[Mesa-dev] [PATCH] mesa: use array object constructor

[Marek Olšák]

Hi,

this patch causes a crash in piglit/vao-element-array-buffer.

Valgrind log:

==28635== Invalid read of size 4
==28635==    at 0x4446D87: pthread_mutex_lock (pthread_mutex_lock.c:50)
==28635==    by 0x4A0ACAC: _mesa_free_context_data (context.c:1121)
==28635==    by 0x4A8EC22: st_destroy_context (st_context.c:276)
==28635==    by 0x49F84FC: st_context_destroy (st_manager.c:596)
==28635==    by 0x49E4CFA: dri_destroy_context (dri_context.c:174)
==28635==    by 0x49B5B79: driDestroyContext (dri_util.c:301)
==28635==    by 0x40706B9: dri2_destroy_context (dri2_glx.c:132)
==28635==    by 0x4049D17: glx_display_free (glxext.c:228)
==28635==    by 0x4049D9E: __glXCloseDisplay (glxext.c:275)
==28635==    by 0x40F5142: XCloseDisplay (in
/usr/lib/i386-linux-gnu/libX11.so.6.3.0)
==28635==    by 0x40BF692: fgDeinitialize (in /usr/lib/libglut.so.3.9.0)
==28635==    by 0x40C2996: glutMainLoop (in /usr/lib/libglut.so.3.9.0)
==28635==  Address 0x46effdc is 20 bytes inside a block of size 1,504 free'd
==28635==    at 0x4027C02: free (vg_replace_malloc.c:366)
==28635==    by 0x4B1B70E: _mesa_delete_array_object (arrayobj.c:120)
==28635==    by 0x4A84543: delete_arrayobj_cb (varray.c:1241)
==28635==    by 0x4A3A7CF: _mesa_HashDeleteAll (hash.c:295)
==28635==    by 0x4A86F35: _mesa_free_varray_data (varray.c:1251)
==28635==    by 0x4A0AC8A: _mesa_free_context_data (context.c:1118)
==28635==    by 0x4A8EC22: st_destroy_context (st_context.c:276)
==28635==    by 0x49F84FC: st_context_destroy (st_manager.c:596)
==28635==    by 0x49E4CFA: dri_destroy_context (dri_context.c:174)
==28635==    by 0x49B5B79: driDestroyContext (dri_util.c:301)
==28635==    by 0x40706B9: dri2_destroy_context (dri2_glx.c:132)
==28635==    by 0x4049D17: glx_display_free (glxext.c:228)
==28635==
==28635== Invalid read of size 4
==28635==    at 0x444261A: __pthread_mutex_lock_full (pthread_mutex_lock.c:139)
==28635==    by 0x4A0ACAC: _mesa_free_context_data (context.c:1121)
==28635==    by 0x4A8EC22: st_destroy_context (st_context.c:276)
==28635==    by 0x49F84FC: st_context_destroy (st_manager.c:596)
==28635==    by 0x49E4CFA: dri_destroy_context (dri_context.c:174)
==28635==    by 0x49B5B79: driDestroyContext (dri_util.c:301)
==28635==    by 0x40706B9: dri2_destroy_context (dri2_glx.c:132)
==28635==    by 0x4049D17: glx_display_free (glxext.c:228)
==28635==    by 0x4049D9E: __glXCloseDisplay (glxext.c:275)
==28635==    by 0x40F5142: XCloseDisplay (in
/usr/lib/i386-linux-gnu/libX11.so.6.3.0)
==28635==    by 0x40BF692: fgDeinitialize (in /usr/lib/libglut.so.3.9.0)
==28635==    by 0x40C2996: glutMainLoop (in /usr/lib/libglut.so.3.9.0)
==28635==  Address 0x46effdc is 20 bytes inside a block of size 1,504 free'd
==28635==    at 0x4027C02: free (vg_replace_malloc.c:366)
==28635==    by 0x4B1B70E: _mesa_delete_array_object (arrayobj.c:120)
==28635==    by 0x4A84543: delete_arrayobj_cb (varray.c:1241)
==28635==    by 0x4A3A7CF: _mesa_HashDeleteAll (hash.c:295)
==28635==    by 0x4A86F35: _mesa_free_varray_data (varray.c:1251)
==28635==    by 0x4A0AC8A: _mesa_free_context_data (context.c:1118)
==28635==    by 0x4A8EC22: st_destroy_context (st_context.c:276)
==28635==    by 0x49F84FC: st_context_destroy (st_manager.c:596)
==28635==    by 0x49E4CFA: dri_destroy_context (dri_context.c:174)
==28635==    by 0x49B5B79: driDestroyContext (dri_util.c:301)
==28635==    by 0x40706B9: dri2_destroy_context (dri2_glx.c:132)
==28635==    by 0x4049D17: glx_display_free (glxext.c:228)
==28635==
==28635== Invalid read of size 4
