Bug 44298

Summary: SIGSEGV src/mesa/state_tracker/st_cb_blit.c:87
Product: Mesa Reporter: Vinson Lee <vlee>
Component: Mesa coreAssignee: mesa-dev
Status: RESOLVED DUPLICATE QA Contact:
Severity: critical    
Priority: medium CC: jfonseca
Version: git   
Hardware: x86 (IA32)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:

Description Vinson Lee 2011-12-29 17:19:45 UTC 
mesa: ded02bd54b5925ee222d7f426850312236b4f59d (master)

Run WebGL Conformance Tests on i915g.

Open Firefox.
Go to https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/webgl-conformance-tests.html.
Run attribs tests.


(gdb) bt
#0  0x00000000 in ?? ()
#1  0x0356cbfc in st_BlitFramebuffer_resolve (ctx=0xa6a13000, mask=16384, info=0xbfd2fcc4) at src/mesa/state_tracker/st_cb_blit.c:87
#2  0x0356d036 in st_BlitFramebuffer (ctx=0xa6a13000, srcX0=0, srcY0=0, srcX1=50, srcY1=50, dstX0=0, dstY0=0, dstX1=50, dstY1=50, 
    mask=16384, filter=9728) at src/mesa/state_tracker/st_cb_blit.c:207
#3  0x034078ca in _mesa_BlitFramebufferEXT (srcX0=0, srcY0=0, srcX1=50, srcY1=50, dstX0=0, dstY0=0, dstX1=50, dstY1=50, mask=16384, 
    filter=9728) at src/mesa/main/fbobject.c:2793
#4  0x01495267 in raw_fBlitFramebuffer (mask=16384, filter=9728, dstY1=<optimized out>, dstX1=<optimized out>, dstY0=0, dstX0=0, 
    srcY1=<optimized out>, srcX1=<optimized out>, srcY0=0, srcX0=0, this=<optimized out>) at ../../../dist/include/GLContext.h:2374
#5  BeforeGLReadCall (this=0xae4d1000) at ../../../dist/include/GLContext.h:920
#6  mozilla::gl::GLContext::BeforeGLReadCall (this=0xae4d1000) at ../../../dist/include/GLContext.h:891
#7  0x01cce14e in fReadPixels (pixels=0xa616f000, type=<optimized out>, format=<optimized out>, height=50, width=50, y=0, x=0, 
    this=0xae4d1000) at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/gfx/thebes/GLContext.h:959
#8  mozilla::gl::GLContext::ReadPixelsIntoImageSurface (this=0xae4d1000, aX=0, aY=0, aWidth=50, aHeight=50, aDest=0xa6785700)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/gfx/thebes/GLContext.cpp:1698
#9  0x01ce8020 in mozilla::layers::BasicCanvasLayer::UpdateSurface (this=0xb75f58a0, aDestSurface=0x0)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/gfx/layers/basic/BasicLayers.cpp:1154
#10 0x01ce813b in mozilla::layers::BasicCanvasLayer::Paint (this=0xb75f58a0, aContext=0xa61b60d0)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/gfx/layers/basic/BasicLayers.cpp:1180
#11 0x01ce90c7 in mozilla::layers::BasicShadowableCanvasLayer::Paint (this=0xb75f58a0, aContext=0xa61b60d0)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/gfx/layers/basic/BasicLayers.cpp:2671
#12 0x01cea64b in mozilla::layers::BasicLayerManager::PaintLayer (this=0xac44a560, aTarget=0xa61b60d0, aLayer=0xb75f58a0, aCallback=
    0x125deda <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0xbfd3119c, aReadback=0xbfd307ec)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/gfx/layers/basic/BasicLayers.cpp:1898
#13 0x01cea710 in mozilla::layers::BasicLayerManager::PaintLayer (this=0xac44a560, aTarget=0xa602e340, aLayer=0xb75f5cc0, 
    aCallback=0x125deda <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0xbfd3119c, aReadback=0xbfd30c5c)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/gfx/layers/basic/BasicLayers.cpp:1911
#14 0x01cea710 in mozilla::layers::BasicLayerManager::PaintLayer (this=0xac44a560, aTarget=0xa602e340, aLayer=0xb75f2f60, 
    aCallback=0x125deda <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0xbfd3119c, aReadback=0x0)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/gfx/layers/basic/BasicLayers.cpp:1911
#15 0x01ceb346 in mozilla::layers::BasicLayerManager::EndTransactionInternal (this=0xac44a560, 
    aCallback=0x125deda <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0xbfd3119c, aFlags=mozilla::layers::LayerManager::END_DEFAULT)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/gfx/layers/basic/BasicLayers.cpp:1608
