https://bugs.freedesktop.org/show_bug.cgi?id=91288
Bug ID: 91288
Summary: [swrast] piglit depthfunc double free
Product: Mesa
Version: git
Hardware: x86-64 (AMD64)
OS: Linux (All)
Status: NEW
Keywords: have-backtrace
Severity: normal
Priority: medium
Component: Mesa core
Assignee: mesa-dev@lists.freedesktop.org
Reporter: v...@freedesktop.org
QA Contact: mesa-dev@lists.freedesktop.org
CC: bri...@vmware.com
mesa: 04a57a7ee92403a1d9e01eada69f1ab133fc0b47 (master 10.7.0-devel)
$ ./bin/depthfunc -auto
*** Error in `./bin/depthfunc': double free or corruption (!prev):
0x014e69b0 ***
Aborted (core dumped)
(gdb) bt
#0 0x7f6549147267 in __GI_raise (sig=sig@entry=6) at
../sysdeps/unix/sysv/linux/raise.c:55
#1 0x7f6549148eca in __GI_abort () at abort.c:89
#2 0x7f654918ac53 in __libc_message (do_abort=do_abort@entry=1,
fmt=fmt@entry=0x7f65492a31a8 "*** Error in `%s': %s: 0x%s ***\n")
at ../sysdeps/posix/libc_fatal.c:175
#3 0x7f6549192c69 in malloc_printerr (ptr=,
str=0x7f65492a32d8 "double free or corruption (!prev)", action=1) at
malloc.c:4965
#4 _int_free (av=, p=, have_lock=0) at
malloc.c:3834
#5 0x7f654919689c in __GI___libc_free (mem=) at
malloc.c:2950
#6 0x7f6543fc6ae5 in swrast_delete_renderbuffer (ctx=0x7f6549ca9010,
rb=0x954550) at swrast.c:358
#7 0x7f6543e07841 in _mesa_reference_renderbuffer_
(ptr=ptr@entry=0x944208, rb=rb@entry=0x0) at main/renderbuffer.c:183
#8 0x7f6543dde580 in _mesa_reference_renderbuffer (rb=0x0, ptr=0x944208)
at main/renderbuffer.h:66
#9 _mesa_free_framebuffer_data (fb=fb@entry=0x9440d0) at
main/framebuffer.c:222
#10 0x7f6543dde65e in _mesa_destroy_framebuffer (fb=0x9440d0) at
main/framebuffer.c:198
#11 0x7f6543dde6f5 in _mesa_reference_framebuffer_
(ptr=ptr@entry=0x7f6549ca9100, fb=fb@entry=0x0) at main/framebuffer.c:255
#12 0x7f6543d471b2 in _mesa_reference_framebuffer (fb=0x0,
ptr=0x7f6549ca9100) at main/framebuffer.h:63
#13 _mesa_free_context_data (ctx=ctx@entry=0x7f6549ca9010) at
main/context.c:1310
#14 0x7f6543d4740e in _mesa_destroy_context (ctx=0x7f6549ca9010) at
main/context.c:1379
#15 0x7f6543fc3363 in driDestroyContext (pcp=0x79a2f0) at dri_util.c:490
#16 0x7f6548a6411f in drisw_destroy_context (context=0x77fa00) at
drisw_glx.c:232
#17 0x7f6548a392c9 in glXDestroyContext (dpy=0x76c780, ctx=0x77fa00) at
glxcmds.c:473
#18 0x7f6548ce234f in ?? () from /usr/lib/x86_64-linux-gnu/libwaffle-1.so.0
#19 0x7f6548cdeb00 in waffle_context_destroy () from
/usr/lib/x86_64-linux-gnu/libwaffle-1.so.0
#20 0x7f6549813edf in piglit_wfl_framework_teardown (wfl_fw=0x76c010)
at piglit/tests/util/piglit-framework-gl/piglit_wfl_framework.c:676
#21 0x7f6549814557 in piglit_winsys_framework_teardown (winsys_fw=0x76c010)
at piglit/tests/util/piglit-framework-gl/piglit_winsys_framework.c:224
#22 0x7f6549814d9e in destroy (gl_fw=0x76c010) at
piglit/tests/util/piglit-framework-gl/piglit_x11_framework.c:212
#23 0x7f65497f89d0 in destroy () at
piglit/tests/util/piglit-framework-gl.c:181
#24 0x7f654914bd32 in __run_exit_handlers (status=status@entry=1,
listp=0x7f65494d6698 <__exit_funcs>,
run_list_atexit=run_list_atexit@entry=true) at exit.c:82
#25 0x7f654914bd85 in __GI_exit (status=status@entry=1) at exit.c:104
#26 0x7f6547ed16b8 in _XDefaultError (dpy=, event=) at ../../src/XlibInt.c:1414
#27 0x7f6547ed17ed in _XError (dpy=dpy@entry=0x76c780,
rep=rep@entry=0x811e70) at ../../src/XlibInt.c:1463
#28 0x7f6547ece7e7 in handle_error (dpy=dpy@entry=0x76c780, err=0x811e70,
in_XReply=in_XReply@entry=1) at ../../src/xcb_io.c:213
#29 0x7f6547ecf8b1 in _XReply (dpy=dpy@entry=0x76c780,
rep=rep@entry=0x7ffc8e731f00, extra=extra@entry=0, discard=discard@entry=0) at
../../src/xcb_io.c:699
#30 0x7f6547eb5945 in XGetImage (dpy=0x76c780, d=73400324, x=0, y=0,
width=160, height=200, plane_mask=18446744073709551615, format=2)
at ../../src/GetImage.c:75
#31 0x7f6547eb5b49 in XGetSubImage (dpy=, d=,
x=, y=, width=,
height=, plane_mask=18446744073709551615, format=2,
dest_image=0x944000, dest_x=0, dest_y=0) at ../../src/GetImage.c:125
#32 0x7f6548a64222 in swrastGetImage (read=, x=, y=, w=, h=, data=,
loaderPrivate=0x943ba0) at drisw_glx.c:198
#33 0x7f6543fc6e2a in swrast_map_renderbuffer (ctx=0x1757, rb=0x954550,
x=0, y=0, w=160, h=200, mode=4294967295, out_map=0x7ffc8e7320b8,
out_stride=0x7ffc8e7320ac) at swrast.c:494
#34 0x7f6543ebb4c9 in clear_rgba_buffer (colorMask=0x7f6549caa960 '\377'
, "\004\004", rb=0x954550, ctx=0x7f6549ca9010)
at swrast/s_clear.c:68
#35 clear_color_buffers (ctx=) at swrast/s_clear.c:190
#36 _swrast_Clear (ctx=0x7f6549ca9010, buffers=17) at swrast/s_clear.c:230
#37 0x7f654977c0ab in stub_glClear (mask=16640) at
piglit/tests/util/piglit-dispatch-gen.c:
