Bug 18367 - [Q965 GEM]mesa xdemo wincopy Segmentation fault
Summary: [Q965 GEM]mesa xdemo wincopy Segmentation fault
Status: VERIFIED FIXED
Alias: None
Product: Mesa
Classification: Unclassified
Component: GLX (show other bugs)
Version: unspecified
Hardware: x86 (IA32) Linux (All)
: medium normal
Assignee: Eric Anholt
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-11-04 01:20 UTC by lin, jiewen
Modified: 2009-02-17 18:54 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments
log (79.38 KB, text/plain)
2008-11-04 01:20 UTC, lin, jiewen
Details
conf (3.67 KB, text/plain)
2008-11-04 01:21 UTC, lin, jiewen
Details
check null pointer at early stage (736 bytes, patch)
2008-12-25 11:38 UTC, Shunichi Fuji
Details | Splinter Review

Description lin, jiewen 2008-11-04 01:20:15 UTC
Created attachment 20031 [details]
log

System Environment:
--------------------------

--Platform: q965
--Architecture(32-bit,64-bit,compatiblity): 32-bit
--2D driver: (master)7e68786cf746b6b984b184080578db1947b268ed
--3D driver: (master)4be624d693554ad3950afab90e331a6725cc5004
--DRM:shipped with kernel 2.6.28-rc3
--libdrm: (master)87e90c73620b88005fcca5fd40aaaad0b08932e1
--Xserver: (master)a7951a4dad902edea76a5cd68f833f0e48ae804b
--Kernel: 2.6.28-rc3 commit 4cfed552365fc7b226d93c28ffc5e85db29f2820

Bug detailed description:
--------------------------
Start X and run wincopy, Segmentation fault appears immediately.

Reproduce steps:
----------------
1. xinit &
2. ./wincopy
Comment 1 lin, jiewen 2008-11-04 01:21:10 UTC
Created attachment 20032 [details]
conf
Comment 2 lin, jiewen 2008-11-04 23:48:42 UTC
The kernel is from the drm-intel-next branch.
Comment 3 Eric Anholt 2008-11-21 01:28:23 UTC
looks like a compat problem from dri2 work.

#0  0xb80682ac in driBindContext (context=0x805ac30, draw=0x0, read=0x8083b88) at dri_glx.c:456
#1  0xb804678c in MakeContextCurrent (dpy=0x804b008, draw=46137350, read=46137348, 

gdb) frame 1
#1  0xb804678c in MakeContextCurrent (dpy=0x804b008, draw=46137350, read=46137348, 
    gc=0x8053018, pre13=0) at glxcurrent.c:390
390	      bindReturnValue =
(gdb) list
385	   /* Bind the direct rendering context to the drawable */
386	   if (gc && gc->driContext) {
387	      __GLXDRIdrawable *pdraw = FetchDRIDrawable(dpy, draw, gc, pre13);
388	      __GLXDRIdrawable *pread = FetchDRIDrawable(dpy, read, gc, pre13);
389	
390	      bindReturnValue =
391	         (gc->driContext->bindContext) (gc->driContext, pdraw, pread);


(gdb) frame 0
#0  0xb80682ac in driBindContext (context=0x805ac30, draw=0x0, read=0x8083b88) at dri_glx.c:456
456	    return (*core->bindContext)(pcp->driContext,
(gdb) list
451				   __GLXDRIdrawable *draw, __GLXDRIdrawable *read)
452	{
453	    __GLXDRIcontextPrivate *pcp = (__GLXDRIcontextPrivate *) context;
454	    const __DRIcoreExtension *core = pcp->psc->core;
455	
456	    return (*core->bindContext)(pcp->driContext,
457					draw->driDrawable,
458					read->driDrawable);
Comment 4 Shunichi Fuji 2008-12-25 11:38:44 UTC
Created attachment 21476 [details] [review]
check null pointer at early stage

FetchDRIDrawable could return NULL obviously, so check the value.
Segfault is gone, but this isn't whole point.

% ./wincopy
Press Esc to exit
Press 'f' to toggle front/back buffer drawing
glXMakeContextCurrent failed in Redraw()
glXMakeCurrent failed in Resize()
glXMakeCurrent failed in Resize()
glXMakeContextCurrent failed in Redraw()
...


glXMakeContextCurrent still fail due to unaccept Window (possible XID?) create by CreateWindow.
GLX spec has
>For backwards compatiblity with GLX versions 1.2 and earlier, a rendering context can also be used to render into a Window. Thus, a GLXDrawable is the union {GLXWindow, GLXPixmap, GLXPbuffer, Window}.

I see "for pre GLX 1.3" code in the source,
Unfortunately, i'm not famillar with the X and DRI internals.

BTW, similar problem is happened at freeglut.
https://sourceforge.net/mailarchive/message.php?msg_name=1226309489.25931.23.camel%40pancake
Comment 5 Shunichi Fuji 2008-12-25 11:47:30 UTC
it's also hannpened on r300, would be GLX problem.
Comment 6 Ian Romanick 2009-01-18 12:51:28 UTC
The real question is why pre13 = 0.  This should only happen when glXMakeContextCurrent is called, and manywin uses glXMakeCurrent.

There is a bug in this area, which is fixed by my patch to bug #19625.  GLX_ALIAS is incorrectly used here.  The parameter lists for MakeContextCurrent and glXMakeContextCurrent / glXMakeCurrentReadSGI are no longer the same.  When GCC function aliasing is used, the last parameter of MakeContextCurrent will get a random value when either of these interfaces is called.

While this hits similar code as bug #19625, I do NOT think it's a dup.
Comment 7 Ian Romanick 2009-01-20 14:03:16 UTC
Fixed by commit ab9b4e1f593b2006a61c0f5440c2d7d3af80ea74.
Comment 8 liuhaien 2009-02-17 18:54:16 UTC
verified against below commit:
Libdrm:		(master)0054e14793e585ec0d8e95e3d7b82cbf1a684af8
Mesa:		(mesa_7_4_branch)0e6d9c1a55510cb4096728fb5fcfac77be09129e	
Xserver:	(server-1.6-branch)660c2a7d4c6cb52fd0992e9d2008a24805dc8c02
Xf86_video_intel:		(master)506bbb8341c052499057834a669b82787454b426
GEM_kernel:       (drm-intel-next)c6f9cade7341025ed342b96ec963a28edd5c3bf8


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.