On my system vga_draw_graphic is called with a surface_width(surface) = 1280, the next time surface_width(surface) = 1024, and then the next time again with surface_width(surface) = 1280. So it's a quick resolution change. Each time the surface pointer changes as well as surface_width(surface) and surface_data(surface). Do NOT try to access the s->last_surface with surface_data(s->last_surface) -- it likely has been freed already.
So my guess is we could add (a subset of) checks like this one here: if (s->last_surface != surface || s->last_surface_width != surface_width(surface) || s->last_surface_height != surface_height(surface) || s->last_surface_data != surface_data(surface)) { s->last_surface = surface; s->last_surface_width = surface_width(surface); ... full_update = 1; } -- You received this bug notification because you are a member of qemu- devel-ml, which is subscribed to QEMU. https://bugs.launchpad.net/bugs/1784900 Title: QEMU (frontend) crashes upon warm reboot with virtio-gpu device and vga=775 on Linux cmdline Status in QEMU: New Bug description: With vga=775 on the Linux command line a first boot of the VM running Linux works fine. After a warm reboot it crashes during Linux boot. The VM was used remotely via virt-manager and VNC. Bisecting the code lead to the following patch that introduced the bug: commit 1fccd7c5a9a722a9cbf1bc91693f4618034f01ac (HEAD, refs/bisect/bad) Author: Gerd Hoffmann <kra...@redhat.com> Date: Mon Jul 2 18:24:43 2018 +0200 virtio-gpu: disable scanout when backing resource is destroyed Signed-off-by: Gerd Hoffmann <kra...@redhat.com> Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com> Message-id: 20180702162443.16796-4-kra...@redhat.com diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 336dc59007..08cd567218 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -430,6 +430,16 @@ static void virtio_gpu_disable_scanout(VirtIOGPU *g, int scanout_id) static void virtio_gpu_resource_destroy(VirtIOGPU *g, struct virtio_gpu_simple_resource *res) { + int i; + + if (res->scanout_bitmask) { + for (i = 0; i < g->conf.max_outputs; i++) { + if (res->scanout_bitmask & (1 << i)) { + virtio_gpu_disable_scanout(g, i); + } + } + } + pixman_image_unref(res->image); virtio_gpu_cleanup_mapping(res); QTAILQ_REMOVE(&g->reslist, res, next); Reported backtraces can be found here: https://paste.fedoraproject.org/paste/OUDEfCk1IY7xiy0I0PDlkw To manage notifications about this bug go to: https://bugs.launchpad.net/qemu/+bug/1784900/+subscriptions