==28635==    at 0x4B1B758: _mesa_reference_array_object (arrayobj.c:142)
==28635==    by 0x4A0ACAC: _mesa_free_context_data (context.c:1121)
==28635==    by 0x4A8EC22: st_destroy_context (st_context.c:276)
==28635==    by 0x49F84FC: st_context_destroy (st_manager.c:596)
==28635==    by 0x49E4CFA: dri_destroy_context (dri_context.c:174)
==28635==    by 0x49B5B79: driDestroyContext (dri_util.c:301)
==28635==    by 0x40706B9: dri2_destroy_context (dri2_glx.c:132)
==28635==    by 0x4049D17: glx_display_free (glxext.c:228)
==28635==    by 0x4049D9E: __glXCloseDisplay (glxext.c:275)
==28635==    by 0x40F5142: XCloseDisplay (in
/usr/lib/i386-linux-gnu/libX11.so.6.3.0)
==28635==    by 0x40BF692: fgDeinitialize (in /usr/lib/libglut.so.3.9.0)
==28635==    by 0x40C2996: glutMainLoop (in /usr/lib/libglut.so.3.9.0)
==28635==  Address 0x46effcc is 4 bytes inside a block of size 1,504 free'd
==28635==    at 0x4027C02: free (vg_replace_malloc.c:366)
==28635==    by 0x4B1B70E: _mesa_delete_array_object (arrayobj.c:120)
==28635==    by 0x4A84543: delete_arrayobj_cb (varray.c:1241)
==28635==    by 0x4A3A7CF: _mesa_HashDeleteAll (hash.c:295)
==28635==    by 0x4A86F35: _mesa_free_varray_data (varray.c:1251)
==28635==    by 0x4A0AC8A: _mesa_free_context_data (context.c:1118)
==28635==    by 0x4A8EC22: st_destroy_context (st_context.c:276)
==28635==    by 0x49F84FC: st_context_destroy (st_manager.c:596)
==28635==    by 0x49E4CFA: dri_destroy_context (dri_context.c:174)
==28635==    by 0x49B5B79: driDestroyContext (dri_util.c:301)
==28635==    by 0x40706B9: dri2_destroy_context (dri2_glx.c:132)
==28635==    by 0x4049D17: glx_display_free (glxext.c:228)
==28635==
==28635== Invalid write of size 4
==28635==    at 0x4B1B75E: _mesa_reference_array_object (arrayobj.c:142)
==28635==    by 0x4A0ACAC: _mesa_free_context_data (context.c:1121)
==28635==    by 0x4A8EC22: st_destroy_context (st_context.c:276)
==28635==    by 0x49F84FC: st_context_destroy (st_manager.c:596)
==28635==    by 0x49E4CFA: dri_destroy_context (dri_context.c:174)
==28635==    by 0x49B5B79: driDestroyContext (dri_util.c:301)
==28635==    by 0x40706B9: dri2_destroy_context (dri2_glx.c:132)
==28635==    by 0x4049D17: glx_display_free (glxext.c:228)
==28635==    by 0x4049D9E: __glXCloseDisplay (glxext.c:275)
==28635==    by 0x40F5142: XCloseDisplay (in
/usr/lib/i386-linux-gnu/libX11.so.6.3.0)
==28635==    by 0x40BF692: fgDeinitialize (in /usr/lib/libglut.so.3.9.0)
==28635==    by 0x40C2996: glutMainLoop (in /usr/lib/libglut.so.3.9.0)
==28635==  Address 0x46effcc is 4 bytes inside a block of size 1,504 free'd
==28635==    at 0x4027C02: free (vg_replace_malloc.c:366)
==28635==    by 0x4B1B70E: _mesa_delete_array_object (arrayobj.c:120)
==28635==    by 0x4A84543: delete_arrayobj_cb (varray.c:1241)
==28635==    by 0x4A3A7CF: _mesa_HashDeleteAll (hash.c:295)
==28635==    by 0x4A86F35: _mesa_free_varray_data (varray.c:1251)
==28635==    by 0x4A0AC8A: _mesa_free_context_data (context.c:1118)
==28635==    by 0x4A8EC22: st_destroy_context (st_context.c:276)
==28635==    by 0x49F84FC: st_context_destroy (st_manager.c:596)
==28635==    by 0x49E4CFA: dri_destroy_context (dri_context.c:174)
==28635==    by 0x49B5B79: driDestroyContext (dri_util.c:301)
==28635==    by 0x40706B9: dri2_destroy_context (dri2_glx.c:132)
==28635==    by 0x4049D17: glx_display_free (glxext.c:228)
==28635==
==28635== Invalid read of size 4
==28635==    at 0x4447D11: __pthread_mutex_unlock_usercnt
(pthread_mutex_unlock.c:37)
==28635==    by 0x4A0ACAC: _mesa_free_context_data (context.c:1121)
==28635==    by 0x4A8EC22: st_destroy_context (st_context.c:276)
==28635==    by 0x49F84FC: st_context_destroy (st_manager.c:596)
==28635==    by 0x49E4CFA: dri_destroy_context (dri_context.c:174)
==28635==    by 0x49B5B79: driDestroyContext (dri_util.c:301)
==28635==    by 0x40706B9: dri2_destroy_context (dri2_glx.c:132)
==28635==    by 0x4049D17: glx_display_free (glxext.c:228)
==28635==    by 0x4049D9E: __glXCloseDisplay (glxext.c:275)
==28635==    by 0x40F5142: XCloseDisplay (in
/usr/lib/i386-linux-gnu/libX11.so.6.3.0)
==28635==    by 0x40BF692: fgDeinitialize (in /usr/lib/libglut.so.3.9.0)
==28635==    by 0x40C2996: glutMainLoop (in /usr/lib/libglut.so.3.9.0)
==28635==  Address 0x46effdc is 20 bytes inside a block of size 1,504 free'd
==28635==    at 0x4027C02: free (vg_replace_malloc.c:366)
==28635==    by 0x4B1B70E: _mesa_delete_array_object (arrayobj.c:120)
==28635==    by 0x4A84543: delete_arrayobj_cb (varray.c:1241)
==28635==    by 0x4A3A7CF: _mesa_HashDeleteAll (hash.c:295)
==28635==    by 0x4A86F35: _mesa_free_varray_data (varray.c:1251)
==28635==    by 0x4A0AC8A: _mesa_free_context_data (context.c:1118)
==28635==    by 0x4A8EC22: st_destroy_context (st_context.c:276)
==28635==    by 0x49F84FC: st_context_destroy (st_manager.c:596)
==28635==    by 0x49E4CFA: dri_destroy_context (dri_context.c:174)
==28635==    by 0x49B5B79: driDestroyContext (dri_util.c:301)
==28635==    by 0x40706B9: dri2_destroy_context (dri2_glx.c:132)
==28635==    by 0x4049D17: glx_display_free (glxext.c:228)
==28635==
==28635== Invalid read of size 4
==28635==    at 0x4442B2A: __pthread_mutex_unlock_full
(pthread_mutex_unlock.c:86)
==28635==    by 0x4A0ACAC: _mesa_free_context_data (context.c:1121)
==28635==    by 0x4A8EC22: st_destroy_context (st_context.c:276)
==28635==    by 0x49F84FC: st_context_destroy (st_manager.c:596)
==28635==    by 0x49E4CFA: dri_destroy_context (dri_context.c:174)
==28635==    by 0x49B5B79: driDestroyContext (dri_util.c:301)
==28635==    by 0x40706B9: dri2_destroy_context (dri2_glx.c:132)
==28635==    by 0x4049D17: glx_display_free (glxext.c:228)
==28635==    by 0x4049D9E: __glXCloseDisplay (glxext.c:275)
==28635==    by 0x40F5142: XCloseDisplay (in
/usr/lib/i386-linux-gnu/libX11.so.6.3.0)
==28635==    by 0x40BF692: fgDeinitialize (in /usr/lib/libglut.so.3.9.0)
==28635==    by 0x40C2996: glutMainLoop (in /usr/lib/libglut.so.3.9.0)
==28635==  Address 0x46effdc is 20 bytes inside a block of size 1,504 free'd
==28635==    at 0x4027C02: free (vg_replace_malloc.c:366)
==28635==    by 0x4B1B70E: _mesa_delete_array_object (arrayobj.c:120)
==28635==    by 0x4A84543: delete_arrayobj_cb (varray.c:1241)
==28635==    by 0x4A3A7CF: _mesa_HashDeleteAll (hash.c:295)
==28635==    by 0x4A86F35: _mesa_free_varray_data (varray.c:1251)
==28635==    by 0x4A0AC8A: _mesa_free_context_data (context.c:1118)
==28635==    by 0x4A8EC22: st_destroy_context (st_context.c:276)
==28635==    by 0x49F84FC: st_context_destroy (st_manager.c:596)
==28635==    by 0x49E4CFA: dri_destroy_context (dri_context.c:174)
==28635==    by 0x49B5B79: driDestroyContext (dri_util.c:301)
==28635==    by 0x40706B9: dri2_destroy_context (dri2_glx.c:132)
==28635==    by 0x4049D17: glx_display_free (glxext.c:228)

Marek

On Wed, Apr 18, 2012 at 7:28 PM, Mathias Fröhlich
<Mathias.Froehlich at gmx.net> wrote:
>
> Hi,
>
> The attached change uses the array object factory for gl_array_objects. This
> prevents crashes when deriving from gl_array_object.
> The change should be orthogonal to Mareks posted changes.
>
> Please Review.
>
> Thanks
>
> Mathias
> _______________________________________________
> mesa-dev mailing list
> mesa-dev at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/mesa-dev
>