[xf86-video-ati] crash with latest code from git (possibly radeon-rewrite related)

[Lowell Alleman]

I've run into an X server crash with the latest radeon driver from
git, packaged for Ubuntu Jaunty by Tormod Volden.  I'm also using the
radeon-rewrite mesa branch, which I have been using for a few weeks
now, however this bug seems to be related to my recent upgrade of the
xf86-video-ati driver.  (I have not attempted to rollback the driver
to confirm this.)

>From the .deb changelog:
xserver-xorg-video-ati (1:6.12.99+git20090526.b34df233-0ubuntu0tormod)
jaunty; urgency=low
  * Checkout from git 20090526 (master branch) up to commit
    b34df233115c0d82d7bcf82e041afbc55981ce82
  * Merge with origin/debian-experimental
  * hook: Log git commit id in RadeonPreInit()

Backtrace:
0: /usr/bin/X(xorg_backtrace+0x3b) [0x813518b]
1: /usr/bin/X(xf86SigHandler+0x55) [0x80c7be5]
2: [0xb7f80400]
3: /usr/lib/dri/r300_dri.so(radeonAllocDmaRegion+0xba) [0xb13a2c2a]
4: /usr/lib/dri/r300_dri.so(rcommon_emit_vector+0x12f) [0xb13a2def]
5: /usr/lib/dri/r300_dri.so(r300EmitArrays+0x1de) [0xb13981ee]
6: /usr/lib/dri/r300_dri.so [0xb1386d61]
7: /usr/lib/dri/r300_dri.so [0xb1387510]
8: /usr/lib/dri/r300_dri.so(_tnl_run_pipeline+0x164) [0xb14445e4]
9: /usr/lib/dri/r300_dri.so(_tnl_draw_prims+0x535) [0xb1444bf5]
10: /usr/lib/dri/r300_dri.so(vbo_exec_vtx_flush+0xfc) [0xb143d09c]
11: /usr/lib/dri/r300_dri.so(vbo_exec_FlushVertices_internal+0x40) [0xb1439e40]
12: /usr/lib/dri/r300_dri.so(vbo_exec_FlushVertices+0x50) [0xb1439ef0]
13: /usr/lib/dri/r300_dri.so(_mesa_set_scissor+0xb9) [0xb1405de9]
14: /usr/lib/dri/r300_dri.so(_mesa_Scissor+0x56) [0xb1405e96]
15: /usr/lib/xorg/modules/extensions//libglx.so [0xb78cab8e]
16: /usr/lib/xorg/modules/extensions//libglx.so [0xb78f546f]
17: /usr/lib/xorg/modules/extensions//libglx.so [0xb78f9d6a]
18: /usr/bin/X(Dispatch+0x33f) [0x808d57f]
19: /usr/bin/X(main+0x3bd) [0x80722ed]
20: /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5) [0xb7b41775]
21: /usr/bin/X [0x80717a1]
Saw signal 11.  Server aborting.

lspci -vvnn
01:00.0 VGA compatible controller [0300]: ATI Technologies Inc RV350
[Mobility Radeon 9600 M10] [1002:4e50]
        Subsystem: IBM Device [1014:0550]
        Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop-
ParErr- Stepping- SERR+ FastB2B+ DisINTx-
        Status: Cap+ 66MHz+ UDF- FastB2B+ ParErr- DEVSEL=medium
>TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
        Latency: 66 (2000ns min), Cache Line Size: 32 bytes
        Interrupt: pin A routed to IRQ 11
        Region 0: Memory at e0000000 (32-bit, prefetchable) [size=128M]
        Region 1: I/O ports at 3000 [size=256]
        Region 2: Memory at c0100000 (32-bit, non-prefetchable) [size=64K]
        [virtual] Expansion ROM at c0120000 [disabled] [size=128K]
        Capabilities: [58] AGP version 2.0
                Status: RQ=80 Iso- ArqSz=0 Cal=0 SBA+ ITACoh- GART64-
HTrans- 64bit- FW+ AGP3- Rate=x1,x2,x4
                Command: RQ=32 ArqSz=0 Cal=0 SBA+ AGP+ GART64- 64bit-
FW- Rate=x1
        Capabilities: [50] Power Management version 2
                Flags: PMEClk- DSI- D1+ D2+ AuxCurrent=0mA
PME(D0-,D1-,D2-,D3hot-,D3cold-)
                Status: D0 PME-Enable- DSel=0 DScale=0 PME-
        Kernel modules: radeonfb



I've had this crash happen a few times, and it appears that the
backtrace is identical each time.

Some relevant package/version info:
  xserver-xorg-core 2:1.6.0-0ubuntu14
  libgl1-mesa-dri  7.6.0~git20090524+radeon-rewrite.7dd184dc-0ubuntu0tormod
  linux-image-generic 2.6.28.12.16


Steps to reproduce:

I've found that I can reproduce the bug with Amarok (v2.0.2 with KDE
4.2.2).  In the "Collection" panel (left side pane), as soon as I
click the "Advanced" button at the X server crashes.  (The screen goes
blank, and apparently changes size--based on the fact that the mouse
cursor shows about 4-8 times larger than normal.  Then a new X session
starts up again via KDM.)

Thanks,

- Lowell Alleman