#16 0x01ceb3eb in mozilla::layers::BasicLayerManager::EndTransaction (this=0xac44a560, 
    aCallback=0x125deda <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0xbfd3119c, aFlags=mozilla::layers::LayerManager::END_DEFAULT)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/gfx/layers/basic/BasicLayers.cpp:1559
#17 0x01cebef2 in mozilla::layers::BasicShadowLayerManager::EndTransaction (this=0xac44a560, 
    aCallback=0x125deda <mozilla::FrameLayerBuilder::DrawThebesLayer(mozilla::layers::ThebesLayer*, gfxContext*, nsIntRegion const&, nsIntRegion const&, void*)>, aCallbackData=0xbfd3119c, aFlags=mozilla::layers::LayerManager::END_DEFAULT)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/gfx/layers/basic/BasicLayers.cpp:3322
#18 0x01283185 in nsDisplayList::PaintForFrame (this=0xbfd310f0, aBuilder=0xbfd3119c, aCtx=0x0, aForFrame=0xb09e47f8, aFlags=5)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/layout/base/nsDisplayList.cpp:633
#19 0x01283240 in nsDisplayList::PaintRoot (this=0xbfd310f0, aBuilder=0xbfd3119c, aCtx=0x0, aFlags=5)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/layout/base/nsDisplayList.cpp:538
#20 0x0129603f in nsLayoutUtils::PaintFrame (aRenderingContext=0x0, aFrame=0xb09e47f8, aDirtyRegion=..., aBackstop=4294967295, aFlags=260)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/layout/base/nsLayoutUtils.cpp:1700
#21 0x012ace94 in PresShell::Paint (this=0xb75f3900, aViewToPaint=0xb7128190, aWidgetToPaint=0xb136acc0, aDirtyRegion=..., 
    aIntDirtyRegion=..., aPaintDefaultBackground=false, aWillSendDidPaint=false)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/layout/base/nsPresShell.cpp:5475
#22 0x015b8d32 in nsViewManager::RenderViews (this=0xb09ddc40, aView=0xb7128190, aWidget=0xb136acc0, aRegion=..., aIntRegion=..., 
    aPaintDefaultBackground=false, aWillSendDidPaint=false)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/view/src/nsViewManager.cpp:415
#23 0x015b8e06 in nsViewManager::Refresh (this=0xb09ddc40, aView=0xb7128190, aWidget=0xb136acc0, aRegion=...)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/view/src/nsViewManager.cpp:390
#24 0x015bae49 in nsViewManager::DispatchEvent (this=0xb09ddc40, aEvent=0xbfd3182c, aView=0xb7128190, aStatus=0xbfd31738)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/view/src/nsViewManager.cpp:888
#25 0x015b810e in HandleEvent (aEvent=0xbfd3182c) at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/view/src/nsView.cpp:159
#26 0x01a8bac0 in nsWindow::DispatchEvent (this=0xb136acc0, aEvent=0xbfd3182c, aStatus=@0xbfd3191c)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/widget/src/gtk2/nsWindow.cpp:613
#27 0x01a93f96 in nsWindow::OnExposeEvent (this=0xb136acc0, aEvent=0xbfd31d68)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/widget/src/gtk2/nsWindow.cpp:2243
#28 0x01a942c7 in expose_event_cb (widget=0xb1dac1f0, event=0xbfd31d68)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/widget/src/gtk2/nsWindow.cpp:5670
#29 0x18140752 in ?? () from /usr/lib/i386-linux-gnu/libgtk-x11-2.0.so.0
#30 0x004ccdac in g_closure_invoke () from /usr/lib/i386-linux-gnu/libgobject-2.0.so.0
#31 0x004de0c5 in ?? () from /usr/lib/i386-linux-gnu/libgobject-2.0.so.0
#32 0x004e5867 in g_signal_emit_valist () from /usr/lib/i386-linux-gnu/libgobject-2.0.so.0
#33 0x004e5ad3 in g_signal_emit () from /usr/lib/i386-linux-gnu/libgobject-2.0.so.0
#34 0x18279e53 in ?? () from /usr/lib/i386-linux-gnu/libgtk-x11-2.0.so.0
#35 0x1813efca in gtk_main_do_event () from /usr/lib/i386-linux-gnu/libgtk-x11-2.0.so.0
#36 0x0084c2df in ?? () from /usr/lib/i386-linux-gnu/libgdk-x11-2.0.so.0
#37 0x0087edc3 in ?? () from /usr/lib/i386-linux-gnu/libgdk-x11-2.0.so.0
#38 0x00846de4 in ?? () from /usr/lib/i386-linux-gnu/libgdk-x11-2.0.so.0
