[Bug 15834] New: Current Amira version 4.1. 1 causes X to crash in _tnl_InvalidateState

http://bugs.freedesktop.org/show_bug.cgi?id=15834

           Summary: Current Amira version 4.1.1 causes X to crash in
                    _tnl_InvalidateState
           Product: Mesa
           Version: unspecified
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: high
         Component: Mesa core
        AssignedTo: mesa3d-dev@...
        ReportedBy: Hugo.Mildenberger@...


When running Amira under current git version of X and current git version of
mesa, dri and so on, Amira crashes the whole session.


(gdb)
Program received signal SIGSEGV, Segmentation fault.
0xaf814ea2 in _tnl_InvalidateState (ctx=0x9074e98, new_state=525315) at
tnl/t_context.c:140
140        if (ctx->Fog.Enabled ||

(gdb) bt
#0  0xaf814ea2 in _tnl_InvalidateState (ctx=0x9074e98, new_state=525315) at
tnl/t_context.c:140
#1  0xaf767ef0 in intelInvalidateState (ctx=0x9074e98, new_state=525315) at
intel_context.c:340
#2  0xaf7da923 in _mesa_update_state_locked (ctx=0x9074e98) at
main/state.c:1253
#3  0xaf7dac2a in _mesa_update_state (ctx=0x9074e98) at main/state.c:1264
#4  0xaf80aeb8 in vbo_exec_Begin (mode=4) at vbo/vbo_exec_api.c:509
#5  0xb7b66315 in __glXDisp_Begin (pc=0x93bd7e4 "\004") at
indirect_dispatch.c:156
#6  0xb7b495ee in __glXDisp_Render (cl=0x86205a4, pc=0x93bd7e0 "\b") at
glxcmds.c:1788
#7  0xb7b4d966 in __glXDispatch (client=0x86204e0) at glxext.c:492
#8  0x0808abfc in Dispatch () at dispatch.c:451
#9  0x080716ea in main (argc=8, argv=0xbfa4a9b4, envp=0x909f870) at main.c:433

This is the location within _tnl_InvalidateState

140        if (ctx->Fog.Enabled ||
141            ((ctx->FragmentProgram._Active || ctx->FragmentProgram._Current)
&&
142             (ctx->FragmentProgram._Current->FogOption != GL_NONE ||
143              (ctx->FragmentProgram._Current->Base.InputsRead &
FRAG_BIT_FOGC))))
144           RENDERINPUTS_SET( tnl->render_inputs_bitset, _TNL_ATTRIB_FOG );


The problem is here, that for whatever reason, ctx->FragmentProgram._Active
happens to be nonzero, whereas ctx->FragmentProgram._Current actually is zero.
Therefore dereferencing ctx->FragmentProgam._Current will signal.

Fix would be simple. Change that "||" to "&&".

(BTW: Wouldn't you like to change the "CVS" tag to "git" in this form?)


--
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Mesa3d-dev mailing list
Mesa3d-dev@...
https://lists.sourceforge.net/lists/listinfo/mesa3d-dev

http://bugs.freedesktop.org/show_bug.cgi?id=15834





--- Comment #1 from Hugo Mildenberger <Hugo.Mildenberger@...>  2008-05-07 04:47:42 PST ---
Created an attachment (id=16411)
 --> (http://bugs.freedesktop.org/attachment.cgi?id=16411)
gdb log with backtrace and structure dumps


This excerpt is perhaps already enough to illuminate the scene:

(gdb) sele 2

(gdb) print ctx->Fog
$3 = {Enabled = 0 '\0', Color = {0, 0, 0, 0}, Density = 1, Start = 0, End = 1,
Index = 0, Mode = 2048,
  ColorSumEnabled = 0 '\0', FogCoordinateSource = 33874, _Scale = 1}

