[Spice-devel] some questions about function <red_process_commands> with bug #997772

[zhou link]

i almost hit the bug when i connect to a vm :
https://bugzilla.redhat.com/show_bug.cgi?id=997772

the log is nearly same
-----------------------------------------
((null):13420): SpiceWorker-Warning **: red_worker.c:1312:validate_surface:
[01-20 08:51:02]canvas address is 0x7f0560000bc8 for 0 (and is NULL)

((null):13420): SpiceWorker-Warning **: red_worker.c:1313:validate_surface:
[01-20 08:51:02]failed on 0
((null):13420): SpiceWorker-Warning **: red_worker.c:1314:validate_surface:
[01-20 08:51:02]condition `!worker->surfaces[surface_id].context.canvas'
reached
((null):13420): SpiceWorker-Warning **:
red_worker.c:160:rendering_incorrect: [01-20 08:51:02]rendering incorrect
from now on: handle_dev_update_async
---------------------------------------------------------------------

as the result client connects, only get black blank screen,

i watch the stack,  the main thread didn't accept the connection and was
blocked on "read" function (maybe in red_dispatcher_display_channel_create)
,

and red_worker thread looks like in a dead loop, consumes 100% cpu,
sometimes gdb attach it call qxl's interface_req_cmd_notification

so i guess the loop was in <red_process_commands>:
=======================================================
................
    while (!display_is_connected(worker) ||
                                  ////Q1
           // TODO: change to average pipe size?
           red_channel_min_pipe_size(&worker->display_channel->common.base)
<= max_pipe_size) {
        if (!worker->qxl->st->qif->get_command(worker->qxl, &ext_cmd)) {
            *ring_is_empty = TRUE;;
            if (worker->repoll_cmd_ring < CMD_RING_POLL_RETRIES) {
                                  ////Q2
                worker->repoll_cmd_ring++;
                worker->event_timeout = MIN(worker->event_timeout,
CMD_RING_POLL_TIMEOUT);
                break;
            }
            if (worker->repoll_cmd_ring > CMD_RING_POLL_RETRIES ||

 worker->qxl->st->qif->req_cmd_notification(worker->qxl)) {
        ////Q3
                worker->repoll_cmd_ring++;
                break;
            }
            continue;
                               //// dead loop ?
        }
        stat_inc_counter(worker->command_counter, 1);
        worker->repoll_cmd_ring = 0;
        switch (ext_cmd.cmd.type) {
        case QXL_CMD_DRAW: {
.......................................
======================================================

i can not understand the code fully,  some questions?
Q1).  why  the loop begin with display NOT connect?
Q2).  when qif->get_command get false,  and
repoll_cmd_ring==CMD_RING_POLL_RETRIES, req_cmd_notification get false,
dead loop ?
Q3).  req_cmd_notification  function hits only when
repoll_cmd_ring==CMD_RING_POLL_RETRIES,  does it meet the design ?


thx all very much !
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/spice-devel/attachments/20140122/da0f2be1/attachment.html>