Bug 33053

using mesa-7.10 with --enable-asm on Gentoo/hardened with Intel Mobile GM965: 


# eselect mesa list
 i915 (Intel 915, 945)
       [1]   classic
       [2]   gallium *
 i965 (Intel 965, G/Q3x, G/Q4x)
       [1]   classic
       [2]   gallium *
  r300 (Radeon R300-R500)
  r600 (Radeon R600-R700, Evergreen, Northern Islands)
  sw (Software renderer)
       [1]   classic
       [2]   gallium *

While all other configurations have been unusable due to screen corruption, the above listed configuration crashed xorg-server-1.9.3.901, obviously while KDE was trying to switch to OpenGL during login.

With tex being NULL, this line of brw_texture should be the point where mesa finally triggers signal 11:

90         assert(tex->b.vtbl == &brw_texture_vtbl);

Since brw_texture doesn't that much except casting a pointer,
that line should probably read

           assert(tex && tex->b.vtbl == &brw_texture_vtbl);

 
#gdb $(which X) --core="0:0-X.core"
[...]
(gdb) bt
#0  0x00000328966e86d5 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00000328966e99d5 in abort () at abort.c:92
#2  0x000000425a1714ae in OsAbort () at utils.c:1274
#3  0x000000425a17dbcd in ddxGiveUp () at xf86Init.c:940
#4  0x000000425a16f0ad in AbortServer () at log.c:424
#5  0x000000425a16f8f0 in FatalError (f=0x425a286d68 "Caught signal %d (%s). Server aborting\n") at log.c:552
#6  0x000000425a17078e in OsSigHandler (signo=11, sip=0x8, unused=<value optimized out>) at osinit.c:156
#7  <signal handler called>
#8  0x00000328931a0d04 in brw_wm_populate_key (brw=0x425c4a0d30, key=0x3f523000780) at brw_wm.c:256
#9  0x00000328931a0e51 in brw_prepare_wm_prog (brw=0x425c4a0d30) at brw_wm.c:287
#10 0x000003289319b51d in brw_validate_state (brw=0x425c4a0d30) at brw_state_upload.c:179
#11 0x000003289318da3d in try_draw_range_elements (brw=0x425c4a0d30, indexed=0 '\000', hw_prim=7, start=0, count=4) at brw_draw.c:151
#12 0x000003289318dbcf in brw_draw_vbo (pipe=0x425c4a0d30, info=0x3f523000dd0) at brw_draw.c:209
#13 0x000003289326dff7 in st_draw_vbo (ctx=0x425c4b8d90, arrays=0x425c4e0a38, prims=0x425c4df154, nr_prims=1, ib=0x0, index_bounds_valid=1 '\001', min_index=0, max_index=3)
    at state_tracker/st_draw.c:732
#14 0x000003289334d44a in vbo_exec_vtx_flush (exec=0x425c4dee70, unmap=1 '\001') at vbo/vbo_exec_draw.c:381
#15 0x000003289334933a in vbo_exec_FlushVertices_internal (ctx=0x425c4b8d90, unmap=1 '\001') at vbo/vbo_exec_api.c:911
#16 0x00000328933493aa in vbo_exec_FlushVertices (ctx=0x425c4b8d90, flags=1) at vbo/vbo_exec_api.c:945
#17 0x00000328932f72dc in _mesa_PopAttrib () at main/attrib.c:858
#18 0x0000032894b42983 in __glXDisp_Render (cl=<value optimized out>, pc=0x3288f6aad88 "\004") at glxcmds.c:1854
#19 0x0000032894b46cd2 in __glXDispatch (client=0x425c4340a0) at glxext.c:605
#20 0x000000425a13bda9 in Dispatch () at dispatch.c:432
#21 0x000000425a1313aa in main (argc=10, argv=0x3f5230012b8, envp=<value optimized out>) at main.c:291
#

(gdb) list brw_wm.c:254
249
250        /* PIPE_NEW_RAST */
251        key->flat_shade = brw->curr.rast->templ.flatshade;
252
253
254        /* PIPE_NEW_BOUND_TEXTURES */
255        for (i = 0; i < brw->curr.num_fragment_sampler_views; i++) {
256           const struct brw_texture *tex = brw_texture(brw->curr.fragment_sampler_views[i]->texture);
257
258           if (tex->b.b.format == PIPE_FORMAT_UYVY)

