| Priority | medium |
|---|---|
| Bug ID | 81680 |
| Assignee | dri-devel@lists.freedesktop.org |
| Summary | [r600g] Firefox crashes with hardware acceleration turned on |
| Severity | critical |
| Classification | Unclassified |
| OS | Linux (All) |
| Reporter | ken20001@ukr.net |
| Hardware | x86-64 (AMD64) |
| Status | NEW |
| Version | 10.1 |
| Component | Drivers/Gallium/r600 |
| Product | Mesa |
Firefox (several versions: 29, 30, 31) always crashes on exit if hardware acceleration turned on (parameter "layers.acceleration.force-enabled" switched to "true"). Automatic crash report here: https://crash-stats.mozilla.com/report/index/e8397029-4c99-41a3-9cfc-a260e2140718
| What | Removed | Added |
|---|---|---|
| CC | ken20001@ukr.net |
The same is with Mesa 10.3: https://crash-stats.mozilla.com/report/index/71106bc2-022a-45e3-b092-aecc62140723
(In reply to comment #2) > Can you resolve the r600_dri.so symbols? If you'll explain me how to.
(In reply to comment #3= ) > (In reply to comment #2) > > Can you resolve the r600_dri.so symbols? >=20 > If you'll explain me how to. First of all, make sure r600_dri.so has debugging symbols, i.e. is built wi= th -g and not stripped. If the Mozilla crash reporter still doesn't resolve the symbols then, try addr2line <frame address> -e /path/to/r600_dri.so for every r600_dri.so frame. BTW, I notice the crash involves libgallium.so.0.0.0, which is an Ubuntu specialty. Can your reproduce the problem with a build of upstream Mesa 10.= 1?
(In reply to comment #4) > (In reply to comment #3) > > (In reply to comment #2) > > > Can you resolve the r600_dri.so symbols? > > > > If you'll explain me how to. > > First of all, make sure r600_dri.so has debugging symbols, i.e. is built > with -g and not stripped. > > If the Mozilla crash reporter still doesn't resolve the symbols then, try > > addr2line <frame address> -e /path/to/r600_dri.so > > for every r600_dri.so frame. Sorry, but I don't understand how to determine how r600_dri.so was built and etc.
(In reply to comment #5= ) > Sorry, but I don't understand how to determine h= ow r600_dri.so was built and > etc. Since you seem to be using Ubuntu, installing the libgl1-mesa-dri-dbg packa= ge should make sure there are debugging symbols for r600_dri.so.
(In reply to comment #6) > (In reply to comment #5) > > Sorry, but I don't understand how to determine how r600_dri.so was built and > > etc. > > Since you seem to be using Ubuntu, installing the libgl1-mesa-dri-dbg > package should make sure there are debugging symbols for r600_dri.so. Yes, I'm using Kubuntu. And Libgl1-mesa-dri-dbg recently installed. Last report is here: https://crash-stats.mozilla.com/report/index/eee0e46e-1b64-4288-b9ac-fd5a82140804
(In reply to comment #7= ) > Yes, I'm using Kubuntu. And Libgl1-mesa-dri-dbg = recently installed. Last > report is here: It still doesn't resolve the symbols, please use addr2line.
(In reply to comment #8) > (In reply to comment #7) > > Yes, I'm using Kubuntu. And Libgl1-mesa-dri-dbg recently installed. Last > > report is here: > > It still doesn't resolve the symbols, please use addr2line. With what frame address I should use it or how to determine it ?
In the crash report referenced in comment 7, frame 1 says r600_dri.so@0x1ba0a1, so the address of frame 1 is 0x1ba0a1.
addr2line 0x1ba0a1 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/mesa/../../../../src/mesa/state_tracker/st_cb_drawpixels.c:1102 addr2line 0x18c0b9 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/mesa/../../../../src/mesa/vbo/vbo_attrib_tmp.h:161 addr2line 0x1145dd -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/mesa/../../../../src/mesa/main/glformats.c:418 addr2line 0x93e6b -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/mesa/../../../../src/mesa/main/context.c:1255 addr2line 0x190220 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/mesa/../../../../src/gallium/auxiliary/util/u_format_r11g11b10f.h:112 addr2line 0x28ea1f -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/glsl/../../../../src/glsl/list.h:440 (discriminator 2) addr2line 0x2657be -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/glsl/../../../../src/glsl/ir_clone.cpp:193 addr2line 0x2621e2 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408060730.c40d7d+gallium/build/dri/src/glsl/../../../../src/glsl/ir.cpp:632 addr2line 0x42cce -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so ??:0 addr2line 0x1c318 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so ??:0
Is it enough or may be something I did wrong ? Please tell me if so.
