[Bug 81694] New: glxpixmap hangs Xwayland on exit with dri3

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=81694

          Priority: medium
            Bug ID: 81694
          Assignee: idr at freedesktop.org
           Summary: glxpixmap hangs Xwayland on exit with dri3
        QA Contact: intel-3d-bugs at lists.freedesktop.org
          Severity: normal
    Classification: Unclassified
                OS: All
          Reporter: stu_dby at 126.com
          Hardware: Other
            Status: NEW
           Version: 10.2
         Component: Drivers/DRI/i965
           Product: Mesa

Xwayland now uses dri3 and glamor as means of acceleration. However, glxpixmap
(uses indirect rendering context) shows it uses software rasterization on intel
hardware:
GL_RENDERER = Gallium 0.4 on llvmpipe (LLVM 3.4, 256 bits)

Moreover, Xwayland will crash when glxpixmap exits (backtrace is listed at the
end). It segfaults in st_renderbuffer_delete in
src/mesa/state_tracker/st_cb_fbo.c where
      struct st_context *st = st_context(ctx);
      pipe_surface_release(st->pipe, &strb->surface);
st on the first line is NULL and it is dereferenced on the second line.

It can't be reproduced with vmglfx since it lacks support for dri3. But I
didn't test nouveau or radeon because I lack such hardware.

Software
Xwayland (xorg-server) 1.16.0
mesa 10.2.3

Hardware
Intel HD 4000
00:02.0 VGA compatible controller [0300]: Intel Corporation 3rd Gen Core
processor Graphics Controller [8086:0166] (rev 09) (prog-if 00 [VGA
controller])
    Subsystem: Lenovo Device [17aa:5018]

Xwayland backtrace:
Program received signal SIGSEGV, Segmentation fault.
0x00007fb353a72107 in st_renderbuffer_delete (ctx=0x7fb35dc3f040, rb=0x253a8d0)
    at state_tracker/st_cb_fbo.c:240
240          pipe_surface_release(st->pipe, &strb->surface);
(gdb) print st
$1 = (struct st_context *) 0x0
(gdb) bt
#0  0x00007fb353a72107 in st_renderbuffer_delete (ctx=0x7fb35dc3f040, 
    rb=0x253a8d0) at state_tracker/st_cb_fbo.c:240
#1  0x00007fb3539b68db in _mesa_reference_renderbuffer_ (ptr=0x253a570, rb=0x0)
    at main/renderbuffer.c:165
#2  0x00007fb3539545cc in _mesa_reference_renderbuffer (ptr=0x253a570, rb=0x0)
    at main/renderbuffer.h:66
#3  0x00007fb353954b3b in _mesa_free_framebuffer_data (fb=0x253a450)
    at main/framebuffer.c:221
#4  0x00007fb353954a60 in _mesa_destroy_framebuffer (fb=0x253a450)
    at main/framebuffer.c:197
#5  0x00007fb353954c7a in _mesa_reference_framebuffer_ (ptr=0x24fc440, fb=0x0)
    at main/framebuffer.c:254
#6  0x00007fb3538ed328 in _mesa_reference_framebuffer (ptr=0x24fc440, fb=0x0)
    at main/framebuffer.h:63
#7  0x00007fb3538ef43d in _mesa_free_context_data (ctx=0x24fc350)
    at main/context.c:1209
#8  0x00007fb353a7be22 in st_destroy_context (st=0x2531520)
    at state_tracker/st_context.c:330
#9  0x00007fb353a98c89 in st_context_destroy (stctxi=0x2531520)
    at state_tracker/st_manager.c:619
#10 0x00007fb353875eaa in dri_destroy_context (cPriv=0x1a69420)
    at dri_context.c:192
#11 0x00007fb353871d10 in driDestroyContext (pcp=0x1a69420)
---Type <return> to continue, or q <return> to quit---
    at ../../../../src/mesa/drivers/dri/common/dri_util.c:487
#12 0x00000000004c4162 in __glXDRIcontextDestroy (baseContext=0x1a69370)
    at glxdriswrast.c:135
#13 0x00000000004c3abc in __glXFreeContext (cx=0x7fb35dc3f040) at glxext.c:209
#14 0x00000000004c3b9e in ContextGone (cx=<optimized out>, id=<optimized out>)
    at glxext.c:101
#15 0x0000000000583959 in doFreeResource (res=0x2538f80, skip=0)
    at resource.c:873
#16 0x000000000058482d in FreeClientResources (client=0x7fb35dc3f040, 
    client at entry=0x1a68320) at resource.c:1139
#17 0x000000000056391a in CloseDownClient (client=0x1a68320) at dispatch.c:3384
#18 0x0000000000563a4a in ProcKillClient (client=0x2461e60) at dispatch.c:3190
#19 0x0000000000563f93 in Dispatch () at dispatch.c:432
#20 0x0000000000567891 in dix_main (argc=10, argv=0x7fff1d029198, 
    envp=<optimized out>) at main.c:296
#21 0x00000000005542ac in main (argc=<optimized out>, argv=<optimized out>, 
    envp=<optimized out>) at stubmain.c:34

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/intel-3d-bugs/attachments/20140724/5593b781/attachment.html>