(gdb) sele 8
(gdb) print brw->curr.fragment_sampler_views
$1 = {0x0 <repeats 16 times>}

(gdb) list brw_texture
87      static INLINE struct brw_texture *brw_texture( struct pipe_resource *resource )
88      {
89         struct brw_texture *tex = (struct brw_texture *)resource;
90         assert(tex->b.vtbl == &brw_texture_vtbl);
91         return tex;
92      }



(gdb) bt f
#0  0x00000328966e86d5 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
        resultvar = 0
        pid = <value optimized out>
        selftid = 3500
#1  0x00000328966e99d5 in abort () at abort.c:92
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x261238, sa_sigaction = 0x261238}, sa_mask = {__val = {284983128240, 284983129872, 285011915848, 2, 3472885982485, 
              3472857221992, 3472887930880, 0, 4294967295, 0, 1, 4030696, 0, 3472830695552, 4, 284978798592}}, sa_flags = -1742586047, sa_restorer = 0x4200000001}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x000000425a1714ae in OsAbort () at utils.c:1274
No locals.
#3  0x000000425a17dbcd in ddxGiveUp () at xf86Init.c:940
        i = <value optimized out>
#4  0x000000425a16f0ad in AbortServer () at log.c:424
No locals.
#5  0x000000425a16f8f0 in FatalError (f=0x425a286d68 "Caught signal %d (%s). Server aborting\n") at log.c:552
        args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x3f5230002a0, reg_save_area = 0x3f5230001e0}}
        beenhere = 1
#6  0x000000425a17078e in OsSigHandler (signo=11, sip=0x8, unused=<value optimized out>) at osinit.c:156
No locals.
#7  <signal handler called>
No symbol table info available.
#8  0x00000328931a0d04 in brw_wm_populate_key (brw=0x425c4a0d30, key=0x3f523000780) at brw_wm.c:256
        tex = 0x90
        lookup = 0
        line_aa = 0
        i = 0
#9  0x00000328931a0e51 in brw_prepare_wm_prog (brw=0x425c4a0d30) at brw_wm.c:287
        key = {source_depth_reg = 0, aa_dest_stencil_reg = 0, dest_depth_reg = 0, nr_depth_regs = 1, computes_depth = 0, source_depth_to_render_target = 0, flat_shade = 0, 
          runtime_check_aads_emit = 0, shadowtex_mask = 0, yuvtex_mask = 0, yuvtex_swap_mask = 0, vp_nr_outputs = 0, nr_inputs = 0, nr_cbufs = 0, has_flow_control = 0, 
          program_string_id = 0}
        fs = 0x425c5776e0
        ret = PIPE_OK
#10 0x000003289319b51d in brw_validate_state (brw=0x425c4a0d30) at brw_state_upload.c:179
        atom = 0x3289374fc60
        state = 0x425c4a15a0
        i = 4
        ret = 0
#11 0x000003289318da3d in try_draw_range_elements (brw=0x425c4a0d30, indexed=0 '\000', hw_prim=7, start=0, count=4) at brw_draw.c:151
        ret = 66
#12 0x000003289318dbcf in brw_draw_vbo (pipe=0x425c4a0d30, info=0x3f523000dd0) at brw_draw.c:209
        brw = 0x425c4a0d30
        ret = 808
        hw_prim = 7
#13 0x000003289326dff7 in st_draw_vbo (ctx=0x425c4b8d90, arrays=0x425c4e0a38, prims=0x425c4df154, nr_prims=1, ib=0x0, index_bounds_valid=1 '\001', min_index=0, max_index=3)
    at state_tracker/st_draw.c:732
        st = 0x425c4dd820
        pipe = 0x425c4a0d30
        vp = 0x425c5710b0
        vpv = 0x425c56c950
        vbuffer = {{stride = 16, max_index = 3, buffer_offset = 584, buffer = 0x425c501410}, {stride = 0, max_index = 0, buffer_offset = 0, buffer = 0x0} <repeats 13 times>, {
            stride = 0, max_index = 0, buffer_offset = 2527190696, buffer = 0x0}, {stride = 0, max_index = 0, buffer_offset = 0, buffer = 0x22}, {stride = 48, max_index = 0, 
            buffer_offset = 0, buffer = 0x50}, {stride = 0, max_index = 3, buffer_offset = 0, buffer = 0x425c575e60}, {stride = 2527190592, max_index = 808, buffer_offset = 34, 
