compiz crashed with SIGSEGV in intel_miptree_release()

StacktraceTop:
 intel_miptree_release (mt=0x220) at intel_mipmap_tree.c:290
 intel_process_dri2_buffer_with_separate_stencil (buffer_name=0x7f10978c0090 "dri2 hiz buffer", rb=0x2d05200, buffer=<optimized out>, intel=0x1c6ba50, drawable=<optimized out>) at intel_context.c:1267
 intel_update_renderbuffers (context=<optimized out>, drawable=0x3149090) at intel_context.c:361
 intelSetTexBuffer2 (pDRICtx=0x1c65920, target=3553, texture_format=8410, dPriv=0x3149090) at intel_tex_image.c:335
 TfpTexture::bindPixmapToTexture(unsigned long, int, int, int) () from /tmp/tmpT7Z2eR/usr/lib/compiz/libopengl.so

Status changed to 'Confirmed' because the bug affects multiple users.

That bug is getting quite some duplicates, Bryce, Chris, any clue if that's an xorg or unity issue?

Crashing in mesa around here:

mesa-git-ubuntu/src/mesa/drivers/dri/i915/intel_context.c:
   /* Release the buffer storage now in case we have to return early
    * due to failure to allocate new storage.
    */
   if (buffer->attachment == __DRI_BUFFER_HIZ) {
      intel_miptree_release(&rb->mt->hiz_mt);
   } else {
      intel_miptree_release(&rb->mt);
   }

Guess it's a regression in mesa 8? Probably should go upstream; would be helpful to know steps to reproduce first though.

Diego and czajkowski,

So far I've been unable to reproduce this bug on Intel. However, this may well be one of the infamous HiZ bugs in mesa 8.0, which are believed should be solved with a patch included in 8.0.1:

http://cgit.freedesktop.org/mesa/mesa/patch/?id=e1f9820b47e3f124c49cd2ab4e09328e0cc3e638

Since it sounds like you guys are able to reproduce this relatively easily, would you mind doing a test? I've verified we include this patch in current xorg-edgers, so can you install that PPA and verify that the problems go away?

https://launchpad.net/~xorg-edgers/+archive/ppa

Here, this is a cleaner PPA with *just* mesa. Use this rather than xorg-edgers:

  https://launchpad.net/~ubuntu-x-swat/+archive/mesa-8.0.1

Added the PPA so far no issues, have opened up numerous applications and switched between them and no crash occurred.

Great, then yeah this looks like it's an HiZ issue.

We'll be updating to 8.0.1 soon enough, not worth the trouble to cherrypick the patches.

This bug was fixed in the package mesa - 8.0.1-0ubuntu1

---------------
mesa (8.0.1-0ubuntu1) precise; urgency=low

  * Merge from Debian experimental.

mesa (8.0.1-1) UNRELEASED; urgency=low

  * New upstream bugfix release. (LP: #926379)

mesa (8.0-2) experimental; urgency=low

  [ Julien Cristau ]
  * Only build the radeon, r200, i915 and i965 dri drivers on Linux. They
    require KMS.

  [ Cyril Brulebois ]
  * Fix FTBFS on GNU/kFreeBSD with libgl1-mesa-dri.install.kfreebsd.in:
    there's no *_dri.so file left in the top directory, only swrast is
    built and shipped under gallium/. So mention it explicitly, in the
    same way as it is done in the libgl1-mesa-dri.install.linux.in file.
  * Enable wayland support again, but only on Linux. Wayland needs some
    porting (it uses *CLOEXEC flags and epoll). For that, add those files
    since EGL packages are also shipped on GNU/kFreeBSD, and we need to
    add a few files for Wayland, but only for Linux:
    - libegl1-mesa-dev.install.linux.in
    - libegl1-mesa-drivers.install.linux.in
  * Limit the wl_drm_interface symbol to arch=linux-any accordingly,
    and bump the version.
  * Limit the build-dependency on libwayland-dev to linux-any too, and
    bump it.
  * Automatically revert changes to bin/{config.{guess,sub},install-sh} in
    the clean target. The first two are modified, the last one needs to be
    turned back into a symlink.
 -- Timo Aaltonen <email address hidden> Thu, 23 Feb 2012 11:34:05 +0200

This seems to have hit me again: bug 942662

I also just got bitten by this - on a freshly updated + rebooted precise laptop with mesa 8.0.1-0ubuntu2 installed. Reopening...

Hmm, bummer. I wonder if it is indeed the prior bug, or just some secondary fallout.

I've re-enabled the apport collector so hopefully it can bring us another stacktrace. Meanwhile, please do whatever you can to reproduce the crash one more time, so we can get an updated stack trace for the new code.

Possibly is this upstream bug:
  https://www.libreoffice.org/bugzilla/show_bug.cgi?id=46303
we'll have to check once someone's posted a stacktrace.

http://article.gmane.org/gmane.comp.freedesktop.xorg.drivers.intel/9022
http://<email address hidden>/msg08585.html
https://bugs.freedesktop.org/show_bug.cgi?id=44970

Our guess is that the 8.0.1 patch solved these crashes for the general case, but there are corner cases. The aforementioned links indicate that this crash happens when compiz renders to a large texture. If that is true, it would mean that this bug can be reproduced only on systems with large extended monitors or similar configurations with very high total resolution allocations. Something like that.

Also, sounds like this issue is believed to affect only sandybridge / ironlake, although I don't have that confirmed and can't tell from the dupes. (Unfortunately the unity apport hook doesn't attach hardware info, grr...)

