Nouveau - Jul 2008 - [Bug 16911] New: xserver EXA optimization causes nv31 to crash

http://bugs.freedesktop.org/show_bug.cgi?id=16911

           Summary: xserver EXA optimization causes nv31 to crash
           Product: xorg
           Version: git
          Platform: x86 (IA32)
        OS/Version: Linux (All)
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Driver/nouveau
        AssignedTo: nouveau at lists.freedesktop.org
        ReportedBy: sb476 at cam.ac.uk
         QAContact: xorg-team at lists.x.org


Created an attachment (id=18015)
 --> (http://bugs.freedesktop.org/attachment.cgi?id=18015)
Kernel log

Following the commit of a3afa6f2fb80489f7b6a88d12def09281d32ed94 "EXA:
Optimize
GXcopy tiled fills." to the xserver, the nouveau driver (git HEAD of both
ddx
and drm) will crash on certain webpages, with

[drm] PGRAPH_ERROR - nSource: LIMIT_COLOR, nStatus: PROTECTION_FAULT
[drm] PGRAPH_ERROR - Ch 1/6 Class 0x009f Mthd 0x0308 Data 0x00000003:0x00f304f8

in the kernel log and a fifo lockup in the ddx log -- both attached. A simple
reproducible case is using Firefox (2.0.0.16) on
http://people.freedesktop.org/~stuart/pgraph_limit_color/crash.html
Going back to the previous xserver commit "EXA: Replace open coded CopyArea
logic with GC op call.", the page does not cause the driver error, nor a
crash.

black.png used in the page was simply created in the GIMP using a new image and
a bucket fill. I suspect the size of the background image is a factor, as tests
using a 200x200 PNG did not crash.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=16911





--- Comment #1 from Stuart Bennett <sb476 at cam.ac.uk>  2008-07-30
16:05:02 PST ---
Created an attachment (id=18016)
 --> (http://bugs.freedesktop.org/attachment.cgi?id=18016)
Xorg log


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=16911





--- Comment #2 from Stephane Marchesin <marchesin at icps.u-strasbg.fr> 
2008-07-30 18:21:36 PST ---
Michel, I would think the following changes are required

                                                                               
                                 -width = min(pBox[i].x2 - dstX, width * 2);   
                                                                               
            +width = min(pBox[i].x2 - dstX, min(width * 2, tileWidth));

-height = min(pBox[i].y2 - dstY, height * 2);
+height = min(pBox[i].y2 - dstY, min(height * 2, tileHeight));

That doesn't solve our issue though.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=16911





--- Comment #3 from Stephane Marchesin <marchesin at icps.u-strasbg.fr> 
2008-07-30 18:27:23 PST ---
Scrap my last comment, I'm too tired. Don't scrap the bug though :)


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=16911





--- Comment #4 from Stephane Marchesin <marchesin at icps.u-strasbg.fr> 
2008-07-30 18:57:14 PST ---
So, there seems to be some issue with the first width/height computation ;
something like this helps:

-int width = min(pBox[i].x2 - pBox[i].x1, tileWidth);
-int height = min(pBox[i].y2 - pBox[i].y1, tileHeight);

+int width = min(pBox[i].x2 - pBox[i].x1 - tileWidth, tileWidth);
+int height = min(pBox[i].y2 - pBox[i].y1 - tileHeight, tileHeight);

Otherwise you start the 2nd copy (first one in the while loop) with the full
tile size, and this can be bigger than the total size.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

http://bugs.freedesktop.org/show_bug.cgi?id=16911





--- Comment #5 from Stuart Bennett <sb476 at cam.ac.uk>  2008-07-30
19:04:15 PST ---
Some things tried as detailed in 
http://people.freedesktop.org/~marcheu/irclogs/nouveau-2008-07-31

Last attempt replacing the width and height defintions/instantiations with:
int width = min(pBox[i].x2 - pBox[i].x1 - tileWidth, tileWidth);
int height = min(pBox[i].y2 - pBox[i].y1 - tileHeight, tileHeight);

fixed the test case, but lead to other problems shortly after -- xorg log with
the arguments to *pExaScr->info->Copy() printed at
http://people.freedesktop.org/~stuart/Xorg.0.log.old-big.txt shows some huge
negative widths and heights being passed, before an endless succession of calls
with height=0.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.