FS#23788 - [mesa/libGL] segfault with gnome-shell/mutter

Attached to Project: Arch Linux
Opened by kang (kang) - Saturday, 16 April 2011, 01:00 GMT
Last edited by Ionut Biru (wonder) - Sunday, 21 August 2011, 19:38 GMT
Task Type Bug Report
Category Packages: Testing
Status Closed
Assigned To Jan de Groot (JGC)
Andreas Radke (AndyRTR)
Ionut Biru (wonder)
Architecture x86_64
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 2
Private No

Details

Description:
gnome-shell (and thus) mutter --replace crashes. kernel reports the segfault being located in libGL.

gnome-shell[27096]: segfault at 28 ip 00007f253f36fe37 sp 00007fffdb130f60 error 6 in libGL.so.1.2[7f253f323000+6b000]

Additional info:
* gnome-shell 3.0.0.2-2
* mutter 3.0.0-1
* mesa 7.10.99.git20110412-1
* libgl 7.10.99.git20110412-1
* intel-dri 7.10.99.git20110412-1
* libdrm 2.4.25-1
* xf86-video-intel 2.15.0-1
* kernel26 2.6.38.2-1

Hardware:
* Intel Ironlake mobile:
VGA compatible controller: Intel Corporation Core Processor Integrated Graphics Controller (rev 02) (prog-if 00 [VGA controller])

Steps to reproduce:
Install GNOME-3 from testing.
Start gnome-shell --replace or mutter --replace or set your default GNOME3 graphic experience to default (not fallback)

This task depends upon

Closed by  Ionut Biru (wonder)
Sunday, 21 August 2011, 19:38 GMT
Reason for closing:  Fixed
Additional comments about closing:  mesa 7.11
Comment by kang (kang) - Saturday, 16 April 2011, 01:03 GMT
Some more info:

$ gdb mutter
GNU gdb (GDB) 7.2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-unknown-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/mutter...(no debugging symbols found)...done.
(gdb) set args --replace
(gdb) r
Starting program: /usr/bin/mutter --replace
[Thread debugging using libthread_db enabled]
[New Thread 0x7fffee30c700 (LWP 27227)]
Window manager warning: Failed to load theme "Clearlooks": Failed to find a valid file for theme Clearlooks


Program received signal SIGSEGV, Segmentation fault.
0x00007ffff3926e37 in glXSelectEventSGIX () from /usr/lib/libGL.so.1
(gdb) bt
#0 0x00007ffff3926e37 in glXSelectEventSGIX () from /usr/lib/libGL.so.1
#1 0x00007ffff482fed7 in ?? () from /usr/lib/libclutter-glx-1.0.so.0
#2 0x00007ffff488a750 in ?? () from /usr/lib/libclutter-glx-1.0.so.0
#3 0x00007ffff254d1ce in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#4 0x00007ffff255de6d in ?? () from /usr/lib/libgobject-2.0.so.0
#5 0x00007ffff256777a in g_signal_emit_valist ()
from /usr/lib/libgobject-2.0.so.0
#6 0x00007ffff2567922 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#7 0x00007ffff4841dad in clutter_actor_realize ()
from /usr/lib/libclutter-glx-1.0.so.0
#8 0x00007ffff488ae3e in clutter_stage_get_default ()
from /usr/lib/libclutter-glx-1.0.so.0
#9 0x00007ffff7b4b65b in meta_compositor_manage_screen ()
from /usr/lib/libmutter.so.0
#10 0x00007ffff7b603c4 in meta_display_open () from /usr/lib/libmutter.so.0
#11 0x00007ffff7b6a39d in meta_run () from /usr/lib/libmutter.so.0
#12 0x0000000000400b6a in main ()
Comment by kang (kang) - Saturday, 16 April 2011, 01:24 GMT
rebuilt libgl and friends with debug symbols and ran gdb again:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff22b424a in ChangeDrawableAttribute (dpy=0x61b0f0, drawable=56623113, attribs=0x7fffffffdf20, num_attribs=1)
at glx_pbuffer.c:144
144 pdraw->eventMask = attribs[i * 2 + 1];
(gdb) bt
#0 0x00007ffff22b424a in ChangeDrawableAttribute (dpy=0x61b0f0, drawable=56623113, attribs=0x7fffffffdf20, num_attribs=1)
at glx_pbuffer.c:144
#1 0x00007ffff22b56a8 in glXSelectEvent (dpy=0x61b0f0, drawable=56623113, mask=67108864) at glx_pbuffer.c:794


(gdb) l *0x00007ffff22b424a
0x7ffff22b424a is in ChangeDrawableAttribute (glx_pbuffer.c:144).
139
140 for (i = 0; i < num_attribs; i++) {
141 switch(attribs[i * 2]) {
142 case GLX_EVENT_MASK:
143 /* Keep a local copy for masking out DRI2 proto events as needed */
144 pdraw->eventMask = attribs[i * 2 + 1];
145 break;
146 }
147 }
148 #endif

(gdb) print pdraw
$1 = (__GLXDRIdrawable *) 0x0
(gdb) print pdraw->eventMask
Cannot access memory at address 0x28
(gdb) print i
$2 = 0
(gdb) print num_attribs
$3 = 1


Original source:

#ifdef GLX_DIRECT_RENDERING
pdraw = GetGLXDRIDrawable(dpy, drawable);

for (i = 0; i < num_attribs; i++) {
switch(attribs[i * 2]) {
case GLX_EVENT_MASK:
/* Keep a local copy for masking out DRI2 proto events as needed */
pdraw->eventMask = attribs[i * 2 + 1];
break;
}
}
#endif


inside the definition of what gets pdraw and return NULL (0x0):


/**
* Get the __DRIdrawable for the drawable associated with a GLXContext
*
* \param dpy The display associated with \c drawable.
* \param drawable GLXDrawable whose __DRIdrawable part is to be retrieved.
* \param scrn_num If non-NULL, the drawables screen is stored there
* \returns A pointer to the context's __DRIdrawable on success, or NULL if
* the drawable is not associated with a direct-rendering context.
*/
_X_HIDDEN __GLXDRIdrawable *
GetGLXDRIDrawable(Display * dpy, GLXDrawable drawable)
{
struct glx_display *priv = __glXInitialize(dpy);
__GLXDRIdrawable *pdraw;

if (priv == NULL)
return NULL;

if (__glxHashLookup(priv->drawHash, drawable, (void *) &pdraw) == 0)
return pdraw;

return NULL;
}


Comment by Andreas Radke (AndyRTR) - Saturday, 16 April 2011, 09:45 GMT
please report this upstream.
Comment by kang (kang) - Saturday, 16 April 2011, 20:08 GMT Comment by kang (kang) - Thursday, 05 May 2011, 15:26 GMT
Fixed upstream. Please note that they specify they think the way mutter is called is wrong, apparently using indirect rendering, if i understand the comment properly, although the offending code is in direct rendering.
If he meant that mutter is not meant to be ran manually then disregard, of course, I ran it manually to expose the bug more easily.
Comment by Ionut Biru (wonder) - Friday, 06 May 2011, 07:21 GMT
@kang do mutter developers know about this?
Comment by Andreas Radke (AndyRTR) - Friday, 17 June 2011, 17:11 GMT
As we have this commit in testing Mesa packages now for a long time can we close this one?

Loading...