https://bugs.freedesktop.org/show_bug.cgi?id=52574

Bug #: 52574 Summary: crash in memcpy_texture because of NULL dstAddr (gl_texture_image.Data) Classification: Unclassified Product: Mesa Version: 7.11 Platform: x86-64 (AMD64) OS/Version: FreeBSD Status: NEW Severity: major Priority: medium Component: Drivers/DRI/R600 AssignedTo: dri-devel@lists.freedesktop.org ReportedBy: avg@icyb.net.ua

Useful part of stack trace: (gdb) bt #0 0x0000000802e452f6 in memcpy () from /lib/libc.so.7 #1 0x0000000817fff011 in memcpy_texture (ctx=0x82c4a8000, dimensions=0, dstFormat=MESA_FORMAT_ARGB8888_REV, dstAddr=0x0, dstXoffset=0, dstYoffset=0, dstZoffset=0, dstRowStride=4352, dstImageOffsets=0x82b1d78c8, srcWidth=1056, srcHeight=33, srcDepth=1, srcFormat=32993, srcType=5121, srcAddr=0x83beff000, srcPacking=0x82c4b7690) at main/texstore.c:994 #2 0x00000008180082ca in _mesa_texstore_argb8888 (ctx=0x82c4a8000, dims=2, baseInternalFormat=6408, dstFormat=MESA_FORMAT_ARGB8888, dstAddr=0x0, dstXoffset=0, dstYoffset=0, dstZoffset=0, dstRowStride=4352, dstImageOffsets=0x82b1d78c8, srcWidth=1056, srcHeight=33, srcDepth=1, srcFormat=32993, srcType=5121, srcAddr=0x83beff000, srcPacking=0x82c4b7690) at main/texstore.c:1430 #3 0x00000008180091fb in _mesa_texstore (ctx=<optimized out>, dims=<optimized out>, baseInternalFormat=<optimized out>, dstFormat=<optimized out>, dstAddr=<optimized out>, dstXoffset=<optimized out>, dstYoffset=0, dstZoffset=0, dstRowStride=4352, dstImageOffsets=0x82b1d78c8, srcWidth=1056, srcHeight=33, srcDepth=1, srcFormat=32993, srcType=5121, srcAddr=0x83beff000, srcPacking=0x82c4b7690) at main/texstore.c:4478 #4 0x0000000817f8a4c7 in radeon_store_teximage (ctx=0x82c4a8000, dims=2, xoffset=0, yoffset=0, zoffset=0, width=1056, height=33, depth=1, imageSize=0, format=32993, type=5121, pixels=0x83beff000, packing=0x82c4b7690, texObj=0x844c11500, texImage=0x82ba98ec0, compressed=0) at radeon_texture.c:749 #5 0x0000000817f8ab1b in radeon_teximage (ctx=0x82c4a8000, dims=2, target=<optimized out>, level=0, internalFormat=<optimized out>, width=1056, height=33, depth=1, imageSize=0, format=32993, type=5121, pixels=<optimized out>, packing=0x82c4b7690, texObj=0x844c11500, texImage=0x82ba98ec0, compressed=0) at radeon_texture.c:834 #6 0x0000000817f8b6e7 in radeonTexImage2D (ctx=<optimized out>, target=<optimized out>, level=<optimized out>, internalFormat=<optimized out>, width=<optimized out>, height=<optimized out>, border=0, format=32993, type=5121, pixels=0x83beff000, packing=0x82c4b7690, texObj=0x844c11500, texImage=0x82ba98ec0) at radeon_texture.c:867 #7 0x0000000817ffad91 in teximage (ctx=0x82c4a8000, dims=2, target=3553, level=0, internalFormat=4, width=1056, height=33, depth=1, border=0, format=32993, type=5121, pixels=0x83beff000) at main/teximage.c:2505 #8 0x0000000817ffafc9 in _mesa_TexImage2D (target=3553, level=0, internalFormat=4, width=1056, height=33, border=0, format=32993, type=5121, pixels=0x83beff000) at main/teximage.c:2559 #9 0x0000000803e46622 in __glXDRIbindTexImage () from /usr/local/lib/xorg/modules/extensions/libglx.so #10 0x0000000803e3a7d8 in __glXDisp_BindTexImageEXT () from /usr/local/lib/xorg/modules/extensions/libglx.so #11 0x0000000803e3b020 in __glXDisp_VendorPrivate () from /usr/local/lib/xorg/modules/extensions/libglx.so #12 0x0000000803e3d22d in __glXDispatch () from /usr/local/lib/xorg/modules/extensions/libglx.so

