Ubuntu
mesa package

[i945] Xorg crash in intel_renderbuffer_set_region() on Dell XPS 1330

Bug #391808 reported by Manoj Iyer on 2009-06-24

112

This bug affects 16 people

Affects		Status	Importance	Assigned to	Milestone
	mesa (Ubuntu)	Fix Released	High	Unassigned

Bug Description

Binary package hint: xorg

After a upgrade on karmic, Xorg segfaults at 0 and reports error 4 from i945_dri.so. I am able to login and the network manager starts, after that X crashes and drops back to login screen.

I tried older version of xserver-xorg-intel from /var/.../archive/ but no help.

I tried booting with i915.modeset=0 but that had no effect.

Backtrace:
0: /usr/X11R6/bin/X(xorg_backtrace+0x26) [0x4f1306]
1: /usr/X11R6/bin/X(xf86SigHandler+0x41) [0x485701]
2: /lib/libc.so.6 [0x7f003ffab0b0]
3: /usr/lib/dri/i965_dri.so(intel_renderbuffer_set_region+0x41) [0x7f003dea5f01]
4: /usr/lib/dri/i965_dri.so [0x7f003dea87a5]
5: /usr/lib/dri/i965_dri.so [0x7f003de97a63]
6: /usr/lib/xorg/modules/extensions//libglx.so [0x7f003f293016]
7: /usr/lib/xorg/modules/extensions//libglx.so [0x7f003f28866d]
8: /usr/X11R6/bin/X(FreeClientResources+0xd3) [0x436263]
9: /usr/X11R6/bin/X(CloseDownClient+0x60) [0x448d60]
10: /usr/X11R6/bin/X(Dispatch+0x210) [0x44ded0]
11: /usr/X11R6/bin/X(main+0x3c5) [0x433f15]
12: /lib/libc.so.6(__libc_start_main+0xe6) [0x7f003ff965e6]
13: /usr/X11R6/bin/X [0x433389]

[lspci]
00:00.0 Host bridge [0600]: Intel Corporation Mobile PM965/GM965/GL960 Memory Controller Hub [8086:2a00] (rev 0c)
Subsystem: Dell Device [1028:0209]
00:02.0 VGA compatible controller [0300]: Intel Corporation Mobile GM965/GL960 Integrated Graphics Controller [8086:2a02] (rev 0c)
Subsystem: Dell Device [1028:0209]

ProblemType: Bug
Architecture: amd64
Date: Wed Jun 24 15:38:04 2009
DistroRelease: Ubuntu 9.10
MachineType: Dell Inc. XPS M1330
Package: xorg 1:7.4~5ubuntu21
ProcCmdLine: root=UUID=3eea46ad-1172-4cb9-b13c-0939cd8e5112 ro quiet splash
ProcEnviron:
PATH=(custom, user)
LANG=en_US.UTF-8
SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.30-10.12-generic
RelatedPackageVersions:
xserver-xorg 1:7.4~5ubuntu21
libgl1-mesa-glx 7.4.1-1ubuntu3
libdrm2 2.4.11-0ubuntu1
xserver-xorg-video-intel 2:2.7.1-1ubuntu1
xserver-xorg-video-ati 1:6.12.2-2ubuntu2
SourcePackage: xorg
Uname: Linux 2.6.30-10-generic x86_64
Xrandr: Error: command ['xrandr', '--verbose'] failed with exit code 1: Can't open display
dmi.bios.date: 12/26/2008
dmi.bios.vendor: Dell Inc.
dmi.bios.version: A15
dmi.board.name: 0N6705
dmi.board.vendor: Dell Inc.
dmi.chassis.type: 8
dmi.chassis.vendor: Dell Inc.
dmi.modalias: dmi:bvnDellInc.:bvrA15:bd12/26/2008:svnDellInc.:pnXPSM1330:pvr:rvnDellInc.:rn0N6705:rvr:cvnDellInc.:ct8:cvr:
dmi.product.name: XPS M1330
dmi.sys.vendor: Dell Inc.
fglrx: Not loaded
glxinfo: Error: command ['glxinfo'] failed with exit code 255: Error: unable to open display
setxkbmap: Error: command ['setxkbmap', '-print'] failed with exit code 255: Cannot open display "default display"
system:
distro: Ubuntu
architecture: x86_64kernel: 2.6.30-10-generic
xdpyinfo: Error: command ['xdpyinfo'] failed with exit code 1: xdpyinfo: unable to open display "".
xkbcomp:
Error: command ['xkbcomp', ':0', '-w0', '-'] failed with exit code 1: No protocol specified
Error: Cannot open display ":0"
Exiting