            buffer = 0x31b7c}, {stride = 1548356736, max_index = 66, buffer_offset = 203644, buffer = 0x3289672cfa0}, {stride = 0, max_index = 0, buffer_offset = 1549229664, 
            buffer = 0x3f523000b00}, {stride = 1547911328, max_index = 66, buffer_offset = 203644, buffer = 0x328931bd4bd}, {stride = 0, max_index = 0, 
            buffer_offset = 1549191840, buffer = 0x425c575fe0}, {stride = 33, max_index = 0, buffer_offset = 587205488, buffer = 0x32893285a18}, {stride = 0, max_index = 0, 
            buffer_offset = 0, buffer = 0x0}, {stride = 1549191840, max_index = 66, buffer_offset = 2003792430, buffer = 0x32896a1de40}, {stride = 587205568, max_index = 1013, 
            buffer_offset = 1547911328, buffer = 0x31b7c}, {stride = 1548356736, max_index = 66, buffer_offset = 203644, buffer = 0x3289672d4ac}, {stride = 3, max_index = 0, 
            buffer_offset = 2468897143, buffer = 0x328934dc1e0}, {stride = 1549227560, max_index = 66, buffer_offset = 587205616, buffer = 0x3289330c807}, {stride = 27394102, 
            max_index = 66, buffer_offset = 3, buffer = 0x3f501b6c001}, {stride = 2469445853, max_index = 0, buffer_offset = 27394050, buffer = 0x3f523000d50}}
        attr = 32
        velements = {{src_offset = 0, instance_divisor = 0, vertex_buffer_index = 0, src_format = PIPE_FORMAT_R32G32_FLOAT}, {src_offset = 27394048, instance_divisor = 66, 
            vertex_buffer_index = 587205968, src_format = 1013}, {src_offset = 587205728, instance_divisor = 1013, vertex_buffer_index = 2469448576, src_format = 808}, {
            src_offset = 27394048, instance_divisor = 808, vertex_buffer_index = 2471346656, src_format = 808}, {src_offset = 665, instance_divisor = 1013, 
            vertex_buffer_index = 2469446846, src_format = 808}, {src_offset = 27394049, instance_divisor = 117, vertex_buffer_index = 587205776, src_format = 1013}, {
            src_offset = 27394050, instance_divisor = 113, vertex_buffer_index = 587205968, src_format = 1013}, {src_offset = 27394048, instance_divisor = 0, 
            vertex_buffer_index = 587205968, src_format = PIPE_FORMAT_X8R8G8B8_UNORM}, {src_offset = 27394050, instance_divisor = 0, vertex_buffer_index = 1547911328, 
            src_format = 1583}, {src_offset = 2471346176, instance_divisor = 808, vertex_buffer_index = 1544145936, src_format = PIPE_FORMAT_R8G8B8_UNORM}, {
            src_offset = 587205792, instance_divisor = 1013, vertex_buffer_index = 2467671295, src_format = 808}, {src_offset = 64, instance_divisor = 0, 
            vertex_buffer_index = 1548750272, src_format = PIPE_FORMAT_R8G8B8_UNORM}, {src_offset = 1544145936, instance_divisor = 66, vertex_buffer_index = 1548750272, 
            src_format = PIPE_FORMAT_R8G8B8_UNORM}, {src_offset = 587205888, instance_divisor = 1013, vertex_buffer_index = 2488220824, src_format = 808}, {
            src_offset = 2527190592, instance_divisor = 808, vertex_buffer_index = 1548751984, src_format = PIPE_FORMAT_R8G8B8_UNORM}, {src_offset = 1544146328, 
            instance_divisor = 66, vertex_buffer_index = 0, src_format = PIPE_FORMAT_NONE}, {src_offset = 1547911328, instance_divisor = 66, vertex_buffer_index = 2481525341, 
            src_format = 808}, {src_offset = 748, instance_divisor = 66, vertex_buffer_index = 64, src_format = PIPE_FORMAT_NONE}, {src_offset = 2469807178, 
            instance_divisor = 808, vertex_buffer_index = 587205936, src_format = 1013}, {src_offset = 2494694272, instance_divisor = 808, vertex_buffer_index = 2467671403, 