In frame 5 the following inconsistency can be observed: (gdb) p *(radeonTexObj*)texObj $12 = {base = {Mutex = 0x8363736a0, RefCount = 3, Name = 10721, Target = 3553, Sampler = {Name = 0, RefCount = 0, WrapS = 33071, WrapT = 33071, WrapR = 10497, MinFilter = 9728, MagFilter = 9728, BorderColor = {f = {0, 0, 0, 0}, ui = {0, 0, 0, 0}, i = {0, 0, 0, 0}}, MinLod = -1000, MaxLod = 1000, LodBias = 0, MaxAnisotropy = 1, CompareMode = 0, CompareFunc = 515, CompareFailValue = 0, sRGBDecode = 35401, CubeMapSeamless = 0 '\000', DepthMode = 6409, _CompleteTexture = 0 '\000'}, Priority = 1, BaseLevel = 0, MaxLevel = 1000, _MaxLevel = 10, _MaxLambda = 10, CropRect = {0, 0, 0, 0}, Swizzle = {6403, 6404, 6405, 6406}, _Swizzle = 1672, GenerateMipmap = 0 '\000', _Complete = 1 '\001', _RenderToTexture = 0 '\000', Purgeable = 0 '\000', Image = {{0x82ba98ec0, 0x0 <repeats 14 times>}, {0x0 <repeats 15 times>}, { 0x0 <repeats 15 times>}, {0x0 <repeats 15 times>}, {0x0 <repeats 15 times>}, {0x0 <repeats 15 times>}}, BufferObject = 0x0, BufferObjectFormat = 0, Palette = {InternalFormat = 0, _BaseFormat = 0, Size = 0, TableF = 0x0, TableUB = 0x0, RedSize = 0 '\000', GreenSize = 0 '\000', BlueSize = 0 '\000', AlphaSize = 0 '\000', LuminanceSize = 0 '\000', IntensitySize = 0 '\000'}, DriverData = 0x0}, mt = 0x846d87b00, validated = 0 '\000', minLod = 0, maxLod = 0, override_offset = 3398523648, image_override = 1 '\001', tile_bits = 0, bo = 0x839e88480, pp_txfilter = 0, pp_txformat = 0, pp_txformat_x = 0, pp_txsize = 0, pp_txpitch = 0, pp_border_color = 0, pp_cubic_faces = 0, pp_txfilter_1 = 0, SQ_TEX_RESOURCE0 = 553158401, SQ_TEX_RESOURCE1 = 1744830496, SQ_TEX_RESOURCE2 = 0, SQ_TEX_RESOURCE3 = 1088, SQ_TEX_RESOURCE4 = 101335040, SQ_TEX_RESOURCE5 = 0, SQ_TEX_RESOURCE6 = 2147483648, SQ_TEX_RESOURCE7 = 0, SQ_TEX_SAMPLER0 = 12582930, SQ_TEX_SAMPLER1 = 4228841472, SQ_TEX_SAMPLER2 = 2147483648, TD_PS_SAMPLER0_BORDER_RED = 0, TD_PS_SAMPLER0_BORDER_GREEN = 0, TD_PS_SAMPLER0_BORDER_BLUE = 0, TD_PS_SAMPLER0_BORDER_ALPHA = 0, border_fallback = 0 '\000'} (gdb) p *(radeon_texture_image*)texImage $14 = {base = {InternalFormat = 4, _BaseFormat = 6408, TexFormat = MESA_FORMAT_ARGB8888, Border = 0, Width = 1056, Height = 33, Depth = 1, Width2 = 1056, Height2 = 33, Depth2 = 1, WidthLog2 = 10, HeightLog2 = 5, DepthLog2 = 0, MaxLog2 = 10, WidthScale = 1056, HeightScale = 33, DepthScale = 1, IsClientData = 0 '\000', _IsPowerOfTwo = 0 '\000', TexObject = 0x844c11500, FetchTexelc = 0x81810268f <fetch_texel_float_to_chan>, FetchTexelf = 0x8180fe1d7 <fetch_texel_2d_f_argb8888>, RowStride = 1056, ImageOffsets = 0x82b1d78c8, Data = 0x0, DriverData = 0x0}, mt = 0x0, bo = 0x0, mtlevel = 0, mtface = 0}

As you can see (a) texObj has bo set, but (b) texImage has neither bo nor mt set.

Because of (a) the Data field is _not_ set in radeon_teximage(), because of (b) the field is not set in radeon_teximage_map() call made from radeon_store_teximage. Thus Data remains NULL.

I am not sure if there is a simple logic error somewhere in radeon_teximage or radeon_store_teximage, or if the discrepancy between texImage and texObj means that there is a bug some place else.

I see that the code in git master is quite different, but unfortunately I do not have an opportunity to test it.