[Bug 32297] New: [r300g] WoW crashes on exit, when run in a window instead of full-screen.
https://bugs.freedesktop.org/show_bug.cgi?id=32297
Summary: [r300g] WoW crashes on exit, when run in a window instead of full-screen. Product: Mesa Version: git Platform: x86 (IA32) OS/Version: Linux (All) Status: NEW Severity: normal Priority: medium Component: Drivers/Gallium/r300 AssignedTo: dri-devel@lists.freedesktop.org ReportedBy: rankincj@googlemail.com
Tested with my RV350, Linux 2.6.36.2 kernel, with WoW running in a 1152x864 window instead of full-screen. On exiting WoW, it crashes with the following stack trace:
Backtrace: =>0 0x7d88bbf7 dri2_invalidate_drawable+0x47(dPriv=*** Invalid address 0x0032eda8 *** Internal symbol error: unable to access memory location 0x32eda8) [/home/chris/Programs/mesa/src/gallium/state_trackers/dri/drm/dri2.c:60] in r300_dri.so (0x0032edc0) 1 0x7e9542fb dri2InvalidateBuffers+0x2a(dpy=*** Invalid address 0x0032edc8 *** Internal symbol error: unable to access memory location 0x32edc8, drawable=*** Invalid address 0x0032edcc *** ) [/home/chris/Programs/mesa/src/glx/dri2_glx.c:678] in libgl.so.1 (0x0032ee00) 2 0x7e95496f DRI2WireToEvent+0x11e(dpy=*** Invalid address 0x0032ee08 *** Internal symbol error: unable to access memory location 0x32ee08, event=*** Invalid address 0x0032ee0c *** Internal symbol error: unable to access memory location 0x32ee0c, wire=*** Invalid address 0x0032ee10 *** Internal symbol error: unable to access memory location 0x32ee10) [/home/chris/Programs/mesa/src/glx/dri2.c:136] in libgl.so.1 (0x0032ee40) 3 0x7e9a9dd1 _XEnq+0x60() in libx11.so.6 (0x0032ee90) 4 0x7e9b0a64 in libx11.so.6 (+0x42a63) (0x0032eeb0) 5 0x7e9b10f8 _XEventsQueued+0x67() in libx11.so.6 (0x0032eed0) 6 0x7e9b119a _XFlush+0x49() in libx11.so.6 (0x0032eef0) 7 0x7e988eb2 XFlush+0x31() in libx11.so.6 (0x0032f000) 8 0x7dd7087a X11DRV_WindowPosChanged+0x199() in winex11 (0x0032f100) 9 0x7ed2ff32 USER_SetWindowPos+0x6e1() in user32 (0x0032f240) 10 0x7ed2f2d7 SetWindowPos+0xa6() in user32 (0x0032f2c0) 11 0x7ed30e95 WINPOS_ShowIconTitle+0xf4() in user32 (0x0032f310) 12 0x7ed31bd4 show_window+0x513() in user32 (0x0032f390) 13 0x7ed31cdb ShowWindow+0x6a() in user32 (0x0032f3c0) 14 0x007b2651 in wow (+0x3b2650) (0x0032f3d4) 15 0x007b1008 in wow (+0x3b1007) (0x0032f444) 16 0x7ed33e1a WINPROC_wrapper+0x19() in user32 (0x0032f474) 17 0x7ed3456c call_window_proc+0x5b() in user32 (0x0032f4c4) 18 0x7ed351fc WINPROC_CallProcWtoA+0x90b() in user32 (0x0032fb54)
https://bugs.freedesktop.org/show_bug.cgi?id=32297
--- Comment #1 from Chris Rankin rankincj@googlemail.com 2011-01-04 16:35:09 PST --- (In reply to comment #0)
Backtrace: =>0 0x7d88bbf7 dri2_invalidate_drawable+0x47(dPriv=*** Invalid address 0x0032eda8 *** Internal symbol error: unable to access memory location 0x32eda8)
I've dug a bit further into this with the latest git code, and it looks like dri2_invalidate_drawable(dPriv) is (somehow) trying to use a garbage dri_context structure. Basically, the dPriv->driContextPriv->driverPrivate field seems to contain a value which is never allocated by dri_create_context(). I haven't determined how this value is set yet, but I'm suspecting memory corruption via a stale pointer because the dri_context struct that all previous dPriv->driContextPriv->driverPrivate fields had referred to had just been destroyed.