            src_format = 808}, {src_offset = 336, instance_divisor = 0, vertex_buffer_index = 2527190592, src_format = 808}, {src_offset = 587206000, instance_divisor = 1013, 
            vertex_buffer_index = 2494694272, src_format = 808}, {src_offset = 1547911328, instance_divisor = 66, vertex_buffer_index = 2497120384, src_format = 808}, {
            src_offset = 4, instance_divisor = 0, vertex_buffer_index = 2524107948, src_format = 808}, {src_offset = 2469807178, instance_divisor = 808, 
            vertex_buffer_index = 2470507633, src_format = 808}, {src_offset = 1549235936, instance_divisor = 66, vertex_buffer_index = 1548356912, 
            src_format = PIPE_FORMAT_R8G8B8_UNORM}, {src_offset = 587206048, instance_divisor = 1013, vertex_buffer_index = 2470508023, src_format = 808}, {
            src_offset = 1549235936, instance_divisor = 66, vertex_buffer_index = 1548356912, src_format = PIPE_FORMAT_R8G8B8_UNORM}, {src_offset = 1, instance_divisor = 1, 
            vertex_buffer_index = 1548751888, src_format = PIPE_FORMAT_R8G8B8_UNORM}, {src_offset = 587206096, instance_divisor = 1013, vertex_buffer_index = 2469805320, 
            src_format = 808}, {src_offset = 587206160, instance_divisor = 1013, vertex_buffer_index = 1549235936, src_format = PIPE_FORMAT_R8G8B8_UNORM}, {
            src_offset = 1548751888, instance_divisor = 66, vertex_buffer_index = 1548356912, src_format = PIPE_FORMAT_R8G8B8_UNORM}}
        num_vbuffers = 1
        num_velements = 1
        ibuffer = {index_size = 0, offset = 0, buffer = 0x0}
        userSpace = 0 '\000'
        vertDataEdgeFlags = 0 '\000'
        info = {indexed = 0 '\000', mode = 7, start = 0, count = 4, start_instance = 0, instance_count = 1, index_bias = 0, min_index = 0, max_index = 3, 
          primitive_restart = 0 '\000', restart_index = 0}
        i = 0
#14 0x000003289334d44a in vbo_exec_vtx_flush (exec=0x425c4dee70, unmap=1 '\001') at vbo/vbo_exec_draw.c:381
        ctx = 0x425c4b8d90
        __FUNCTION__ = "vbo_exec_vtx_flush"
#15 0x000003289334933a in vbo_exec_FlushVertices_internal (ctx=0x425c4b8d90, unmap=1 '\001') at vbo/vbo_exec_api.c:911
        exec = 0x425c4dee70
#16 0x00000328933493aa in vbo_exec_FlushVertices (ctx=0x425c4b8d90, flags=1) at vbo/vbo_exec_api.c:945
        exec = 0x425c4dee70
        __FUNCTION__ = "vbo_exec_FlushVertices"
#17 0x00000328932f72dc in _mesa_PopAttrib () at main/attrib.c:858
        attr = 0x328933486f3
        next = 0x3f523001020
        ctx = 0x425c4b8d90
#18 0x0000032894b42983 in __glXDisp_Render (cl=<value optimized out>, pc=0x3288f6aad88 "\004") at glxcmds.c:1854
        entry = {bytes = 4, varsize = 0}
        extra = <value optimized out>
        proc = 0x32894b20380 <__glXDisp_PopAttrib>
        err = 0
        client = 0x425c4340a0
        left = 88
        cmdlen = 4
        error = 66
        commandsDone = 36
        glxc = 0x425c4a0c80
        sw = <value optimized out>
#19 0x0000032894b46cd2 in __glXDispatch (client=0x425c4340a0) at glxext.c:605
        stuff = 0x3288f6aabc8
        opcode = <value optimized out>
        cl = 0x425c4341b8
        retval = <value optimized out>
#20 0x000000425a13bda9 in Dispatch () at dispatch.c:432
        result = <value optimized out>
        client = 0x425c4340a0
        nready = <value optimized out>
        start_tick = 120
#21 0x000000425a1313aa in main (argc=10, argv=0x3f5230012b8, envp=<value optimized out>) at main.c:291
        i = 1
        alwaysCheckForInput = {0, 1}