Nouveau - Oct 2012 - [Bug 56546] New: crash at the second render when applying gamma correction

https://bugs.freedesktop.org/show_bug.cgi?id=56546

          Priority: medium
            Bug ID: 56546
          Assignee: nouveau at lists.freedesktop.org
           Summary: crash at the second render when applying gamma
                    correction
          Severity: critical
    Classification: Unclassified
                OS: Linux (All)
          Reporter: yves at 3delight.com
          Hardware: x86-64 (AMD64)
            Status: NEW
           Version: 8.0
         Component: Drivers/DRI/nouveau
           Product: Mesa

Created attachment 69256
  --> https://bugs.freedesktop.org/attachment.cgi?id=69256&action=edit
example of the crash

Here a very simple program which illustrate a bug in
driver 2.1 Mesa 8.0.4 when applying a gamma value with opengl.

(The program is OK with driver NVIDIA).

In attachment, the file utc24.tga used by the program glut_gamma_bug.cpp.

Compile the program with the command:

g++ -L/usr/lib64 -lGL -lGLU -lglut -lX11 -lXi -lxcb-glx -lxcb-xlib -ldl
glut_gamma_bug.cpp

Start it with: ./a.out

It will open a small window with an image composed of vertical strips.

Press the enter key (it apply a gamma correction of 3 to the image):

a) it will print a message: KEY_ENTER
b) it will print another message: current error GL: no error
c) the same image will be brightness
d) at the second message: current error GL: no error, it will crash


Crash in:

==17340== Invalid read of size 4
==17340==    at 0xE5D4ABE: set_sampler_views.isra.2 (u_atomic.h:62)
==17340==    by 0xE5B72E8: draw_textured_quad.isra.8 (st_cb_drawpixels.c:777)
==17340==    by 0xE5B9596: st_DrawPixels (st_cb_drawpixels.c:1156)
==17340==    by 0xE56BE98: _mesa_DrawPixels (drawpix.c:131)

=17340==  Address 0x101a95b0 is 0 bytes inside a block of size 96 free'd
==17340==    at 0x4C2A5C6: free (vg_replace_malloc.c:446)
==17340==    by 0xE5B95FB: st_DrawPixels (u_inlines.h:134)
==17340==    by 0xE56BE98: _mesa_DrawPixels (drawpix.c:131)


Thanks.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20121029/ca466242/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=56546

--- Comment #1 from Yves Claude <yves at 3delight.com> ---
Created attachment 69257
  --> https://bugs.freedesktop.org/attachment.cgi?id=69257&action=edit
data image for cpp file

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20121029/65f822ed/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=56546

--- Comment #2 from Ilia Mirkin <imirkin at alum.mit.edu> ---
Couldn't reproduce this with mesa 9.1 or 9.2 on nv96. Please re-test, and if
you're still having issues, please provide more information about your
setup.
(I did see a glibc malloc warning, but I didn't try to figure out if it was
in
your code or not.)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20130826/fefb825b/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=56546

Ilia Mirkin <imirkin at alum.mit.edu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |INVALID

--- Comment #3 from Ilia Mirkin <imirkin at alum.mit.edu> ---
No response to re-test request in a month. Closing as invalid.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.freedesktop.org/archives/nouveau/attachments/20130927/666e45df/attachment-0001.html>