<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - driCreateContextAttribs uses freed memory on context recreation"
href="https://bugs.freedesktop.org/show_bug.cgi?id=73761">73761</a>
</td>
</tr>
<tr>
<th>Assignee</th>
<td>mesa-dev@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Summary</th>
<td>driCreateContextAttribs uses freed memory on context recreation
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux (All)
</td>
</tr>
<tr>
<th>Reporter</th>
<td>edwin+mesa@etorok.net
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86-64 (AMD64)
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Version</th>
<td>10.0
</td>
</tr>
<tr>
<th>Component</th>
<td>Other
</td>
</tr>
<tr>
<th>Product</th>
<td>Mesa
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=92327" name="attach_92327" title="bug.c">attachment 92327</a> <a href="attachment.cgi?id=92327&action=edit" title="bug.c">[details]</a></span>
bug.c
If I create a debug context, have the window receive some events (for example
mouse movements), then delete the context/window, and recreate them I get a
crash here:
struct gl_context *ctx = context->driverPrivate;
if ((flags & __DRI_CTX_FLAG_FORWARD_COMPATIBLE) != 0)
ctx->Const.ContextFlags |= GL_CONTEXT_FLAG_FORWARD_COMPATIBLE_BIT;
if ((flags & __DRI_CTX_FLAG_DEBUG) != 0) {
ctx->Const.ContextFlags |= GL_CONTEXT_FLAG_DEBUG_BIT;//<--- crash
ctx->Debug.DebugOutput = GL_TRUE;
}
See valgrind output below, and attached testcase. The testcase uses SDL 2.0.1.
$ gcc /tmp/bug.c `sdl2-config --cflags --libs`
$ valgrind ./a.out
==29028== Memcheck, a memory error detector
==29028== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==29028== Using Valgrind-3.9.0 and LibVEX; rerun with -h for copyright info
==29028== Command: ./a.out
==29028==
Move your mouse now to generate some events
==29028== Invalid write of size 1
==29028== at 0x53A8570: driCreateContextAttribs (dri_util.c:446)
==29028== by 0x3067840357: ??? (in
/usr/lib/mesa-diverted/x86_64-linux-gnu/libGL.so.1.2.0)
==29028== by 0x3067818461: ??? (in
/usr/lib/mesa-diverted/x86_64-linux-gnu/libGL.so.1.2.0)
==29028== by 0x4CFA37D: X11_GL_CreateContext (in
/usr/lib/x86_64-linux-gnu/libSDL2-2.0.so.0.1.0)
==29028== by 0x4CEF2AF: SDL_GL_CreateContext (in
/usr/lib/x86_64-linux-gnu/libSDL2-2.0.so.0.1.0)
==29028== by 0x400A50: test_window (in
/home/edwin/HDD/me/language/OpenGL/tgls-arcsynthesis/a.out)
==29028== by 0x400ACC: main (in
/home/edwin/HDD/me/language/OpenGL/tgls-arcsynthesis/a.out)
==29028== Address 0x530f701 is 52,753 bytes inside a block of size 65,536
free'd
==29028== at 0x4A0870C: free (vg_replace_malloc.c:468)
==29028== by 0x56FD463: r600_sb::sb_pool::free_all() (sb_valtable.cpp:313)
==29028== by 0x56F6291: r600_sb::shader::~shader() (sb_ir.h:89)
==29028== by 0x56D97DC: r600_sb_bytecode_process (sb_core.cpp:285)
==29028== by 0x56B237E: r600_pipe_shader_create (r600_shader.c:152)
==29028== by 0x56C4F54: r600_shader_select (r600_state_common.c:746)
==29028== by 0x56C510F: r600_create_shader_state (r600_state_common.c:793)
==29028== by 0x55D0AAE: ureg_create_shader (tgsi_ureg.c:1704)
==29028== by 0x55FDE6C: util_make_empty_fragment_shader (tgsi_ureg.h:138)
==29028== by 0x55DE91C: util_blitter_create (u_blitter.c:281)
==29028== by 0x56A3E01: r600_create_context (r600_pipe.c:316)
==29028== by 0x54DE4F1: st_api_create_context (st_manager.c:615)
$ uname -a
Linux debian 3.12.8 #39 SMP PREEMPT Thu Jan 16 10:06:30 EET 2014 x86_64
GNU/Linux
$ glxinfo | grep OpenGL
OpenGL vendor string: X.Org
OpenGL renderer string: Gallium 0.4 on AMD RV730
OpenGL core profile version string: 3.1 (Core Profile) Mesa 10.0.1
OpenGL core profile shading language version string: 1.40
OpenGL core profile context flags: (none)
OpenGL core profile extensions:
OpenGL version string: 3.0 Mesa 10.0.1
OpenGL shading language version string: 1.30
OpenGL context flags: (none)
Note: if at first you can't reproduce it, make sure the window is receiving
some events (I guess its more about memory being allocated than the events
themselves), and try to use my command-line above exactly as is.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>