Crash in Chromium browser while enabling hardware acceleration

[Diepakk Sharma k]

I am trying to enable hardware acceleration on AMD platform, after enabling hardware acceleration, I can see crash in browser. Log shows 

kernel: [   27.974171] chrome[3915]: segfault at 0 ip 00007f7ddba175f9 sp 00007ffc00cd0fe0 error 4 in chrome[7f7dda8c1000+7c22000]

kernel: [   35.388945] chrome[4856]: segfault at c ip 00007fe515b94760 sp 00007fff65e5af18 error 4 in libxcb-glx.so.0.0.0[7fe515b89000+13000]

Initially system was rebooting after hardware acceleration was enabled , so I modified Option    "NoTrapSignals" to "false"  in Section "ServerFlags" of Xorg.conf.

After that I was able to see this crash, i think this crash was cause of reboot. How will i look into this issue, I have not build browser separately and not modified any code in libxcb. I am using xf86-video-ati-7.3.0. ebuild for ddx driver.

Attaching logs. 

    

  

[Sumit Agrawal]

Hi Deepak,

I am also facing similar issue. I tried to "run build_packages with --withdebugsymbols" as mentioned in below link.

https://www.chromium.org/chromium-os/how-tos-and-troubleshooting/portage-build-faq#TOC-How-do-I-build-a-debug-package-

But I did not get any extra debug symbols or callstack, in the logs. You can try the same and check if it helps.

I am running out of ideas on how to debug this issue or how to get the callstack. Can someone help?

Regards,

Sumit

[Dominik Behr]

Fun chrome options you can add to chrome command line in /etc/chrome_dev.conf:

--disable-hang-monitor

--no-sandbox # disables all sandboxes

--disable-gpu-sandbox # disables gpu sandbox only, creates only one GPU process

--disable-gpu-watchdog # disables 10 second watchdog thread for GL calls, needed to debug GL driver

--enable-gpu-debugging

--wait-for-debugger

Afterwards you can attach debugger to the gpu process to see what happens during the crash.

Which version of Mesa are you using? From Chromium tree or your own? If you use your own Mesa please makes sure to port all the patches, particularly this one is important 10.3-state_tracker-gallium-fix-crash-with-st_renderbuffer.patch

--

Dominik

[Diepakk Sharma k]

Thanks Dominik, will try chrome option you have provided.

 Regarding mesa , using mesa-9999.ebuild , which is downloading 10.6. Verified that  all patches are applied.

Diepakk

--
--
Chromium OS Developers mailing list: chromiu...@chromium.org
View archives, change email options, or unsubscribe:
http://groups.google.com/a/chromium.org/group/chromium-os-dev?hl=en

[Diepakk Sharma k]

Hi Dominik,

I tried given option , but not able to narrow down the issue. Used GDB to trace call stack. Didn't find gpu pocess in process list, so tried to attach with chrome and X/Xorg prcoess.

backtrace of chrome :

#0  0x00007f12b2c775f9 in ?? ()

#1  0x00007f12b2c78c5f in ?? ()

#2  0x00007f12b567c8fa in ?? ()

#3  0x00007f12b6223bca in ?? ()

#4  0x00007f12b6223e1b in ?? ()

#5  0x00007f12b6226d53 in ?? ()

#6  0x00007f12b6226f81 in ?? ()

#7  0x00007f12b58900ea in ?? ()

#8  0x00007f12b58901e1 in ?? ()

#9  0x00007f12b567a6db in ?? ()

#10 0x00007f12b5679a83 in ?? ()

#11 0x00007f12b2bd822a in ?? ()

#12 0x00007f12b2bd6ad9 in ?? ()

#13 0x00007f12b26b1d0f in ChromeMain ()

#14 0x00007f12b0078fb6 in __libc_start_main (main=0x7f12b26b1050, argc=25, argv=0x7ffd56042dd8, init=<optimized out>, fini=<optimized out>, 

    rtld_fini=<optimized out>, stack_end=0x7ffd56042dc8) at libc-start.c:292

#15 0x00007f12b26b1b80 in _start ()

Backtrace of Xorg: 

0  0x0000000000000000 in ?? ()

No symbol table info available.

