Bug#616485: libgl1-mesa-dri/radeon: [amd64] iceweasel segfault from flashplugin-nonfree inside libgl-mesa-*

[Yann Dirson <ydirson@free.fr>]

On Sun, Mar 06, 2011 at 12:03:19AM +0100, Cyril Brulebois wrote:
> > Ah, so that's planned for 7.10-5 or so ?  But then 7.10-2 would have
> > made things better, if I understand well.
> 
> Yep, although it might be 7.10.1-1 in experimental instead (hopefully,
> 7.10-4 will move to testing, and we'll upload that r600g???r600c switch
> to sid through 7.10.1-*).
> 
> > I also note that I still have the old 7.7.1 glu packages.  Not being
> > sure about the effect of any mismatch here...
> 
> I don't think it matters, but all those packages scare the hell out of
> me???

I confirm that upgrading them to 7.10-2 does not help.

> > Should I try to downgrade any other packages ?  Or to another
> > specific version ?
> 
> You might want to try 7.10.1 when it shows up in experimental, or try
> a local build from master:
>   http://pkg-xorg.alioth.debian.org/howto/build-mesa.html

Looking forward to this.

Downgrading to 7.7.1 for the time being... it now says (without
restarting X, but I'm not sure it matters for this particular bug):

#0  0x00007fff983f9410 in radeonFlush (ctx=0x7fffc458c000) at radeon_common.c:1107
#1  0x00007fff983f4a73 in radeon_firevertices (ctx=0x7fffc458c000, texObj=0x7fffbc77d000) at radeon_cmdbuf.h:118
#2  r600DeleteTexture (ctx=0x7fffc458c000, texObj=0x7fffbc77d000) at r600_tex.c:351
#3  0x00007fff9847963b in _mesa_reference_texobj (ptr=0x7fffc4597650, tex=0x0) at main/texobj.c:345
#4  0x00007fff9847c360 in _mesa_free_texture_data (ctx=0x7fffc458c000) at main/texstate.c:788
#5  0x00007fff984169e8 in _mesa_free_context_data (ctx=0x7fffc458c000) at main/context.c:972
#6  0x00007fff98416b0e in _mesa_destroy_context (ctx=0x7fffc458c000) at main/context.c:1028
#7  0x00007fff983f80a5 in radeonDestroyContext (driContextPriv=<value optimized out>) at radeon_common_context.c:328
#8  0x00007fff983d4ea0 in driDestroyContext (pcp=0x7fffb5b50640) at ../common/dri_util.c:546
#9  0x00007fff98ca3593 in dri2DestroyContext (context=0x7fffb5b503a0, psc=0x0, dpy=0x4) at dri2_glx.c:95
#10 0x00007fff98c7d6d8 in DestroyContext (dpy=0x7ffff6d72000, gc=0x7fffc9fafc80) at glxcmds.c:556
#11 0x00007fff9fbf7744 in ?? () from /usr/lib/flashplugin-nonfree/libflashplayer.so

Looks like a good time to hunt for the particular tab that triggers the crash...

> I don't think it would hurt to report a bug upstream (product Mesa):
>   http://bugs.freedesktop.org/
> 
> but they'll likely ask you to try 7.10.1 at least.

OK, so waiting first :)