Bug 524183

Summary: Segfault from mesa when called through pyopengl
Product: [Fedora] Fedora Reporter: Mary Ellen Foster <mefoster>
Component: mesaAssignee: Adam Jackson <ajax>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 11CC: ajax
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-09-18 14:54:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Mary Ellen Foster 2009-09-18 09:23:39 UTC
Description of problem:
I've got a PyOpenGL program that reliably segfaults every time it's run -- unfortunately, it's a bit of a complicated system, and my attempts so far to create a cut-down version don't segfault in the same way. :(

Anyway, the crash happens at the following line in the Python code:
    pos = gluProject(object.pos[0], object.pos[1], object.pos[2])
(the object.pos[n] values are good, for what it's worth). I'll include the gdb backtrace at the end because it's quite long, but it seems clear that the actual crash is happening in the glGetDoublev() function.

Version-Release number of selected component (if applicable):
mesa-libGL-7.6-0.1.fc11.x86_64
mesa-libGLU-7.6-0.1.fc11.x86_64
python-2.6-11.fc11.x86_64
PyOpenGL-3.0.1-0.a3.fc11.noarch (this is a self-built version of the latest upstream alpha; the symptoms were the same with the latest 3.0.0 version from Fedora)

How reproducible:
Every time with the full system; haven't been able to reproduce a cut-down version yet


Additional info:
The function gets called as a result of a message sent through the Ice object middleware, and I haven't yet been able to reproduce it without Ice. I can't imagine that has anything directly to do with it, but it's hard to say.

