Does this patch help? Marek
On Tue, Mar 26, 2013 at 8:32 AM, Dave Airlie <airl...@gmail.com> wrote: > so I've been playing with MSAA in softpipe and saw this, I don't think > any of my code is causing it, but it does take an MSAA test to trigger > it > > with texelFetch fs sampler2DMS 4 I get the below valgrind trace > > so it looks like we are keeping a reference in ctx->Array._DrawArrays > that is stale, without a reference, it seems to come from the vbo > exec.arrays.input setup. > > Dave. > > ==12086== Invalid read of size 8 > ==12086== at 0x62B9632: is_interleaved_arrays (st_atom_array.c:323) > ==12086== by 0x62B9E97: update_array (st_atom_array.c:556) > ==12086== by 0x62B8E7A: st_validate_state (st_atom.c:205) > ==12086== by 0x62C5245: st_Clear (st_cb_clear.c:394) > ==12086== by 0x6150EA9: _mesa_Clear (clear.c:227) > ==12086== by 0x58541CC: shared_dispatch_stub_203 (glapi_mapi_tmp.h:14273) > ==12086== by 0x4C7CA17: stub_glClear (generated_dispatch.c:1713) > ==12086== by 0x40284C: piglit_display (texelFetch.c:141) > ==12086== by 0x4C7718F: run_test (piglit_fbo_framework.c:57) > ==12086== by 0x4C75328: piglit_gl_test_run (piglit-framework-gl.c:127) > ==12086== by 0x4026C0: main (texelFetch.c:90) > ==12086== Address 0xed16c28 is 1,192 bytes inside a block of size 2,200 > free'd > ==12086== at 0x4A074C4: free (in > /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) > ==12086== by 0x6147F97: _mesa_delete_array_object (arrayobj.c:120) > ==12086== by 0x61480B2: _mesa_reference_array_object_ (arrayobj.c:153) > ==12086== by 0x6147D59: _mesa_reference_array_object (arrayobj.h:66) > ==12086== by 0x61488FA: _mesa_DeleteVertexArrays (arrayobj.c:463) > ==12086== by 0x585BCAE: shared_dispatch_stub_683 (glapi_mapi_tmp.h:17633) > ==12086== by 0x403047: draw_rect_core (texelFetch.c:307) > ==12086== by 0x40336F: upload_multisample_data (texelFetch.c:403) > ==12086== by 0x403A05: generate_texture (texelFetch.c:524) > ==12086== by 0x404197: piglit_init (texelFetch.c:800) > ==12086== by 0x4C77172: run_test (piglit_fbo_framework.c:55) > ==12086== by 0x4C75328: piglit_gl_test_run (piglit-framework-gl.c:127) > ==12086== > _______________________________________________ > mesa-dev mailing list > mesa-dev@lists.freedesktop.org > http://lists.freedesktop.org/mailman/listinfo/mesa-dev
0001-mesa-fix-use-after-free-with-a-stale-pointer-in-_Dra.patch
Description: Binary data
_______________________________________________ mesa-dev mailing list mesa-dev@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/mesa-dev
