Hi, this patch causes a crash in piglit/vao-element-array-buffer.
Valgrind log: ==28635== Invalid read of size 4 ==28635== at 0x4446D87: pthread_mutex_lock (pthread_mutex_lock.c:50) ==28635== by 0x4A0ACAC: _mesa_free_context_data (context.c:1121) ==28635== by 0x4A8EC22: st_destroy_context (st_context.c:276) ==28635== by 0x49F84FC: st_context_destroy (st_manager.c:596) ==28635== by 0x49E4CFA: dri_destroy_context (dri_context.c:174) ==28635== by 0x49B5B79: driDestroyContext (dri_util.c:301) ==28635== by 0x40706B9: dri2_destroy_context (dri2_glx.c:132) ==28635== by 0x4049D17: glx_display_free (glxext.c:228) ==28635== by 0x4049D9E: __glXCloseDisplay (glxext.c:275) ==28635== by 0x40F5142: XCloseDisplay (in /usr/lib/i386-linux-gnu/libX11.so.6.3.0) ==28635== by 0x40BF692: fgDeinitialize (in /usr/lib/libglut.so.3.9.0) ==28635== by 0x40C2996: glutMainLoop (in /usr/lib/libglut.so.3.9.0) ==28635== Address 0x46effdc is 20 bytes inside a block of size 1,504 free'd ==28635== at 0x4027C02: free (vg_replace_malloc.c:366) ==28635== by 0x4B1B70E: _mesa_delete_array_object (arrayobj.c:120) ==28635== by 0x4A84543: delete_arrayobj_cb (varray.c:1241) ==28635== by 0x4A3A7CF: _mesa_HashDeleteAll (hash.c:295) ==28635== by 0x4A86F35: _mesa_free_varray_data (varray.c:1251) ==28635== by 0x4A0AC8A: _mesa_free_context_data (context.c:1118) ==28635== by 0x4A8EC22: st_destroy_context (st_context.c:276) ==28635== by 0x49F84FC: st_context_destroy (st_manager.c:596) ==28635== by 0x49E4CFA: dri_destroy_context (dri_context.c:174) ==28635== by 0x49B5B79: driDestroyContext (dri_util.c:301) ==28635== by 0x40706B9: dri2_destroy_context (dri2_glx.c:132) ==28635== by 0x4049D17: glx_display_free (glxext.c:228) ==28635== ==28635== Invalid read of size 4 ==28635== at 0x444261A: __pthread_mutex_lock_full (pthread_mutex_lock.c:139) ==28635== by 0x4A0ACAC: _mesa_free_context_data (context.c:1121) ==28635== by 0x4A8EC22: st_destroy_context (st_context.c:276) ==28635== by 0x49F84FC: st_context_destroy (st_manager.c:596) ==28635== by 0x49E4CFA: dri_destroy_context (dri_context.c:174) ==28635== by 0x49B5B79: driDestroyContext (dri_util.c:301) ==28635== by 0x40706B9: dri2_destroy_context (dri2_glx.c:132) ==28635== by 0x4049D17: glx_display_free (glxext.c:228) ==28635== by 0x4049D9E: __glXCloseDisplay (glxext.c:275) ==28635== by 0x40F5142: XCloseDisplay (in /usr/lib/i386-linux-gnu/libX11.so.6.3.0) ==28635== by 0x40BF692: fgDeinitialize (in /usr/lib/libglut.so.3.9.0) ==28635== by 0x40C2996: glutMainLoop (in /usr/lib/libglut.so.3.9.0) ==28635== Address 0x46effdc is 20 bytes inside a block of size 1,504 free'd ==28635== at 0x4027C02: free (vg_replace_malloc.c:366) ==28635== by 0x4B1B70E: _mesa_delete_array_object (arrayobj.c:120) ==28635== by 0x4A84543: delete_arrayobj_cb (varray.c:1241) ==28635== by 0x4A3A7CF: _mesa_HashDeleteAll (hash.c:295) ==28635== by 0x4A86F35: _mesa_free_varray_data (varray.c:1251) ==28635== by 0x4A0AC8A: _mesa_free_context_data (context.c:1118) ==28635== by 0x4A8EC22: st_destroy_context (st_context.c:276) ==28635== by 0x49F84FC: st_context_destroy (st_manager.c:596) ==28635== by 0x49E4CFA: dri_destroy_context (dri_context.c:174) ==28635== by 0x49B5B79: driDestroyContext (dri_util.c:301) ==28635== by 0x40706B9: dri2_destroy_context (dri2_glx.c:132) ==28635== by 0x4049D17: glx_display_free (glxext.c:228) ==28635== ==28635== Invalid read of size 4 ==28635== at 0x4B1B758: _mesa_reference_array_object (arrayobj.c:142) ==28635== by 0x4A0ACAC: _mesa_free_context_data (context.c:1121) ==28635== by 0x4A8EC22: st_destroy_context (st_context.c:276) ==28635== by 0x49F84FC: st_context_destroy (st_manager.c:596) ==28635== by 0x49E4CFA: dri_destroy_context (dri_context.c:174) ==28635== by 0x49B5B79: driDestroyContext (dri_util.c:301) ==28635== by 0x40706B9: dri2_destroy_context (dri2_glx.c:132) ==28635== by 0x4049D17: glx_display_free (glxext.c:228) ==28635== by 0x4049D9E: __glXCloseDisplay (glxext.c:275) ==28635== by 0x40F5142: XCloseDisplay (in /usr/lib/i386-linux-gnu/libX11.so.6.3.0) ==28635== by 0x40BF692: fgDeinitialize (in /usr/lib/libglut.so.3.9.0) ==28635== by 0x40C2996: glutMainLoop (in /usr/lib/libglut.so.3.9.0) ==28635== Address 0x46effcc is 4 bytes inside a block of size 1,504 free'd ==28635== at 0x4027C02: free (vg_replace_malloc.c:366) ==28635== by 0x4B1B70E: _mesa_delete_array_object (arrayobj.c:120) ==28635== by 0x4A84543: delete_arrayobj_cb (varray.c:1241) ==28635== by 0x4A3A7CF: _mesa_HashDeleteAll (hash.c:295) ==28635== by 0x4A86F35: _mesa_free_varray_data (varray.c:1251) ==28635== by 0x4A0AC8A: _mesa_free_context_data (context.c:1118) ==28635== by 0x4A8EC22: st_destroy_context (st_context.c:276) ==28635== by 0x49F84FC: st_context_destroy (st_manager.c:596) ==28635== by 0x49E4CFA: dri_destroy_context (dri_context.c:174) ==28635== by 0x49B5B79: driDestroyContext (dri_util.c:301) ==28635== by 0x40706B9: dri2_destroy_context (dri2_glx.c:132) ==28635== by 0x4049D17: glx_display_free (glxext.c:228) ==28635== ==28635== Invalid write of size 4 ==28635== at 0x4B1B75E: _mesa_reference_array_object (arrayobj.c:142) ==28635== by 0x4A0ACAC: _mesa_free_context_data (context.c:1121) ==28635== by 0x4A8EC22: st_destroy_context (st_context.c:276) ==28635== by 0x49F84FC: st_context_destroy (st_manager.c:596) ==28635== by 0x49E4CFA: dri_destroy_context (dri_context.c:174) ==28635== by 0x49B5B79: driDestroyContext (dri_util.c:301) ==28635== by 0x40706B9: dri2_destroy_context (dri2_glx.c:132) ==28635== by 0x4049D17: glx_display_free (glxext.c:228) ==28635== by 0x4049D9E: __glXCloseDisplay (glxext.c:275) ==28635== by 0x40F5142: XCloseDisplay (in /usr/lib/i386-linux-gnu/libX11.so.6.3.0) ==28635== by 0x40BF692: fgDeinitialize (in /usr/lib/libglut.so.3.9.0) ==28635== by 0x40C2996: glutMainLoop (in /usr/lib/libglut.so.3.9.0) ==28635== Address 0x46effcc is 4 bytes inside a block of size 1,504 free'd ==28635== at 0x4027C02: free (vg_replace_malloc.c:366) ==28635== by 0x4B1B70E: _mesa_delete_array_object (arrayobj.c:120) ==28635== by 0x4A84543: delete_arrayobj_cb (varray.c:1241) ==28635== by 0x4A3A7CF: _mesa_HashDeleteAll (hash.c:295) ==28635== by 0x4A86F35: _mesa_free_varray_data (varray.c:1251) ==28635== by 0x4A0AC8A: _mesa_free_context_data (context.c:1118) ==28635== by 0x4A8EC22: st_destroy_context (st_context.c:276) ==28635== by 0x49F84FC: st_context_destroy (st_manager.c:596) ==28635== by 0x49E4CFA: dri_destroy_context (dri_context.c:174) ==28635== by 0x49B5B79: driDestroyContext (dri_util.c:301) ==28635== by 0x40706B9: dri2_destroy_context (dri2_glx.c:132) ==28635== by 0x4049D17: glx_display_free (glxext.c:228) ==28635== ==28635== Invalid read of size 4 ==28635== at 0x4447D11: __pthread_mutex_unlock_usercnt (pthread_mutex_unlock.c:37) ==28635== by 0x4A0ACAC: _mesa_free_context_data (context.c:1121) ==28635== by 0x4A8EC22: st_destroy_context (st_context.c:276) ==28635== by 0x49F84FC: st_context_destroy (st_manager.c:596) ==28635== by 0x49E4CFA: dri_destroy_context (dri_context.c:174) ==28635== by 