The previous backtrace seems to contain an invalid dPriv value instead, which isn't exactly what I'm seeing now either.
https://bugs.freedesktop.org/show_bug.cgi?id=32297
Chris Rankin rankincj@googlemail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|[r300g] WoW crashes on |[r300g] Memory corruption |exit, when run in a window |crash when exiting |instead of full-screen. |DRI2/OpenGL application.
https://bugs.freedesktop.org/show_bug.cgi?id=32297
Chris Rankin rankincj@googlemail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|[r300g] Memory corruption |[r300g] Memory corruption |crash when exiting |crash when exiting |DRI2/OpenGL application. |application using | |DRI2_InvalidateBuffers
--- Comment #2 from Chris Rankin rankincj@googlemail.com 2011-01-04 17:48:12 PST --- Just to
https://bugs.freedesktop.org/show_bug.cgi?id=32297
--- Comment #3 from Chris Rankin rankincj@googlemail.com 2011-01-04 17:49:10 PST --- Just to be clear: the crash only happens when WoW is run inside a window. It exits normally when run full-screen.
https://bugs.freedesktop.org/show_bug.cgi?id=32297
--- Comment #4 from Chris Rankin rankincj@googlemail.com 2011-01-05 16:40:23 PST --- I think I've debugged this as far as I can; to get any further I'll need to find where the __DRIcontext.driverPrivate field is set to the "garbage"(?) value.
According to the fprintf() statements that I've littered throughout the Mesa/gallium code, where:
&__DRIcontext = 0x7d6f8d70 &struct dri_context = 0x7d13c4f0
Starting just before the crash:
** ENTER dri2_destroy_context: pcp->driContext=0x7d6f8d70, pcp->driContext->driverPrivate=0x7d13c4f0 ** destroying dri_context 0x7d13c4f0 *** setting cPriv(0x7d6f8d70)->driverPrivate from 0x7d13c4f0 to NULL ** DONE dri2_destroy_context: pcp->driContext=0x7d6f8d70, pcp->driContext->driverPrivate=(nil)
So at this point, we have destroyed the dri_context at 0x7d13c4f0, and for good measure I have also explicitly NULLed out the __DRIcontext.driverPrivate field which referred to it. However, we then get this call to DRI2WireToEvent(), which triggers the fatal call to dri2InvalidateBuffers():
** ENTER DRI2WireToEvent *** wire->u.u.type=0x4b dri2 invalidate buffers: awire=0x7a56b4c8, awire->drawable=0x4800011 ** ENTER dri2GetGlxDrawableFromXDrawableId ** found pdraw=0x7d775bd8 for drawable 0x4800011: cPriv=0x7d6f8d70, driverPrivate=0x7a5047a8 ** ENTER dri2InvalidateBuffers: pdp->driDrawable->driContextPriv=0x7d6f8d70 ** drawable IDs: 0x4800011 0x7d775c78 dri2_invalidate_drawable: dPriv=0x7d775c78, dPriv->driContextPriv=0x7d6f8d70, drawable=0x7d775cf8, ctx=0x7a5047a8, drawable->dPriv=0x7d775c78 wine: Unhandled page fault on read access to 0x0000003c at address 0x7d9710df (thread 000d), starting debugger...
This event fetches a struct dri2_drawable from the dri2Hash structure, which is linked to the __DRIcontext at 0x7d6f8d70 via driDrawable->driContextPriv. However, the driverPrivate field on this __DRIcontext structure is now set to 0x7a5047a8, which is a garbage value as far as I can tell. Chaos ensues when this value is mistaken for the address of a struct dri_context.
Interestingly, this problem actually DOES happen when WoW runs full-screen. However, the Wine debugger isn't started to tell me about it.
If anyone has any ideas on how to debug this further then I'm all ears. I've already tried using valgrind, but wine/WoW completely failed to run.
https://bugs.freedesktop.org/show_bug.cgi?id=32297
Chris Rankin rankincj@googlemail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |DUPLICATE
--- Comment #5 from Chris Rankin rankincj@googlemail.com 2011-01-09 11:13:16 PST --- The patch in #31940's comment 7 seems to fix the issue here as well. (So far, anyway...)
*** This bug has been marked as a duplicate of bug 31940 ***
dri-devel@lists.freedesktop.org
-
bugzilla-daemon＠freedesktop.org