Bug 36307

Description:
gnome-shell (and thus) mutter --replace crashes. kernel reports the segfault being located in libGL (in glx code)

gnome-shell[27096]: segfault at 28 ip 00007f253f36fe37 sp 00007fffdb130f60 error 6 in libGL.so.1.2[7f253f323000+6b000]

Additional info (all versions, from archlinux 64 bit - note the GIT version snapshots including the date of the snapshopt):
* gnome-shell 3.0.0.2-2
* mutter 3.0.0-1
* mesa 7.10.99.git20110412-1
* libgl 7.10.99.git20110412-1
* intel-dri 7.10.99.git20110412-1
* libdrm 2.4.25-1
* xf86-video-intel 2.15.0-1
* kernel26 2.6.38.2-1

Hardware:
* Intel Ironlake mobile:
VGA compatible controller: Intel Corporation Core Processor Integrated Graphics Controller (rev 02) (prog-if 00 [VGA controller])

Steps to reproduce:
Install GNOME-3 from testing (archlinux)
Start gnome-shell --replace or mutter --replace or set your default GNOME3 graphic experience to default (not fallback)

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff22b424a in ChangeDrawableAttribute (dpy=0x61b0f0, drawable=56623113, attribs=0x7fffffffdf20, num_attribs=1)
at glx_pbuffer.c:144
144 pdraw->eventMask = attribs[i * 2 + 1];
(gdb) bt
#0 0x00007ffff22b424a in ChangeDrawableAttribute (dpy=0x61b0f0, drawable=56623113, attribs=0x7fffffffdf20, num_attribs=1)
at glx_pbuffer.c:144
#1 0x00007ffff22b56a8 in glXSelectEvent (dpy=0x61b0f0, drawable=56623113, mask=67108864) at glx_pbuffer.c:794


(gdb) l *0x00007ffff22b424a
0x7ffff22b424a is in ChangeDrawableAttribute (glx_pbuffer.c:144).
139
140 for (i = 0; i < num_attribs; i++) {
141 switch(attribs[i * 2]) {
142 case GLX_EVENT_MASK:
143 /* Keep a local copy for masking out DRI2 proto events as needed */
144 pdraw->eventMask = attribs[i * 2 + 1];
145 break;
146 }
147 }
148 #endif

(gdb) print pdraw
$1 = (__GLXDRIdrawable *) 0x0
(gdb) print pdraw->eventMask
Cannot access memory at address 0x28
(gdb) print i
$2 = 0
(gdb) print num_attribs
$3 = 1


Original source:

#ifdef GLX_DIRECT_RENDERING
pdraw = GetGLXDRIDrawable(dpy, drawable);

for (i = 0; i < num_attribs; i++) {
switch(attribs[i * 2]) {
case GLX_EVENT_MASK:
/* Keep a local copy for masking out DRI2 proto events as needed */
pdraw->eventMask = attribs[i * 2 + 1];
break;
}
}
#endif


inside the definition of what gets pdraw and return NULL (0x0):


/**
* Get the __DRIdrawable for the drawable associated with a GLXContext
*
* \param dpy The display associated with \c drawable.
* \param drawable GLXDrawable whose __DRIdrawable part is to be retrieved.
* \param scrn_num If non-NULL, the drawables screen is stored there
* \returns A pointer to the context's __DRIdrawable on success, or NULL if
* the drawable is not associated with a direct-rendering context.
*/
_X_HIDDEN __GLXDRIdrawable *
GetGLXDRIDrawable(Display * dpy, GLXDrawable drawable)
{
struct glx_display *priv = __glXInitialize(dpy);
__GLXDRIdrawable *pdraw;

if (priv == NULL)
return NULL;

if (__glxHashLookup(priv->drawHash, drawable, (void *) &pdraw) == 0)
return pdraw;

return NULL;
}



See also https://bugs.archlinux.org/task/23788