Bug 22408 - intel_renderbuffer_set_region crashes when sent NULL as region
intel_renderbuffer_set_region crashes when sent NULL as region
Status: RESOLVED FIXED
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/i915
unspecified
x86-64 (AMD64) Linux (All)
: medium normal
Assigned To: Default DRI bug account
:
: 22374 22377 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2009-06-22 00:52 UTC by Alex Bennee
Modified: 2009-06-23 08:01 UTC (History)
3 users (show)

See Also:
i915 platform:
i915 features:


Attachments
GDB Backtrace of the crash (4.71 KB, text/plain)
2009-06-22 00:52 UTC, Alex Bennee
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Bennee 2009-06-22 00:52:22 UTC
Created attachment 27002 [details]
GDB Backtrace of the crash

After a recent version bump of Mesa I can no longer start X due to a crash in intel_renderbuffer_set_region. The backtrace shows a crash due to a NULL region being passed to it.

-- chipset:  Intel Corporation 82945G/GZ Integrated Graphics Controller (rev
02)
-- system architecture: x86_64
-- xf86-video-intel: 2.7.1
-- xserver: 1.6.1.901-r3
-- mesa: 7.4.3
-- libdrm: 2.4.11
-- kernel: 2.6.30 (Clean Linus Tree)
-- Linux distribution: Gentoo
-- Machine or mobo model: Efficient PC ASUS (ICH7)
-- Display connector: TMDS-1

KMS is not enabled (see bug 22225)
Comment 1 Alex Bennee 2009-06-22 01:10:26 UTC
Can confirm the crash introduced in Mesa 7.4.3, downgrading to 7.4.2 fixes the problem.
Comment 2 Brian Paul 2009-06-22 10:29:39 UTC
OK, fixed in Mesa with commit 1dbbc39f48ce5f9aa63ab42930b14e48938b326f

Looks like a Mesa 7.4.4 release will be needed...
Comment 3 Brian Paul 2009-06-22 13:28:25 UTC
*** Bug 22377 has been marked as a duplicate of this bug. ***
Comment 4 Alex Bennee 2009-06-22 13:59:04 UTC
*** Bug 22374 has been marked as a duplicate of this bug. ***
Comment 5 Alex Bennee 2009-06-23 02:06:47 UTC
(In reply to comment #2)
> OK, fixed in Mesa with commit 1dbbc39f48ce5f9aa63ab42930b14e48938b326f
> 
> Looks like a Mesa 7.4.4 release will be needed...
> 

OK I attempted to patch the ebuild with that commit and got a crash later on:

0x00007f8fea7bb165 in raise () from /lib/libc.so.6
#0  0x00007f8fea7bb165 in raise () from /lib/libc.so.6
#1  0x00007f8fea7bc4de in abort () from /lib/libc.so.6
#2  0x00007f8fea7b449f in __assert_fail () from /lib/libc.so.6
#3  0x00007f8fd89fb999 in _mesa_reference_framebuffer (ptr=0x12b1338, fb=0x0) at main/framebuffer.c:230
#4  0x00007f8fd8975e53 in driDestroyDrawable (pdp=0x12b1330) at ../common/dri_util.c:503
#5  0x00007f8fe9b29cd6 in ?? () from /usr/lib64/xorg/modules/extensions//libglx.so
#6  0x00007f8fe9b1f40d in ?? () from /usr/lib64/xorg/modules/extensions//libglx.so
#7  0x0000000000434064 in FreeResource (id=20971578, skipDeleteFuncType=0) at resource.c:561
#8  0x00007f8fe9b1cd5c in ?? () from /usr/lib64/xorg/modules/extensions//libglx.so
#9  0x00007f8fe9b1fb72 in ?? () from /usr/lib64/xorg/modules/extensions//libglx.so
#10 0x000000000044b914 in Dispatch () at dispatch.c:437
#11 0x000000000043180d in main (argc=9, argv=0x7fff8ba34bb8, envp=<value optimized out>) at main.c:397
#3  0x00007f8fd89fb999 in _mesa_reference_framebuffer (ptr=0x12b1338, fb=0x0) at main/framebuffer.c:230
230     main/framebuffer.c: No such file or directory.
        in main/framebuffer.c
Source directories searched: /var/tmp/portage/media-libs/mesa-7.4.3/work/Mesa-7.4.3/src/mesa/main:$cdir:$cwd
#3  0x00007f8fd89fb999 in _mesa_reference_framebuffer (ptr=0x12b1338, fb=0x0) at main/framebuffer.c:230
230        assert(fb);
$1 = (struct gl_framebuffer *) 0x0
#4  0x00007f8fd8975e53 in driDestroyDrawable (pdp=0x12b1330) at ../common/dri_util.c:503
503             (*psp->DriverAPI.DestroyBuffer)(pdp);
No symbol "psp" in current context.
No locals.
$2 = (__DRIdrawable *) 0x12b1330
$3 = {hHWDrawable = 0, driverPrivate = 0x0, loaderPrivate = 0x12b1470, refcount = 0, index = 0, pStamp = 0x0, lastStamp = 0, x = 0, y = 0, w = 0, h = 0, 
  numClipRects = 0, pClipRects = 0x12afbf0, backX = 0, backY = 0, backClipRectType = 0, numBackClipRects = 0, pBackClipRects = 0x12a0360, vblSeq = 0, 
  vblFlags = 0, vblank_base = 0, msc_base = 0, driContextPriv = 0xb3bfe8, driScreenPriv = 0xb3bef0, swap_interval = 4294967295}

I've re-oppened the bug as my problem still isn't solved although the
crash has progressed onwards. If you think it's really a different bug
I can raise a new bug for this crash or wait for the 7.4.4 release so
I can test properly.

Any idea when a 7.4.4 build will be released?
Comment 6 Brian Paul 2009-06-23 08:01:11 UTC
That assertion was also fixed.  Commit 4b8cd0b0ad48c3b0129451924f7461ffcbbc8597

I'll try to release 7.4.4 today.