#1  0x00007efd91ecc792 in ?? () from /usr/lib64/dri/radeonsi_dri.so

No symbol table info available.

#2  0x0000000000000000 in ?? ()

No symbol table info available. 

------------------------------------------------------

Not able to find correct sp to see where the crash it.  I have build Mesa,X-server and ati-ddx driver with debug symbol using:

USE="debug" CFLAGS="-g -O0" FEATURES="nostrip noclean -splitdebug" emerge-amd64-generic -a x11-drivers/xf86-video-ati

By adding option in chrome_dev.conf, found some more error in log , not sure if this is due to --wait-for-debugger option ,as once I remove that option, error did not occur.

"session_manager[1012]: [ERROR:logging.h(779)] Failed to call method: org.chromium.LibCrosServiceInterface.CheckLiveness:"

attaching log with modified chrome_dev.conf option.

Any suggestion? 

Thanks,

Deepak

[Dominik Behr]

From the kernel log file I see you have usb serial dongle PL2303 on ttyUSB0, is this the serial ports you guys are trying to see kernel messages from?

From chrome log it looks like X server has crashed first?

[10008:10008:0819/042137:ERROR:x11_util.cc(82)] X IO error received (X server probably went away)

[1723:1723:0819/042137:ERROR:chrome_browser_main_extra_parts_x11.cc(57)] X IO error received (X server probably went away)

I use these aliases to build with debug symbols:

alias demerge='USE="debug kgdb" FEATURES="nostrip noclean -splitdebug" emerge-${BOARD} $*'

and to deploy the package on the chromebook

alias rdeploy='cros deploy --board=$BOARD $REMOTE_IP $*'

where BOARD and REMOTE_IP are respectively board name, and IP address of the board

most of the time we use ASIX based ethernet adapters for remote access

Please be sure to rebuild and deploy xorg-server, xf86-video-ati, mesa and chromeos-chrome to get meaningful stack traces. From your stack trace it looks like radeonsi_drv called a NULL pointer.

--

Dominik

--

Dominik

[Diepakk Sharma k]

Hi Dominik,

Yes was trying to use that serial port to see kernel logs but later was not required.

Regarding stack trace I am not sure , we are getting correct as Can see NULL pointer after and before radeonsi_drv call.

Have tried to use debug symbol as you suggested. If i flash the image am getting same output as earlier. I have done debug build for  xorg-server, xf86-video-ati, mesa 

When tried it for chromeos-chrome , getting "No space left on device" . Have tried 2gb and 4gb rootfs disk layout.

Thanks,

Diepakk 

[Dominik Behr]

You can try symlinking /opt/google/chrome to /usr/local/chrome so bigger chrome with symbols would be deployed there.

Also, be sure to use --no-strip option for cros deploy.

--

Dominik

--

Dominik

[Diepakk Sharma k]

Hi Dominik,

Thanks it worked. Finally can see symbols.. debugging issue.

Thanks,

Diepakk

[Diepakk Sharma k]

Hi Dominik,

Thanks for your support.Issue got fixed. Surprisingly issue was caused by "10.3-state_tracker-gallium-fix-crash-with-st_renderbuffer.patch". After removing this patch it worked, Glamor initialized successfully and X-server did not crash. So now Its working and able to use chromium with hardware acceleration for radeonsi.

Call stack was pointing to "pipe_sampler_view_reference" in "gallium/auxiliary/util/u_inlines.h".

Thanks,
Diepakk

    

[Dominik Behr]

Hi Diepakk,

It's great news it works now, but you should investigate what went wrong with this patch and reapply it with the fixes for radeonsi.

I am betting it is missing changes (assignment of destructor functions) in radeonsi driver, so when upper layer tries to destroy an object it calls NULL pointer.

So you will have to add a patch for radeonsi to set sampler_view_destroy and surface_destroy methods in radeonsi.

Otherwise you will see crashes or memory leaks in other places.

--

Dominik

[Diepakk Sharma k]

Hi Dominik,

Sure. Thanks for Input, will look into that part to make sure don't see memory leak for crash.

Thanks,

Diepakk