<div dir="ltr">(CC'ing Mesa-dev since this is a Mesa bug). <div> On 16 September 2013 11:00, Chad Versace <<a href="mailto:chad.versace@linux.intel.com" target="_blank">chad.versace@linux.intel.com</a>> wrote: <div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">CC'ing Piglit.<div><div class="h5"> On 09/14/2013 08:54 AM, Paul Berry wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> I'm investigating a failure in spec/OES_fixed_point/attribute-arrays, specifically the command line "/home/pberry/.platform/piglit-mesa/piglit/build/bin/oes_fixed_point-attribute-arrays -auto -fbo". It's segfaulting during piglit/waffle initialization due to Mesa accessing freed memory. This only started happening for me recently, however I suspect that's because the access to freed memory makes it a heisenbug, and the root cause has probably been around for a long time. What's interesting about this test is that it's a GLES1 test being run in -fbo mode, which means that piglit first starts initializing things assuming it's going to run the test with fbo's, then at some point it figures out that it can't (because fbo's are unsupported), so it tears down its configuration and starts a new configuration to test using a window. While establishing the new configuration, waffle calls eglMakeCurrent(). Deep in the bowels of Mesa's implementation of this function, it decides that it needs to flush the context that was previously current. But that context refers to data structures that were freed when piglit tore down its old configuration (specifically, it refers to brw->bufmgr, which was freed in response to a call to eglTerminate()). I've been studying the egl calls made by piglit/waffle during this test and I believe they look like this (I may be missing a few but I think I found most of them): Initial setup: - eglGetDisplay() - eglInitialize() (causes intel_init_bufmgr() to be called, which creates bufmgr 1) - eglQueryString() - eglChooseConfig() - eglBindAPI() - eglCreateContext() (causes brwCreateContext() to be called, which creates context 1) - eglGetConfigAttrib() - eglCreateWindowSurface() - eglMakeCurrent() Initial teardown: - eglDestroySurface() - eglDestroyContext() (interestingly, does not cause intelDestroyContext to be called, perhaps because the context is still current?) - eglTerminate() (causes intelDestroyScreen() to be called, which frees bufmgr 1) Second setup: - eglGetDisplay() - eglInitialize() (causes intel_init_bufmgr() to be called, which creates bufmgr 2) - eglQueryString() - eglChooseConfig() - eglBindAPI() - eglCreateContext() (causes brwCreateContext() to be called, which creates context 2) - eglGetConfigAttrib() - eglCreateWindowSurface() - eglMakeCurrent() (at this point Mesa tries to flush context 1, which causes a segfault beause this causes it to try to access bufmgr 1, which has already been freed) So, my questions are: - Does it look like piglit/waffle is making an allowed sequence of EGL calls? (In other words, is the bug in Mesa or piglit/waffle?) - If the bug is in Mesa, what should be happening instead? I assume that at some point Mesa should have made the current context non-current (and destroyed it, perhaps), but I'm not sure when that should have happened, nor what code should have been responsible for doing it. Thanks in advance, Chad. I hope you're enjoying your business travel! </blockquote> </div></div> The sequence of EGL calls is legal. The bug is in Mesa. After discovering the bug many months ago, I posted a test to the Piglit list, but it was ignored and then forgotten. (Gerrit please!) I'll repost the test in the next day or so after rebasing it. See the comments [1] in my test to see why the sequence of EGL calls is legal. [1] <a href="http://cgit.freedesktop.org/~chadversary/piglit/tree/tests/egl/spec/egl-1.4/egl-terminate-then-unbind-context.c?h=egl-terminate-then-unbind#n26" target="_blank">http://cgit.freedesktop.org/~chadversary/piglit/tree/tests/egl/spec/egl-1.4/egl-terminate-then-unbind-context.c?h=egl-terminate-then-unbind#n26</a> If I correctly understand the EGL spec quote above, the call to eglMakeCurrent that currently segfaults should instead flush the queued-to-be-destroyed context and then promptly destroy it. </blockquote></div> </div><div class="gmail_extra">Yeah, after consulation with ajax on IRC I agree. In point of fact, this is what eglMakeCurrent is trying to do--it's just not succeeding because the act of flushing the context causes it to refer to the already-freed bufmgr. </div><div class="gmail_extra">It sounds like what we need to do in Mesa is add some sort of mechanism to make sure eglTerminate() doesn't destroy the bufmgr until after the context using it is no longer current (e.g. reference counting). </div></div></div>