[Bug 67209] New: Image decoding corruption and linux kernel crash with hardware reset

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=67209

          Priority: medium
            Bug ID: 67209
          Assignee: chris at chris-wilson.co.uk
           Summary: Image decoding corruption and linux kernel crash with
                    hardware reset
        QA Contact: intel-gfx-bugs at lists.freedesktop.org
          Severity: normal
    Classification: Unclassified
                OS: Linux (All)
          Reporter: carstenmattner at gmail.com
          Hardware: x86 (IA32)
            Status: NEW
           Version: unspecified
         Component: Driver/intel
           Product: xorg

Related bugs filed earlier:
https://bugs.archlinux.org/task/36105
https://bugzilla.mozilla.org/show_bug.cgi?id=892567

Steps to reproduce:

Opening a jpeg like
http://blather.michaelwlucas.com/wp-content/uploads/2013/07/ao2e-index.jpg
first gets decoded correctly and once it's done the bottom half of the image
gets corrupted. In one test the corrupted part displayed small snapshots of the
Firefox window. When I clicked reload twice the kernelcrashed and reset the
machine. The corruption happens with Firefox 22 to 25 and with 24 and 25 I was
able to reliably make it crash while at least 22 doesn't crash the kernel.

A workaround is to either set Firefox's gfx.xrender.enabled to false or disable
SNA in /etc/X11/xorg.conf.d.

SNA used to work without corrupted images or any other issues before a couple
months ago and the bug must have slipped in one of the kernel or
xf86-video-intel release of the last 3 months or so.

Also of interest is that with SNA enabled presumably caused by the same bug
Gtk+ 2.x widgets sometimes sporadically draw the inner part of button or scroll
bars rectangles corrupted but that never caused an instant crash with hardware
reset.

This looks like a critical memory corruption bug in the xorg or kernel code.

Software and hardware info:
* Core2Duo in Mac Mini 2,1 running in 32bit mode
* linux 3.10.2
* xf86-video-intel 2.21.11
* mesa 9.1.5
* Intel 945GM

Actual results:

Corrupted image and kernel crash with reset upon hitting reload button.


Expected results:

Image should be decoded and displayed correctly without resetting the machine.


>From Xorg.log with SNA enabled:
[    73.948] (==) Depth 24 pixmap format is 32 bpp
[    73.948] (II) intel(0): SNA initialized with Alviso (gen3) backend
[    73.948] (==) intel(0): Backing store disabled
[    73.948] (==) intel(0): Silken mouse enabled
[    73.948] (II) intel(0): HW Cursor enabled
[    73.948] (II) intel(0): RandR 1.2 enabled, ignore the following RandR
disabled message.
[    73.948] (==) intel(0): DPMS enabled
[    73.948] (II) intel(0): [XvMC] i915_xvmc driver initialized.
[    73.948] (II) intel(0): [DRI2] Setup complete
[    73.948] (II) intel(0): [DRI2]   DRI driver: i915
[    73.948] (II) intel(0): direct rendering: DRI2 Enabled
[    73.948] (==) intel(0): hotplug detection: "enabled"
[    73.949] (--) RandR disabled
[    73.968] (II) AIGLX: enabled GLX_MESA_copy_sub_buffer
[    73.968] (II) AIGLX: enabled GLX_INTEL_swap_event
[    73.968] (II) AIGLX: enabled GLX_ARB_create_context
[    73.968] (II) AIGLX: enabled GLX_ARB_create_context_profile
[    73.968] (II) AIGLX: enabled GLX_EXT_create_context_es2_profile
[    73.968] (II) AIGLX: enabled GLX_SGI_swap_control and GLX_MESA_swap_control
[    73.968] (II) AIGLX: GLX_EXT_texture_from_pixmap backed by buffer objects
[    73.969] (II) AIGLX: Loaded and initialized i915
[    73.969] (II) GLX: Initialized DRI2 GL provider for screen 0

>From Xorg.log without SNA enabled:
[  4731.653] (==) Depth 24 pixmap format is 32 bpp
[  4731.653] (II) intel(0): [DRI2] Setup complete
[  4731.653] (II) intel(0): [DRI2]   DRI driver: i915
[  4731.653] (II) UXA(0): Driver registered support for the following
operations:
[  4731.653] (II)         solid
[  4731.653] (II)         copy
[  4731.653] (II)         composite (RENDER acceleration)
[  4731.654] (II)         put_image
[  4731.654] (II)         get_image
[  4731.654] (==) intel(0): Backing store disabled
[  4731.654] (==) intel(0): Silken mouse enabled
[  4731.654] (II) intel(0): Initializing HW Cursor
[  4731.654] (II) intel(0): RandR 1.2 enabled, ignore the following RandR
disabled message.
[  4731.654] (==) intel(0): DPMS enabled
[  4731.654] (==) intel(0): Intel XvMC decoder disabled
[  4731.654] (II) intel(0): Set up textured video
[  4731.654] (II) intel(0): Set up overlay video
[  4731.654] (II) intel(0): direct rendering: DRI2 Enabled
[  4731.654] (==) intel(0): hotplug detection: "enabled"
[  4731.683] (--) RandR disabled
[  4731.703] (II) AIGLX: enabled GLX_MESA_copy_sub_buffer
[  4731.703] (II) AIGLX: enabled GLX_INTEL_swap_event
[  4731.703] (II) AIGLX: enabled GLX_ARB_create_context
[  4731.703] (II) AIGLX: enabled GLX_ARB_create_context_profile
[  4731.703] (II) AIGLX: enabled GLX_EXT_create_context_es2_profile
[  4731.703] (II) AIGLX: enabled GLX_SGI_swap_control and GLX_MESA_swap_control
[  4731.703] (II) AIGLX: GLX_EXT_texture_from_pixmap backed by buffer objects
[  4731.703] (II) AIGLX: Loaded and initialized i915
[  4731.703] (II) GLX: Initialized DRI2 GL provider for screen 0

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/intel-gfx-bugs/attachments/20130723/c45d8521/attachment.html>