[Bug 20925] New: d3d[89]/tests/visual crash under valgrind

http://bugs.winehq.org/show_bug.cgi?id=20925

Summary: d3d[89]/tests/visual crash under valgrind
           Product: Wine
           Version: 1.1.34
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Keywords: download, source, testcase
          Severity: normal
          Priority: P2
         Component: -unknown
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

http://kegel.com/wine/valgrind/logs/2009-12-05-01.15/vg-d3d8_visual.txt
and
http://kegel.com/wine/valgrind/logs/2009-12-05-01.15/vg-d3d9_visual.txt
both show the crash

Unhandled exception: page fault on read access to 0x58469450 in 32-bit code
(0x0d9bc92b).
Backtrace:
=>0 0x0d9bc92b (0x11ad7000)
  1 0x0fa16d50 in libgl.so.1 (+0x3dd50) (0x0ffbc038)

which might be a problem in the driver, but could also be a disagreement
between valgrind and the driver.

I'm going to stop running d3d[89]/tests/visual under valgrind for now,
since they always crash.  Perhaps the good folks at Nvidia could
have a look at how to get valgrind and their drivers to play nice together.
(One of those logs also seems to have found a real use-after-free bug
in their driver:
 Invalid read of size 4
    at  ??? (in /usr/lib32/libGLcore.so.180.44)
  Address 0xe6905f4 is 156 bytes inside a block of size 632 free'd
    at  free (vg_replace_malloc.c:325)
    by  ??? (in /usr/lib32/libGLcore.so.180.44)
 so perhaps they would actually get something out of this.)

[Bug 20925] d3d[89]/tests/visual crash under valgrind

http://bugs.winehq.org/show_bug.cgi?id=20925

--- Comment #1 from Dan Kegel   2009-12-05 14:07:48 ---
Likewise with
http://kegel.com/wine/valgrind/logs/2009-12-05-01.15/vg-d3dx9_36_core.txt
which shows the crash without a useful backtrace:

Invalid write of size 2
    at  ??? (in /dev/zero)
  Address 0x3f540000 is not stack'd, malloc'd or (recently) free'd
Unhandled exception: page fault on write access to 0x3f540000 in 32-bit code
(0x0d9289b1).

[Bug 20925] d3d[89]/tests/visual crash under valgrind

http://bugs.winehq.org/show_bug.cgi?id=20925

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #2 from Austin English  2011-01-31 18:15:30 CST ---
FWIW, I filed an nvidia bug with nvidia-bug-report.sh, but I'm sure it will go
to /dev/null.

I've since switched to running mesa from git on my valgrinding machine. The
d3d9 visual test crashes there, as does d3d8/d3d9 device.

Henri said he'd take a look at that next (he fixed a bunch of leaks in the mesa
driver this weekend :-)).

[Bug 20925] d3d[89]/tests/visual crash under valgrind

http://bugs.winehq.org/show_bug.cgi?id=20925

--- Comment #3 from Austin English  2012-09-26 13:16:55 CDT ---
d3d8 no longer crashes, but d3d9 does.

OpenGL version string: 4.2.0 NVIDIA 304.43
wine-1.5.13-346-g0445393
valgrind-3.8.1

[Bug 20925] d3d[89]/tests/visual crash under valgrind

http://bugs.winehq.org/show_bug.cgi?id=20925

--- Comment #4 from Austin English  2012-09-26 13:18:05 CDT ---
Created attachment 41843
  --> http://bugs.winehq.org/attachment.cgi?id=41843
valgrind output from d3d9/visual