(gdb) print ctx->FragmentProgram
$4 = {Enabled = 0 '\0', _Enabled = 0 '\0', _Active = 1 '\001', Current =
0x9088bc8, _Current = 0x0, Parameters = {{0, 0, 0,
      0} <repeats 128 times>}, _MaintainTexEnvProgram = 0 '\0',
_UseTexEnvProgram = 1 '\001', _TexEnvProgram = 0x0,
  Callback = 0, CallbackData = 0x0, CallbackEnabled = 0 '\0', CurrentPosition =
0}


I may add, that after I locally fixed this, amira again crashed the system,
this time within drm kernel module, saying:

[drm:drm_bo_expire_fence] *ERROR* Detected GPU lockup or fence driver was taken
down. Evicting buffer.
[drm:drm_bo_leave_list] *ERROR* A DRM_BO_NO_EVICT buffer present at cleanup.
Removing flag and evicting.

I don't currently have also a backtrace for that bug araound, since this was
obtained while looking for the cause of another a bug located within latest
xf86-video-intel driver. I will retry it after that getting fixed.

Let me add, that the source for all this may really be a header inconsistency,
which I myself can't fix, since Amira is closed source. But even that
presumably beeing the case, running a buggy program or a program which was
compiled for another minor X revision shouldn't crash the whole system.


--
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Don't miss this year's exciting event. There's still time to save $100.
Use priority code J8TL2D2.
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
_______________________________________________
Mesa3d-dev mailing list
Mesa3d-dev@...
https://lists.sourceforge.net/lists/listinfo/mesa3d-dev

http://bugs.freedesktop.org/show_bug.cgi?id=15834


Brice Goglin <brice.goglin@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |brice.goglin@...
          Component|Mesa core                   |Drivers/DRI/i915




--- Comment #2 from Brice Goglin <brice.goglin@...>  2008-08-29 14:33:05 PST ---
A similar backtrace has been caught by Vincent Bernat with Mesa 7.1.1 when
running Blender:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=497096


--
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Mesa3d-dev mailing list
Mesa3d-dev@...
https://lists.sourceforge.net/lists/listinfo/mesa3d-dev

http://bugs.freedesktop.org/show_bug.cgi?id=15834


haihao <haihao.xiang@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dchipman@...




--- Comment #3 from haihao <haihao.xiang@...>  2008-09-04 02:17:43 PST ---
*** Bug 17237 has been marked as a duplicate of this bug. ***


--
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Mesa3d-dev mailing list
Mesa3d-dev@...
https://lists.sourceforge.net/lists/listinfo/mesa3d-dev

http://bugs.freedesktop.org/show_bug.cgi?id=15834


Gordon Jin <gordon.jin@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |critical
           Priority|high                        |medium




--
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Mesa3d-dev mailing list
Mesa3d-dev@...
https://lists.sourceforge.net/lists/listinfo/mesa3d-dev

http://bugs.freedesktop.org/show_bug.cgi?id=15834





--- Comment #4 from Brian Paul <brian.paul@...>  2008-09-18 07:44:21 PST ---
Created an attachment (id=18980)
 --> (http://bugs.freedesktop.org/attachment.cgi?id=18980)
patch to fix segfault

Can you try the attached patch?


--
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Mesa3d-dev mailing list
Mesa3d-dev@...
https://lists.sourceforge.net/lists/listinfo/mesa3d-dev

http://bugs.freedesktop.org/show_bug.cgi?id=15834


David Chipman <dchipman@...> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|dchipman@...           |




--
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Mesa3d-dev mailing list
Mesa3d-dev@...
https://lists.sourceforge.net/lists/listinfo/mesa3d-dev

http://bugs.freedesktop.org/show_bug.cgi?id=15834





--- Comment #5 from Brian Paul <brian.paul@...>  2008-09-18 14:31:34 PST ---
I've committed my patch for Mesa 7.2.  Would still appreciate confirmation from
an Amira user that this is fixed now.


--
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Mesa3d-dev mailing list
Mesa3d-dev@...
https://lists.sourceforge.net/lists/listinfo/mesa3d-dev