Here's the monster backtrace from gdb:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f7837392910 (LWP 8719)]
glGetDoublev () at ../../../src/mesa/x86-64/glapi_x86-64.S:9341
9341		movq	2080(%rax), %r11
Current language:  auto; currently asm
(gdb) bt
#0  glGetDoublev () at ../../../src/mesa/x86-64/glapi_x86-64.S:9341
#1  0x00007f783e367ebc in ffi_call_unix64 () at src/x86/unix64.S:75
#2  0x00007f783e367c44 in ffi_call (cif=<value optimized out>, fn=<value optimized out>, 
    rvalue=<value optimized out>, avalue=0x7f783738f460) at src/x86/ffi64.c:430
#3  0x00007f783e57b014 in _call_function_pointer (argcount=<value optimized out>, 
    resmem=<value optimized out>, restype=<value optimized out>, atypes=<value optimized out>, 
    avalues=<value optimized out>, pProc=<value optimized out>, flags=<value optimized out>)
    at /usr/src/debug/Python-2.6/Modules/_ctypes/callproc.c:814
#4  _CallProc (argcount=<value optimized out>, resmem=<value optimized out>, restype=<value optimized out>, 
    atypes=<value optimized out>, avalues=<value optimized out>, pProc=<value optimized out>, 
    flags=<value optimized out>) at /usr/src/debug/Python-2.6/Modules/_ctypes/callproc.c:1161
#5  0x00007f783e574326 in CFuncPtr_call (self=0x2212d50, inargs=0x2, kwds=<value optimized out>)
    at /usr/src/debug/Python-2.6/Modules/_ctypes/_ctypes.c:3855
#6  0x0000003e5fc43ac3 in PyObject_Call (func=0x2212d50, arg=0x7f78140128d0, kw=0x7f7837392a90)
    at Objects/abstract.c:2487
#7  0x0000003e5fcdbdb1 in ext_do_call (nk=<value optimized out>, na=<value optimized out>, 
    flags=<value optimized out>, pp_stack=<value optimized out>, func=<value optimized out>)
    at Python/ceval.c:3978
#8  PyEval_EvalFrameEx (nk=<value optimized out>, na=<value optimized out>, flags=<value optimized out>, 
    pp_stack=<value optimized out>, func=<value optimized out>) at Python/ceval.c:2410
#9  0x0000003e5fcdef85 in PyEval_EvalCodeEx (co=0x1dbea08, globals=<value optimized out>, 
    locals=<value optimized out>, args=0x0, argcount=<value optimized out>, kws=0x0, kwcount=0, defs=0x0, 
    defcount=0, closure=0x29069f0) at Python/ceval.c:2942
#10 0x0000003e5fc6dc7b in function_call (func=0x2fdc1b8, arg=0x28ffb50, kw=0x7f7814011af0)
    at Objects/funcobject.c:524
#11 0x0000003e5fc43ac3 in PyObject_Call (func=0x2fdc1b8, arg=0x7f78140128d0, kw=0x7f7837392a90)
    at Objects/abstract.c:2487
#12 0x0000003e5fcdbdb1 in ext_do_call (nk=<value optimized out>, na=<value optimized out>, 
    flags=<value optimized out>, pp_stack=<value optimized out>, func=<value optimized out>)
    at Python/ceval.c:3978
#13 PyEval_EvalFrameEx (nk=<value optimized out>, na=<value optimized out>, flags=<value optimized out>, 
    pp_stack=<value optimized out>, func=<value optimized out>) at Python/ceval.c:2410
#14 0x0000003e5fcdef85 in PyEval_EvalCodeEx (co=0x1dc4af8, globals=<value optimized out>, 
    locals=<value optimized out>, args=0x0, argcount=<value optimized out>, kws=0x1, kwcount=0, defs=0x0, 
    defcount=0, closure=0x0) at Python/ceval.c:2942
#15 0x0000003e5fc6db7f in function_call (func=0x1dd1b90, arg=0x28fae60, kw=0x0) at Objects/funcobject.c:524
#16 0x0000003e5fc43ac3 in PyObject_Call (func=0x1dd1b90, arg=0x7f78140128d0, kw=0x7f7837392a90)
    at Objects/abstract.c:2487
#17 0x0000003e5fc5897f in instancemethod_call (func=0x1dd1b90, arg=0x28fae60, kw=0x0)
    at Objects/classobject.c:2579
#18 0x0000003e5fc43ac3 in PyObject_Call (func=0x2901cd0, arg=0x7f78140128d0, kw=0x7f7837392a90)
    at Objects/abstract.c:2487
#19 0x0000003e5fc9b764 in slot_tp_call (self=<value optimized out>, args=0x28ff8d0, kwds=0x0)
    at Objects/typeobject.c:5368
#20 0x0000003e5fc43ac3 in PyObject_Call (func=0x235c908, arg=0x7f78140128d0, kw=0x7f7837392a90)
    at Objects/abstract.c:2487
#21 0x0000003e5fcdcb0e in do_call (nk=<value optimized out>, na=-1, pp_stack=<value optimized out>, 
    func=<value optimized out>) at Python/ceval.c:3890
#22 call_function (nk=<value optimized out>, na=-1, pp_stack=<value optimized out>, 
    func=<value optimized out>) at Python/ceval.c:3702
#23 PyEval_EvalFrameEx (nk=<value optimized out>, na=-1, pp_stack=<value optimized out>, 
    func=<value optimized out>) at Python/ceval.c:2370
#24 0x0000003e5fcdef85 in PyEval_EvalCodeEx (co=0x24f4eb8, globals=<value optimized out>, 
    locals=<value optimized out>, args=0x3, argcount=<value optimized out>, kws=0x26144e0, kwcount=0, 
    defs=0x26144c8, defcount=3, closure=0x0) at Python/ceval.c:2942
#25 0x0000003e5fc6dc7b in function_call (func=0x26170c8, arg=0x2fda0a8, kw=0x3008dd0)
    at Objects/funcobject.c:524
#26 0x0000003e5fc43ac3 in PyObject_Call (func=0x26170c8, arg=0x7f78140128d0, kw=0x7f7837392a90)
    at Objects/abstract.c:2487
#27 0x0000003e5fcdbdb1 in ext_do_call (nk=<value optimized out>, na=<value optimized out>, 
