Bug 82814

Summary:	glDrawBuffers(0, NULL) segfaults in _mesa_drawbuffers
Product:	Mesa	Reporter:	Christoph Haag <haagch>
Component:	Mesa core	Assignee:	mesa-dev
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	medium
Version:	git
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:
Attachments:	full backtrace

Description Christoph Haag 2014-08-19 13:27:48 UTC

Created attachment 104888 [details]
full backtrace

e.g. doom3 bfg uses it: https://github.com/RobertBeckebans/RBDOOM-3-BFG/blob/195b99e39fdda73facd73cac61e7ce317fc92e33/neo/renderer/Framebuffer.cpp#L86


< Sarayan> 904ed3b3153a73b601085ed22d2ba3693812b1cf is what made it explode

Comment 1 Ilia Mirkin 2014-08-19 13:35:01 UTC

FWIW I'm fairly sure that it's actually commit 39b40ad144f5f587e505b45048e33a03641ba857
Author: Brian Paul <brianp@vmware.com>
Date:   Fri Aug 8 15:01:50 2014 -0600

    mesa: fix assertion in _mesa_drawbuffers()
    
    Fixes failed assertion when _mesa_update_draw_buffers() was called
    with GL_DRAW_BUFFER == GL_FRONT_AND_BACK.  The piglit gl30basic hit
    this.
    
    Cc: "10.2" <mesa-stable@lists.freedesktop.org>
    
    Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>

It changed a if (n == 1) into a if (_mesa_bitcount(...) > 1) without any regard for n, which might be 0. Should probably be

if (n > 0 && ...) or if (n == 1 && ...). Not entirely sure what the logic is there though.

Comment 2 Brian Paul 2014-08-19 13:52:48 UTC

Patch posted to mesa-dev.  Thanks for finding/reporting this.

Comment 3 Brian Paul 2014-08-19 15:41:56 UTC

Fixed w/ commit 31ce84a81f7166ded07e9cb41e5dfe212dd8fed1

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.