[Bug 92751] Segmentation Fault in sna_put_zpixmap_blt (X server crash)

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=92751

--- Comment #6 from Chris Wilson <chris at chris-wilson.co.uk> ---
That looks to be a different bug, whilst it may cause sufficient corruption to
result in the earlier assertion failure, it would have died with the second
assertion beforehand.

commit af680486608686ade375f5737bff556343366230
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Thu Nov 5 16:54:36 2015 +0000

    sna/dri2: Update TearFree recursion prevention

    Some time past, we switched to a seperate boolean to mark when the
    shadow is no longer accessible due to recursion - but I missed an
    important check inside the vblank handler.

    Reported-by: Joe Peterson <joe at wildlava.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92751#c5
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

The first assertion is consistent with the segfault. But what is surprising is
that we didn't hit an earlier assertion, so the list is being corrupted during
later processing (i.e. something akin to a use-after-free).

As for gdb not helping, the process exited before gdb prompted. Seems like
FatalError() no longer causes a gdb trap, so add a breakpoint on FatalError
instead.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/intel-gfx-bugs/attachments/20151105/e514fd4d/attachment.html>