Bug 826000

Created attachment 587377 [details]
Xorg log from a crashed session

Description of problem:
After the XAA acceleration was removed, the MGA driver doesn't behave well.  (Also noted in bug 824569.)  It is significantly slower, and there are several small bugs in the rendering.

I tried to use the EXA acceleration instead, by setting

	Option "AccelMethod" "EXA"

in my xorg.conf.  After that, the server crashes when I try to start a session.  Just starting an empty server doesn't trigger the problem, and some clients can connect to it without errors.  But many other clients makes it crash.  A simple test case I've been using has been to start xclock.



Version-Release number of selected component (if applicable):
xorg-x11-server-Xorg-1.12.0-5.fc17.x86_64
xorg-x11-drv-mga-1.4.13-19.20120104git9223c44a7.fc17.x86_64
xorg-x11-apps-7.6-5.fc17.x86_64

How reproducible:
Every time

Steps to Reproduce:
1. Xorg :42
2. xclock  -display :42

Actual results:
The server crashes

Expected results:
The server should run, showing an xclock

Additional info:
I've tried to look at this in a debugger, and I get the backtrace shown below.  My limited understanding is that the call from exaCopyDirty() in exa_migration_classic.c to mgaDownloadFromScreen() in mga_exa.c breaks, most likely because some inconsistency in the argument.  If the bug is exaCopyDirty sending wrong arguments, or mgaDownloadFromScreen treating them incorrectly, I don't know, so assigning this to the server package is just a guess from my side.  AFAIK, it could just as well be a bug in the MGA driver.

#0  __memcpy_sse2 () at ../sysdeps/x86_64/memcpy.S:197
#1  0x00007fa3f0b1d2fe in memcpy (__len=32, __src=0x14650, __dest=0x238afd8) at /usr/include/bits/string3.h:52
#2  mgaDownloadFromScreen (pSrc=pSrc@entry=0x237dd40, x=<optimized out>, y=<optimized out>, w=<optimized out>, h=<optimized out>, dst=0x238afd8 "", dst_pitch=656) at mga_exa.c:745
#3  0x00007fa3f06eba7b in exaCopyDirty (migrate=migrate@entry=0x7fff9ebc7550, pValidDst=0x237ddc8, pValidSrc=0x237ddd8, transfer=0x7fa3f0b1d290 <mgaDownloadFromScreen>, fallback_index=fallback_index@entry=1, sync=0x7fa3f06ea6e0 <exaWaitSync>) at exa_migration_classic.c:220
#4  0x00007fa3f06ebdc4 in exaCopyDirtyToSys (migrate=migrate@entry=0x7fff9ebc7550) at exa_migration_classic.c:281
#5  0x00007fa3f06ebe38 in exaDoMoveOutPixmap (migrate=migrate@entry=0x7fff9ebc7550) at exa_migration_classic.c:396
#6  0x00007fa3f06ec914 in exaDoMigration_classic (pixmaps=0x7fff9ebc7550, npixmaps=<optimized out>, can_accel=0) at exa_migration_classic.c:704
#7  0x00007fa3f06eca14 in exaPrepareAccessReg_classic (pPixmap=0x237dd40, index=0, pReg=<optimized out>) at exa_migration_classic.c:742
#8  0x00007fa3f06f7f68 in ExaPrepareCompositeReg (height=2, width=8, yDst=81, xDst=148, yMask=0, xMask=0, ySrc=0, xSrc=0, pDst=0x2350210, pMask=0x21df840, pSrc=0x23504d0, op=3 '\003', pScreen=<optimized out>) at exa_unaccel.c:599
#9  ExaCheckComposite (op=op@entry=3 '\003', pSrc=pSrc@entry=0x23504d0, pMask=pMask@entry=0x21df840, pDst=pDst@entry=0x2350210, xSrc=xSrc@entry=0, ySrc=ySrc@entry=0, xMask=xMask@entry=0, yMask=yMask@entry=0, xDst=148, yDst=81, width=width@entry=8, height=height@entry=2) at exa_unaccel.c:624
#10 0x00007fa3f06f4898 in exaComposite (op=3 '\003', pSrc=0x23504d0, pMask=0x21df840, pDst=0x2350210, xSrc=<optimized out>, ySrc=<optimized out>, xMask=0, yMask=0, xDst=<optimized out>, yDst=<optimized out>, width=8, height=2) at exa_render.c:1066
#11 0x0000000000501989 in damageComposite (op=3 '\003', pSrc=0x23504d0, pMask=0x21df840, pDst=0x2350210, xSrc=0, ySrc=0, xMask=0, yMask=0, xDst=148, yDst=81, width=8, height=2) at damage.c:569
#12 0x00007fa3f06f595f in exaTrapezoids (op=3 '\003', pSrc=0x23504d0, pDst=0x2350210, maskFormat=<optimized out>, xSrc=0, ySrc=<optimized out>, ntrap=<optimized out>, traps=0x22c58f8) at exa_render.c:1181
#13 0x00000000004fb4cb in ProcRenderTrapezoids (client=0x22c9220) at render.c:777
#14 0x000000000043439a in Dispatch () at dispatch.c:439
#15 0x00000000004233e5 in main (argc=2, argv=0x7fff9ebc7ad8, envp=<optimized out>) at main.c:287