mesa/progs/xdemo/texture_from_pixmap crashes xserver on 2nd run

[Pierre Willenbrock]

Hi list,

while trying to find out why kwin of kde4 does only display a black
screen when using opengl compositing, i wanted to check if the texture
from pixmap gl extension works. For that, i modified
mesa/progs/xdemo/texture_from_pixmap to ignore the missing bits of the
fbconfigs, and ran it. Showed the correct image for the first run, but
crashed the xserver on the second run(same xserver).

I am using git master of drm, mesa, xserver, xf86-video-intel.

Valgrinding X results in these errors(after the usual uninitialised
ioctls/jumps in bios code):

==7683== Invalid read of size 4
==7683==    at 0x4933923: __glXDRIleaveServer (glxdri.c:131)
==7683==    by 0x48FD94B: __glXleaveServer (glxext.c:442)
==7683==    by 0x48FDEB9: __glXDispatch (glxext.c:488)
==7683==    by 0x808A618: Dispatch (dispatch.c:468)
==7683==    by 0x8071134: main (main.c:448)
==7683==  Address 0x194c26d0 is 72 bytes inside a block of size 88 free'd
==7683==    at 0x402398C: free (in
/usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==7683==    by 0x8130B10: Xfree (utils.c:1451)
==7683==    by 0x4933C57: __glXDRIdrawableDestroy (glxdri.c:199)
==7683==    by 0x48FF2A6: __glXUnrefDrawable (glxutil.c:136)
==7683==    by 0x48FDD7A: DrawableGone (glxext.c:112)
==7683==    by 0x8073538: FreeClientResources (resource.c:812)
==7683==    by 0x80842C8: CloseDownClient (dispatch.c:3689)
==7683==    by 0x808A641: Dispatch (dispatch.c:479)
==7683==    by 0x8071134: main (main.c:448)
==7683==
==7683== Invalid read of size 4
==7683==    at 0x493392A: __glXDRIleaveServer (glxdri.c:132)
==7683==    by 0x48FD94B: __glXleaveServer (glxext.c:442)
==7683==    by 0x48FDEB9: __glXDispatch (glxext.c:488)
==7683==    by 0x808A618: Dispatch (dispatch.c:468)
==7683==    by 0x8071134: main (main.c:448)
==7683==  Address 0x194c26a0 is 24 bytes inside a block of size 88 free'd
==7683==    at 0x402398C: free (in
/usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==7683==    by 0x8130B10: Xfree (utils.c:1451)
==7683==    by 0x4933C57: __glXDRIdrawableDestroy (glxdri.c:199)
==7683==    by 0x48FF2A6: __glXUnrefDrawable (glxutil.c:136)
==7683==    by 0x48FDD7A: DrawableGone (glxext.c:112)
==7683==    by 0x8073538: FreeClientResources (resource.c:812)
==7683==    by 0x80842C8: CloseDownClient (dispatch.c:3689)
==7683==    by 0x808A641: Dispatch (dispatch.c:479)
==7683==    by 0x8071134: main (main.c:448)
==7683==
==7683== Invalid read of size 4
==7683==    at 0x4AD6B5A: exaDoMoveInPixmap (exa_migration.c:300)
==7683==    by 0x4992F91: I830TexOffsetStart (i830_exa.c:616)
==7683==    by 0x4933933: __glXDRIleaveServer (glxdri.c:132)
==7683==    by 0x48FD94B: __glXleaveServer (glxext.c:442)
==7683==    by 0x48FDEB9: __glXDispatch (glxext.c:488)
==7683==    by 0x808A618: Dispatch (dispatch.c:468)
==7683==    by 0x8071134: main (main.c:448)
==7683==  Address 0x10 is not stack'd, malloc'd or (recently) free'd

This is where the xserver does a matching backtrace, valgrind exits
gracefully and my kernel halts(without kernel messages). The kernel does
not halt when not running under valgrind, so that is not a problem.

Looking at glxdri.c i guess the pixmap is not unregistered from
screen->texOffsetOverride on destruction. I have tried to fix this, but
i can't figure out where to put the texOffsetOverride[x] = NULL;...

Regards,
  Pierre