| Priority | medium |
|---|---|
| Bug ID | 82279 |
| Assignee | dri-devel@lists.freedesktop.org |
| Summary | SDL applications crash when changing video mode: double free or corruption |
| Severity | normal |
| Classification | Unclassified |
| OS | Linux (All) |
| Reporter | xamaniqinqu@gmail.com |
| Hardware | x86-64 (AMD64) |
| Status | NEW |
| Version | git |
| Component | Drivers/Gallium/radeonsi |
| Product | Mesa |
Created attachment 104195 [details]
GDB backtrace of Dosbox crash.
Overview:
SDL applications crash when changing video mode, "corrupted double-linked
list" and "double free or corruption" are printed to stderr. The applications
tested are Dosbox and Enemy Territory: Quake Wars.
Steps to reproduce:
1) Install an abandonware game such as Commander Keen 4
2) Run it in Dosbox
3) Depending on the game, press a key to start the game proper
Actual results:
The application crashes upon changing video mode.
Expected results:
The application changes video mode without causing a crash.
Build date and platform:
Build date of all components: 2014-08-07
Platform: Gentoo GNU/Linux x86_64
Linux kernel version: 3.16
Additional information:
Bisecting revealed the culprit commit to be
"58d2afa2232060b88f9c444ce7a0d6e63c841bb2: radeonsi: fix leaking the bound
state on destruction v2". See attachments for backtraces.
Created attachment 104196 [details]
GDB full backtrace of Dosbox crash.
| What | Removed | Added |
|---|---|---|
| Keywords | bisected |
| What | Removed | Added |
|---|---|---|
| Summary | SDL applications crash when changing video mode: double free or corruption | [bisected] SDL applications crash when changing video mode: double free or corruption |
Some additional information: the crash (obviously) only occurs when Dosbox uses
opengl rendering. For this, 'output=opengl' or 'output=openglnb' needs to be
set in ~/${USER}/.dosbox/dosbox-${VERSION}.conf.
| What | Removed | Added |
|---|---|---|
| Summary | [bisected] SDL applications crash when changing video mode: double free or corruption | SDL applications crash when changing video mode: double free or corruption |
| What | Removed | Added |
|---|---|---|
| Summary | SDL applications crash when changing video mode: double free or corruption | SDL applications crash when changing video mode on radeonsi: double free or corruption |
| What | Removed | Added |
|---|---|---|
| CC | deathsimple@vodafone.de | |
| Summary | SDL applications crash when changing video mode on radeonsi:= double free or corruption | [bisected] double free or corruption on context destruction = with postprocessing enabled |
AFAICT this only happens if postprocessing is enabled via one = of the pp_* driconf options or environment variables. (In reply to comment #0) > Bisecting revealed the culprit commit to be > "58d2afa2232060b88f9c444ce7a0d6e63c841bb2: radeonsi: fix leaking = the bound > state on destruction v2". Christian, any ideas?
(In reply to comment #3= ) > AFAICT this only happens if postprocessing is en= abled via one of the pp_* > driconf options or environment variables. >=20 > (In reply to comment #0) > > Bisecting revealed the culprit commit to be > > "58d2afa2232060b88f9c444ce7a0d6e63c841bb2: radeonsi: fix lea= king the bound > > state on destruction v2". >=20 > Christian, any ideas? That looks like a bug in the post processing cleanup to me. The context the shaders belong to is destroyed before pp_free is called to destroy the shad= ers created from that context. Since the bisected patch explicitly destroys all bound shaders of a context= if the context is destroyed we get a double free of the shader.
I can now confirm that the crash only occurs with postprocessing enabled through driconf. Apparently, there was still a .drirc present on my /home partition from an earlier installation that had the 'pp_jimenezmlaa' and 'force_s3tc_enable' options enabled. Resetting .drirc to defaults allows me to run all SDL applications normally.
| What | Removed | Added |
|---|---|---|
| Resolution | --- | FIXED |
| Status | NEW | RESOLVED |
I think that issue is fixed by now. Any objections to closing = this bug?