<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - crash in intel_miptree_create_for_dri_image due to invalid bo"
href="https://bugs.freedesktop.org/show_bug.cgi?id=104579">104579</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>crash in intel_miptree_create_for_dri_image due to invalid bo
</td>
</tr>
<tr>
<th>Product</th>
<td>Mesa
</td>
</tr>
<tr>
<th>Version</th>
<td>17.3
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>Drivers/DRI/i965
</td>
</tr>
<tr>
<th>Assignee</th>
<td>intel-3d-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>freedesktop@pkh.me
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>intel-3d-bugs@lists.freedesktop.org
</td>
</tr></table>
<p>
<div>
<pre>Running openra (20171014, mono5+SDL+OpenGL) under i3-wm and switching
workspaces 3-4 times quickly leads to a crash in the i965 code:
Thread 1 (Thread 0x7fb469096780 (LWP 25267)):
#0 0x00007fb468557697 in waitpid () from /usr/lib/libpthread.so.0
#1 0x000055bd82cc9ff0 in mono_handle_native_crash (signal=<optimized out>,
signal@entry=0x55bd82ec6333 "SIGSEGV", ctx=ctx@entry=0x7ffc61d9bd40,
info=info@entry=0x7ffc61d9be70) at mini-exceptions.c:2567
#2 0x000055bd82c3fee5 in mono_sigsegv_signal_handler (_dummy=11,
_info=0x7ffc61d9be70, context=0x7ffc61d9bd40) at mini-runtime.c:2868
#3 <signal handler called>
#4 brw_bo_get_tiling (bo=bo@entry=0x51,
tiling_mode=tiling_mode@entry=0x7ffc61d9c2f8,
swizzle_mode=swizzle_mode@entry=0x7ffc61d9c2fc) at brw_bufmgr.c:1104
#5 0x00007fb45b2198fa in intel_miptree_create_for_bo
(brw=brw@entry=0x55bd84d997e0, bo=0x51,
format=format@entry=MESA_FORMAT_B8G8R8X8_UNORM, offset=0, width=80, height=0,
depth=1, pitch=-1979489440, flags=MIPTREE_CREATE_DEFAULT) at
intel_mipmap_tree.c:850
#6 0x00007fb45b219b5a in intel_miptree_create_for_dri_image
(brw=brw@entry=0x55bd84d997e0, image=image@entry=0x55bd89c890d0,
target=target@entry=3553, format=MESA_FORMAT_B8G8R8X8_UNORM,
is_winsys_image=is_winsys_image@entry=true) at intel_mipmap_tree.c:1039
#7 0x00007fb45b1ee5c5 in intel_update_image_buffer
(intel=intel@entry=0x55bd84d997e0, rb=rb@entry=0x55bd84f4e2c0,
buffer=0x55bd89c890d0, buffer_type=buffer_type@entry=__DRI_IMAGE_BUFFER_BACK,
drawable=<optimized out>) at brw_context.c:1632
#8 0x00007fb45b1f1242 in intel_update_image_buffers (drawable=0x55bd84f3fea0,
brw=0x55bd84d997e0) at brw_context.c:1703
#9 intel_update_renderbuffers (context=context@entry=0x55bd84dc6870,
drawable=drawable@entry=0x55bd84f3fea0) at brw_context.c:1361
#10 0x00007fb45b1f1531 in intel_prepare_render (brw=brw@entry=0x55bd84d997e0)
at brw_context.c:1382
#11 0x00007fb45b1ecdee in brw_clear (ctx=0x55bd84d997e0, mask=18) at
brw_clear.c:278
Commenting out the GL.Clear() call in OpenRA leads to a similar crash somewhere
else (typically from GL draw primitives).
In the backtrace, the pointer to bo looks pretty much invalid (0x51), leading
to a crash in brw_bo_get_tiling when dereferencing it.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>