Skip to content

GitLab

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
mesa
mesa
  • Project overview
    • Project overview
    • Details
    • Activity
    • Releases
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 2,361
    • Issues 2,361
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
  • Merge Requests 664
    • Merge Requests 664
  • CI / CD
    • CI / CD
    • Pipelines
    • Jobs
    • Schedules
  • Operations
    • Operations
    • Incidents
    • Environments
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Analytics
    • Analytics
    • CI / CD
    • Repository
    • Value Stream
  • Members
    • Members
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Mesa
  • mesamesa
  • Issues
  • #24

Closed
Open
Opened Jun 13, 2019 by Kristian H. Kristensen@krhDeveloper

Double free in dEQP-GLES3.functional.transform_feedback.random.*

Could be the cause of our flaky xfb tests:

(gdb) r                                                                                                                                                                                                                                                                                     
Starting program: /usr/local/deqp/modules/gles3/deqp-gles3 --deqp-surface-type=pbuffer --deqp-gl-config-name=rgba8888d24s8ms0 --deqp-surface-width=256 --deqp-surface-height=256 -n dEQP-GLES3.functional.transform_feedback.random.\*                                                      
[Thread debugging using libthread_db enabled]                                                                                                                                                                                                                                               
Using host libthread_db library "/lib/libthread_db.so.1".
Writing test log into TestResults.qpa
dEQP Core unknown (0xcafebabe) starting..
  target implementation = 'Surfaceless'
[I] Pipe Info: (msm_pipe_new:239)
[I]  GPU-id:          630 (msm_pipe_new:240)
[I]  Chip-id:         0x06030002 (msm_pipe_new:241)
[I]  GMEM size:       0x00100000 (msm_pipe_new:242)
[I] Pipe Info: (msm_pipe_new:239)                                   
[I]  GPU-id:          630 (msm_pipe_new:240)                         
[I]  Chip-id:         0x06030002 (msm_pipe_new:241)                 
[I]  GMEM size:       0x00100000 (msm_pipe_new:242)                 
Test case 'dEQP-GLES3.functional.transform_feedback.random.separate.points.1'..
double free or corruption (fasttop)                                  
Program received signal SIGABRT, Aborted.                           
__libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47
47      ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S: No such file or directory.
(gdb) bt                                                             
#0  __libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47
#1  0xf7d2e18e in __libc_signal_restore_set (set=0xfffee1bc) at ../sysdeps/unix/sysv/linux/nptl-signals.h:80
#2  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:48
#3  0xf7d2ef12 in __GI_abort () at abort.c:79                       
#4  0xf7d596d2 in __libc_message (action=action@entry=do_abort, fmt=0xf7de8108 "%s\n") at ../sysdeps/posix/libc_fatal.c:181
#5  0xf7d5daee in malloc_printerr (str=<optimized out>) at malloc.c:5350
#6  0xf7d5e692 in _int_free (av=<optimized out>, p=0x100fbd8, have_lock=0) at malloc.c:4230
#7  0xf78e1b14 in unsafe_free (info=0x100fbe0) at ../src/util/ralloc.c:299
#8  0xf78e1af8 in unsafe_free (info=0xd399fc) at ../src/util/ralloc.c:292                                               
#9  0xf78e1af8 in unsafe_free (info=0x10284e8) at ../src/util/ralloc.c:292     
#10 0xf78e1af8 in unsafe_free (info=0x1038468) at ../src/util/ralloc.c:292
#11 0xf78e1a62 in ralloc_free (ptr=0x1038480) at ../src/util/ralloc.c:262                                               
#12 0xf74c0536 in ir3_context_free (ctx=0x1038480) at ../src/freedreno/ir3/ir3_context.c:126
#13 0xf74b5b64 in ir3_compile_shader_nir (compiler=0xbde258, so=0x100f850) at ../src/freedreno/ir3/ir3_compiler_nir.c:3318
#14 0xf74ad2ee in create_variant (shader=0x10303e8, key=0xfffee6cc, binning_pass=false) at ../src/freedreno/ir3/ir3_shader.c:196
#15 0xf74ad230 in shader_variant (shader=0x10303e8, key=0xfffee6cc, created=0xfffee6cb) at ../src/freedreno/ir3/ir3_shader.c:228
#16 0xf74ad18c in ir3_shader_get_variant (shader=0x10303e8, key=0xfffee6cc, binning_pass=false, created=0xfffee6cb) at ../src/freedreno/ir3/ir3_shader.c:243
#17 0xf748b942 in ir3_shader_variant (shader=0x10303e8, key=..., binning_pass=false, debug=0xc974d0) at ../src/gallium/drivers/freedreno/ir3/ir3_gallium.c:80
#18 0xf748b678 in ir3_cache_lookup (cache=0xc1a718, key=0xfffee85c, debug=0xc974d0) at ../src/gallium/drivers/freedreno/ir3/ir3_cache.c:98
#19 0xf74789aa in fd6_emit_get_prog (emit=0xfffee850) at ../src/gallium/drivers/freedreno/a6xx/fd6_emit.h:115
#20 0xf7478308 in fd6_draw_vbo (ctx=0xc92c60, info=0xfffeec40, index_offset=0) at ../src/gallium/drivers/freedreno/a6xx/fd6_draw.c:165
#21 0xf74928c8 in fd_draw_vbo (pctx=0xc92c60, info=0xfffeec40) at ../src/gallium/drivers/freedreno/freedreno_draw.c:286
#22 0xf741c830 in u_vbuf_draw_vbo (mgr=0xcfcfb0, info=0xfffeed14) at ../src/gallium/auxiliary/util/u_vbuf.c:1451
#23 0xf73e4e00 in cso_draw_vbo (cso=0xcfc258, info=0xfffeed14) at ../src/gallium/auxiliary/cso_cache/cso_context.c:1705                                                                       
#24 0xf76f7b42 in st_draw_vbo (ctx=0xca1068, prims=0xfffeedc0, nr_prims=1, ib=0x0, index_bounds_valid=1 '\001', min_index=0, max_index=0, tfb_vertcount=0x0, stream=0, indirect=0x0)
    at ../src/mesa/state_tracker/st_draw.c:268                           
#25 0xf764ee98 in _mesa_draw_arrays (ctx=0xca1068, mode=0, start=0, count=1, numInstances=1, baseInstance=0, drawID=0) at ../src/mesa/main/draw.c:374
#26 0xf764ece4 in _mesa_DrawArrays (mode=0, start=0, count=1) at ../src/mesa/main/draw.c:531
#27 0xf7cb05de in shared_dispatch_stub_310 (mode=0, first=0, count=1) at src/mapi/shared-glapi/glapi_mapi_tmp.h:19933                                                                                    
#28 0x0050a414 in _start ()                                        
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
None
Milestone
None
Assign milestone
Time tracking
None
Due date
None
Reference: mesa/mesa#24