Bug 87925 - SIGSEGV libX11 src/ImUtil.c:733
Summary: SIGSEGV libX11 src/ImUtil.c:733
Status: RESOLVED MOVED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/swrast (show other bugs)
Version: 10.2
Hardware: x86-64 (AMD64) Linux (All)
: medium critical
Assignee: mesa-dev
QA Contact:
URL:
Whiteboard:
Keywords: have-backtrace
Depends on:
Blocks:
 
Reported: 2015-01-01 02:43 UTC by Vinson Lee
Modified: 2019-09-18 18:45 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments

Description Vinson Lee 2015-01-01 02:43:46 UTC
$ pkg-config --modversion x11
1.6.2

Run piglit test glx-tfp on Mesa Software Rasterizer.

$ ./bin/glx-tfp -auto
Segmentation fault (core dumped)

(gdb) bt
#0  _XPutPixel32 (ximage=0x17b0200, x=0, y=<optimized out>, pixel=16711680) at ../../src/ImUtil.c:733
#1  0x00007f6fe63e7cd3 in _XSetImage (srcimg=srcimg@entry=0x17afc50, dstimg=dstimg@entry=0x17b0200, x=0, x@entry=2, y=0, y@entry=24838656) at ../../src/ImUtil.c:949
#2  0x00007f6fe63e3b66 in XGetSubImage (dpy=<optimized out>, d=<optimized out>, x=<optimized out>, y=<optimized out>, width=<optimized out>, height=<optimized out>, 
    plane_mask=plane_mask@entry=18446744073709551615, format=format@entry=2, dest_image=dest_image@entry=0x17b0200, dest_x=dest_x@entry=0, dest_y=dest_y@entry=0)
    at ../../src/GetImage.c:129
#3  0x00007f6fe6739ede in swrastGetImage (read=<optimized out>, x=<optimized out>, y=<optimized out>, w=<optimized out>, h=<optimized out>, data=<optimized out>, 
    loaderPrivate=0x17afe50) at drisw_glx.c:198
#4  0x00007f6fe1ad1fc4 in swrastSetTexBuffer2 (pDRICtx=<optimized out>, target=<optimized out>, texture_format=8409, dPriv=0x17b0290) at swrast.c:103
#5  0x0000000000401b13 in draw_pixmap (pixmap=75497480, x=32, y=32, w=64, h=64) at piglit/tests/glx/glx-tfp.c:143
#6  0x0000000000401cc4 in draw (dpy=0x15a1010) at piglit/tests/glx/glx-tfp.c:175
#7  0x00007f6fe6a1cd11 in piglit_glx_event_loop (dpy=0x15a1010, draw=0x401be2 <draw>) at piglit/tests/util/piglit-glx-util.c:210
#8  0x0000000000402310 in main (argc=2, argv=0x7fff75933008) at piglit/tests/glx/glx-tfp.c:355
(gdb) frame 0
#0  _XPutPixel32 (ximage=0x17b0200, x=0, y=<optimized out>, pixel=16711680) at ../../src/ImUtil.c:733
733	in ../../src/ImUtil.c
(gdb) print addr
$1 = (unsigned char *) 0x0
(gdb) print ximage->data
$2 = 0x0


libX11/src/ImUtil.c
   721  static int _XPutPixel32 (
   722      register XImage *ximage,
   723      int x,
   724      int y,
   725      unsigned long pixel)
   726  {
   727          unsigned char *addr;
   728  
   729          if ((ximage->format == ZPixmap) && (ximage->bits_per_pixel == 32)) {
   730              addr = &((unsigned char *)ximage->data)
   731                          [y * ximage->bytes_per_line + (x << 2)];
   732              if (*((const char *)&byteorderpixel) == ximage->byte_order)
   733                  *((CARD32 *)addr) = pixel;
   734              else if (ximage->byte_order == MSBFirst) {
   735                  addr[0] = pixel >> 24;
   736                  addr[1] = pixel >> 16;
   737                  addr[2] = pixel >> 8;
   738                  addr[3] = pixel;
   739              } else {
   740                  addr[3] = pixel >> 24;
   741                  addr[2] = pixel >> 16;
   742                  addr[1] = pixel >> 8;
   743                  addr[0] = pixel;
   744              }
   745              return 1;
   746          } else {
   747              _XInitImageFuncPtrs(ximage);
   748              return XPutPixel(ximage, x, y, pixel);
   749          }
   750  }
Comment 1 Alan Coopersmith 2015-01-01 18:42:26 UTC
If mesa is passing an XImage with NULL data to Xlib, segfaults are expected.
Comment 2 Emil Velikov 2015-01-03 16:13:58 UTC
Quick look at my old piglit results indicates:
 - It dates back at least until 10.2
 - Only the classic swrast is affected
Comment 3 Vinson Lee 2017-10-06 23:38:03 UTC
mesa: 52b73caaf40e79c90a105ec6d349abb3398e3c6b (master 17.3.0-devel)

glx-tfp still crashes on swrast.
Comment 4 GitLab Migration User 2019-09-18 18:45:11 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/mesa/mesa/issues/315.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.