You didn't do anything particularly wrong (though note that fo= r the frames that say libGL.so.1.2.0@*, you need to pass libGL.so.1.2.0 instead of r600_d= ri.so to addr2line), but the resolved source code lines don't seem to have any sensi= ble correspondence. :( Are you sure Firefox was using the same /usr/lib/x86_64-linux-gnu/dri/r600_dri.so file when it crashed? Would it be possible for you to run Firefox in gdb, reproduce the crash and then attach the output of bt full?
I have some difficulties getting bt (don't know why):
Starting program: /usr/lib/firefox/firefox=20
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so=
.1".
[New Thread 0x7fffe9be4700 (LWP 4870)]
[Thread 0x7fffe9be4700 (LWP 4870) exited]
[New Thread 0x7fffe9be4700 (LWP 4873)]
[New Thread 0x7fffe2eff700 (LWP 4874)]
[New Thread 0x7fffe1ee6700 (LWP 4875)]
[New Thread 0x7fffe16e5700 (LWP 4876)]
[New Thread 0x7fffe0aff700 (LWP 4877)]
[New Thread 0x7fffdeed0700 (LWP 4880)]
[New Thread 0x7fffde4ff700 (LWP 4881)]
[New Thread 0x7fffe3030700 (LWP 4882)]
[New Thread 0x7fffdd5ff700 (LWP 4883)]
[New Thread 0x7fffdc7ff700 (LWP 4884)]
[New Thread 0x7fffe0ee4700 (LWP 4885)]
[New Thread 0x7fffde6cf700 (LWP 4886)]
[New Thread 0x7fffddcfe700 (LWP 4887)]
[New Thread 0x7fffdcdfe700 (LWP 4888)]
[New Thread 0x7fffc17ff700 (LWP 4889)]
[New Thread 0x7fffc09ff700 (LWP 4890)]
[New Thread 0x7fffc03ff700 (LWP 4891)]
[New Thread 0x7fffbfbfe700 (LWP 4892)]
[New Thread 0x7fffbf3fd700 (LWP 4893)]
[New Thread 0x7fffbebfc700 (LWP 4894)]
[New Thread 0x7fffbe1ff700 (LWP 4895)]
[New Thread 0x7fffbd9fe700 (LWP 4896)]
[Thread 0x7fffdc7ff700 (LWP 4884) exited]
[New Thread 0x7fffbcfff700 (LWP 4897)]
[Thread 0x7fffbf3fd700 (LWP 4893) exited]
[Thread 0x7fffbebfc700 (LWP 4894) exited]
[New Thread 0x7fffbc7fe700 (LWP 4898)]
[New Thread 0x7fffdc7ff700 (LWP 4899)]
[New Thread 0x7fffbf3fd700 (LWP 4900)]
[Thread 0x7fffdc7ff700 (LWP 4899) exited]
[Thread 0x7fffbfbfe700 (LWP 4892) exited]
[Thread 0x7fffbf3fd700 (LWP 4900) exited]
[New Thread 0x7fffbf3fd700 (LWP 4901)]
[Thread 0x7fffbf3fd700 (LWP 4901) exited]
[New Thread 0x7fffbf3fd700 (LWP 4902)]
[Thread 0x7fffbc7fe700 (LWP 4898) exited]
[New Thread 0x7fffbc7fe700 (LWP 4903)]
[New Thread 0x7fffdc7ff700 (LWP 4904)]
[Thread 0x7fffbf3fd700 (LWP 4902) exited]
[Thread 0x7fffbc7fe700 (LWP 4903) exited]
[New Thread 0x7fffbf3fd700 (LWP 4905)]
[New Thread 0x7fffbc7fe700 (LWP 4906)]
[New Thread 0x7fffbfbfe700 (LWP 4907)]
Program received signal SIGSEGV, Segmentation fault.
PatchJump (label=3D..., jump=3D...) at
/build/buildd/firefox-31.0+build1/js/src/jit/x64/Assembler-x64.h:716
716 /build/buildd/firefox-31.0+build1/js/src/jit/x64/Assembler-x64.h: =
=D0=9D=D0=B5=D0=BC=D0=B0=D1=94
=D1=82=D0=B0=D0=BA=D0=BE=D0=B3=D0=BE =D1=84=D0=B0=D0=B9=D0=BB=D0=B0 =D0=B0=
=D0=B1=D0=BE =D0=BA=D0=B0=D1=82=D0=B0=D0=BB=D0=BE=D0=B3=D1=83.
