[Mesa-dev] segfault in pstip_bind_sampler_states

[Brian Paul]

On 08/07/2013 12:17 PM, Kevin H. Hobbs wrote:
> One of the VTK tests (vtkFiltersHybridPython-largeImageOffset) makes
> OSMesa segfault.
>
> This is the top of the gdb backtrace :
>
> #0  pstip_bind_sampler_states (pipe=<optimized out>, num=0, sampler=0x0)
> at draw/draw_pipe_pstipple.c:713
> #1  0x00007fffdf7580fc in cso_release_all (ctx=ctx at entry=0x15f1540) at
> cso_cache/cso_context.c:307
> #2  0x00007fffdf6aebad in st_destroy_context (st=0x15da330) at
> ../../src/mesa/state_tracker/st_context.c:287
> #3  0x00007fffdf888022 in OSMesaDestroyContext (osmesa=0x13622d0) at
> osmesa.c:583
> #4  0x00007fffdcc02c13 in
> vtkOSOpenGLRenderWindow::DestroyOffScreenWindow (this=0xec6770) at
> /home/kevin/kitware/VTK/Rendering/OpenGL/vtkOSOpenGLRenderWindow.cxx:226
>
> Do I interpret that as pstip_bind_sampler_states was sent a null pointer
> sampler?


Hmm, I'd expect memcpy() of length zero to be fine even if src/dst were 
null.

Can you try this patch?

diff --git a/src/gallium/auxiliary/draw/draw_pipe_pstipple.c 
b/src/gallium/auxil
index 51f5a86..623edb8 100644
--- a/src/gallium/auxiliary/draw/draw_pipe_pstipple.c
+++ b/src/gallium/auxiliary/draw/draw_pipe_pstipple.c
@@ -708,7 +708,8 @@ pstip_bind_sampler_states(struct pipe_context *pipe,
     uint i;

     /* save current */
-   memcpy(pstip->state.samplers, sampler, num * sizeof(void *));
+   if (num > 0)
+      memcpy(pstip->state.samplers, sampler, num * sizeof(void *));
     for (i = num; i < PIPE_MAX_SAMPLERS; i++) {
        pstip->state.samplers[i] = NULL;
     }


-Brian