[Spice-devel] [ spice-devel ] libspice server segfault

[Alon Levy]

> hello
> libspice 0.11.3
> qemu 1.2rc2
> 
> In windows XP Guest VM ,
> Change screensaver ( with small preview windows change)
> causes a segfault in libspice server .
> 
> I can always reproduce it ,
> two logs juste before segfault.
> 
> 
> usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (0, 0) (194, 21)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:2030:red_clear_surface_drawables_from_pipe: surface 19
> dependent item found 0x7fdb3a46ae10, 0x7fdb3b132150
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (165, 455) (359, 613)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 7: area ==>
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (5, 0) (199, 158)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:2030:red_clear_surface_drawables_from_pipe: surface 7
> dependent item found 0x7fdb3a46ccb0, 0x7fdb3ac64ce0
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (168, 437) (339, 452)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 19: area ==>
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (3, 3) (174, 18)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:2030:red_clear_surface_drawables_from_pipe: surface 19
> dependent item found 0x7fdb3a46c818, 0x7fdb3ac987e0
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:2633:red_display_detach_stream_gracefully: stream 49:
> upgrade by screenshot. has current 0. box ==>
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (257, 265) (409, 377)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (257, 265) (409, 377)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:2674:red_detach_streams_behind: stream 49
> (/usr/local/bin/qemu:11553): Spice-Debug **:
> red_dispatcher.c:309:async_command_alloc: 0x7fdaa007f4b0
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 7: area ==>
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (0, 0) (32, 32)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:11443:worker_handle_dispatcher_async_done:
> (/usr/local/bin/qemu:11553): Spice-Debug **:
> red_dispatcher.c:960:red_dispatcher_async_complete: 0x7fdaa007f4b0:
> cookie 140576964702000
> (/usr/local/bin/qemu:11553): Spice-Debug **:
> red_dispatcher.c:962:red_dispatcher_async_complete: no more async
> commands
> (/usr/local/bin/qemu:11553): Spice-Debug **:
> red_dispatcher.c:309:async_command_alloc: 0x7fdaa00b6f30
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 20: area ==>
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (0, 0) (16, 16)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:11443:worker_handle_dispatcher_async_done:
> (/usr/local/bin/qemu:11553): Spice-Debug **:
> red_dispatcher.c:960:red_dispatcher_async_complete: 0x7fdaa00b6f30:
> cookie 140576964474032
> (/usr/local/bin/qemu:11553): Spice-Debug **:
> red_dispatcher.c:962:red_dispatcher_async_complete: no more async
> commands
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:11553): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (472, 596) (547, 619)
> (/usr/local/bin/qemu:11553): SpiceWorker-ERROR **:
> ../spice-common/common/ring.h:83:ring_remove: assertion `item->next
> !=
> NULL && item->prev != NULL' failed
> Aborted
> 
> 
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (165, 434) (359, 455)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 22: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (0, 0) (194, 21)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:2030:red_clear_surface_drawables_from_pipe: surface 22
> dependent item found 0x7f67c1181838, 0x7f6728484650
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (168, 435) (358, 454)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 22: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (3, 1) (193, 20)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:2030:red_clear_surface_drawables_from_pipe: surface 22
> dependent item found 0x7f67c117e738, 0x7f672809f6e0
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 8: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (5, 0) (199, 158)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (165, 455) (359, 613)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (165, 455) (359, 613)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 25: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (0, 0) (194, 158)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:2030:red_clear_surface_drawables_from_pipe: surface 25
> dependent item found 0x7f67c11813a0, 0x7f672806db10
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (341, 435) (358, 454)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 22: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (176, 1) (193, 20)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:2030:red_clear_surface_drawables_from_pipe: surface 22
> dependent item found 0x7f67c117e118, 0x7f67280ab110
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (165, 434) (359, 455)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 10: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (0, 0) (194, 21)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:2030:red_clear_surface_drawables_from_pipe: surface 10
> dependent item found 0x7f67c11bd540, 0x7f6728189b90
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (165, 455) (359, 613)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 8: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (5, 0) (199, 158)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:2030:red_clear_surface_drawables_from_pipe: surface 8
> dependent item found 0x7f67c11bd540, 0x7f67285e68c0
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (168, 437) (339, 452)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 10: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (3, 3) (174, 18)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:2030:red_clear_surface_drawables_from_pipe: surface 10
> dependent item found 0x7f67c1181838, 0x7f67281b6310
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:10258:display_channel_release_item: not pushed (101)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:2633:red_display_detach_stream_gracefully: stream 49:
> upgrade by screenshot. has current 0. box ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (257, 265) (409, 377)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:4593:red_update_area: surface 0: area ==>
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> ../spice-common/common/rect.h:91:rect_debug: (257, 265) (409, 377)
> (/usr/local/bin/qemu:21130): SpiceWorker-Debug **:
> red_worker.c:2674:red_detach_streams_behind: stream 49
> Segmentation fault
> 

Hi Nicolas,

 Thanks for the report (s), can you please provide a stacktrace of qemu when it segfaults?
 Simplest way differs depending on how you run it:
  1) standalone - you launch qemu directly. Then run it under gdb:
    gdb --args qemu...
    r
    <do what leads to segfault>
    thread apply all bt
  2) you launch qemu via libvirt / any other means.
    launch qemu normally
    if this is the only copy of qemu that is running, you can launch:
     gdb -p `pgrep qemu`
    if you have more then one, you'll need to identify the pid yourself.
    <do what leads to segfault>
    thread apply all bt

Alon

> 
> 
> Regards,
> Nicolas
> _______________________________________________
> Spice-devel mailing list
> Spice-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/spice-devel
>