Bug 38856

Summary: [i915g] SIGSEGV src/gallium/drivers/i915/i915_state.c:511
Product: Mesa Reporter: Vinson Lee <vlee>
Component: Drivers/Gallium/i915gAssignee: Default DRI bug account <dri-devel>
Status: RESOLVED FIXED QA Contact:
Severity: critical    
Priority: medium    
Version: git   
Hardware: x86 (IA32)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:

Description Vinson Lee 2011-06-30 18:11:30 UTC
mesa: f8fcaf0215f0434baf13bb5c45545c58f97846b6 (master)

chipset: 945GM (Intel GMA 950)
system architecture: i686
xserver-xorg-video-intel: 2:2.14.0-4ubuntu7.1
libdrm-intel1: 2.4.23-1ubuntu6
kernel version: 2.6.38-8-generic
Linux distribution: Ubuntu 11.04 i386

Run piglit fbo-copyteximage test.

$ ./bin/fbo-copyteximage -auto
Probe at (73,73)
  Expected: 1.000000 0.000000 0.000000
  Observed: 0.000000 0.000000 1.000000
Probe at (200,73)
  Expected: 0.000000 1.000000 0.000000
  Observed: 1.000000 0.000000 0.000000
Probe at (73,200)
  Expected: 0.000000 0.000000 1.000000
  Observed: 1.000000 1.000000 1.000000
Segmentation fault (core dumped)


Core was generated by `./bin/fbo-copyteximage -auto'.
Program terminated with signal 11, Segmentation fault.
#0  __libc_free (mem=0x3f800000) at malloc.c:3709
3709	malloc.c: No such file or directory.
	in malloc.c
(gdb) bt
#0  __libc_free (mem=0x3f800000) at malloc.c:3709
#1  0x01134a96 in i915_delete_fs_state (pipe=0x94343f8, shader=0x94f66d8) at src/gallium/drivers/i915/i915_state.c:511
#2  0x0115b2d9 in aaline_delete_fs_state (pipe=0x94343f8, fs=0x94f5398) at src/gallium/auxiliary/draw/draw_pipe_aaline.c:880
#3  0x01188635 in util_blitter_destroy (blitter=0x94bd360) at src/gallium/auxiliary/util/u_blitter.c:251
#4  0x011310df in i915_destroy (pipe=0x94343f8) at src/gallium/drivers/i915/i915_context.c:105
#5  0x0196f29f in st_destroy_context (st=0x9500598) at src/mesa/state_tracker/st_context.c:261
#6  0x018a7ce1 in st_context_destroy (stctxi=0x9500598) at src/mesa/state_tracker/st_manager.c:651
#7  0x018a34fc in dri_destroy_context (cPriv=0x942df90) at src/gallium/state_trackers/dri/drm/dri_context.c:135
#8  0x0120ea80 in driDestroyContext (pcp=0x942df90) at src/mesa/drivers/dri/common/dri_util.c:588
#9  0x002d45a0 in dri2_destroy_context (context=0x942ed50) at dri2_glx.c:129
#10 0x002aecf0 in glx_display_free (priv=0x942cad0) at glxext.c:220
#11 0x002aed7c in __glXCloseDisplay (dpy=0x9422028, codes=0x942cd5c) at glxext.c:265
#12 0x00583ccb in XCloseDisplay () from /usr/lib/i386-linux-gnu/libX11.so.6
#13 0x003a3693 in fgDeinitialize () at freeglut_init.c:488
#14 0x003a6997 in glutMainLoop () at freeglut_main.c:1533
#15 0x0806b2df in main (argc=1, argv=0xbf9cd2b4) at piglit/tests/util/piglit-framework.c:116
(gdb) frame 1
#1  0x01134a96 in i915_delete_fs_state (pipe=0x94343f8, shader=0x94f66d8) at src/gallium/drivers/i915/i915_state.c:511
511	      FREE(ifs->program);
(gdb) print ifs->program
$1 = (uint *) 0x3f800000
Comment 1 Stephane Marchesin 2011-06-30 18:16:40 UTC
Yeah I've seen that one too, it's related to the aapoint/aaline stages, haven't gotten around to fixing it yet.
Comment 2 Vinson Lee 2011-06-30 18:38:18 UTC
235225ec935002b4669d14a48c9c20864a5496f8 is the first bad commit
commit 235225ec935002b4669d14a48c9c20864a5496f8
Author: José Fonseca <jfonseca@vmware.com>
Date:   Thu Jun 30 17:36:37 2011 +0100

    scons: Expose pkg-config in a simpler manner.

:040000 040000 d1e31f44576f790f83ed98ebd47e79f08be46fac 1368586475da31dd9a85b72b42c05ab73b0bbff4 M	scons
:040000 040000 dacff729d0c004ca1143314c37c9dcc280f2d379 4e38036c6ab10b6a0a073fe47f6b9d5c7bfeb632 M	src
bisect run success
Comment 3 Stephane Marchesin 2011-12-30 00:41:32 UTC
The crash has been fixed, but the test still doesn't pass. Since the bug is for the crash, we should close it?

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.