https://bugs.freedesktop.org/show_bug.cgi?id=32449

Summary: crash in r600_set_vertex_buffers with invalid GL usage flag used in glBufferData Product: Mesa Version: 7.10 Platform: x86-64 (AMD64) OS/Version: Linux (All) Status: NEW Severity: normal Priority: medium Component: Drivers/DRI/R600 AssignedTo: dri-devel@lists.freedesktop.org ReportedBy: sean@middleditch.us

Created an attachment (id=41180) --> (https://bugs.freedesktop.org/attachment.cgi?id=41180) VBO flag test case

If an invalid usage flag (something other than the GL_STATIC_DRAW, GL_DYNAMIC_DRAW, etc.) is passed to glBufferData, then any Draw calls using that VBO will crash inside the r600 driver.

The error should either be detected during the call to glBufferData or an invalid flag should simply use a sensible default rather than crashing during Draw.

This is on an x86-64 machine (Fedora Rawhide). I do not know if this happens on other architectures.

Attaching a simple test case (using GLEW and GLUT). Backtrace from test case is here. I also don't know if this happens with other DRI drivers, and whether this is a bug in the R600 specifically or something that should be fixed higher up in the common Mesa layers, but since the crash happens in the R600 driver I'm assuming that's the culprit.

Program received signal SIGSEGV, Segmentation fault. 0x00007ffff724dd7f in r600_set_vertex_buffers (ctx=0x6154c0, count=1, buffers=0x7fffffffd5c0) at r600_state_common.c:165 165 if (r600_buffer_is_user_buffer(buffers[i].buffer)) #0 0x00007ffff724dd7f in r600_set_vertex_buffers (ctx=0x6154c0, count=1, buffers=0x7fffffffd5c0) at r600_state_common.c:165 #1 0x00007ffff7304b3c in st_draw_vbo (ctx=0xb48d80, arrays=<value optimized out>, prims=0x7fffffffdb60, nr_prims=1, ib=0x0, index_bounds_valid=<value optimized out>, min_index=0, max_index=2) at state_tracker/st_draw.c:701 #2 0x00007ffff73012cb in vbo_draw_arrays (ctx=0xb48d80, mode=4, start=0, count=<value optimized out>, numInstances=<value optimized out>) at vbo/vbo_exec_array.c:588 #3 0x0000000000400d85 in display () #4 0x00000039f0020f75 in ?? () from /usr/lib64/libglut.so.3 #5 0x00000039f0024ab9 in fgEnumWindows () from /usr/lib64/libglut.so.3 #6 0x00000039f00214da in glutMainLoopEvent () from /usr/lib64/libglut.so.3 #7 0x00000039f0021db5 in glutMainLoop () from /usr/lib64/libglut.so.3 #8 0x0000000000400f00 in main ()