Bug 22408

Summary: intel_renderbuffer_set_region crashes when sent NULL as region
Product: Mesa Reporter: Alex Bennee <bugzilla>
Component: Drivers/DRI/i915Assignee: Default DRI bug account <dri-devel>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: medium CC: bugzilla, daimler3, pva
Version: unspecified   
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:
Attachments: GDB Backtrace of the crash

Description Alex Bennee 2009-06-22 00:52:22 UTC
Created attachment 27002 [details]
GDB Backtrace of the crash

After a recent version bump of Mesa I can no longer start X due to a crash in intel_renderbuffer_set_region. The backtrace shows a crash due to a NULL region being passed to it.

-- chipset:  Intel Corporation 82945G/GZ Integrated Graphics Controller (rev
02)
-- system architecture: x86_64
-- xf86-video-intel: 2.7.1
-- xserver: 1.6.1.901-r3
-- mesa: 7.4.3
-- libdrm: 2.4.11
-- kernel: 2.6.30 (Clean Linus Tree)
-- Linux distribution: Gentoo
-- Machine or mobo model: Efficient PC ASUS (ICH7)
-- Display connector: TMDS-1

KMS is not enabled (see bug 22225)
Comment 1 Alex Bennee 2009-06-22 01:10:26 UTC
Can confirm the crash introduced in Mesa 7.4.3, downgrading to 7.4.2 fixes the problem.
Comment 2 Brian Paul 2009-06-22 10:29:39 UTC
OK, fixed in Mesa with commit 1dbbc39f48ce5f9aa63ab42930b14e48938b326f

Looks like a Mesa 7.4.4 release will be needed...
Comment 3 Brian Paul 2009-06-22 13:28:25 UTC
*** Bug 22377 has been marked as a duplicate of this bug. ***
Comment 4 Alex Bennee 2009-06-22 13:59:04 UTC
*** Bug 22374 has been marked as a duplicate of this bug. ***
Comment 5 Alex Bennee 2009-06-23 02:06:47 UTC
(In reply to comment #2)
> OK, fixed in Mesa with commit 1dbbc39f48ce5f9aa63ab42930b14e48938b326f
> 
> Looks like a Mesa 7.4.4 release will be needed...
> 

OK I attempted to patch the ebuild with that commit and got a crash later on:

0x00007f8fea7bb165 in raise () from /lib/libc.so.6
#0  0x00007f8fea7bb165 in raise () from /lib/libc.so.6
#1  0x00007f8fea7bc4de in abort () from /lib/libc.so.6
#2  0x00007f8fea7b449f in __assert_fail () from /lib/libc.so.6
#3  0x00007f8fd89fb999 in _mesa_reference_framebuffer (ptr=0x12b1338, fb=0x0) at main/framebuffer.c:230
#4  0x00007f8fd8975e53 in driDestroyDrawable (pdp=0x12b1330) at ../common/dri_util.c:503
#5  0x00007f8fe9b29cd6 in ?? () from /usr/lib64/xorg/modules/extensions//libglx.so
#6  0x00007f8fe9b1f40d in ?? () from /usr/lib64/xorg/modules/extensions//libglx.so
#7  0x0000000000434064 in FreeResource (id=20971578, skipDeleteFuncType=0) at resource.c:561
#8  0x00007f8fe9b1cd5c in ?? () from /usr/lib64/xorg/modules/extensions//libglx.so
#9  0x00007f8fe9b1fb72 in ?? () from /usr/lib64/xorg/modules/extensions//libglx.so
#10 0x000000000044b914 in Dispatch () at dispatch.c:437
#11 0x000000000043180d in main (argc=9, argv=0x7fff8ba34bb8, envp=<value optimized out>) at main.c:397
#3  0x00007f8fd89fb999 in _mesa_reference_framebuffer (ptr=0x12b1338, fb=0x0) at main/framebuffer.c:230
230     main/framebuffer.c: No such file or directory.
        in main/framebuffer.c
Source directories searched: /var/tmp/portage/media-libs/mesa-7.4.3/work/Mesa-7.4.3/src/mesa/main:$cdir:$cwd
#3  0x00007f8fd89fb999 in _mesa_reference_framebuffer (ptr=0x12b1338, fb=0x0) at main/framebuffer.c:230
230        assert(fb);
$1 = (struct gl_framebuffer *) 0x0
#4  0x00007f8fd8975e53 in driDestroyDrawable (pdp=0x12b1330) at ../common/dri_util.c:503
503             (*psp->DriverAPI.DestroyBuffer)(pdp);
No symbol "psp" in current context.
No locals.
$2 = (__DRIdrawable *) 0x12b1330
$3 = {hHWDrawable = 0, driverPrivate = 0x0, loaderPrivate = 0x12b1470, refcount = 0, index = 0, pStamp = 0x0, lastStamp = 0, x = 0, y = 0, w = 0, h = 0, 
  numClipRects = 0, pClipRects = 0x12afbf0, backX = 0, backY = 0, backClipRectType = 0, numBackClipRects = 0, pBackClipRects = 0x12a0360, vblSeq = 0, 
  vblFlags = 0, vblank_base = 0, msc_base = 0, driContextPriv = 0xb3bfe8, driScreenPriv = 0xb3bef0, swap_interval = 4294967295}

I've re-oppened the bug as my problem still isn't solved although the
crash has progressed onwards. If you think it's really a different bug
I can raise a new bug for this crash or wait for the 7.4.4 release so
I can test properly.

Any idea when a 7.4.4 build will be released?
Comment 6 Brian Paul 2009-06-23 08:01:11 UTC
That assertion was also fixed.  Commit 4b8cd0b0ad48c3b0129451924f7461ffcbbc8597

I'll try to release 7.4.4 today.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.