[Bug 20539] Segmentation Fault with Radeon (maybe with pixmap command)

[bugzilla-daemon at freedesktop.org]

http://bugs.freedesktop.org/show_bug.cgi?id=20539


Michel Dänzer <michel at daenzer.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|xorg-driver-ati at lists.x.org |dri-
                   |                            |devel at lists.sourceforge.net
          Component|Driver/Radeon               |Drivers/DRI/r300
            Product|xorg                        |Mesa
          QAContact|xorg-team at lists.x.org       |
            Version|7.4                         |unspecified




--- Comment #16 from Michel Dänzer <michel at daenzer.net>  2009-03-19 01:40:11 PST ---
The valgrind error below looks like the most likely culprit at this point.
Apparently the Mesa r300 driver is accessing texture object memory after it's
been freed. I'm not sure if it's the responsibility of the driver or the Mesa
core to prevent this, assuming the driver for now.

==27872== Invalid read of size 4
==27872==    at 0x7A7F4BB: r300UpdateTexture (r300_texstate.c:576)
==27872==    by 0x7A7F5A8: r300UpdateTextureState (r300_texstate.c:648)
==27872==    by 0x7A782B9: r300UpdateShaderStates (r300_state.c:2685)
==27872==    by 0x7A7B6D2: r300RunRender (r300_render.c:314)
==27872==    by 0x7B135F3: _tnl_run_pipeline (t_pipeline.c:158)
==27872==    by 0x7B13B64: _tnl_draw_prims (t_draw.c:402)
==27872==    by 0x7B0C823: vbo_exec_vtx_flush (vbo_exec_draw.c:251)
==27872==    by 0x7B07F27: vbo_exec_FlushVertices (vbo_exec_api.c:751)
==27872==    by 0x7B98460: _mesa_PopAttrib (attrib.c:862)
==27872==    by 0x5922AD0: __glXDisp_PopAttrib (indirect_dispatch.c:1445)
==27872==    by 0x594C77E: __glXDisp_Render (glxcmds.c:1783)
==27872==    by 0x5951079: __glXDispatch (glxext.c:523)
==27872==  Address 0x4ec6e00 is 24 bytes inside a block of size 1,572 free'd
==27872==    at 0x4024E3A: free (vg_replace_malloc.c:323)
==27872==    by 0x7AD01AC: _mesa_free (imports.c:85)
==27872==    by 0x7A60767: driDestroyTextureObject (texmem.c:353)
==27872==    by 0x7A7E26D: r300DeleteTexture (r300_tex.c:1000)
==27872==    by 0x7AF2F00: _mesa_reference_texobj (texobj.c:317)
==27872==    by 0x7AF45A0: _mesa_DeleteTextures (texobj.c:852)
==27872==    by 0x5926692: __glXDisp_DeleteTextures (indirect_dispatch.c:2848)
==27872==    by 0x5951079: __glXDispatch (glxext.c:523)
==27872==    by 0x808C51E: Dispatch (dispatch.c:437)
==27872==    by 0x80716F4: main (main.c:397)


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.