Bug 74251 - Segfault in st_finalize_texture with Texture Buffer
Summary: Segfault in st_finalize_texture with Texture Buffer
Alias: None
Product: Mesa
Classification: Unclassified
Component: Mesa core (show other bugs)
Version: 10.0
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: mesa-dev
QA Contact:
Depends on:
Reported: 2014-01-30 23:00 UTC by Ian Milligan
Modified: 2014-02-14 20:47 UTC (History)
0 users

See Also:
i915 platform:
i915 features:

Vertex shader using texture buffer. (143 bytes, text/plain)
2014-01-31 01:21 UTC, Ian Milligan
Failing code. (1.09 KB, text/plain)
2014-01-31 01:22 UTC, Ian Milligan

Note You need to log in before you can comment on or make changes to this bug.
Description Ian Milligan 2014-01-30 23:00:05 UTC
Using a texture buffer in mesa 10.1 causes a segfault at st_finalize_texture (st_cb_texture.c:1488). This only appears to occur if the texture buffer is used by the shader. Additionally, if I never unbind and rebind the texture, there is no segfault but the texture buffer still doesn't seem to work properly.
Comment 1 Ian Milligan 2014-01-30 23:01:09 UTC
I forgot to add that I am using the r600g driver.
Comment 2 Marek Olšák 2014-01-30 23:05:31 UTC
Could you please attach the backtrace?
Comment 3 Ian Milligan 2014-01-30 23:08:27 UTC
Oops, I meant mesa 10.0 of course. Here is the backtrace:
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff26296f4 in st_finalize_texture (ctx=0x7ffff1324010, pipe=0xf1b2e0, tObj=0xf25d70) at state_tracker/st_cb_texture.c:1488
1488    state_tracker/st_cb_texture.c: No such file or directory.
(gdb) bt
#0  0x00007ffff26296f4 in st_finalize_texture (ctx=0x7ffff1324010, pipe=0xf1b2e0, tObj=0xf25d70) at state_tracker/st_cb_texture.c:1488
#1  0x00007ffff26147aa in finalize_textures (st=0xfc5660) at state_tracker/st_atom_texture.c:420
#2  0x00007ffff260d546 in st_validate_state (st=0xfc5660) at state_tracker/st_atom.c:202
#3  0x00007ffff2619c40 in st_Clear (ctx=0x7ffff1324010, mask=2) at state_tracker/st_cb_clear.c:390
#4  0x00007ffff249901a in _mesa_Clear (mask=16384) at main/clear.c:202
#5  0x000000000040970c in sbXU_info ()
#6  0x00007ffff3dd9010 in ?? ()
#7  0x0000000000000000 in ?? ()
Comment 4 Marek Olšák 2014-01-30 23:46:30 UTC
Do you have a code sample how to reproduce this?
Comment 5 Ian Milligan 2014-01-30 23:51:03 UTC
I do but it's not written in C. Let me try to write something which can reproduce this.
Comment 6 Ian Milligan 2014-01-31 01:21:24 UTC
Created attachment 93095 [details]
Vertex shader using texture buffer.
Comment 7 Ian Milligan 2014-01-31 01:22:10 UTC
Created attachment 93096 [details]
Failing code.
Comment 8 Ian Milligan 2014-01-31 01:22:41 UTC
The segfault appears to occur when glClear is called while a vertex shader expecting a texture buffer is loaded, but no texture is bound. This can be reproduced simply by loading the attached vertex shader and calling glClear.
Comment 9 Ian Milligan 2014-02-03 22:33:35 UTC
It appears that loading a shader which expects a texture buffer causes the first texture unit's target to be set to TEXTURE_BUFFER. When st_validate_state is called without a texture bound to this texture unit, st_validate_texture is called on this texture unit's texture object. However st_validate_texture expects a texture object with target TEXTURE_BUFFER to have defined the field BufferObject, causing the null pointer dereference. Unfortunately, I'm not sure where the fault lies here.
Comment 11 Marek Olšák 2014-02-14 20:47:33 UTC
Indeed. The fix will be backported to stable branches if it hasn't been backported already. Closing.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct.