<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - glxpixmap hangs Xwayland on exit with dri3"
href="https://bugs.freedesktop.org/show_bug.cgi?id=81694">81694</a>
</td>
</tr>
<tr>
<th>Assignee</th>
<td>idr@freedesktop.org
</td>
</tr>
<tr>
<th>Summary</th>
<td>glxpixmap hangs Xwayland on exit with dri3
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>intel-3d-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Reporter</th>
<td>stu_dby@126.com
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Version</th>
<td>10.2
</td>
</tr>
<tr>
<th>Component</th>
<td>Drivers/DRI/i965
</td>
</tr>
<tr>
<th>Product</th>
<td>Mesa
</td>
</tr></table>
<p>
<div>
<pre>Xwayland now uses dri3 and glamor as means of acceleration. However, glxpixmap
(uses indirect rendering context) shows it uses software rasterization on intel
hardware:
GL_RENDERER = Gallium 0.4 on llvmpipe (LLVM 3.4, 256 bits)
Moreover, Xwayland will crash when glxpixmap exits (backtrace is listed at the
end). It segfaults in st_renderbuffer_delete in
src/mesa/state_tracker/st_cb_fbo.c where
struct st_context *st = st_context(ctx);
pipe_surface_release(st->pipe, &strb->surface);
st on the first line is NULL and it is dereferenced on the second line.
It can't be reproduced with vmglfx since it lacks support for dri3. But I
didn't test nouveau or radeon because I lack such hardware.
Software
Xwayland (xorg-server) 1.16.0
mesa 10.2.3
Hardware
Intel HD 4000
00:02.0 VGA compatible controller [0300]: Intel Corporation 3rd Gen Core
processor Graphics Controller [8086:0166] (rev 09) (prog-if 00 [VGA
controller])
Subsystem: Lenovo Device [17aa:5018]
Xwayland backtrace:
Program received signal SIGSEGV, Segmentation fault.
0x00007fb353a72107 in st_renderbuffer_delete (ctx=0x7fb35dc3f040, rb=0x253a8d0)
at state_tracker/st_cb_fbo.c:240
240 pipe_surface_release(st->pipe, &strb->surface);
(gdb) print st
$1 = (struct st_context *) 0x0
(gdb) bt
#0 0x00007fb353a72107 in st_renderbuffer_delete (ctx=0x7fb35dc3f040,
rb=0x253a8d0) at state_tracker/st_cb_fbo.c:240
#1 0x00007fb3539b68db in _mesa_reference_renderbuffer_ (ptr=0x253a570, rb=0x0)
at main/renderbuffer.c:165
#2 0x00007fb3539545cc in _mesa_reference_renderbuffer (ptr=0x253a570, rb=0x0)
at main/renderbuffer.h:66
#3 0x00007fb353954b3b in _mesa_free_framebuffer_data (fb=0x253a450)
at main/framebuffer.c:221
#4 0x00007fb353954a60 in _mesa_destroy_framebuffer (fb=0x253a450)
at main/framebuffer.c:197
#5 0x00007fb353954c7a in _mesa_reference_framebuffer_ (ptr=0x24fc440, fb=0x0)
at main/framebuffer.c:254
#6 0x00007fb3538ed328 in _mesa_reference_framebuffer (ptr=0x24fc440, fb=0x0)
at main/framebuffer.h:63
#7 0x00007fb3538ef43d in _mesa_free_context_data (ctx=0x24fc350)
at main/context.c:1209
#8 0x00007fb353a7be22 in st_destroy_context (st=0x2531520)
at state_tracker/st_context.c:330
#9 0x00007fb353a98c89 in st_context_destroy (stctxi=0x2531520)
at state_tracker/st_manager.c:619
#10 0x00007fb353875eaa in dri_destroy_context (cPriv=0x1a69420)
at dri_context.c:192
#11 0x00007fb353871d10 in driDestroyContext (pcp=0x1a69420)
---Type <return> to continue, or q <return> to quit---
at ../../../../src/mesa/drivers/dri/common/dri_util.c:487
#12 0x00000000004c4162 in __glXDRIcontextDestroy (baseContext=0x1a69370)
at glxdriswrast.c:135
#13 0x00000000004c3abc in __glXFreeContext (cx=0x7fb35dc3f040) at glxext.c:209
#14 0x00000000004c3b9e in ContextGone (cx=<optimized out>, id=<optimized out>)
at glxext.c:101
#15 0x0000000000583959 in doFreeResource (res=0x2538f80, skip=0)
at resource.c:873
#16 0x000000000058482d in FreeClientResources (client=0x7fb35dc3f040,
client@entry=0x1a68320) at resource.c:1139
#17 0x000000000056391a in CloseDownClient (client=0x1a68320) at dispatch.c:3384
#18 0x0000000000563a4a in ProcKillClient (client=0x2461e60) at dispatch.c:3190
#19 0x0000000000563f93 in Dispatch () at dispatch.c:432
#20 0x0000000000567891 in dix_main (argc=10, argv=0x7fff1d029198,
envp=<optimized out>) at main.c:296
#21 0x00000000005542ac in main (argc=<optimized out>, argv=<optimized out>,
envp=<optimized out>) at stubmain.c:34</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>