    flags=<value optimized out>, pp_stack=<value optimized out>, func=<value optimized out>)
    at Python/ceval.c:3978
#28 PyEval_EvalFrameEx (nk=<value optimized out>, na=<value optimized out>, flags=<value optimized out>, 
    pp_stack=<value optimized out>, func=<value optimized out>) at Python/ceval.c:2410
#29 0x0000003e5fcdef85 in PyEval_EvalCodeEx (co=0x237f288, globals=<value optimized out>, 
    locals=<value optimized out>, args=0x0, argcount=<value optimized out>, kws=0x1, kwcount=0, defs=0x0, 
    defcount=0, closure=0x2502a28) at Python/ceval.c:2942
#30 0x0000003e5fc6db7f in function_call (func=0x2617140, arg=0x2906af8, kw=0x0) at Objects/funcobject.c:524
#31 0x0000003e5fc43ac3 in PyObject_Call (func=0x2617140, arg=0x7f78140128d0, kw=0x7f7837392a90)
    at Objects/abstract.c:2487
#32 0x0000003e5fc5897f in instancemethod_call (func=0x2617140, arg=0x2906af8, kw=0x0)
    at Objects/classobject.c:2579
#33 0x0000003e5fc43ac3 in PyObject_Call (func=0x2901c80, arg=0x7f78140128d0, kw=0x7f7837392a90)
    at Objects/abstract.c:2487
#34 0x0000003e5fc9b764 in slot_tp_call (self=<value optimized out>, args=0x28fbaf0, kwds=0x0)
    at Objects/typeobject.c:5368
#35 0x0000003e5fc43ac3 in PyObject_Call (func=0x2613610, arg=0x7f78140128d0, kw=0x7f7837392a90)
    at Objects/abstract.c:2487
#36 0x0000003e5fcdcb0e in do_call (nk=<value optimized out>, na=-1, pp_stack=<value optimized out>, 
    func=<value optimized out>) at Python/ceval.c:3890
#37 call_function (nk=<value optimized out>, na=-1, pp_stack=<value optimized out>, 
    func=<value optimized out>) at Python/ceval.c:3702
#38 PyEval_EvalFrameEx (nk=<value optimized out>, na=-1, pp_stack=<value optimized out>, 
    func=<value optimized out>) at Python/ceval.c:2370
#39 0x0000003e5fcde699 in fast_function (nk=<value optimized out>, na=<value optimized out>, 
    n=<value optimized out>, pp_stack=<value optimized out>, func=<value optimized out>)
    at Python/ceval.c:3765
#40 call_function (nk=<value optimized out>, na=<value optimized out>, n=<value optimized out>, 
    pp_stack=<value optimized out>, func=<value optimized out>) at Python/ceval.c:3700
#41 PyEval_EvalFrameEx (nk=<value optimized out>, na=<value optimized out>, n=<value optimized out>, 
    pp_stack=<value optimized out>, func=<value optimized out>) at Python/ceval.c:2370
#42 0x0000003e5fcdef85 in PyEval_EvalCodeEx (co=0x28f8a08, globals=<value optimized out>, 
    locals=<value optimized out>, args=0x0, argcount=<value optimized out>, kws=0x7, kwcount=0, 
    defs=0x28f9be8, defcount=1, closure=0x0) at Python/ceval.c:2942
#43 0x0000003e5fc6db7f in function_call (func=0x28fd398, arg=0x28301a0, kw=0x0) at Objects/funcobject.c:524
#44 0x0000003e5fc43ac3 in PyObject_Call (func=0x28fd398, arg=0x7f78140128d0, kw=0x7f7837392a90)
    at Objects/abstract.c:2487
#45 0x0000003e5fc5897f in instancemethod_call (func=0x28fd398, arg=0x28301a0, kw=0x0)
    at Objects/classobject.c:2579
#46 0x0000003e5fc43ac3 in PyObject_Call (func=0x29019b0, arg=0x7f78140128d0, kw=0x7f7837392a90)
    at Objects/abstract.c:2487
#47 0x00007f7839132736 in IcePy::TypedUpcall::dispatch(_object*, std::pair<unsigned char const*, unsigned char const*> const&, Ice::Current const&) () from /usr/lib64/python2.6/site-packages/Ice/IcePy.so
#48 0x00007f783912bd9a in IcePy::TypedServantWrapper::ice_invoke_async(IceInternal::Handle<Ice::AMD_Array_Object_ice_invoke> const&, std::pair<unsigned char const*, unsigned char const*> const&, Ice::Current const&) ()
   from /usr/lib64/python2.6/site-packages/Ice/IcePy.so
#49 0x00007f7838dd035b in Ice::BlobjectArrayAsync::__dispatch(IceInternal::Incoming&, Ice::Current const&) ()
   from /usr/lib64/libIce.so.33
#50 0x00007f7838d7911e in IceInternal::Incoming::invoke(IceInternal::Handle<IceInternal::ServantManager> const&) () from /usr/lib64/libIce.so.33
#51 0x00007f7838d4c09c in Ice::ConnectionI::invokeAll(IceInternal::BasicStream&, int, int, unsigned char, IceInternal::Handle<IceInternal::ServantManager> const&, IceInternal::Handle<Ice::ObjectAdapter> const&) ()
   from /usr/lib64/libIce.so.33
#52 0x00007f7838d5411d in Ice::ConnectionI::message(IceInternal::BasicStream&, IceInternal::Handle<IceInternal::ThreadPool> const&) () from /usr/lib64/libIce.so.33
#53 0x00007f7838e41e23 in IceInternal::ThreadPool::run() () from /usr/lib64/libIce.so.33
#54 0x00007f7838e44936 in IceInternal::ThreadPool::EventHandlerThread::run() () from /usr/lib64/libIce.so.33
#55 0x00007f7838a48232 in ?? () from /usr/lib64/libIceUtil.so.33
#56 0x0000003e4ee0686a in start_thread (arg=<value optimized out>) at pthread_create.c:297
#57 0x0000003e4e2de3bd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
#58 0x0000000000000000 in ?? ()

Comment 1 Mary Ellen Foster 2009-09-18 14:54:19 UTC
Oops, sorry about that -- turns out to be a PEBKAC from an OpenGL novice. :)