Quit
#0 PatchJump (label=3D..., jump=3D...) at
/build/buildd/firefox-31.0+build1/js/src/jit/x64/Assembler-x64.h:716
No locals.
#1 js::jit::JitRuntime::patchIonBackedges (this=3D<optimized out>, r=
t=3D<optimized
out>, target=3Dtarget@entry=3Djs::jit::JitRuntime::BackedgeLoopHeade=
r) at
/build/buildd/firefox-31.0+build1/js/src/jit/Ion.cpp:412
iter =3D {iter =3D 0x7fffbaaec5e0}
#2 0x00007ffff32cab85 in js::jit::InterruptCheck (cx=3D0x7fffde553480) at
/build/buildd/firefox-31.0+build1/js/src/jit/VMFunctions.cpp:523
No locals.
#3 0x00007ffff7e5627a in ?? ()
No symbol table info available.
#4 0x00007fffffff78b8 in ?? ()
No symbol table info available.
#5 0x00007fffffff7840 in ?? ()
No symbol table info available.
#6 0x00007ffff54f0840 in DeepCloneObjectLiteralInfo () from
/usr/lib/firefox/libxul.so
No symbol table info available.
#7 0x00007fffe0d34880 in ?? ()
No symbol table info available.
#8 0x00007fffdb8e8b59 in ?? ()
No symbol table info available.
#9 0x0000000000000601 in ?? ()
No symbol table info available.
#10 0x00007fffffff78b8 in ?? ()
No symbol table info available.
#11 0xfffbffffe0b77700 in ?? ()
No symbol table info available.
#12 0xfffbffffdb721b00 in ?? ()
No symbol table info available.
#13 0x24a0f352d0012900 in ?? ()
No symbol table info available.
#14 0x00007fffffff7990 in ?? ()
No symbol table info available.
#15 0xfff8800000000058 in ?? ()
No symbol table info available.
#16 0x00007fffdb730a80 in ?? ()
No symbol table info available.
#17 0x0000000000000000 in ?? ()
No symbol table info available.
Quit
P.S. libgl1-mesa-dri-dbg and firefox-dbg is definitely installed.
Any suggestions ?
There are only two r600_dri.so files: locate r600_dri.so /usr/lib/i386-linux-gnu/dri/r600_dri.so /usr/lib/x86_64-linux-gnu/dri/r600_dri.so And trying the one in i386-linux-gnu directory gives nothing. Only x86_64 version gives something (https://crash-stats.mozilla.com/report/index/b964df8c-1a33-4302-ba89-686422140811): addr2line 0x1ee641 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/mesa/../../../../src/gallium/auxiliary/util/u_inlines.h:151 addr2line 0x1c0669 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/mesa/../../../../src/mesa/state_tracker/st_cb_texture.c:157 addr2line 0x14da8d -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/mesa/../../../../src/mesa/main/shared.c:298 addr2line 0x940bb -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/mesa/../../../../src/mesa/main/context.c:1255 addr2line 0x1c47e0 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/mesa/../../../../src/mesa/state_tracker/st_context.c:333 addr2line 0x29adce -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/gallium/state_trackers/dri/../../../../../../src/gallium/state_trackers/dri/dri_context.c:194 addr2line 0x2977f2 -e /usr/lib/x86_64-linux-gnu/dri/r600_dri.so /build/buildd/mesa-10.3~git1408111930.904ed3+gallium/build/dri/src/mesa/drivers/dri/common/../../../../../../../src/mesa/drivers/dri/common/dri_util.c:487
| What | Removed | Added |
|---|---|---|
| Assignee | dri-devel@lists.freedesktop.org | mesa-dev@lists.freedesktop.org |
| CC | deathsimple@vodafone.de | |
| Component | Drivers/Gallium/r600 | Mesa core |
Okay, looks like it's crashing in st_texture_release_all_sampl=
er_views(),
specifically on this line of pipe_sampler_view_reference():
old_view->context->sampler_view_destroy(old_view->context, o=
ld_view);
Maybe old_view->context is no longer a valid context.
(In reply to comment #14)
> I have some difficulties getting bt (don't know =
why):
That looks like a different crash. Or maybe this is actually part of the no=
rmal
operation of the JavaScript JIT; what happens if you run 'continue' when th=
is
happens?