I don't have a sandybridge/ironlake system on hand, and can't reproduce on my other intel hardware.

However if someone does have that hardware and can reproduce the issue, here's what we need right now:

a) Gather a full backtrace (see https://wiki.ubuntu.com/Backtrace)
b) Is it reproducible on any graphics other than ironlake/sandybridge?
c) What are some steps that will (semi-)reliably reproduce the crash?

Bryce, do you still need me to attach dmesg/Xorg.0.log/xsession-errors?

There have been two patches proposed upstream (one to mesa, one to libdrm) which purportedly fix this crash, however they've not yet been reviewed or accepted into any official git trees. If someone figures out a reliable way to reproduce the crash, we can package the patches for testing (probably not worth packaging them until we have a way to definitively know whether or not they will work.)

I won't be able to get a backtrace today, but will do so tomorrow if nobody beats me to it.

Guilherme, yes a fresh dmesg/Xorg.0.log/.xsession-errors would be helpful. The backtrace is the most important bit though so we definitely need that.

Package: unity 5.4.0-0ubuntu2
ProcCmdline: compiz

From elmo's dupe bug #942966

.xsession-errors:
Gtk-WARNING **: Unable to locate theme engine in module_path: "pixmap",
ERROR:dbus.service:Unable to append ({'CanGoNext': True, 'CanPause': True, 'Shuffle': True, 'CanControl': True, 'LoopStatus': 'None', 'PlaybackStatus': 'Paused', 'Volume': 1.0, 'MinimumRate': 1.0, 'Rate': 1.0, 'CanPlay': True, 'CanSeek': True, 'Position': <function __get_position at 0x3fc47d0>, 'CanGoPrevious': True, 'MaximumRate': 1.0, 'Metadata': dbus.Dictionary({'mpris:trackid': '/org/mpris/MediaPlayer2/'}, signature=dbus.Signature('sv'))},) to message with signature a{sv}: <type 'exceptions.TypeError'>: Don't know which D-Bus type to use to encode type "function"

** WARNING **: Error calling current_status: Method "current_status" with signature "" on interface "com.ubuntuone.SyncDaemon.Status" doesn't exist

** CRITICAL **: syncdaemon_status_info_get_online: assertion `SYNCDAEMON_IS_STATUS_INFO (sinfo)' failed
gnome-session[2252]: WARNING: Application 'compiz.desktop' killed by signal
gnome-session[2252]: WARNING: App 'compiz.desktop' respawning too quickly
gnome-session[2252]: CRITICAL: We failed, but the fail whale is dead. Sorry....
Checking if settings need to be migrated ...no

Nothing in Xorg.0.log pertaining to the crash.

dmesg shows compiz crash:
[ 59.698080] [UFW BLOCK] IN=lxcbr0 OUT= MAC=01:00:5e:00:00:01:22:e2:79:01:8e:08:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2
[ 59.698147] [UFW BLOCK] IN=lxcbr0 OUT= MAC=33:33:00:00:00:01:22:e2:79:01:8e:08:86:dd SRC=fe80:0000:0000:0000:20e2:79ff:fe01:8e08 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=130 CODE=0
[ 63.471023] [UFW BLOCK] IN=virbr0 OUT= MAC=01:00:5e:00:00:01:9e:da:ff:51:e8:e6:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2
[ 65.272714] [drm] Changing LVDS panel from (-hsync, -vsync) to (-hsync, +vsync)
[ 68.500193] Valid eCryptfs headers not found in file header region or xattr region, inode 20578766
[ 68.500196] Either the lower file is not in a valid eCryptfs format, or the key could not be retrieved. Plaintext passthrough mode is not enabled; returning -EIO
[ 104.146438] compiz[2324]: segfault at 220 ip 00007f80c046e5a9 sp 00007fff153052b0 error 4 in i965_dri.so[7f80c0444000+ce000]
[ 184.765977] [UFW BLOCK] IN=lxcbr0 OUT= MAC=01:00:5e:00:00:01:22:e2:79:01:8e:08:08:00 SRC=0.0.0.0 DST=224.0.0.1 LEN=32 TOS=0x00 PREC=0xC0 TTL=1 ID=0 DF PROTO=2
[ 184.766101] [UFW BLOCK] IN=lxcbr0 OUT= MAC=33:33:00:00:00:01:22:e2:79:01:8e:08:86:dd SRC=fe80:0000:0000:0000:20e2:79ff:fe01:8e08 DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=130 CODE=0

I've forwarded this bug upstream to: https://bugs.freedesktop.org//show_bug.cgi?id=46739

I think we have enough info now, although I wouldn't mind seeing other stacktraces in case there are more permutations on this bug.

I have somewhat artificial steps but they reproduce this problem pretty easily on my Sandy Bridge laptop.
Open video with gmplayer and start switching fullscreen/windowed using 'f' key and scroll forward using right arrow simultaneously. Usually it takes less then 30 seconds before crash.

Critical bug in xorg ... I suspect the desktop team will want to look at it again, so assigning

This keeps happening to me today when i alt tab through applications and it just randomly crashes!

The fix

This bug was fixed in the package mesa - 8.0.2-0ubuntu2

---------------
mesa (8.0.2-0ubuntu2) precise; urgency=low

  [ Robert Hooker ]
  * Add 117_intel_fix_hiz_null_dereference.patch fixing a null deference
    when processing HiZ buffers (LP: #926379)
 -- Timo Aaltonen <email address hidden> Thu, 22 Mar 2012 21:25:52 +0200