Bug 61312

Summary: Assertion failure: freeing bad or corrupted memory in st_translate_mesa_program
Product: Mesa Reporter: Keith Kriewall <keith.kriewall>
Component: Mesa coreAssignee: mesa-dev
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: medium    
Version: 9.0   
Hardware: x86 (IA32)   
OS: Windows (All)   
Whiteboard:
i915 platform: i915 features:
Attachments: RXA product settings
Trace of GL calls made by dinospin

Description Keith Kriewall 2013-02-22 21:40:32 UTC
Created attachment 75372 [details]
RXA product settings

Using Mesa 9.0.2 Gallium softpipe or llvmpipe drivers, debug builds on Windows report the following assertion failure:

src\mesa\state_tracker\st_mesa_to_tgsi.c:1256:st_translate_mesa_program: freeing bad or corrupted memory 0x63588d38
src\gallium\auxiliary\util\u_debug_memory.c:160:debug_free: Assertion `0' failed.

This assert fails during the initialization of most GLUT sample programs such as dinospin, gears, bounce, etc.

Mesa 9.0.2 is built with mingw, python 2.7, scons 2.2.0.  Same result with LLVM (llvmpipe) or without it (softpipe).

My steps to reproduce:

1.  Install Attachmate Reflection X Advantage v4.2 (a PC X Server product), available in an evaluation download of the Reflection X 2011 product suite (http://www.attachmate.com/Evals/pc-x-server/rsx2011/portal.htm).
2.  Copy the debug Mesa library into the product install folder:
  from
\Mesa-9.0.2\build\windows-x86-debug\gallium\targets\libgl-gdi\opengl32.dll
  to
\Program Files (x86)\Attachmate\Reflection
3.  Start > All Programs > Attachmate Reflection > X Manager - Reflection X Advantage
4.  Run a debugger, e.g. Visual Studio, and attach to the "rxmgr.exe" process.
5.  In X Manager, import the attached rxa_settings.rxd file.
6.  Click on My Sessions > MWM Session, and click Action > Start.  Enter host name, username, and password for any Linux/UNIX host that has GLUT sample applications (e.g. dinospin).
7.  In the XTerm, run a GLUT application, e.g. dinospin.
8.  Debugger breaks on os_abort() in u_debug.c _debug_assert_fail().  Call stack:

>	opengl32.dll!_debug_assert_fail(const char * expr=0x66f4e0b8, const char * file=0x66f4e08c, unsigned int line=0x000000a0, const char * function=0x66f4e080)  Line 278	C
 	opengl32.dll!debug_free(const char * file=0x66ee9554, unsigned int line=0x000004e8, const char * function=0x66ee94f4, void * ptr=0x5ad75540)  Line 160 + 0x19 bytes	C
 	opengl32.dll!st_translate_mesa_program(gl_context * ctx=0x5ad86048, unsigned int procType=0x00000001, ureg_program * ureg=0x5aff5f08, const gl_program * program=0x63487188, unsigned int numInputs=0x00000007, const unsigned int * inputMapping=0x6349742c, const unsigned char * inputSemanticName=0x00000000, const unsigned char * inputSemanticIndex=0x00000000, const unsigned int * interpMode=0x00000000, unsigned int numOutputs=0x00000002, const unsigned int * outputMapping=0x63497534, const unsigned char * outputSemanticName=0x63497600, const unsigned char * outputSemanticIndex=0x63497633, unsigned char passthrough_edgeflags=0x00, unsigned char clamp_color=0x00)  Line 1256 + 0x21 bytes	C
 	opengl32.dll!st_translate_vertex_program(st_context * st=0x5ad3d398, st_vertex_program * stvp=0x63487188, const st_vp_variant_key * key=0x5a97f9bc)  Line 375 + 0x61 bytes	C
 	opengl32.dll!st_get_vp_variant(st_context * st=0x5ad3d398, st_vertex_program * stvp=0x63487188, const st_vp_variant_key * key=0x5a97f9bc)  Line 430 + 0x11 bytes	C
 	opengl32.dll!update_vp(st_context * st=0x5ad3d398)  Line 152 + 0x11 bytes	C
 	opengl32.dll!st_validate_state(st_context * st=0x5ad3d398)  Line 203 + 0x13 bytes	C
 	opengl32.dll!st_Clear(gl_context * ctx=0x5ad86048, unsigned int mask=0x00000012)  Line 462 + 0x9 bytes	C
 	opengl32.dll!_mesa_Clear(unsigned int mask=0x00004100)  Line 233 + 0x13 bytes	C
 	opengl32.dll!glClear(unsigned int mask=0x00004100)  Line 1303	C
 	jogl.dll!62cf20fd() 	
 	[Frames below may be incorrect and/or missing, no symbols loaded for jogl.dll]	
 	jvm.dll!5e7b2e06() 	
 	msvcr100.dll!749bc556() 	
 	msvcr100.dll!749bc600() 	
 	kernel32.dll!74f833aa() 	
 	ntdll.dll!773c9ef2() 	
 	ntdll.dll!773c9ec5()
Comment 1 Keith Kriewall 2013-02-22 21:47:48 UTC
Created attachment 75375 [details]
Trace of GL calls made by dinospin

In case it helps, I'm attaching a JOGL trace of the GL calls made by 'dinospin'.
Comment 2 Jose Fonseca 2014-11-07 14:44:09 UTC
This assertion happened because code in st_mesa_to_tgsi.c was mixing up realloc() with FREE() for the same pointer, instead of using REALLOC()+FREE() or realloc() + free() consistent, as the debugging helpers are only enabled with the macros.

But this has been fixed since then.

It wasn't a single fix. The last one was 11070105f0b5ad20f12bb40a8dd0b357924bcfdd.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.