[Spice-devel] Segmentation fault in alloc_drawable at red_worker.c:1437

[Chen Coolper]

Hi,
I got a segmentation fault of spice, spice version is 0.8, qemu version is
spice.v32.kvm.
The following is the detail information:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffaaadb700 (LWP 26633)]
0x00007ffff63520bb in alloc_drawable (worker=0x7fffaa9046a0)
    at red_worker.c:1437
1437    worker->free_drawables = worker->free_drawables->u.next;
(gdb) l
1432    Drawable *drawable;
1433    if (!worker->free_drawables) {
1434        return NULL;
1435    }
1436    drawable = &worker->free_drawables->u.drawable;
1437    worker->free_drawables = worker->free_drawables->u.next;
1438    return drawable;
1439 }
(gdb) p drawable
$6 = (Drawable *) 0x7fffaaad32a8ff
(gdb) p worker->free_drawables
$7 = (_Drawable *) 0x7fffaaad32a8ff
(gdb) p worker->free_drawables->u.drawable
Cannot access memory at address 0x7fffaaad32a8ff
(gdb) p worker
$8 = (RedWorker *) 0x7fffaa9046a0
(gdb) p &worker->drawables
$10 = (_Drawable (*)[1024]) 0x7fffaaa778d8    //I change NUM_DRAWABLES to
1024
(gdb) p &worker->drawables[1023]
$11 = (_Drawable *) 0x7fffaaad5760
(gdb) p sizeof(void *)
$18 = 8
(gdb) x/16bx 0x7fffaaad32a8
0x7fffaaad32a8: 0x28 0x40 0xa9 0xaa 0xff 0x7f 0x00 0x00
0x7fffaaad32b0: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
(gdb) x/16bx 0x7fffaaad32a0
0x7fffaaad32a0: 0xff 0xff 0xff 0xff 0xff 0xff 0xff 0xff
0x7fffaaad32a8: 0x28 0x40 0xa9 0xaa 0xff 0x7f 0x00 0x00
(gdb) p &worker->free_drawables
$19 = (_Drawable **) 0x7fffaaad58d8
(gdb) x/16bx 0x7fffaaad58d8
0x7fffaaad58d8: 0xff 0xa8 0x32 0xad 0xaa 0xff 0x7f 0x00
0x7fffaaad58e0: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

address 0x7fffaaad58d8 is in the worker->drawables array, but
0x7fffaaad32a8ff is not, why it has ff in the end?

--
Best Regards
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/spice-devel/attachments/20110331/17e3027c/attachment-0001.htm>