https://bugs.freedesktop.org/show_bug.cgi?id=38856

Summary: [i915g] SIGSEGV src/gallium/drivers/i915/i915_state.c:511 Product: Mesa Version: git Platform: x86 (IA32) OS/Version: Linux (All) Status: NEW Severity: critical Priority: medium Component: Drivers/Gallium/i915g AssignedTo: dri-devel@lists.freedesktop.org ReportedBy: vlee@vmware.com

mesa: f8fcaf0215f0434baf13bb5c45545c58f97846b6 (master)

chipset: 945GM (Intel GMA 950) system architecture: i686 xserver-xorg-video-intel: 2:2.14.0-4ubuntu7.1 libdrm-intel1: 2.4.23-1ubuntu6 kernel version: 2.6.38-8-generic Linux distribution: Ubuntu 11.04 i386

Run piglit fbo-copyteximage test.

$ ./bin/fbo-copyteximage -auto Probe at (73,73) Expected: 1.000000 0.000000 0.000000 Observed: 0.000000 0.000000 1.000000 Probe at (200,73) Expected: 0.000000 1.000000 0.000000 Observed: 1.000000 0.000000 0.000000 Probe at (73,200) Expected: 0.000000 0.000000 1.000000 Observed: 1.000000 1.000000 1.000000 Segmentation fault (core dumped)

Core was generated by `./bin/fbo-copyteximage -auto'. Program terminated with signal 11, Segmentation fault. #0 __libc_free (mem=0x3f800000) at malloc.c:3709 3709 malloc.c: No such file or directory. in malloc.c (gdb) bt #0 __libc_free (mem=0x3f800000) at malloc.c:3709 #1 0x01134a96 in i915_delete_fs_state (pipe=0x94343f8, shader=0x94f66d8) at src/gallium/drivers/i915/i915_state.c:511 #2 0x0115b2d9 in aaline_delete_fs_state (pipe=0x94343f8, fs=0x94f5398) at src/gallium/auxiliary/draw/draw_pipe_aaline.c:880 #3 0x01188635 in util_blitter_destroy (blitter=0x94bd360) at src/gallium/auxiliary/util/u_blitter.c:251 #4 0x011310df in i915_destroy (pipe=0x94343f8) at src/gallium/drivers/i915/i915_context.c:105 #5 0x0196f29f in st_destroy_context (st=0x9500598) at src/mesa/state_tracker/st_context.c:261 #6 0x018a7ce1 in st_context_destroy (stctxi=0x9500598) at src/mesa/state_tracker/st_manager.c:651 #7 0x018a34fc in dri_destroy_context (cPriv=0x942df90) at src/gallium/state_trackers/dri/drm/dri_context.c:135 #8 0x0120ea80 in driDestroyContext (pcp=0x942df90) at src/mesa/drivers/dri/common/dri_util.c:588 #9 0x002d45a0 in dri2_destroy_context (context=0x942ed50) at dri2_glx.c:129 #10 0x002aecf0 in glx_display_free (priv=0x942cad0) at glxext.c:220 #11 0x002aed7c in __glXCloseDisplay (dpy=0x9422028, codes=0x942cd5c) at glxext.c:265 #12 0x00583ccb in XCloseDisplay () from /usr/lib/i386-linux-gnu/libX11.so.6 #13 0x003a3693 in fgDeinitialize () at freeglut_init.c:488 #14 0x003a6997 in glutMainLoop () at freeglut_main.c:1533 #15 0x0806b2df in main (argc=1, argv=0xbf9cd2b4) at piglit/tests/util/piglit-framework.c:116 (gdb) frame 1 #1 0x01134a96 in i915_delete_fs_state (pipe=0x94343f8, shader=0x94f66d8) at src/gallium/drivers/i915/i915_state.c:511 511 FREE(ifs->program); (gdb) print ifs->program $1 = (uint *) 0x3f800000