[RV410] Xorg crashes in damageDestroyPixmap using a X700 Pro

Using gdb to attach Xorg gives me the following backtrace:

(gdb) bt
#0 damageDestroyPixmap (pPixmap=0x9744840) at ../../../miext/damage/damage.c:1634
#1 0xb7fb0fb8 in XvDestroyPixmap (pPix=0x9744840) at ../../Xext/xvmain.c:381
#2 0x08085ff5 in dixDestroyPixmap (value=0x9744840, pid=63207183) at ../../dix/dispatch.c:1272
#3 0x0807461c in FreeResource (id=63207183, skipDeleteFuncType=0) at ../../dix/resource.c:561
#4 0x08087963 in ProcFreePixmap (client=0x9be5ad0) at ../../dix/dispatch.c:1358
#5 0x0808c89f in Dispatch () at ../../dix/dispatch.c:454
#6 0x08071d1d in main (argc=10, argv=0xbfddd0e4, envp=0xc14fe8f4) at ../../dix/main.c:441

(gdb) backtrace full
#0 damageDestroyPixmap (pPixmap=0x9744840)
    at ../../../miext/damage/damage.c:1634
        pPrev = (DamagePtr *) 0x81dc968
        pDamage = (DamagePtr) 0x81dc968
        pScreen = (ScreenPtr) 0x8763cd0
        pScrPriv = (DamageScrPrivPtr) 0x876d3a8
#1 0xb7fb0fb8 in XvDestroyPixmap (pPix=0x9744840) at ../../Xext/xvmain.c:381
        status = 136169832
        pScreen = (ScreenPtr) 0x8763cd0
        pa = (XvAdaptorPtr) 0x87799ec
        na = 2
        pp = (XvPortPtr) 0x877a7f0
        np = 16
#2 0x08085ff5 in dixDestroyPixmap (value=0x9744840, pid=63207183)
    at ../../dix/dispatch.c:1272
No locals.
#3 0x0807461c in FreeResource (id=63207183, skipDeleteFuncType=0)
    at ../../dix/resource.c:561
        rtype = 2
        cid = <value optimized out>
        res = (ResourcePtr) 0x90daaa0
        prev = (ResourcePtr *) 0x9c7bb90
        head = (ResourcePtr *) 0x9c7bb90
#4 0x08087963 in ProcFreePixmap (client=0x9be5ad0)
    at ../../dix/dispatch.c:1358
        pMap = (PixmapPtr) 0x9744840
        rc = 136169832
#5 0x0808c89f in Dispatch () at ../../dix/dispatch.c:454
        result = <value optimized out>
        client = (ClientPtr) 0x9be5ad0
        nready = 0
        start_tick = 240240
#6 0x08071d1d in main (argc=10, argv=0xbfddd0e4, envp=0xc14fe8f4)
    at ../../dix/main.c:441
        i = <value optimized out>
        error = 136151028
        xauthfile = <value optimized out>
        alwaysCheckForInput = {0, 1}

just another backtrace

(gdb) bt
#0 0x08176685 in damageDestroyPixmap (pPixmap=0x979b5a0) at ../../../miext/damage/damage.c:1675
#1 0xb8037fb8 in XvDestroyPixmap (pPix=0x979b5a0) at ../../Xext/xvmain.c:381
#2 0x081603c4 in FreePicture (value=0x9852f80, pid=85984620) at ../../render/picture.c:1528
#3 0x08074196 in FreeClientResources (client=0x9519218) at ../../dix/resource.c:807
#4 0x080868bf in CloseDownClient (client=0x9519218) at ../../dix/dispatch.c:3461
#5 0x0808c730 in Dispatch () at ../../dix/dispatch.c:465
#6 0x08071d1d in main (argc=10, argv=0xbfc64a74, envp=0xc14fe8f4) at ../../dix/main.c:441
(gdb) bt full
#0 0x08176685 in damageDestroyPixmap (pPixmap=0x979b5a0) at ../../../miext/damage/damage.c:1675
 pPrev = (DamagePtr *) 0x81dc968
 pDamage = (DamagePtr) 0x81dc968
 pScreen = (ScreenPtr) 0x8f2ad70
 pScrPriv = (DamageScrPrivPtr) 0x8f34448
#1 0xb8037fb8 in XvDestroyPixmap (pPix=0x979b5a0) at ../../Xext/xvmain.c:381
 status = 136169832
 pScreen = (ScreenPtr) 0x8f2ad70
 pa = (XvAdaptorPtr) 0x8f40a8c
 na = 2
 pp = (XvPortPtr) 0x8f41890
 np = 16
#2 0x081603c4 in FreePicture (value=0x9852f80, pid=85984620) at ../../render/picture.c:1528
 pScreen = (ScreenPtr) 0x8f2ad70
 ps = (PictureScreenPtr) 0x8f28808
#3 0x08074196 in FreeClientResources (client=0x9519218) at ../../dix/resource.c:807
 rtype = 10
 resources = (ResourcePtr *) 0x9f05d48
 this = (ResourcePtr) 0x9852fd8
 j = 102
#4 0x080868bf in CloseDownClient (client=0x9519218) at ../../dix/dispatch.c:3461
 really_close_down = 1
#5 0x0808c730 in Dispatch () at ../../dix/dispatch.c:465
 result = -2147483647
 client = (ClientPtr) 0x9519218
 nready = 0
 start_tick = 15580
#6 0x08071d1d in main (argc=10, argv=0xbfc64a74, envp=0xc14fe8f4) at ../../dix/main.c:441
 i = <value optimized out>
 error = 136151028
 xauthfile = <value optimized out>
 alwaysCheckForInput = {0, 1}

I'm experiencing the same issue, and also find the "EQ overflowing" messages in the Xorg.0.log.old.

When X crashes, no keyboard input is available, although my bluetooth mouse is responsive, no mouse input can be recognized. A forced manual shutdown is unavoidable.

I'm using the open source ati driver xorg-xserver-video-ati and my graphic card is a mobility x300. I'm also using compiz. And don't know if it important, but roughly half of the time when this lock up happened, I was minimizing/quiting Firefox.

BTW, I have EXA enabled and maybe this is potentially problematic. But in Hardy, EXA worked just fine.

@AZ, thanks for collecting the backtraces. Could you also attach your Xorg.0.log (since it contains version information which may be useful) and the output of lspci -vvnn in case we need your hardware's PCI ID's.

Also, do you have any USB devices connected to the system (tablets, game controllers, ...)? If so, can you test with and without those attached?

@Peng, the "[mi] EQ overflowing" message is a generic message that simply means the server is stuck in an infinite loop for some reason. If you can collect a backtrace identical to AZ's, then you have the same bug, otherwise you should probably report it as a separate bug.

I believe already attached my Xorg.0.log in comment 1
. The output of lspci -vvnn is attached.

Removing usb devices and testing is difficult as I connected my keyboard and mice using usb and have some internally connected usb devices. Further, the bug occurs randomly, so not experiencing the bug for days does not mean that it has been solved. I'll do my best.

Thanks AZ, I've gone ahead and forwarded this upstream to https://bugs.freedesktop.org/show_bug.cgi?id=18906. Could you please subscribe to that bug, in case upstream has additional questions or wishes you to test something. Thanks ahead of time.

thanks

According to the upstream bug, this is fixed in Jaunty as of mesa 7.4.