[Bug 30132] [rs690, r300g] No packet3 for relocation for packet at 211

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=30132

--- Comment #1 from steckdenis at yahoo.fr 2010-09-12 04:34:11 PDT ---
Hello,

I have more informations for you.

Reproductible: Always

Steps to reproduce:

* Launch neverball with the r300g driver and a rs690 graphics card
* Go to Options
* Set Textures to High
* Set Geometry to High
* Set Reflection to Yes*
* Click "Back"
* Press CAPS LOCK
* Enter CHEAT (when all the leters are typed, the Play menu changes to Cheat)
* You can again press CAPS LOCK
* Click on Cheat
* Click on Tour de force
* Click on 09. It's a race full of mirrors.

The Command Stream is rejected and Neverball segfaults.

*It seems that keeping Reflection to No also triggers the bug, but a bit later.
The race is not loaded but I have to wait one more second to see Neverball
crashing, also with a CS error :

[drm:r100_cs_packet_next_reloc] *ERROR* No packet3 for relocation for packet at
214.
[drm] ib[214]=0x000013C6
[drm] ib[215]=0x00000001
[drm:r100_packet3_load_vbpntr] *ERROR* No reloc for packet3 47
[drm] ib[209]=0xC0032F00
[drm] ib[210]=0x00000001
[drm] ib[211]=0x00001010
[drm] ib[212]=0x0004E040
[drm] ib[213]=0x00000000
[drm:radeon_cs_ioctl] *ERROR* Invalid command stream !

GDB output when running Neverball:

I launched Neverball under GDB with "gdb neverball". The stderr line "radeon:
The kernel rejected CS, see dmesg for more information." isn't printed, but GCC
prints this :

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff1a3bad8 in r300_emit_aos_swtcl (r300=0x7fed40, indexed=16 '\020') at
r300_emit.c:847
847         OUT_CS_BUF_RELOC(r300->vbo, 0, r300_buffer(r300->vbo)->domain, 0);
(gdb) bt
#0  0x00007ffff1a3bad8 in r300_emit_aos_swtcl (r300=0x7fed40, indexed=16
'\020') at r300_emit.c:847
#1  0x00007ffff1a3f5c4 in r300_render_draw_elements (render=0x65acc0,
indices=0x9adfd0, count=192)
    at r300_render.c:889
#2  0x00007ffff1bbe111 in vbuf_flush_vertices (stage=0xc75a70, flags=<value
optimized out>)
    at draw/draw_pipe_vbuf.c:327
#3  vbuf_flush (stage=0xc75a70, flags=<value optimized out>) at
draw/draw_pipe_vbuf.c:380
#4  0x00007ffff1bbaa6e in draw_pipeline_flush (draw=0x718480, flags=<value
optimized out>) at draw/draw_pipe.c:346
#5  0x00007ffff1bb3e61 in draw_do_flush (draw=0x718480) at
draw/draw_context.c:550
#6  draw_flush (draw=0x718480) at draw/draw_context.c:174
#7  0x00007ffff1a3e1da in r300_swtcl_draw_vbo (pipe=0x7fed40,
info=0x7fffffffdb00) at r300_render.c:694
#8  0x00007ffff1b764fd in st_draw_vbo (ctx=0x978810, arrays=<value optimized
out>, prims=0xc8aca4, nr_prims=1, 
    ib=0x0, index_bounds_valid=<value optimized out>, min_index=0,
max_index=309) at state_tracker/st_draw.c:719
#9  0x00007ffff1b99bc9 in vbo_save_playback_vertex_list (ctx=0x978810,
data=0x8223f8) at vbo/vbo_save_draw.c:287
#10 0x00007ffff1a8115a in ext_opcode_execute (ctx=0x978810, list=<value
optimized out>) at main/dlist.c:533
#11 execute_list (ctx=0x978810, list=<value optimized out>) at
main/dlist.c:6883
#12 0x00007ffff1a83bd2 in _mesa_CallList (list=744) at main/dlist.c:8140

I don't know if it's the same bug, but it is triggered at the same place.

I hope this helps you (and sorry for my English).

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.