Created attachment 35604 [details]
Xorg.0.log including backtrace.
This was originally described in bug 27922 and occurs when running the
"glresize" test program there, which creates an OpenGL window and then rapidly
resizes it, switching back and forth between filling the entire screen and its
Running "glresize" with LIBGL_ALWAYS_INDIRECT=1 causes the server to immediately segfault. This occurs with (at least) servers 1.8.0 and git master. I'm using mesa 7.8.1.
The system is a ThinkPad T500 with a GM45, running git xf86-video-intel but it also occurs with 2.11.0.
Note to self:
==1267== Invalid read of size 4
==1267== at 0x4942A9D: I830DRI2CopyRegion (i830_dri.c:280)
==1267== by 0x4943989: I830DRI2FrameEventHandler (i830_dri.c:551)
==1267== by 0x493F021: drmmode_vblank_handler (drmmode_display.c:1400)
==1267== by 0x4903FAB: drmHandleEvent (xf86drmMode.c:776)
==1267== by 0x493EF5E: drm_wakeup_handler (drmmode_display.c:1425)
==1267== by 0x8074EF1: WakeupHandler (dixutils.c:421)
==1267== by 0x80B9699: WaitForSomething (WaitFor.c:232)
==1267== by 0x80853FF: Dispatch (dispatch.c:375)
==1267== by 0x8066734: main (main.c:283)
==1267== Address 0x5c85af0 is 24 bytes inside a block of size 28 free'd
==1267== at 0x4024866: free (vg_replace_malloc.c:325)
==1267== by 0x80B03F0: Xfree (utils.c:1137)
==1267== by 0x49429D4: I830DRI2DestroyBuffer (i830_dri.c:270)
==1267== by 0x4908B86: do_get_buffers (dri2.c:407)
==1267== by 0x48DCFD4: dri2GetBuffersWithFormat (glxdri2.c:529)
==1267== by 0x4DB0BB9: intel_update_renderbuffers (intel_context.c:279)
==1267== by 0x4DB1191: intel_prepare_render (intel_context.c:421)
==1267== by 0x4DB127E: intelMakeCurrent (intel_context.c:902)
==1267== by 0x4D8D190: driBindContext (dri_util.c:195)
==1267== by 0x48DCDBB: __glXDRIcontextMakeCurrent (glxdri2.c:262)
==1267== by 0x48CFCA4: DoMakeCurrent (glxcmds.c:645)
==1267== by 0x48D0094: __glXDisp_MakeCurrent (glxcmds.c:684)
Author: Chris Wilson <firstname.lastname@example.org>
Date: Fri May 14 10:32:12 2010 +0100
dri: Hold reference to buffers across swap
As we schedule swaps for some time in the future and may process a
detachment prior to receiving the vblank notification from the kernel,
we need to hold a reference to the buffers for our swap event handler.
Bug 28080 - "glresize" causes X server segfault with indirect rendering.