[Bug 34336] r300g: segfault in r300_draw_arrays_immediate

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=34336

--- Comment #2 from Wiktor Janas <wixorpeek at gmail.com> 2011-02-17 05:17:12 PST ---
(In reply to comment #1)
> I can't reproduce it with Blender 2.49. Could you possibly bisect?

Well, the drawing code has changed much between 2.49 and 2.5x, you may want to
get the beta release from blender.org. The exact steps to reproduce are: start
blender and maximize (not fullscreen) the window. In the top-left corner there
is an combo box with a circled 'i' letter; open it and move the mouse quickly
around the menu for some time. It crashes after a second or so.
I have also spotted this on kwin cube-desktop-switch effect, crashes every time
after painting some dozen frames.

The exact commit introducing the bug is 45e1cd522bd ("interaction between
UNSYNCHRONIZED and DONTBLOCK"). I have introduced a debug statement into
radeon_bo_map_internal and this is what I found (the first column is timestamp
in nanoseconds, the parentheses contain bo->size, bo->name. bo->handle):

170745153: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170749993: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170754953: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170759793: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170764473: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170790113: bo = 0x2c4a310 (65536, 13, 0), flags = 00000600, cs = 0x2b8fe40
170809233: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170814913: bo = 0x2c4a310 (65536, 13, 0), flags = 00000600, cs = 0x2b8fe40
170827513: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170833233: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
170838153: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172139113: bo = 0x441d610 (128, 3, 0), flags = 00000400, cs = 0x2b8fe40
172182793: bo = 0x441d610 (128, 3, 0), flags = 00000400, cs = 0x2b8fe40
172204593: bo = 0x2c4a310 (65536, 13, 0), flags = 00000600, cs = 0x2b8fe40
172250793: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172256993: bo = 0x2c4a310 (65536, 13, 0), flags = 00000600, cs = 0x2b8fe40
172276473: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172282353: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172287313: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172292113: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172296993: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172301793: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172306473: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172311353: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172316193: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172320913: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172325833: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172330673: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172335433: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172340353: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172345033: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172349873: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172354713: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172359553: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172364393: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172369193: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172373873: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172378713: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172383553: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172388233: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172392993: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172397833: bo = 0x2c4a310 (65536, 13, 0), flags = 00000400, cs = 0x2b8fe40
172425513: bo = 0x44ef860 (65536, 14, 0), flags = 00000600, cs = 0x2b8fe40
172485593: bo = 0x44ef860 (65536, 14, 0), flags = 00000400, cs = 0x2b8fe40
*boom*

Hope it means something.

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.