Bug#366283: Segfault in r200 driver (glDrawArrays)

[Darren Salt]

Package: libgl1-mesa-dri
Version: 6.4.1-0.4

I can reliably cause a segfault in EDGE [1] by playing the game without first
accessing its console and typing

  set vertexarray 0

Partial backtrace:

  #0  0x00000000 in ?? ()
  #1  0xb6ea4461 in _math_trans_1ub () from /usr/lib/dri/r200_dri.so
  #2  0xb6ece3db in _ac_import_edgeflag () from /usr/lib/dri/r200_dri.so
  #3  0xb6ea58ae in _tnl_vb_bind_arrays () from /usr/lib/dri/r200_dri.so
  #4  0xb6ea4f9f in _tnl_DrawArrays () from /usr/lib/dri/r200_dri.so
  #5  0xb7dec328 in glDrawArrays () from /usr/lib/libGL.so.1

There's only one call to glDrawArrays in EDGE: RGL_DrawUnits in rgl_unit.cpp.

This same code works with vertexarray = 1 without crashing when run with
X.org 6.8.2 and the corresponding xlibmesa-dri; however, 6.9.0 also shows
this bug.

I've sent a workaround patch to the EDGE maintainers, causing vertexarray to
be set to 0 by default for the r200 driver from this version of Mesa.


[1] Home: <URL:http://sourceforge.net/projects/edge>
    .debs: <URL:http://www.youmustbejoking.demon.co.uk/progs.unstable.html>
    You'll need Doom or Doom 2 IWADs; freedoom will suffice.

-- 
| Darren Salt    | linux or ds at              | nr. Ashington, | Toon
| RISC OS, Linux | youmustbejoking,demon,co,uk | Northumberland | Army
| + At least 4000 million too many people. POPULATION LEVEL IS UNSUSTAINABLE.

Confucius say: He who post large binary, get flamed.