https://bugs.freedesktop.org/show_bug.cgi?id=39193

Summary: glCheckFramebufferStatusEXT segfaults in Gallium when checking status on a framebuffer bound to a texture that's bound to a pixmap Product: Mesa Version: unspecified Platform: x86 (IA32) OS/Version: Linux (All) Status: NEW Severity: normal Priority: medium Component: Drivers/Gallium/r600 AssignedTo: dri-devel@lists.freedesktop.org ReportedBy: simon.farnsworth@onelan.co.uk

Created an attachment (id=49039) --> (https://bugs.freedesktop.org/attachment.cgi?id=49039) Test program demonstrating the crash

In our OpenGL compositor, we double-buffer some windows by using GL_EXT_framebuffer_object and glTexCopyImage to copy the window backing pixmap to a new texture.

This crashes on r600g (but not Intel DRI) drivers, in Gallium's implementation of glCheckFramebufferStatusEXT due to a NULL deference.

I've attached a program that demonstrates the crash, using a scratch pixmap created by the program instead of a window backing store pixmap created by XComposite. It's built with:

gcc -O2 -ggdb -Wall -Werror -o framebuffertexturetest framebuffertexturetest.c -lX11 -lGL -lGLEW -lGLU

When I run this against git versions of Mesa, I get the following backtrace (via gdb):

(gdb) t a a bt full

Thread 1 (Thread 0xb7a1e6d0 (LWP 971)): #0 0xb771a9b4 in st_validate_attachment (ctx=0x8162248, screen=0x8063968, att=0x81aabd8, bindings=2) at state_tracker/st_cb_fbo.c:472 stObj = 0x81aa4b8 format = <optimized out> texFormat = <optimized out> #1 0xb771ab6a in st_validate_framebuffer (ctx=0x8162248, fb=0x81aa9f8) at state_tracker/st_cb_fbo.c:570 att = 0x81aabd8 format = <optimized out> screen = 0x8063968 depth = 0x81aab68 stencil = 0x81aab84 i = <optimized out> first_format = <optimized out> mixed_formats = 1 '\001' #2 0xb76be381 in _mesa_test_framebuffer_completeness (ctx=0x8162248, fb=0x81aa9f8) at main/fbobject.c:866 numImages = <optimized out> intFormat = <optimized out> minWidth = <optimized out> minHeight = <optimized out> maxWidth = <optimized out> maxHeight = <optimized out> numSamples = <optimized out> i = <optimized out> j = <optimized out> __PRETTY_FUNCTION__ = "_mesa_test_framebuffer_completeness" #3 0xb76bff48 in _mesa_CheckFramebufferStatusEXT (target=36160) at main/fbobject.c:1850 buffer = 0x81aa9f8 ctx = 0x8162248 #4 0xb7e6d6e8 in glCheckFramebufferStatusEXT (target=36160) at ../../../src/mapi/glapi/glapitemp.h:5728 No locals. #5 0x08049a2f in render_to_texture (target_texture=1) at framebuffertexturetest.c:151 framebuffer = 1 value = <optimized out> pixmapAttribs = {8406, 8412, 8405, 8410, 0} glx_pixmap = 2097159 gc = <optimized out> attrib = {x = 0, y = 0, width = 1920, height = 1200, border_width = 0, depth = 24, visual = 0x8056ab8, root = 343, class = 1, bit_gravity = 0, win_gravity = 1, backing_store = 0, backing_planes = 4294967295, backing_pixel = 0, save_under = 0, colormap = 2097153, map_installed = 0, map_state = 2, all_event_masks = 0, your_event_mask = 0, do_not_propagate_mask = 0, override_redirect = 0, screen = 0x80566c8} visualid = 273 fbconfigs = 0x81a74f0 nfbconfigs = 144 status = <optimized out> bound_texture = 4 i = <optimized out> pixmap = 2097157 visinfo = <optimized out> #6 main (argc=1, argv=0xbffff6e4) at framebuffertexturetest.c:344 last_frame_time = <optimized out> start_time = <optimized out> ust = 577789755707940852 msc = <optimized out> draw_texture = 1

My X stack is using the following components from git; everything else is from Fedora 15, apart from the kernel, which is airlied's drm-fixes:

dri2proto: commit 7fd18b15646a62bd82a4eb0eca60a34c1731813d drm: commit 8d055890d90c3d92647e3d8b98d32630ef87c2c8 glproto: commit 6d7e398150dde1c15b7f62f485cb33bad8f4d5c6 libpciaccess: commit f9159b97834ba4b4e42a07953a33866e7ac90dbd mesa: commit 5fe5d236c26b3b2428bc7395304e40cf21d3d3e1 pixman: commit e814b50877bf313619fbf777dcab98d39874f8a4 randrproto: commit b5c977ad70b845c278ef52c004d9e5fc3ec97cbf xf86-input-evdev: commit 5069e053354ad6adfcbb08c962bff93b607dec3d xf86-video-ati: commit e8d0d437957b15252dfad775796a3949ed50dbcf xorg-font-util: commit 9f807dfb4e7bea7128b7538e41de78bb5994ca80 xorg-macros: commit 08dd5d30c137abe43d5b1673edc39eb569881d66 xproto: commit 06ebd5b88bee8c54222bde3178dc773776036802 xserver: commit 73c05be80a1d682ff623e66f47e87403d94caef5

I'm going to start digging, see if I can work out where my texture goes missing, but all advice would be gratefully received; my goal is to keep the pixmap GPU-side if possible, while copying its contents to a separate texture.