[Bug 84327] New: crash in gnome-shell when typing in the app view

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=84327

          Priority: medium
            Bug ID: 84327
          Assignee: dri-devel at lists.freedesktop.org
           Summary: crash in gnome-shell when typing in the app view
          Severity: normal
    Classification: Unclassified
                OS: All
          Reporter: rstrode at redhat.com
          Hardware: Other
            Status: NEW
           Version: unspecified
         Component: Drivers/Gallium/r300
           Product: Mesa

in gnome-shell 3.14.0 (with mutter 3.14.0) any time i type in the overview it
crashes.  valgrind reports this:



    ==6970== Thread 1:
    ==6970== Invalid read of size 4
    ==6970==    at 0x228163E9: UnknownInlinedFun (register_allocate.c:524)
    ==6970==    by 0x228163E9: ra_allocate (register_allocate.c:555)
    ==6970==    by 0x22AF000F: do_advanced_regalloc
(radeon_pair_regalloc.c:620)
    ==6970==    by 0x22AF000F: rc_pair_regalloc (radeon_pair_regalloc.c:776)
    ==6970==    by 0x22AE417B: rc_run_compiler_passes (radeon_compiler.c:465)
    ==6970==    by 0x22AE4224: rc_run_compiler (radeon_compiler.c:491)
    ==6970==    by 0x22AF69B3: r3xx_compile_fragment_program
(r3xx_fragprog.c:153)
    ==6970==    by 0x22AD03AF: r300_translate_fragment_shader (r300_fs.c:519)
    ==6970==    by 0x22AD1439: r300_pick_fragment_shader (r300_fs.c:597)
    ==6970==    by 0x22ADC5F2: r300_validate_fragment_shader
(r300_state_derived.c:1048)
    ==6970==    by 0x22ADC5F2: r300_update_derived_state
(r300_state_derived.c:1075)
    ==6970==    by 0x22AD3476: r300_draw_vbo (r300_render.c:794)
    ==6970==    by 0x22926B74: u_vbuf_draw_vbo (u_vbuf.c:1148)
    ==6970==    by 0x227DCD5E: st_draw_vbo (st_draw.c:285)
    ==6970==    by 0x227AF16D: vbo_draw_arrays (vbo_exec_array.c:667)
    ==6970==  Address 0x45864d64 is 18,532 bytes inside an unallocated block of
size 20,144 in arena "client"
    ==6970==
    gnome-shell: compiler/radeon_variable.c:61: rc_variable_change_dst:
Assertion `new_writemask & 8' failed.

COGL_DEBUG=show-source writes this to the console just before the crash:

Cogl-Message: fragment shader:
#version 120

#ifdef GL_ES
precision highp float;
#endif
#define COGL_VERSION 100

uniform mat4 cogl_modelview_matrix;
uniform mat4 cogl_modelview_projection_matrix;
uniform mat4 cogl_projection_matrix;

varying vec4 _cogl_color;

#define cogl_color_in _cogl_color
#define cogl_tex_coord_in _cogl_tex_coord

#define cogl_color_out gl_FragColor
#define cogl_depth_out gl_FragDepth

#define cogl_front_facing gl_FrontFacing

#define cogl_point_coord gl_PointCoord
varying vec4 _cogl_tex_coord[1];
#define cogl_tex_coord0_in _cogl_tex_coord[0]
/*
 * st-scroll-view-fade.glsl: Edge fade effect for StScrollView
 *
 * Copyright 2010 Intel Corporation.
 * Copyright 2011 Adel Gadllah
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms and conditions of the GNU Lesser General Public License,
 * version 2.1, as published by the Free Software Foundation.
 *
 * This program is distributed in the hope it will be useful, but WITHOUT ANY
 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 * FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for
 * more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */

uniform sampler2D tex;
uniform float height;
uniform float width;
uniform float vfade_offset;
uniform float hfade_offset;
uniform bool  fade_edges_top;
uniform bool  fade_edges_right;
uniform bool  fade_edges_bottom;
uniform bool  fade_edges_left;

uniform vec2 fade_area_topleft;
uniform vec2 fade_area_bottomright;

void main ()
{
    cogl_color_out = cogl_color_in * texture2D (tex, vec2
(cogl_tex_coord_in[0].xy));

    float y = height * cogl_tex_coord_in[0].y;
    float x = width * cogl_tex_coord_in[0].x;

    /*
     * We cannot just return here due to a bug in llvmpipe see:
     * https://bugzilla.freedesktop.org/show_bug.cgi?id=62357
     */
    if (x > fade_area_topleft[0] && x < fade_area_bottomright[0] &&
        y > fade_area_topleft[1] && y < fade_area_bottomright[1]) {
        float ratio = 1.0;
        float fade_bottom_start = fade_area_bottomright[1] - vfade_offset;
        float fade_right_start = fade_area_bottomright[0] - hfade_offset;
        bool fade_top = y < vfade_offset && fade_edges_top;
        bool fade_bottom = y > fade_bottom_start && fade_edges_bottom;
        bool fade_left = x < hfade_offset && fade_edges_left;
        bool fade_right = x > fade_right_start && fade_edges_right;

        float vfade_scale = height / vfade_offset;
        if (fade_top) {
            ratio *= y / vfade_offset;
        }

        if (fade_bottom) {
            ratio *= (fade_area_bottomright[1] - y) / (fade_area_bottomright[1]
- fade_bottom_start);
        }

        float hfade_scale = width / hfade_offset;
        if (fade_left) {
            ratio *= x / hfade_offset;
        }

        if (fade_right) {
            ratio *= (fade_area_bottomright[0] - x) / (fade_area_bottomright[0]
- fade_right_start);
        }

        cogl_color_out *= ratio;
    }
}

Segmentation fault (core dumped)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20140925/f510811c/attachment.html>