Ubuntu
rss-glx package

solarwinds crashed with SIGFPE in vbo_exec_vtx_flush()

Bug #346072 reported by Martin Olsson on 2009-03-20

284

This bug affects 66 people

	Status	Importance	Assigned to
Mesa	Fix Released	Medium	freedesktop-bugs #23489
mesa (Ubuntu)	Fix Released	Undecided	Unassigned
rss-glx (Ubuntu)	Confirmed	Medium	Unassigned

Bug Description

Binary package hint: rss-glx

crash

I was running in UXA mode using xorg-edgers as of march 20th and a vanilla 2.6.29-rc8 kernel compiled with ubuntu's kernel config.

ProblemType: Crash
Architecture: amd64
CrashCounter: 1
DistroRelease: Ubuntu 9.04
ExecutablePath: /usr/lib/xscreensaver/solarwinds
Package: rss-glx 0.8.2-1ubuntu3
ProcCmdline: solarwinds -r
ProcEnviron:
PATH=(custom, no user)
LANG=en_US.UTF-8
Signal: 8
SourcePackage: rss-glx
StacktraceTop:
vbo_exec_vtx_flush (exec=0x18a4a40, unmap=0 '\0')
?? ()
?? ()
?? ()
?? ()
Title: solarwinds crashed with SIGFPE in vbo_exec_vtx_flush()
Uname: Linux 2.6.29-020629rc8-generic x86_64
UserGroups: adm admin cdrom dialout fuse lpadmin plugdev sambashare

Tags:

Revision history for this message

Martin Olsson (mnemo) wrote on 2009-03-20:

Dependencies.txt Edit (2.7 KiB, text/plain; charset="utf-8")
Disassembly.txt Edit (991 bytes, text/plain; charset="utf-8")
ProcMaps.txt Edit (11.4 KiB, text/plain; charset="utf-8")
ProcStatus.txt Edit (761 bytes, text/plain; charset="utf-8")
Registers.txt Edit (1003 bytes, text/plain; charset="utf-8")
Stacktrace.txt Edit (1.1 KiB, text/plain; charset="utf-8")
ThreadStacktrace.txt Edit (1.1 KiB, text/plain; charset="utf-8")

Revision history for this message

Apport retracing service (apport) wrote on 2009-03-25: Symbolic stack trace

Stacktrace.txt (retraced) Edit (258 bytes, text/plain)

StacktraceTop:?? () from /usr/lib/dri/i965_dri.so
wind::update ()
hack_draw ()
mainLoop ()
main ()

Revision history for this message

Apport retracing service (apport) wrote on 2009-03-25: Symbolic threaded stack trace

ThreadStacktrace.txt (retraced) Edit (285 bytes, text/plain)

Changed in rss-glx:
importance:	Undecided → Medium

Brian Murray (brian-murray) on 2009-05-06

visibility:	private → public
Changed in rss-glx (Ubuntu):
status:	New → Triaged

Revision history for this message

Daniel Hermansson (daniel.h) wrote on 2009-06-23:

Also happens on ati (radeon-kms ppa)

Jonathan Thomas (echidnaman) on 2009-08-03

affects:	rss-glx (Ubuntu) → mesa (Ubuntu)
Changed in mesa (Ubuntu):
status:	Triaged → Confirmed

Bryce Harrington (bryce) on 2009-08-21

affects:	mesa (Ubuntu) → xscreensaver (Ubuntu)
Changed in xscreensaver (Ubuntu):
status:	Confirmed → New

Revision history for this message

Tormod Volden (tormodvolden) wrote on 2009-08-23:

Can you please try again with Karmic?

affects:	xscreensaver (Ubuntu) → mesa (Ubuntu)
Changed in mesa (Ubuntu):
assignee:	nobody → Tormod Volden (tormodvolden)
status:	New → Incomplete

Revision history for this message

Martin Olsson (mnemo) wrote on 2009-08-23:

Yes I just repro'd it on karmic. I just had to open the screensaver dialog and then I selected solarwinds and press "Preview". I let the apport crash submit from karmic and I marked that bug (417855) as a duplicate of this one in case the fresh logs contains additional clues.

As of right now, Karmic still has "mesa 7.5-1ubuntu1" though. I wonder if this repros on the 7.6 branch (I don't have time to check this right now though).

Revision history for this message

Martin Olsson (mnemo) wrote on 2009-08-23:

Here is a gdb log showing /usr/lib/xscreensaver/solarwinds being executing succesfully a couple of times in karmic-as-of-aug-23rd and then on the 4th time the program is started, it hits a SIGFPE almost right away. The log includes "bt full" and "info registers".

