGL.so.1.2.0@*, you need to pass libGL.so.1.2.0 instead of r600_dri.so to
addr2line), but the resolved source code lines don't seem to have any sensible
correspondence. :( Are you sure Firefox was using the same
/usr/lib/x86_64-linux-gnu/dri/r600_dri.so file when it crashed?

Would it be possible for you to run Firefox in gdb, reproduce the crash and
then attach the output of bt full?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #12 from Eugene  ---
Is it enough or may be something I did wrong ? Please tell me if so.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #11 from Eugene  ---
addr2line 0x1ba0a1 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so
/build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/mesa/../../../../src/mesa/state_tracker/st_cb_drawpixels.c:1102

addr2line 0x18c0b9 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so
/build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/mesa/../../../../src/mesa/vbo/vbo_attrib_tmp.h:161

addr2line 0x1145dd -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so
/build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/mesa/../../../../src/mesa/main/glformats.c:418

addr2line 0x93e6b -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so
/build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/mesa/../../../../src/mesa/main/context.c:1255

addr2line 0x190220 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so
/build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/mesa/../../../../src/gallium/auxiliary/util/u_format_r11g11b10f.h:112

addr2line 0x28ea1f -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so
/build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/glsl/../../../../src/glsl/list.h:440
(discriminator 2)

addr2line 0x2657be -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so
/build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/glsl/../../../../src/glsl/ir_clone.cpp:193


addr2line 0x2621e2 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so
/build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/glsl/../../../../src/glsl/ir.cpp:632

addr2line 0x42cce -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so
??:0

addr2line 0x1c318 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so
??:0

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #10 from Michel D?nzer  ---
In the crash report referenced in comment 7, frame 1 says r600_dri.so at 
0x1ba0a1,
so the address of frame 1 is 0x1ba0a1.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #9 from Eugene  ---
(In reply to comment #8)
> (In reply to comment #7)
> > Yes, I'm using Kubuntu. And Libgl1-mesa-dri-dbg recently installed. Last
> > report is here:
> 
> It still doesn't resolve the symbols, please use addr2line.

With what frame address I should use it or how to determine it ?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #8 from Michel D?nzer  ---
(In reply to comment #7)
> Yes, I'm using Kubuntu. And Libgl1-mesa-dri-dbg recently installed. Last
> report is here:

It still doesn't resolve the symbols, please use addr2line.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #7 from Eugene  ---
(In reply to comment #6)
> (In reply to comment #5)
> > Sorry, but I don't understand how to determine how r600_dri.so was built and
> > etc.
> 
> Since you seem to be using Ubuntu, installing the libgl1-mesa-dri-dbg
> package should make sure there are debugging symbols for r600_dri.so.

Yes, I'm using Kubuntu. And Libgl1-mesa-dri-dbg recently installed. Last report
is here:
https://crash-stats.mozilla.com/report/index/eee0e46e-1b64-4288-b9ac-fd5a82140804

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #6 from Michel D?nzer  ---
(In reply to comment #5)
> Sorry, but I don't understand how to determine how r600_dri.so was built and
> etc.

Since you seem to be using Ubuntu, installing the libgl1-mesa-dri-dbg package
should make sure there are debugging symbols for r600_dri.so.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #5 from Eugene  ---
(In reply to comment #4)
> (In reply to comment #3)
> > (In reply to comment #2)
> > > Can you resolve the r600_dri.so symbols?
> > 
> > If you'll explain me how to.
> 
> First of all, make sure r600_dri.so has debugging symbols, i.e. is built
> with -g and not stripped.
> 
> If the Mozilla crash reporter still doesn't resolve the symbols then, try
> 
>  addr2line  -e /path/to/r600_dri.so
> 
> for every r600_dri.so frame.

Sorry, but I don't understand how to determine how r600_dri.so was built and
etc.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #4 from Michel D?nzer  ---
(In reply to comment #3)
> (In reply to comment #2)
> > Can you resolve the r600_dri.so symbols?
> 
> If you'll explain me how to.

First of all, make sure r600_dri.so has debugging symbols, i.e. is built with
-g and not stripped.

If the Mozilla crash reporter still doesn't resolve the symbols then, try

 addr2line  -e /path/to/r600_dri.so

for every r600_dri.so frame.

BTW, I notice the crash involves libgallium.so.0.0.0, which is an Ubuntu
specialty. Can your reproduce the problem with a build of upstream Mesa 10.1?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #3 from Eugene  ---
(In reply to comment #2)
> Can you resolve the r600_dri.so symbols?

If you'll explain me how to.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

--- Comment #2 from Michel D?nzer  ---
Can you resolve the r600_dri.so symbols?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: 

[Bug 81680] [r600g] Firefox crashes with hardware acceleration turned on

[bugzilla-dae...@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81680

Eugene  changed:

   What|Removed |Added

 CC||ken20001 at ukr.net

--- Comment #1 from Eugene  ---
The same is with Mesa 10.3:
https://crash-stats.mozilla.com/report/index/71106bc2-022a-45e3-b092-aecc62140723

-- 
You are receiving this mail because:
You are the assignee for the bug.
-- next part --
An HTML attachment was scrubbed...
URL: