[Mesa-dev] memory stomping/other error in a3ed98f7aa (gallium: new, unified pipe_context::set_sampler_views() function)

[Ilia Mirkin]

On Thu, Nov 28, 2013 at 4:38 AM, Ilia Mirkin <imirkin at alum.mit.edu> wrote:
> Hi Brian,
>
> I've just completed a bisect which pointed out a3ed98f7aa (gallium:
> new, unified pipe_context::set_sampler_views() function) as the bad
> commit.
>
> Starting with that commit, I see things like
>
> *** glibc detected *** glretrace: corrupted double-linked list:
> 0x00000000016632f0 ***
>
> but it can also be
>
> *** glibc detected *** glretrace: free(): invalid pointer:
> 0x0000000001cb0130 ***
>
> and also plain ol' segfaults. I'm on a nv98 card, using the nv50
> driver. I had to manually patch it with the equivalent of c1345720c866
> (except I just hard-coded it to 16) in order to avoid the assert.
> However I also get segfaults with llvmpipe. I'm using gcc-4.7.3 in
> case it matters.

BTW, it should be worth noting that llvmpipe does seem to work at HEAD
(although it fails reliably for me at the commit I mentioned). I can
do a "reverse" bisect to figure out when things got better for it, but
I'm guessing that things just got jumbled around s.t. the memory
stomping is no longer over a critical area.

>
> My reproducer is running glretrace on the portal.trace file that you
> can obtain from https://bugs.freedesktop.org/show_bug.cgi?id=64323#c1.
> I was not able to repro using random other traces I had sitting
> around, so I'm guessing something in that trace is triggering the
> erring functionality. The crashes always happen in
> dri_destroy_context/st_destroy_context, but that doesn't mean that
> trouble doesn't happen earlier on.
>
> Any ideas?
>
>   -ilia