[Bug 20925] d3d[89]/tests/visual crash under valgrind

https://bugs.winehq.org/show_bug.cgi?id=20925

--- Comment #5 from Austin English  ---
[austin@localhost tests]$ make visual.ok
../../../tools/runtest -q -P wine -T ../../.. -M d3d8.dll -p d3d8_test.exe.so
visual && touch visual.ok
preloader: Warning: failed to reserve range 00110000-68000000
preloader: Warning: failed to reserve range 7f000000-82000000
fixme:win:EnumDisplayDevicesW ((null),0,0x4dff240,0x00000000), stub!
==13670== Invalid read of size 4
==13670==    at 0x400AD40: memcpy (in
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==13670==    by 0x4F3508A: surface_cpu_blt (surface.c:5654)
==13670==    by 0x4F37B77: wined3d_surface_blt (surface.c:6309)
==13670==    by 0x4E18B01: d3d8_device_CopyRects (device.c:1043)
==13670==    by 0x497E825: getPixelColor (visual.c:83)
==13670==    by 0x497EAD0: test_sanity (visual.c:162)
==13670==    by 0x4998D7E: func_visual (visual.c:4717)
==13670==    by 0x4999D24: run_test (test.h:584)
==13670==    by 0x499A113: main (test.h:654)
==13670==  Address 0x7fce4000 is on thread 1's stack
==13670==

wine-1.7.16-178-g7e874ae mesa 10.0.4 / i965 no crash.

For d3d9/visual:
../../../tools/runtest -q -P wine -T ../../.. -M d3d9.dll -p d3d9_test.exe.so
visual && touch visual.ok
preloader: Warning: failed to reserve range 00110000-68000000
preloader: Warning: failed to reserve range 7f000000-82000000
fixme:win:EnumDisplayDevicesW ((null),0,0x4edf310,0x00000000), stub!
intel_do_flush_locked failed: Input/output error
make: *** [visual.ok] Error 1

Dan, please retest.

[Bug 20925] d3d[89]/tests/visual crash under valgrind

https://bugs.winehq.org/show_bug.cgi?id=20925

joaopa  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #6 from joaopa  ---
What about this bug with current wine(3.20)?

[Bug 20925] d3d[89]/tests/visual crash under valgrind

https://bugs.winehq.org/show_bug.cgi?id=20925

--- Comment #7 from joaopa  ---
What about this bug with current wine(3.20)?

[Bug 20925] d3d[89]/tests/visual crash under valgrind

https://bugs.winehq.org/show_bug.cgi?id=20925

--- Comment #8 from Austin English  ---
In wine-4.1-108-gf7b3120991 / valgrind-3.15.0.GIT-3e94579a5a-20190126, I get:

==14286== Process terminating with default action of signal 11 (SIGSEGV)
==14286==  General Protection Fault
==14286==    at 0x7BC79145: segv_handler (signal_i386.c:1993)
==14286==    by 0x4251BEF: ??? (in /lib32/libpthread-2.27.so)
==14286==    by 0x7BC791B7: segv_handler (signal_i386.c:2023)
==14286==    by 0x4251BEF: ??? (in /lib32/libpthread-2.27.so)
==14286==    by 0xFAF1E3F: ???
==14286== 
==14286== Process terminating with default action of signal 11 (SIGSEGV)
==14286==  General Protection Fault
==14286==    at 0x400EF1A: _dl_fixup (dl-runtime.c:102)
==14286==    by 0x4014CDF: _dl_runtime_resolve (dl-trampoline.S:43)
==14286==    by 0x402A51E: _vgnU_freeres (vg_preloaded.c:77)
==14286==    by 0x7BC79135: segv_handler (signal_i386.c:1993)
==14286==    by 0x4251BEF: ??? (in /lib32/libpthread-2.27.so)
==14286==    by 0x7BC791B7: segv_handler (signal_i386.c:2023)
==14286==    by 0x4251BEF: ??? (in /lib32/libpthread-2.27.so)
==14286==    by 0xFAF1E3F: ???

which I suspect is a variation of bug 26130

[Bug 20925] d3d[89]/tests/visual crash under valgrind

https://bugs.winehq.org/show_bug.cgi?id=20925

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |36657

[Bug 20925] d3d8:visual and d3d9:visual crash under valgrind

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=20925

François Gouget  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|d3d[89]/tests/visual crash  |d3d8:visual and d3d9:visual
                   |under valgrind              |crash under valgrind
           Keywords|                            |valgrind
                 CC|                            |[e-mail]