[Qemu-devel] Crash when booting KDE Neon using qxl-vga

[Leonardo Soares Müller]

With QEMU version 3.1.50 (v3.1.0-1218-gad7a21e812-dirty) (commit
ad7a21e81231ae64540310384fb0f87ac8758b02) on Xubuntu 18.04 host, a KDE
Neon guest is crashing on boot. The QEMU command line is:

gdb -q -ex "set pagination off" -ex "set print thread-events off" -ex
"handle SIGUSR1 nostop nopass noprint" -ex "run" --args
qemu-system-x86_64 -accel kvm -cpu host -smp cores=2,threads=1 -m 2048
-hda neonbroken.qcow2 -cdrom
~/Downloads/neon-useredition-20190124-0530-amd64.iso -device
qxl-vga,xres=1366,yres=768,addr=2 -display gtk,gl=on -monitor vc -serial
vc -device qemu-xhci,addr=3 -netdev user,id=net0 -device
e1000,netdev=net0,addr=4 -bios /usr/share/ovmf/OVMF.fd

The crash is happening pretty frequently but not 100% of the times.
Using virtio-vga instead of qxl-vga it's possible to use the guest
normally. Before the crash there are some graphical artifacts on guest
screen, they can be seen at https://i.imgur.com/rfTmmJ0.png

On terminal QEMU prints the following messages:

$ qemu-system-x86_64 -accel kvm -cpu host -smp cores=2,threads=1 -m 2048
-hda neonbroken.qcow2 -cdrom
~/Downloads/neon-useredition-20190124-0530-amd64.iso -device
qxl-vga,xres=1366,yres=768,addr=2 -display gtk,gl=on -monitor vc -serial
vc -device qemu-xhci,addr=3 -netdev user,id=net0 -device
e1000,netdev=net0,addr=4 -bios /usr/share/ovmf/OVMF.fd

(qemu-system-x86_64:11683): Gtk-WARNING **: 18:18:34.797: Theme parsing
error: gtk.css:47:15: negative values are not allowed.
id 0, group 0, virt start 0, virt end ffffffffffffffff, generation 0,
delta 0
id 1, group 1, virt start 7ff31fe00000, virt end 7ff323dfe000,
generation 0, delta 7ff31fe00000
id 2, group 1, virt start 7ff31bc00000, virt end 7ff31fc00000,
generation 0, delta 7ff31bc00000

(qemu:11683): Spice-CRITICAL **: 18:39:40.747:
memslot.c:111:memslot_get_virt: slot_id 255 too big, addr=ff000000ff000000
Abortado (imagem do núcleo gravada)

Here is the backtrace:

(gdb) bt
#0  0x00007ffff0373e97 in __GI_raise (address@hidden) at
../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff0375801 in __GI_abort () at abort.c:79
#2  0x00007ffff1171cc9 in  () at
/usr/lib/x86_64-linux-gnu/libspice-server.so.1
#3  0x00007ffff11373b8 in  () at
/usr/lib/x86_64-linux-gnu/libspice-server.so.1
#4  0x00007ffff11407d0 in  () at
/usr/lib/x86_64-linux-gnu/libspice-server.so.1
#5  0x00007ffff1140a76 in  () at
/usr/lib/x86_64-linux-gnu/libspice-server.so.1
#6  0x00007ffff11419a1 in  () at
/usr/lib/x86_64-linux-gnu/libspice-server.so.1
#7  0x00007ffff11543cd in  () at
/usr/lib/x86_64-linux-gnu/libspice-server.so.1
#8  0x00007ffff1152d21 in  () at
/usr/lib/x86_64-linux-gnu/libspice-server.so.1
#9  0x00007ffff11534bf in  () at
/usr/lib/x86_64-linux-gnu/libspice-server.so.1
#10 0x00007ffff11214f1 in  () at
/usr/lib/x86_64-linux-gnu/libspice-server.so.1
#11 0x00007ffff1127d7b in  () at
/usr/lib/x86_64-linux-gnu/libspice-server.so.1
#12 0x00007ffff47931f5 in g_main_context_dispatch () at
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#13 0x00007ffff47935c0 in  () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#14 0x00007ffff47938d2 in g_main_loop_run () at
/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#15 0x00007ffff1153b3a in  () at
/usr/lib/x86_64-linux-gnu/libspice-server.so.1
#16 0x00007ffff072d6db in start_thread (arg=0x7fff3602c700) at
pthread_create.c:463