See original description

Tags:

Related branches

lp:ubuntu/karmic/mesa

Revision history for this message

Manoj Iyer (manjo) wrote on 2009-06-24:

BootDmesg.txt Edit (49.9 KiB, text/plain; charset="utf-8")
CurrentDmesg.txt Edit (988 bytes, text/plain; charset="utf-8")
Dependencies.txt Edit (4.9 KiB, text/plain; charset="utf-8")
GdmLog.txt Edit (1.2 KiB, text/plain; charset="utf-8")
GdmLogOld.txt Edit (1.9 KiB, text/plain; charset="utf-8")
Lspci.txt Edit (14.9 KiB, text/plain; charset="utf-8")
Lsusb.txt Edit (951 bytes, text/plain; charset="utf-8")
PciDisplay.txt Edit (474 bytes, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (1.4 KiB, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (1.3 KiB, text/plain; charset="utf-8")
ProcModules.txt Edit (3.2 KiB, text/plain; charset="utf-8")
UdevDb.txt Edit (125.1 KiB, text/plain; charset="utf-8")
UdevLog.txt Edit (259.6 KiB, text/plain; charset="utf-8")
XorgConf.txt Edit (1.0 KiB, text/plain; charset="utf-8")
XorgLog.gz Edit (4.8 KiB, application/x-gzip)
XorgLogOld.gz Edit (5.2 KiB, application/x-gzip)

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-06-24:

Btw, you can now drop "AccelMethod" "UXA" from your xorg.conf; that's now the default on Karmic. Doesn't hurt anything to leave it there, but it's no longer needed.

description:

updated

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-06-24:

Please collect a full backtrace - see http://wiki.ubuntu.com/X/Backtracing for directions.

description:	updated
summary:	- Xorg segfault 0 on Dell XPS 1330 Intel 945 graphics card + [i945] Xorg crash in intel_renderbuffer_set_region() on Dell XPS 1330
Changed in xorg (Ubuntu):
importance:	Undecided → High
status:	New → Incomplete
description:	updated
affects:	xorg (Ubuntu) → xserver-xorg-video-intel (Ubuntu)

Revision history for this message

Manoj Iyer (manjo) wrote on 2009-06-24:

Download full text (6.9 KiB)

After installing dbg packages I logged in on the GDM prompt, and got dropped into gdb with the following backtrace

(gdb) continue
Continuing.

Program received signal SIGPIPE, Broken pipe.
[Switching to Thread 0x7f1e9dd8a6f0 (LWP 3699)]
0x00007f1e9bced383 in writev () from /lib/libc.so.6
(gdb) backtrace full
#0 0x00007f1e9bced383 in writev () from /lib/libc.so.6
No symbol table info available.
#1 0x00000000004f76ac in _XSERVTransSocketWritev (
    ciptr=<value optimized out>, buf=0x7fff2a93ee90, size=1)
    at /usr/include/X11/Xtrans/Xtranssock.c:2184
No locals.
#2 0x00000000004f321d in FlushClient (who=<value optimized out>,
    oc=<value optimized out>, __extraBuf=<value optimized out>,
    extraCount=<value optimized out>) at ../../os/io.c:899
before = -1
remain = <value optimized out>
i = 1
len = -32
oco = (ConnectionOutputPtr) 0x46b76e0
connection = 18
trans_conn = (XtransConnInfo) 0x4622bb0
iov = {{iov_base = 0x46bb4d0, iov_len = 128}, {iov_base = 0x46b5e10,
    iov_len = 4417360}, {iov_base = 0x40, iov_len = 0}}
padBuffer = "\000\000"
written = 0
padsize = 0
notWritten = 128
todo = 128
#3 0x00000000004f1b0c in CloseDownConnection (client=0x12)
    at ../../os/connection.c:1047
oc = (OsCommPtr) 0x46332c0
#4 0x0000000000448e64 in CloseDownClient (client=0x46254b0)
    at ../../dix/dispatch.c:3404
really_close_down = 1
#5 0x000000000044ded0 in Dispatch () at ../../dix/dispatch.c:448
result = 0
client = (ClientPtr) 0x46254b0
nready = 0
start_tick = 280
#6 0x0000000000433f15 in main (argc=<value optimized out>,
    argv=0x7fff2a93f138, envp=<value optimized out>) at ../../dix/main.c:397
i = 1
alwaysCheckForInput = {0, 1}
(gdb)