#39 0x0084906f in gdk_window_process_all_updates () from /usr/lib/i386-linux-gnu/libgdk-x11-2.0.so.0
#40 0x008490e8 in ?? () from /usr/lib/i386-linux-gnu/libgdk-x11-2.0.so.0
#41 0x00823fb8 in ?? () from /usr/lib/i386-linux-gnu/libgdk-x11-2.0.so.0
#42 0x0b8b0cc0 in ?? () from /lib/i386-linux-gnu/libglib-2.0.so.0
#43 0x0b8b328a in g_main_context_dispatch () from /lib/i386-linux-gnu/libglib-2.0.so.0
#44 0x0b8b3695 in ?? () from /lib/i386-linux-gnu/libglib-2.0.so.0
#45 0x0b8b3771 in g_main_context_iteration () from /lib/i386-linux-gnu/libglib-2.0.so.0
#46 0x01a961a6 in nsAppShell::ProcessNextNativeEvent (this=0xb7174100, mayWait=true)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/widget/src/gtk2/nsAppShell.cpp:144
#47 0x01aacc65 in nsBaseAppShell::DoProcessNextNativeEvent (this=0xb7174100, mayWait=true)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:171
#48 0x01aace7d in nsBaseAppShell::OnProcessNextEvent (this=0xb7174100, thr=0xb7581940, mayWait=<optimized out>, recursionDepth=0)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:324
#49 0x01c72d43 in nsThread::ProcessNextEvent (this=0xb7581940, mayWait=true, result=0xbfd320cf)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/xpcom/threads/nsThread.cpp:595
#50 0x01c41ca1 in NS_ProcessNextEvent_P (thread=<optimized out>, mayWait=true)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/obj-i686-linux-gnu/xpcom/build/nsThreadUtils.cpp:245
#51 0x01b5d8e9 in mozilla::ipc::MessagePump::Run (this=0xb710e370, aDelegate=0xb7551aa0)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/ipc/glue/MessagePump.cpp:134
#52 0x01c954b6 in MessageLoop::RunInternal (this=0xb7551aa0)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/ipc/chromium/src/base/message_loop.cc:208
#53 0x01c955de in RunHandler (this=0xb7551aa0)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/ipc/chromium/src/base/message_loop.cc:201
#54 MessageLoop::Run (this=0xb7551aa0) at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/ipc/chromium/src/base/message_loop.cc:175
#55 0x01aac8bc in nsBaseAppShell::Run (this=0xb7174100)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:189
#56 0x0195cdc3 in nsAppStartup::Run (this=0xb71825e0)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/toolkit/components/startup/nsAppStartup.cpp:228
#57 0x01110934 in XRE_main (argc=1, argv=0xbfd348e4, aAppData=0xb7516880)
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/toolkit/xre/nsAppRunner.cpp:3551
#58 0x009e292f in do_main (argv=0xbfd348e4, argc=1, exePath=0xbfd3282c "/usr/lib/firefox-10.0/libxpcom.so")
    at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/browser/app/nsBrowserApp.cpp:198
#59 main (argc=1, argv=0xbfd348e4) at /build/buildd/firefox-10.0~b1+build1/build-tree/mozilla/browser/app/nsBrowserApp.cpp:281
(gdb) frame 1
#1  0x0356cbfc in st_BlitFramebuffer_resolve (ctx=0xa6a13000, mask=16384, info=0xbfd2fcc4) at src/mesa/state_tracker/st_cb_blit.c:87
87	      st->pipe->resource_resolve(st->pipe, info);
(gdb) print st
$1 = (struct st_context *) 0xa6a29000
(gdb) print info
$2 = (struct pipe_resolve_info *) 0xbfd2fcc4
(gdb) print st->pipe->resource_resolve
$3 = (void (*)(struct pipe_context *, const struct pipe_resolve_info *)) 0
Comment 1 Vinson Lee 2011-12-29 17:26:37 UTC 
Crash can be reproduced with llvmpipe too.
Comment 2 Stephane Marchesin 2011-12-29 17:29:28 UTC 
I think it's a similar problem to the one discussed in http://lists.freedesktop.org/archives/mesa-dev/2011-September/011578.html

The bug will affect all gallium drivers, and requires quite a bit of refactoring. I've been meaning to do it, but don't hold your breath just yet.
Comment 3 Alex Deucher 2011-12-30 06:53:31 UTC 

*** This bug has been marked as a duplicate of bug 42883 ***

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.