[Xcb] mesa +xcb = assertion death

[Jamey Sharp]

On Wed, 2005-05-04 at 17:52 -0400, Jeremy Kolb wrote:
> Jamey Sharp wrote: 
> >>* glx-mesa-xorg-6.8.99.5-noxcb-glxinfo.dump
> >>glxinfo on Xorg 6.8.99.5 running 'vesa' against normal xlibs.
> > 
> > Without the Nvidia bits, there's a different request sent where the
> > reply claims to be 112 bytes long, but appears to actually be 912 bytes
> > long. (This same thing showed up in the first trace you posted.)
> 
> Jamey I don't see anything here with a reply length of 20 (112 bytes). 
> Where is that?

In the above-referenced trace, it's the GLX reply for sequence number
12; the length field is 0x70... uh, I guess that's not 112 bytes, but
112 words, which means 448 bytes. Anyway, it's still not covering the
912 byte stream of data.

> > Presumably Mesa is ignoring the length field of the reply in both cases,
> > and there's some other length information in the vendor-private bits. (I
> > imagine you can confirm this by reading the relevant Mesa source.) I
> > believe you've found a bug in the X.org server-side GLX implementation,
> > where these replies are not having their length computed correctly. You
> > should file a bug report.
> 
> I'll check it out.

I'm just taking a moment to study glxext.c, which looks to me like the
code on the client side that's making both of the wacky requests, in
AllocAndFetchScreenConfigs. First thing I noticed is a double-unlock bug
in the case that a screen doesn't support GL rendering. I also suspect
that most of the error-handling code leaves the X protocol stream
unsynchronized, so that later chatter with the server would lose if
anything goes wrong in this function. (Needs some calls to _XEatData.)

It looks like the three kinds of requests supported by this function
(GLXVendorPrivateWithReply/GetFBConfigsSGIX, GLXGetFBConfigs, and
GLXGetVisualConfigs) all reply with a numProps and a numVisuals field,
and the number of words returned is something like numProps times
numVisuals (times 2, when not using GLXGetVisualConfigs). The length
field of the reply is never consulted. So that much of my hypothesis is
confirmed, at least.

Poor design. Ick. They should have just returned numVisuals, and let
numProps be implied.

--Jamey