Nouveau - Sep 2015 - [Bug 91972] New: xorg/nouveau crashes when running wine's unit tests under valgrind: EXA: malloc failed for size -262140 bytes

https://bugs.freedesktop.org/show_bug.cgi?id=91972

            Bug ID: 91972
           Summary: xorg/nouveau crashes when running wine's unit tests
                    under valgrind: EXA: malloc failed for size -262140
                    bytes
           Product: xorg
           Version: unspecified
          Hardware: x86-64 (AMD64)
                OS: Linux (All)
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Driver/nouveau
          Assignee: nouveau at lists.freedesktop.org
          Reporter: austinenglish at gmail.com
        QA Contact: xorg-team at lists.x.org

Created attachment 118205
  --> https://bugs.freedesktop.org/attachment.cgi?id=118205&action=edit
xorg.log

Originally reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=1248314

bug only occurred sometimes, but running the tests under valgrind triggers this
bug 100% of the time for me.

Running wine's dlls/user32/tests/win.c tests under valgrind causes the X
client
to fail, killing the user session.

[austin at localhost ~]$ dnf list installed | grep xorg | grep -e nouveau -e
server
xorg-x11-drv-nouveau.x86_64            1:1.0.11-2.fc22                  
@System
xorg-x11-server-Xorg.x86_64            1.17.2-2.fc22                    
@System
xorg-x11-server-Xwayland.x86_64        1.17.2-2.fc22                    
@System
xorg-x11-server-common.x86_64          1.17.2-2.fc22                    
@System
xorg-x11-server-utils.x86_64           7.7-15.fc22                      
@System

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20150911/b5d2c3c2/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=91972

Ilia Mirkin <imirkin at alum.mit.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|xorg/nouveau crashes when   |[NVE7] xorg/nouveau crashes
                   |running wine's unit tests   |when running wine's
unit
                   |under valgrind: EXA: malloc |tests under valgrind: EXA:
                   |failed for size -262140     |malloc failed for size
                   |bytes                       |-262140 bytes

--- Comment #1 from Ilia Mirkin <imirkin at alum.mit.edu> ---
Wow, very uncommon configuration... nouveau as main and intel as
"GPU". Are you
doing any actual offloading (of either outputs or rendering)?

exa/exa_migration_mixed.c:                FatalError("EXA: malloc failed
for
size %d bytes\n",

pExaPixmap->sys_pitch * pPixmap->drawable.height

exa/exa_priv.h:    int sys_pitch;              /**< pitch of pixmap in system
memory */
include/pixmapstr.h:    unsigned short height;

I guess sys_pitch is somehow negative then.

Can you "bisect" the test, i.e. figure out which bit of it triggers
the issue?
And perhaps modify that print to show what the individual values in that
multiplication are?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20150911/d2abad0d/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=91972

--- Comment #2 from Austin English <austinenglish at gmail.com> ---
(In reply to Ilia Mirkin from comment #1)
> Wow, very uncommon configuration... nouveau as main and intel as
"GPU". Are
> you doing any actual offloading (of either outputs or rendering)?
Not that I'm aware of (whatever Fedora set up for this particular hardware).

00:02.0 Display controller: Intel Corporation Xeon E3-1200 v3/4th Gen Core
Processor Integrated Graphics Controller (rev 06)
01:00.0 VGA compatible controller: NVIDIA Corporation GK104 [GeForce GTX 660
OEM] (rev a1)
> exa/exa_migration_mixed.c:                FatalError("EXA: malloc
failed for
> size %d bytes\n",
> 
> pExaPixmap->sys_pitch * pPixmap->drawable.height
> 
> exa/exa_priv.h:    int sys_pitch;              /**< pitch of pixmap in
> system memory */
> include/pixmapstr.h:    unsigned short height;
> 
> I guess sys_pitch is somehow negative then.
> 
> Can you "bisect" the test, i.e. figure out which bit of it
triggers the
> issue? And perhaps modify that print to show what the individual values in
> that multiplication are?
I've gotten it down to test_SetWindowPos(). I'll narrow it down further
next
week.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20150911/1a0d434a/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=91972

--- Comment #3 from Ilia Mirkin <imirkin at alum.mit.edu> ---
Can you also include the output of 'xrandr -q'? That should give me an
idea of
where the various outputs are located. Not sure if it'll be important to the
bug, but easy information to collect.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20150911/53f5ae07/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=91972

Ilia Mirkin <imirkin at alum.mit.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[NVE7] xorg/nouveau crashes |[NVE4] xorg/nouveau crashes
                   |when running wine's unit    |when running wine's
unit
                   |tests under valgrind: EXA:  |tests under valgrind: EXA:
                   |malloc failed for size      |malloc failed for size
                   |-262140 bytes               |-262140 bytes

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20150911/dbede301/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=91972

--- Comment #4 from Austin English <austinenglish at gmail.com> ---
(In reply to Ilia Mirkin from comment #3)
> Can you also include the output of 'xrandr -q'? That should give me
an idea
> of where the various outputs are located. Not sure if it'll be
important to
> the bug, but easy information to collect.
Screen 0: minimum 320 x 200, current 1920 x 1200, maximum 8192 x 8192
DVI-I-1 disconnected (normal left inverted right x axis y axis)
DVI-D-1 connected 1920x1200+0+0 (normal left inverted right x axis y axis)
518mm x 324mm
   1920x1200     59.95*+
   1600x1200     60.00  
   1280x1024     75.02    60.02  
   1152x864      75.00  
   1024x768      75.08    60.00  
   800x600       75.00    60.32  
   640x480       75.00    60.00  
   720x400       70.08  
HDMI-2 disconnected (normal left inverted right x axis y axis)
DP-1 disconnected (normal left inverted right x axis y axis)
HDMI1 disconnected (normal left inverted right x axis y axis)
VGA1 disconnected (normal left inverted right x axis y axis)
VIRTUAL1 disconnected (normal left inverted right x axis y axis)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20150914/46a28035/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=91972

--- Comment #5 from Austin English <austinenglish at gmail.com> ---
(In reply to Ilia Mirkin from comment #1)
> Wow, very uncommon configuration... nouveau as main and intel as
"GPU". Are
> you doing any actual offloading (of either outputs or rendering)?
> 
> exa/exa_migration_mixed.c:                FatalError("EXA: malloc
failed for
> size %d bytes\n",
> 
> pExaPixmap->sys_pitch * pPixmap->drawable.height
> 
> exa/exa_priv.h:    int sys_pitch;              /**< pitch of pixmap in
> system memory */
> include/pixmapstr.h:    unsigned short height;
> 
> I guess sys_pitch is somehow negative then.
> 
> Can you "bisect" the test, i.e. figure out which bit of it
triggers the
> issue? And perhaps modify that print to show what the individual values in
> that multiplication are?
Finally got to this, it's this call:
https://source.winehq.org/git/wine.git/blob/12111d8c3b897df92fabc1c1a81567477952e9b1:/dlls/user32/tests/win.c#l2200

printed the individual values:
win.c:2201: window handle: 0x1f00be window handle2: 0, left position: 100, top
position: 100, width: 12c height: 300, flags: 0

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20151102/9f2cea6c/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=91972

Martin Peres <martin.peres at free.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |MOVED
             Status|NEW                         |RESOLVED

--- Comment #6 from Martin Peres <martin.peres at free.fr> ---
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been
closed from further activity.

You can subscribe and participate further through the new bug through this link
to our GitLab instance:
https://gitlab.freedesktop.org/xorg/driver/xf86-video-nouveau/issues/214.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20191204/d64484c1/attachment.html>