Bug 91673

Summary:	Segfault when calling glTexSubImage2D on storage texture to bound FBO
Product:	Mesa	Reporter:	Dongseong Hwang <dongseong.hwang>
Component:	Mesa core	Assignee:	Tapani Pälli <lemody>
Status:	RESOLVED FIXED	QA Contact:	mesa-dev
Severity:	major
Priority:	medium
Version:	git
Hardware:	x86-64 (AMD64)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:
Attachments:	GDB backtrace

Description Dongseong Hwang 2015-08-18 06:00:31 UTC

Counterpart chromium project issue: https://code.google.com/p/chromium/issues/detail?id=521904

Following code causes segfault
    GLuint tex_;
    GLuint fbo_;
    glGenTextures(1, &tex_);
    glBindTexture(GL_TEXTURE_2D, tex_);

    glGenFramebuffers(1, &fbo_);
    glBindFramebuffer(GL_FRAMEBUFFER, fbo_);
    glFramebufferTexture2D(GL_FRAMEBUFFER,
                           GL_COLOR_ATTACHMENT0,
                           GL_TEXTURE_2D,
                           tex_,
                           0);

    glBindTexture(GL_TEXTURE_2D, tex_);
    glTexStorage2D(GL_TEXTURE_2D, 2, GL_RGBA8, 2, 2);

    // SEGFAULT
    glTexSubImage2D(GL_TEXTURE_2D,
                    0,
                    0, 0,
                    2, 2,
                    GL_RGBA, GL_UNSIGNED_BYTE,
                    source_pixels);


Here's buildable minimal case; https://github.com/ds-hwang/opengl_snippets/blob/master/glx/texture_storage_fbo_crash.cpp

Comment 1 Michel Dänzer 2015-08-18 06:38:23 UTC

Created attachment 117750 [details]
GDB backtrace

Comment 2 Tapani Pälli 2015-08-18 11:13:31 UTC

With a bit of testing it seems things work fine if glTexStorage2D call is moved to happen right after first glBindTexture call (this is also how is being done in some Piglit tests). Maybe this will help you get forward while the bug is being fixed.

Comment 3 Dongseong Hwang 2015-08-19 12:45:24 UTC

(In reply to Tapani Pälli from comment #2)
> With a bit of testing it seems things work fine if glTexStorage2D call is
> moved to happen right after first glBindTexture call (this is also how is
> being done in some Piglit tests). Maybe this will help you get forward while
> the bug is being fixed.

That's good hint for chromium.

Mesa crashes on updating immutable texture bound to FBO.
So following code doesn't crash

    GLuint tex_;
    GLuint fbo_;
    glGenTextures(1, &tex_);
    glBindTexture(GL_TEXTURE_2D, tex_);

    glGenFramebuffers(1, &fbo_);
    glBindFramebuffer(GL_FRAMEBUFFER, fbo_);
    glFramebufferTexture2D(GL_FRAMEBUFFER,
                           GL_COLOR_ATTACHMENT0,
                           GL_TEXTURE_2D,
                           tex_,
                           0);

    glBindTexture(GL_TEXTURE_2D, tex_);
    glTexStorage2D(GL_TEXTURE_2D, 2, GL_RGBA8, 2, 2);

    // hack to prevent crash
    glFramebufferTexture2D(GL_FRAMEBUFFER,
                           GL_COLOR_ATTACHMENT0,
                           GL_TEXTURE_2D,
                           0,
                           0);

    // not SEGFAULT lol
    glTexSubImage2D(GL_TEXTURE_2D,
                    0,
                    0, 0,
                    2, 2,
                    GL_RGBA, GL_UNSIGNED_BYTE,
                    source_pixels);

    glFramebufferTexture2D(GL_FRAMEBUFFER,
                           GL_COLOR_ATTACHMENT0,
                           GL_TEXTURE_2D,
                           tex_,
                           0);

Comment 4 Tapani Pälli 2015-08-20 06:23:20 UTC

(In reply to Dongseong Hwang from comment #3)
> (In reply to Tapani Pälli from comment #2)
> > With a bit of testing it seems things work fine if glTexStorage2D call is
> > moved to happen right after first glBindTexture call (this is also how is
> > being done in some Piglit tests). Maybe this will help you get forward while
> > the bug is being fixed.
> 
> That's good hint for chromium.
> 
> Mesa crashes on updating immutable texture bound to FBO.

Yes, but *only* if the contents of that texture were unspecified when attaching texture to the FBO. Your hack in comment #3 is unnecessary.

Comment 5 Tapani Pälli 2015-08-21 08:26:27 UTC

Dongseong, fix is now pushed to Mesa master as commit 7eda897 and should be made also available for >=10.6 stable releases. Thanks for the test case!

Comment 6 Dongseong Hwang 2015-08-21 10:38:03 UTC

Wow, cool. Tapani Pälli, thank you for this quick fix.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.