Bug 91288

mesa: 04a57a7ee92403a1d9e01eada69f1ab133fc0b47 (master 10.7.0-devel)

$ ./bin/depthfunc -auto
*** Error in `./bin/depthfunc': double free or corruption (!prev): 0x00000000014e69b0 ***
Aborted (core dumped)

(gdb) bt
#0  0x00007f6549147267 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55
#1  0x00007f6549148eca in __GI_abort () at abort.c:89
#2  0x00007f654918ac53 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7f65492a31a8 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007f6549192c69 in malloc_printerr (ptr=<optimized out>, str=0x7f65492a32d8 "double free or corruption (!prev)", action=1) at malloc.c:4965
#4  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3834
#5  0x00007f654919689c in __GI___libc_free (mem=<optimized out>) at malloc.c:2950
#6  0x00007f6543fc6ae5 in swrast_delete_renderbuffer (ctx=0x7f6549ca9010, rb=0x954550) at swrast.c:358
#7  0x00007f6543e07841 in _mesa_reference_renderbuffer_ (ptr=ptr@entry=0x944208, rb=rb@entry=0x0) at main/renderbuffer.c:183
#8  0x00007f6543dde580 in _mesa_reference_renderbuffer (rb=0x0, ptr=0x944208) at main/renderbuffer.h:66
#9  _mesa_free_framebuffer_data (fb=fb@entry=0x9440d0) at main/framebuffer.c:222
#10 0x00007f6543dde65e in _mesa_destroy_framebuffer (fb=0x9440d0) at main/framebuffer.c:198
#11 0x00007f6543dde6f5 in _mesa_reference_framebuffer_ (ptr=ptr@entry=0x7f6549ca9100, fb=fb@entry=0x0) at main/framebuffer.c:255
#12 0x00007f6543d471b2 in _mesa_reference_framebuffer (fb=0x0, ptr=0x7f6549ca9100) at main/framebuffer.h:63
#13 _mesa_free_context_data (ctx=ctx@entry=0x7f6549ca9010) at main/context.c:1310
#14 0x00007f6543d4740e in _mesa_destroy_context (ctx=0x7f6549ca9010) at main/context.c:1379
#15 0x00007f6543fc3363 in driDestroyContext (pcp=0x79a2f0) at dri_util.c:490
#16 0x00007f6548a6411f in drisw_destroy_context (context=0x77fa00) at drisw_glx.c:232
#17 0x00007f6548a392c9 in glXDestroyContext (dpy=0x76c780, ctx=0x77fa00) at glxcmds.c:473
#18 0x00007f6548ce234f in ?? () from /usr/lib/x86_64-linux-gnu/libwaffle-1.so.0
#19 0x00007f6548cdeb00 in waffle_context_destroy () from /usr/lib/x86_64-linux-gnu/libwaffle-1.so.0
#20 0x00007f6549813edf in piglit_wfl_framework_teardown (wfl_fw=0x76c010)
    at piglit/tests/util/piglit-framework-gl/piglit_wfl_framework.c:676
#21 0x00007f6549814557 in piglit_winsys_framework_teardown (winsys_fw=0x76c010)
    at piglit/tests/util/piglit-framework-gl/piglit_winsys_framework.c:224
#22 0x00007f6549814d9e in destroy (gl_fw=0x76c010) at piglit/tests/util/piglit-framework-gl/piglit_x11_framework.c:212
#23 0x00007f65497f89d0 in destroy () at piglit/tests/util/piglit-framework-gl.c:181
#24 0x00007f654914bd32 in __run_exit_handlers (status=status@entry=1, listp=0x7f65494d6698 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true) at exit.c:82
#25 0x00007f654914bd85 in __GI_exit (status=status@entry=1) at exit.c:104
#26 0x00007f6547ed16b8 in _XDefaultError (dpy=<optimized out>, event=<optimized out>) at ../../src/XlibInt.c:1414
#27 0x00007f6547ed17ed in _XError (dpy=dpy@entry=0x76c780, rep=rep@entry=0x811e70) at ../../src/XlibInt.c:1463
#28 0x00007f6547ece7e7 in handle_error (dpy=dpy@entry=0x76c780, err=0x811e70, in_XReply=in_XReply@entry=1) at ../../src/xcb_io.c:213
#29 0x00007f6547ecf8b1 in _XReply (dpy=dpy@entry=0x76c780, rep=rep@entry=0x7ffc8e731f00, extra=extra@entry=0, discard=discard@entry=0) at ../../src/xcb_io.c:699
#30 0x00007f6547eb5945 in XGetImage (dpy=0x76c780, d=73400324, x=0, y=0, width=160, height=200, plane_mask=18446744073709551615, format=2)
    at ../../src/GetImage.c:75
#31 0x00007f6547eb5b49 in XGetSubImage (dpy=<optimized out>, d=<optimized out>, x=<optimized out>, y=<optimized out>, width=<optimized out>, 
    height=<optimized out>, plane_mask=18446744073709551615, format=2, dest_image=0x944000, dest_x=0, dest_y=0) at ../../src/GetImage.c:125
#32 0x00007f6548a64222 in swrastGetImage (read=<optimized out>, x=<optimized out>, y=<optimized out>, w=<optimized out>, h=<optimized out>, data=<optimized out>, 
    loaderPrivate=0x943ba0) at drisw_glx.c:198
#33 0x00007f6543fc6e2a in swrast_map_renderbuffer (ctx=0x1757, rb=0x954550, x=0, y=0, w=160, h=200, mode=4294967295, out_map=0x7ffc8e7320b8, 
    out_stride=0x7ffc8e7320ac) at swrast.c:494
#34 0x00007f6543ebb4c9 in clear_rgba_buffer (colorMask=0x7f6549caa960 '\377' <repeats 32 times>, "\004\004", rb=0x954550, ctx=0x7f6549ca9010)
    at swrast/s_clear.c:68
#35 clear_color_buffers (ctx=<optimized out>) at swrast/s_clear.c:190
#36 _swrast_Clear (ctx=0x7f6549ca9010, buffers=17) at swrast/s_clear.c:230
#37 0x00007f654977c0ab in stub_glClear (mask=16640) at piglit/tests/util/piglit-dispatch-gen.c:3633
#38 0x0000000000401198 in piglit_display () at piglit/tests/general/depthfunc.c:98
#39 0x00007f6549814057 in run_test (gl_fw=0x76c010, argc=1, argv=0x7ffc8e7323a8)
    at piglit/tests/util/piglit-framework-gl/piglit_winsys_framework.c:79
#40 0x00007f65497f8a73 in piglit_gl_test_run (argc=1, argv=0x7ffc8e7323a8, config=0x7ffc8e732260)
    at piglit/tests/util/piglit-framework-gl.c:199
#41 0x0000000000400f66 in main (argc=1, argv=0x7ffc8e7323a8) at piglit/tests/general/depthfunc.c:42