[Mesa3d-dev] [Bug 12906] reproducible crash in _mesa_set_viewport

[<bug...@fr...>]

http://bugs.freedesktop.org/show_bug.cgi?id=12906





------- Comment #9 from my...@ro...  2007-10-31 16:58 PST -------
c->mesa.WinSysDrawBuffer and c->mesa.WinSysReadBuffer are indeed NULL.
and they are unref'd from within _mesa_make_current itself, in this fragment:

  if (oldCtx) {
      _mesa_unreference_framebuffer(&oldCtx->WinSysDrawBuffer);
      _mesa_unreference_framebuffer(&oldCtx->WinSysReadBuffer);
      _mesa_unreference_framebuffer(&oldCtx->DrawBuffer);
      _mesa_unreference_framebuffer(&oldCtx->ReadBuffer);
   }

here's the debugging session:

(gdb) break _mesa_make_current
Breakpoint 1 at 0x307a7437: file context.c, line 1440.
(gdb) break _mesa_unreference_framebuffer
Breakpoint 2 at 0x307cb3a7: file framebuffer.c, line 244.
(gdb) cont
Continuing.

Breakpoint 1, _mesa_make_current (newCtx=0x87e2000, drawBuffer=0x9606000,
readBuffer=0x9606000) at context.c:1440
1440       GET_CURRENT_CONTEXT(oldCtx);

[this is first call to _mesa_make_current with newCtx=0x87e2000]

(gdb) cont
Continuing.

Breakpoint 1, _mesa_make_current (newCtx=0x906c000, drawBuffer=0x9665000,
readBuffer=0x9665000) at context.c:1440
1440       GET_CURRENT_CONTEXT(oldCtx);

[this is second call to _mesa_make_current, this time with newCtx=0x906c000]

(gdb) cont
Continuing.

Breakpoint 2, _mesa_unreference_framebuffer (fb=0x87e2000) at framebuffer.c:244
244     {
(gdb) bt
#0  _mesa_unreference_framebuffer (fb=0x87e2000) at framebuffer.c:244
#1  0x307a74b6 in _mesa_make_current (newCtx=0x906c000, drawBuffer=0x9665000,
readBuffer=0x9665000) at context.c:1467
#2  0x308ef457 in XMesaMakeCurrent2 (c=0x906c000, drawBuffer=0x9665000,
readBuffer=0x9665000) at xm_api.c:1789
#3  0x28644ca4 in __glXMesaContextMakeCurrent (baseContext=0x906c000) at
glxglcore.c:178
#4  0x2863fc27 in DoMakeCurrent (cl=0x87b5980, drawId=33554495,
readId=33554495, contextId=33554496, tag=0) at glxcmds.c:650
#5  0x2863fe69 in __glXDisp_MakeCurrent (cl=0x87e20e8, pc=0x906c000 "") at
glxcmds.c:395
#6  0x28644938 in __glXDispatch (client=0x87bf600) at glxext.c:561
#7  0x0814656d in XaceCatchExtProc (client=0x87bf600) at xace.c:299
#8  0x08087024 in Dispatch () at dispatch.c:502
#9  0x0806df1c in main (argc=7, argv=0xbfbfeebc, envp=0x87e20e8) at main.c:452
(gdb) frame 1
#1  0x307a74e0 in _mesa_make_current (newCtx=0x906c000, drawBuffer=0x9665000,
readBuffer=0x9665000) at context.c:1470
1470          _mesa_unreference_framebuffer(&oldCtx->ReadBuffer);
(gdb) print oldCtx
$1 = (GLcontext *) 0x87e2000
(gdb) print &oldCtx->ReadBuffer
$2 = (GLframebuffer **) 0x87e20e4
(gdb) frame 0
#0  _mesa_unreference_framebuffer (fb=0x87e2000) at framebuffer.c:244
244     {
(gdb) step
246        if (*fb) {
(gdb) print *fb
$9 = (struct gl_framebuffer *) 0x9606000
(gdb) print fb
$10 = (struct gl_framebuffer **) 0x87e20e4
(gdb) cont
Continuing.

Breakpoint 1, _mesa_make_current (newCtx=0x87e2000, drawBuffer=0x0,
readBuffer=0x0) at context.c:1440
1440       GET_CURRENT_CONTEXT(oldCtx);
(gdb) bt
#0  _mesa_make_current (newCtx=0x87e2000, drawBuffer=0x0, readBuffer=0x0) at
context.c:1440
#1  0x308ef65e in XMesaForceCurrent (c=0x87e2000) at xm_api.c:1879
#2  0x28644d40 in __glXMesaContextForceCurrent (baseContext=0x0) at
glxglcore.c:209
#3  0x286446b6 in __glXForceCurrent (cl=0x87b5a80, tag=677967912,
error=0xbfbfe904) at glxext.c:408
#4  0x286643d1 in DoGetString (cl=0x87b5a80, pc=0x8792000 "\220\201\003",
need_swap=0 '\0') at single2.c:334
#5  0x286645da in __glXDisp_GetString (cl=0x0, pc=0x0) at single2.c:393
#6  0x28644938 in __glXDispatch (client=0x8674a00) at glxext.c:561
#7  0x0814656d in XaceCatchExtProc (client=0x8674a00) at xace.c:299
#8  0x08087024 in Dispatch () at dispatch.c:502
#9  0x0806df1c in main (argc=7, argv=0xbfbfeebc, envp=0x0) at main.c:452


in summary, i found gdb backtrace to be misleading (fb=0x87e2000 ?), but it
seems that the general sequence of events is _mesa_make_current(ctx1) ->
_mesa_make_current(ctx2), this derefs buffers in ctx1 ->
_mesa_make_current(ctx1) again, with buffers now NULL.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.