Then I hit continue to continue to Gnome desktop ... Again got dropped into GDB promt with the backtrace as follows:

Program received signal SIGPIPE, Broken pipe.
0x00007f1e9bced383 in writev () from /lib/libc.so.6
(gdb) backtrace full
#0 0x00007f1e9bced383 in writev () from /lib/libc.so.6
No symbol table info available.
#1 0x00000000004f76ac in _XSERVTransSocketWritev (
    ciptr=<value optimized out>, buf=0x7fff2a93eeb0, size=1)
    at /usr/include/X11/Xtrans/Xtranssock.c:2184
No locals.
#2 0x00000000004f321d in FlushClient (who=<value optimized out>,
    oc=<value optimized out>, __extraBuf=<value optimized out>,
    extraCount=<value optimized out>) at ../../os/io.c:899
before = -1
remain = <value optimized out>
i = 1
len = -32
oco = (ConnectionOutputPtr) 0x461bb50
connection = 19
trans_conn = (XtransConnInfo) 0x46aac30
iov = {{iov_base = 0x46b4480, iov_len = 96}, {iov_base = 0x46a05a0,
    iov_len = 4409080}, {iov_base = 0x7dd9f4, iov_len = 139769442454016}}
padBuffer = "\000\000"
written = 0
padsize = 0
notWritten = 96
todo = 96
#3 0x00000000004f3cc1 in FlushAllOutput () at ../../os/io.c:649
index = <value optimized out>
mask = 0
oc = (OsCommPtr) 0x7fff2a93eeb0
client = (ClientPtr) 0x13
newoutput = <value optimized out>
#4 0x000000000044ded5 in Dispatch () at ../../dix/dispatch.c:456
result = -32
client = (ClientPtr) 0x46254b0
nready = 0
start_tick = 280
#5 0x0000000000433f15 in main (argc=<value optimized out>,
    argv=0x7fff2a93f138, envp=<v...

After installing dbg packages I logged in on the GDM prompt, and got dropped into gdb with the following backtrace

(gdb) continue 
Continuing.

Program received signal SIGPIPE, Broken pipe.
[Switching to Thread 0x7f1e9dd8a6f0 (LWP 3699)]
0x00007f1e9bced383 in writev () from /lib/libc.so.6
(gdb) backtrace full
#0  0x00007f1e9bced383 in writev () from /lib/libc.so.6
No symbol table info available.
#1  0x00000000004f76ac in _XSERVTransSocketWritev (
    ciptr=<value optimized out>, buf=0x7fff2a93ee90, size=1)
    at /usr/include/X11/Xtrans/Xtranssock.c:2184
No locals.
#2  0x00000000004f321d in FlushClient (who=<value optimized out>, 
    oc=<value optimized out>, __extraBuf=<value optimized out>, 
    extraCount=<value optimized out>) at ../../os/io.c:899
	before = -1
	remain = <value optimized out>
	i = 1
	len = -32
	oco = (ConnectionOutputPtr) 0x46b76e0
	connection = 18
	trans_conn = (XtransConnInfo) 0x4622bb0
	iov = {{iov_base = 0x46bb4d0, iov_len = 128}, {iov_base = 0x46b5e10, 
    iov_len = 4417360}, {iov_base = 0x40, iov_len = 0}}
	padBuffer = "\000\000"
	written = 0
	padsize = 0
	notWritten = 128
	todo = 128
#3  0x00000000004f1b0c in CloseDownConnection (client=0x12)
    at ../../os/connection.c:1047
	oc = (OsCommPtr) 0x46332c0
#4  0x0000000000448e64 in CloseDownClient (client=0x46254b0)
    at ../../dix/dispatch.c:3404
	really_close_down = 1
#5  0x000000000044ded0 in Dispatch () at ../../dix/dispatch.c:448
	result = 0
	client = (ClientPtr) 0x46254b0
	nready = 0
	start_tick = 280
#6  0x0000000000433f15 in main (argc=<value optimized out>, 
    argv=0x7fff2a93f138, envp=<value optimized out>) at ../../dix/main.c:397
	i = 1
	alwaysCheckForInput = {0, 1}
(gdb)

Then I hit continue to continue to Gnome desktop ... Again got dropped into GDB promt with the backtrace as follows:

Program received signal SIGPIPE, Broken pipe.
0x00007f1e9bced383 in writev () from /lib/libc.so.6
(gdb) backtrace full
#0  0x00007f1e9bced383 in writev () from /lib/libc.so.6
No symbol table info available.
#1  0x00000000004f76ac in _XSERVTransSocketWritev (
    ciptr=<value optimized out>, buf=0x7fff2a93eeb0, size=1)
    at /usr/include/X11/Xtrans/Xtranssock.c:2184
No locals.
#2  0x00000000004f321d in FlushClient (who=<value optimized out>, 
    oc=<value optimized out>, __extraBuf=<value optimized out>, 
    extraCount=<value optimized out>) at ../../os/io.c:899
	before = -1
	remain = <value optimized out>
	i = 1
	len = -32
	oco = (ConnectionOutputPtr) 0x461bb50
	connection = 19
	trans_conn = (XtransConnInfo) 0x46aac30
	iov = {{iov_base = 0x46b4480, iov_len = 96}, {iov_base = 0x46a05a0, 
    iov_len = 4409080}, {iov_base = 0x7dd9f4, iov_len = 139769442454016}}
	padBuffer = "\000\000"
	written = 0
	padsize = 0
	notWritten = 96
	todo = 96
#3  0x00000000004f3cc1 in FlushAllOutput () at ../../os/io.c:649
	index = <value optimized out>
	mask = 0
	oc = (OsCommPtr) 0x7fff2a93eeb0
	client = (ClientPtr) 0x13
	newoutput = <value optimized out>
#4  0x000000000044ded5 in Dispatch () at ../../dix/dispatch.c:456
	result = -32
	client = (ClientPtr) 0x46254b0
	nready = 0
	start_tick = 280
#5  0x0000000000433f15 in main (argc=<value optimized out>, 
    argv=0x7fff2a93f138, envp=<value optimized out>) at ../../dix/main.c:397
	i = 1
	alwaysCheckForInput = {0, 1}
(gdb) continue 
Continuing.

I hit continue again... and gnome desktop comes up .. starts network manager ... and few seconds later drops back into GDB with the following backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00007f1e99b4df01 in intel_renderbuffer_set_region ()
   from /usr/lib/dri/i965_dri.so
(gdb) backtrace full
#0  0x00007f1e99b4df01 in intel_renderbuffer_set_region ()
   from /usr/lib/dri/i965_dri.so
No symbol table info available.
#1  0x00007f1e99b507a5 in ?? () from /usr/lib/dri/i965_dri.so
No symbol table info available.
#2  0x00007f1e99b3fa63 in ?? () from /usr/lib/dri/i965_dri.so
No symbol table info available.
#3  0x00007f1e9af2a016 in __glXDRIdrawableDestroy (drawable=0x478dd30)
    at ../../glx/glxdri2.c:103
No locals.
#4  0x00007f1e9af1f66d in DrawableGone (glxPriv=0x0, xid=0)
    at ../../glx/glxext.c:136
	c = (__GLXcontext *) 0x0
#5  0x0000000000436263 in FreeClientResources (client=<value optimized out>)
    at ../../dix/resource.c:807
	rtype = <value optimized out>
	resources = <value optimized out>
	this = (ResourcePtr) 0x478df00
	j = 0
#6  0x0000000000448d60 in CloseDownClient (client=0x46a68b0)
    at ../../dix/dispatch.c:3433
	really_close_down = 1
#7  0x000000000044ded0 in Dispatch () at ../../dix/dispatch.c:448
	result = 0
	client = (ClientPtr) 0x46a68b0
	nready = 0
	start_tick = 780
#8  0x0000000000433f15 in main (argc=<value optimized out>, 
    argv=0x7fff2a93f138, envp=<value optimized out>) at ../../dix/main.c:397
	i = 1
	alwaysCheckForInput = {0, 1}
(gdb)

