Bug 73761 - driCreateContextAttribs uses freed memory on context recreation
Summary: driCreateContextAttribs uses freed memory on context recreation
Status: RESOLVED FIXED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Other (show other bugs)
Version: 10.0
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: mesa-dev
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-01-18 11:42 UTC by Török Edwin
Modified: 2014-01-18 20:49 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
bug.c (861 bytes, text/plain)
2014-01-18 11:42 UTC, Török Edwin
Details

Description Török Edwin 2014-01-18 11:42:18 UTC
Created attachment 92327 [details]
bug.c

If I create a debug context, have the window receive some events (for example mouse movements), then delete the context/window, and recreate them I get a crash here:

    struct gl_context *ctx = context->driverPrivate;
    if ((flags & __DRI_CTX_FLAG_FORWARD_COMPATIBLE) != 0)
        ctx->Const.ContextFlags |= GL_CONTEXT_FLAG_FORWARD_COMPATIBLE_BIT;
    if ((flags & __DRI_CTX_FLAG_DEBUG) != 0) {
        ctx->Const.ContextFlags |= GL_CONTEXT_FLAG_DEBUG_BIT;//<--- crash
        ctx->Debug.DebugOutput = GL_TRUE;
    }

See valgrind output below, and attached testcase. The testcase uses SDL 2.0.1.

$ gcc /tmp/bug.c `sdl2-config --cflags --libs`
$ valgrind ./a.out 
==29028== Memcheck, a memory error detector
==29028== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==29028== Using Valgrind-3.9.0 and LibVEX; rerun with -h for copyright info
==29028== Command: ./a.out
==29028== 
Move your mouse now to generate some events
==29028== Invalid write of size 1
==29028==    at 0x53A8570: driCreateContextAttribs (dri_util.c:446)
==29028==    by 0x3067840357: ??? (in /usr/lib/mesa-diverted/x86_64-linux-gnu/libGL.so.1.2.0)
==29028==    by 0x3067818461: ??? (in /usr/lib/mesa-diverted/x86_64-linux-gnu/libGL.so.1.2.0)
==29028==    by 0x4CFA37D: X11_GL_CreateContext (in /usr/lib/x86_64-linux-gnu/libSDL2-2.0.so.0.1.0)
==29028==    by 0x4CEF2AF: SDL_GL_CreateContext (in /usr/lib/x86_64-linux-gnu/libSDL2-2.0.so.0.1.0)
==29028==    by 0x400A50: test_window (in /home/edwin/HDD/me/language/OpenGL/tgls-arcsynthesis/a.out)
==29028==    by 0x400ACC: main (in /home/edwin/HDD/me/language/OpenGL/tgls-arcsynthesis/a.out)
==29028==  Address 0x530f701 is 52,753 bytes inside a block of size 65,536 free'd
==29028==    at 0x4A0870C: free (vg_replace_malloc.c:468)
==29028==    by 0x56FD463: r600_sb::sb_pool::free_all() (sb_valtable.cpp:313)
==29028==    by 0x56F6291: r600_sb::shader::~shader() (sb_ir.h:89)
==29028==    by 0x56D97DC: r600_sb_bytecode_process (sb_core.cpp:285)
==29028==    by 0x56B237E: r600_pipe_shader_create (r600_shader.c:152)
==29028==    by 0x56C4F54: r600_shader_select (r600_state_common.c:746)
==29028==    by 0x56C510F: r600_create_shader_state (r600_state_common.c:793)
==29028==    by 0x55D0AAE: ureg_create_shader (tgsi_ureg.c:1704)
==29028==    by 0x55FDE6C: util_make_empty_fragment_shader (tgsi_ureg.h:138)
==29028==    by 0x55DE91C: util_blitter_create (u_blitter.c:281)
==29028==    by 0x56A3E01: r600_create_context (r600_pipe.c:316)
==29028==    by 0x54DE4F1: st_api_create_context (st_manager.c:615)

$ uname -a
Linux debian 3.12.8 #39 SMP PREEMPT Thu Jan 16 10:06:30 EET 2014 x86_64 GNU/Linux

$ glxinfo | grep OpenGL
OpenGL vendor string: X.Org
OpenGL renderer string: Gallium 0.4 on AMD RV730
OpenGL core profile version string: 3.1 (Core Profile) Mesa 10.0.1
OpenGL core profile shading language version string: 1.40
OpenGL core profile context flags: (none)
OpenGL core profile extensions:
OpenGL version string: 3.0 Mesa 10.0.1
OpenGL shading language version string: 1.30
OpenGL context flags: (none)

Note: if at first you can't reproduce it, make sure the window is receiving some events (I guess its more about memory being allocated than the events themselves), and try to use my command-line above exactly as is.
Comment 1 Ilia Mirkin 2014-01-18 20:37:21 UTC
Yes, I reported this very shortly before the 10.0 release, and it should be fixed by 38366c0c6e715314367b15680702e382d5c46a4a in the main tree, and db0dc5c008f3f4a475de1c6471f99f45f7c5b7d6 on the 10.0 branch, which should be in mesa-10.0.2.
Comment 2 Török Edwin 2014-01-18 20:49:59 UTC
(In reply to comment #1)
> Yes, I reported this very shortly before the 10.0 release, and it should be
> fixed by 38366c0c6e715314367b15680702e382d5c46a4a in the main tree, and
> db0dc5c008f3f4a475de1c6471f99f45f7c5b7d6 on the 10.0 branch, which should be
> in mesa-10.0.2.

I must've missed the 10.0.2 release, its not listed on http://mesa3d.org/index.html, found it at ftp://freedesktop.org/pub/mesa/10.0.2/ though.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.