Changed in mesa (Ubuntu):
status:	Incomplete → Confirmed

Revision history for this message

Martin Olsson (mnemo) wrote on 2009-08-23:

gdb log show "bt full" with symbols and "info registers" Edit (8.7 KiB, text/plain)

Revision history for this message

Tormod Volden (tormodvolden) wrote on 2009-08-23: Re: [i965] solarwinds crashed with SIGFPE in vbo_exec_vtx_flush()

Thanks. The 7.6 snapshot should get into the archive within the next days, so let's see then.

summary:

- solarwinds crashed with SIGFPE in vbo_exec_vtx_flush()
+ [i965] solarwinds crashed with SIGFPE in vbo_exec_vtx_flush()

Revision history for this message

Tormod Volden (tormodvolden) wrote on 2009-08-23:

#10

In fact I can reproduce it on r300 also (M26 card) with 7.6.0~git20090817.7c422387-0ubuntu0sarvatt.
Presets 2, 3 and 4 are crashing here: /usr/lib/xscreensaver/solarwinds --preset 2

summary:	- [i965] solarwinds crashed with SIGFPE in vbo_exec_vtx_flush() + solarwinds crashed with SIGFPE in vbo_exec_vtx_flush()
Changed in mesa (Ubuntu):
assignee:	Tormod Volden (tormodvolden) → nobody

Revision history for this message

Tormod Volden (tormodvolden) wrote on 2009-08-23:

#11

debug backtrace Edit (7.1 KiB, text/plain)

Revision history for this message

Tormod Volden (tormodvolden) wrote on 2009-08-23:

#12

move also glBegin and glEnd inside the conditional Edit (787 bytes, text/plain)

It seems that vbo_exec_vtx_flush gets called with exec->vtx.vertex_size=0 and we get a division by zero. Not sure I understand this, but since this happens when linelist[i][1] = -1 in wind::update, I thought it was a bit strange that an empty GL_LINES block is run. This patch seems to avoid the crash at least.

affects:

mesa (Ubuntu) → rss-glx (Ubuntu)

Revision history for this message

Tormod Volden (tormodvolden) wrote on 2009-08-23:

#13

I am pretty sure this just exposes a bug in mesa though.

Revision history for this message

In freedesktop.org Bugzilla #23489, Bugzi09-fdo-tormod (bugzi09-fdo-tormod) wrote on 2009-08-24:

#14

Created an attachment (id=28886)
test case

If for instance,
glBegin(GL_LINES);
glEnd();
is repeated (64 times here) mesa will crash with

Program received signal SIGFPE, Arithmetic exception.
0x0109d5a0 in vbo_exec_vtx_flush (exec=0x809fc98, unmap=0 '\0')

because exec->vtx.vertex_size = 0 and we get a division by zero. Not that this is a useful construct, but it happens in some programs and did not crash before. http://www.opengl.org/documentation/specs/man_pages/hardcopy/GL/html/gl/begin.html says "Lines, triangles, quadrilaterals, and polygons that are incompletely specified are not drawn."

The attached test program demonstrates the crash (it is based on the example in http://glprogramming.com/red/chapter01.html :) )

Revision history for this message

In freedesktop.org Bugzilla #23489, Brian-paul (brian-paul) wrote on 2009-08-24:

#15

Fixed with commit b9b04872d526ed7955f647542399e110ace0325c.
This'll be in Mesa 7.5.1 and later.

Bryce Harrington (bryce) on 2009-08-24

tags:

added: crash

Revision history for this message

Martin Olsson (mnemo) wrote on 2009-08-24:

#16

Wow.. great work narrowing that down Tormod!

Bug Watch Updater (bug-watch-updater) on 2009-08-24

Changed in mesa:
status:	Unknown → Fix Released

Revision history for this message

Tormod Volden (tormodvolden) wrote on 2009-08-24:

#17

Fixed upstream in http://cgit.freedesktop.org/mesa/mesa/commit/?id=93aa0fd81c44c7a5f29f30e8f730e060597b06ad

Revision history for this message

In freedesktop.org Bugzilla #23489, Bugzi09-fdo-tormod (bugzi09-fdo-tormod) wrote on 2009-08-25:

#18

*** Bug 20850 has been marked as a duplicate of this bug. ***

Tormod Volden (tormodvolden) on 2009-08-25

Changed in mesa (Ubuntu):
status:	New → Confirmed

Revision history for this message

Tormod Volden (tormodvolden) wrote on 2009-08-25:

#19

My patch above was sent to and accepted by the upstream rss-glx author, so we might consider applying it until we have it through an upstream release. When it comes to SRU, the rss-glx workaround is trivial, whereas we might be more cautious about touching the mesa libraries.

Bryce Harrington (bryce) on 2009-09-02

tags:

added: jaunty

LEKE316 (leke316) on 2009-09-13

Changed in mesa:
status:	Fix Released → Incomplete
status:	Incomplete → Fix Released

Revision history for this message

spbrereton (simon-brereton) wrote on 2009-09-21:

#20

I suppose it makes sense for me to add I'm on a MacBook Pro 2.2 - and running Karmic..

Revision history for this message

Bryce Harrington (bryce) wrote on 2009-10-13:

#21

Confirmed that the fix for the mesa aspect of this bug is already present in Karmic now.

Changed in mesa (Ubuntu):
status:	Confirmed → Fix Released

David Futcher (bobbo) on 2010-06-10

tags:

added: patch-accepted-upstream

Bug Watch Updater (bug-watch-updater) on 2010-09-14

Changed in mesa:
importance:	Unknown → Medium

Bug Watch Updater (bug-watch-updater) on 2011-01-25

Changed in mesa:
importance:	Medium → Unknown

Bug Watch Updater (bug-watch-updater) on 2011-02-03

Changed in mesa:
importance:	Unknown → Medium

Revision history for this message

resolv_25 (elcondor1008-hotmail) wrote on 2012-04-22:

#22

Problem with this screensaver (actually, the other screensaver from the same package), system gets frozen, and brute force restart is the only way out.
This is on Natty Ubuntu - 32-bit.
Version of rss-glx is 0.9.1-3ubuntu1