(gdb) continue 
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x00000000004f14e4 in IgnoreClient (client=0x46a68b0)
    at ../../os/connection.c:1158
1158	../../os/connection.c: No such file or directory.
	in ../../os/connection.c
(gdb) backtrace full
#0  0x00000000004f14e4 in IgnoreClient (client=0x46a68b0)
    at ../../os/connection.c:1158
	connection = <value optimized out>
#1  0x00007f1e9af1fcd7 in glxSuspendClients () at ../../glx/glxext.c:431
	i = 9
#2  0x00007f1e9af29df7 in glxDRILeaveVT (index=0, flags=0)
    at ../../glx/glxdri2.c:425
No locals.
#3  0x000000000046d65d in SigAbortDDX (signo=11)
    at ../../../../hw/xfree86/common/xf86Init.c:1482
	i = 1
#4  0x0000000000485778 in xf86SigHandler (signo=11)
    at ../../../../hw/xfree86/common/xf86Events.c:408
	beenhere = 1
#5  <signal handler called>
No symbol table info available.
#6  0x00007f1e99b4df01 in intel_renderbuffer_set_region ()
   from /usr/lib/dri/i965_dri.so
No symbol table info available.
#7  0x00007f1e99b507a5 in ?? () from /usr/lib/dri/i965_dri.so
No symbol table info available.
#8  0x00007f1e99b3fa63 in ?? () from /usr/lib/dri/i965_dri.so
No symbol table info available.
#9  0x00007f1e9af2a016 in __glXDRIdrawableDestroy (drawable=0x478dd30)
    at ../../glx/glxdri2.c:103
No locals.
#10 0x00007f1e9af1f66d in DrawableGone (glxPriv=0x0, xid=0)
    at ../../glx/glxext.c:136
	c = (__GLXcontext *) 0x0
#11 0x0000000000436263 in FreeClientResources (client=<value optimized out>)
    at ../../dix/resource.c:807
	rtype = <value optimized out>
	resources = <value optimized out>
	this = (ResourcePtr) 0x478df00
	j = 0
#12 0x0000000000448d60 in CloseDownClient (client=0x46a68b0)
    at ../../dix/dispatch.c:3433
	really_close_down = 1
#13 0x000000000044ded0 in Dispatch () at ../../dix/dispatch.c:448
	result = 0
	client = (ClientPtr) 0x46a68b0
	nready = 0
	start_tick = 780
#14 0x0000000000433f15 in main (argc=<value optimized out>, 
    argv=0x7fff2a93f138, envp=<value optimized out>) at ../../dix/main.c:397
	i = 1
	alwaysCheckForInput = {0, 1}
(gdb)

(gdb) continue 
Continuing.

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.
(gdb) backtrace full
No stack.
(gdb)

Revision history for this message

Manoj Iyer (manjo) wrote on 2009-06-24:

Xorg.0.log Edit (18.8 KiB, application/octet-stream)

Attaching new xorg.log for the crash debug above.

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-06-24:

Crash was caused by code errors in the recent memory leak patches to mesa. Fixes from upstream are available and will be uploaded shortly.

affects:	xserver-xorg-video-intel (Ubuntu) → mesa (Ubuntu)
Changed in mesa (Ubuntu):
status:	Incomplete → In Progress

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-06-24:

Uploaded mesa - 7.4.1-1ubuntu4 to my ppa with a fix for this:

https://edge.launchpad.net/~bryceharrington/+archive/ppa

It's currently building (this can take up to a couple hours), but after that if someone can test and verify that it solves the issue (which I'm pretty confident it should), I'll upload to Ubuntu.

Revision history for this message

Manoj Iyer (manjo) wrote on 2009-06-24:

Bryce, will test your PPA this evening.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2009-06-24:

This bug was fixed in the package mesa - 7.4.1-1ubuntu4

---------------
mesa (7.4.1-1ubuntu4) karmic; urgency=low

  * Add 110_null_ptr_during_screen_tear_down.patch and
    111_fix_mesa_ref_fb_call_syntax.patch to fix crashes caused by errors
    in the previous memory leak fixes in -1u3.
    (LP: #391808)

-- Bryce Harrington <email address hidden> Wed, 24 Jun 2009 15:32:54 -0700

Changed in mesa (Ubuntu):
status:	In Progress → Fix Released

Revision history for this message

John Haitas (jhaitas) wrote on 2009-06-25:

#10

lspci for affected system Edit (2.0 KiB, text/plain)

Bryce,

I can confirm this bug for the attached 'lspci' listing...

I can also confirm that adding your PPA resolved the issue...

Thank you

Revision history for this message

Manoj Iyer (manjo) wrote on 2009-06-25:

#11

Bryce,

Adding your ppa fIxes the crash for me.

Revision history for this message

marbud (marbud) wrote on 2009-06-25:

#12

Bryce, your ppa packages fixxed the problem for me to.

jose angel (chely0146) on 2009-10-31

Changed in mesa (Ubuntu):
status:	Fix Released → New

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-10-31:

#13

jose, don't reopen other people's bugs... file a new one instead.

Changed in mesa (Ubuntu):
status:	New → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

Duplicates of this bug

You are

Subscribing...

Edit bug mail

Other bug subscribers

Bug attachments

Add attachment

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntumesa package

[i945] Xorg crash in intel_renderbuffer_set_region() on Dell XPS 1330

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
mesa package