0x49B5B79: driDestroyContext (dri_util.c:301) ==28635== by 0x40706B9: dri2_destroy_context (dri2_glx.c:132) ==28635== by 0x4049D17: glx_display_free (glxext.c:228) ==28635== by 0x4049D9E: __glXCloseDisplay (glxext.c:275) ==28635== by 0x40F5142: XCloseDisplay (in /usr/lib/i386-linux-gnu/libX11.so.6.3.0) ==28635== by 0x40BF692: fgDeinitialize (in /usr/lib/libglut.so.3.9.0) ==28635== by 0x40C2996: glutMainLoop (in /usr/lib/libglut.so.3.9.0) ==28635== Address 0x46effdc is 20 bytes inside a block of size 1,504 free'd ==28635== at 0x4027C02: free (vg_replace_malloc.c:366) ==28635== by 0x4B1B70E: _mesa_delete_array_object (arrayobj.c:120) ==28635== by 0x4A84543: delete_arrayobj_cb (varray.c:1241) ==28635== by 0x4A3A7CF: _mesa_HashDeleteAll (hash.c:295) ==28635== by 0x4A86F35: _mesa_free_varray_data (varray.c:1251) ==28635== by 0x4A0AC8A: _mesa_free_context_data (context.c:1118) ==28635== by 0x4A8EC22: st_destroy_context (st_context.c:276) ==28635== by 0x49F84FC: st_context_destroy (st_manager.c:596) ==28635== by 0x49E4CFA: dri_destroy_context (dri_context.c:174) ==28635== by 0x49B5B79: driDestroyContext (dri_util.c:301) ==28635== by 0x40706B9: dri2_destroy_context (dri2_glx.c:132) ==28635== by 0x4049D17: glx_display_free (glxext.c:228) ==28635== ==28635== Invalid read of size 4 ==28635== at 0x4442B2A: __pthread_mutex_unlock_full (pthread_mutex_unlock.c:86) ==28635== by 0x4A0ACAC: _mesa_free_context_data (context.c:1121) ==28635== by 0x4A8EC22: st_destroy_context (st_context.c:276) ==28635== by 0x49F84FC: st_context_destroy (st_manager.c:596) ==28635== by 0x49E4CFA: dri_destroy_context (dri_context.c:174) ==28635== by 0x49B5B79: driDestroyContext (dri_util.c:301) ==28635== by 0x40706B9: dri2_destroy_context (dri2_glx.c:132) ==28635== by 0x4049D17: glx_display_free (glxext.c:228) ==28635== by 0x4049D9E: __glXCloseDisplay (glxext.c:275) ==28635== by 0x40F5142: XCloseDisplay (in /usr/lib/i386-linux-gnu/libX11.so.6.3.0) ==28635== by 0x40BF692: fgDeinitialize (in /usr/lib/libglut.so.3.9.0) ==28635== by 0x40C2996: glutMainLoop (in /usr/lib/libglut.so.3.9.0) ==28635== Address 0x46effdc is 20 bytes inside a block of size 1,504 free'd ==28635== at 0x4027C02: free (vg_replace_malloc.c:366) ==28635== by 0x4B1B70E: _mesa_delete_array_object (arrayobj.c:120) ==28635== by 0x4A84543: delete_arrayobj_cb (varray.c:1241) ==28635== by 0x4A3A7CF: _mesa_HashDeleteAll (hash.c:295) ==28635== by 0x4A86F35: _mesa_free_varray_data (varray.c:1251) ==28635== by 0x4A0AC8A: _mesa_free_context_data (context.c:1118) ==28635== by 0x4A8EC22: st_destroy_context (st_context.c:276) ==28635== by 0x49F84FC: st_context_destroy (st_manager.c:596) ==28635== by 0x49E4CFA: dri_destroy_context (dri_context.c:174) ==28635== by 0x49B5B79: driDestroyContext (dri_util.c:301) ==28635== by 0x40706B9: dri2_destroy_context (dri2_glx.c:132) ==28635== by 0x4049D17: glx_display_free (glxext.c:228) Marek On Wed, Apr 18, 2012 at 7:28 PM, Mathias Fröhlich <[email protected]> wrote: > > Hi, > > The attached change uses the array object factory for gl_array_objects. This > prevents crashes when deriving from gl_array_object. > The change should be orthogonal to Mareks posted changes. > > Please Review. > > Thanks > > Mathias > _______________________________________________ > mesa-dev mailing list > [email protected] > http://lists.freedesktop.org/mailman/listinfo/mesa-dev > _______________________________________________ mesa-dev mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/mesa-dev
