glretrace crash with SDL 2.0.1 application

[edwintorok]

Testcase: https://raw.github.com/dbuenzli/tsdl/master/test/minc.c
$ gcc -o minc minc.c sdl2-config --cflags --libs
$ apitrace trace ./minc
... close window
$ glretrace ./minc.trace
Rendered 0 frames in 0.139517 secs, average of 0 fps
apitrace: warning: caught signal 11
47: error: caught an unhandled exception
apitrace: info: taking default action for signal 11
Segmentation fault

Backtrace under gdb:
Program received signal SIGSEGV, Segmentation fault.
0x0000000000618b70 in trace::Parser::close (this=0x8ee860 retrace::parser)
at /home/edwin/me/language/C++/apitrace/common/trace_parser.cpp:110
110 delete [] sig->name;
(gdb) bt
#0 0x0000000000618b70 in trace::Parser::close (this=0x8ee860 retrace::parser)

at /home/edwin/me/language/C++/apitrace/common/trace_parser.cpp:110

#1 0x000000000041fd3a in main (argc=2, argv=0x7fffffffe108)

at /home/edwin/me/language/C++/apitrace/retrace/retrace_main.cpp:776

Interestingly no crashes under valgrind.

$ glxinfo|grep OpenGL
OpenGL vendor string: X.Org
OpenGL renderer string: Gallium 0.4 on AMD RV730
OpenGL core profile version string: 3.1 (Core Profile) Mesa 10.0.1
OpenGL core profile shading language version string: 1.40
OpenGL core profile context flags: (none)
OpenGL core profile extensions:
OpenGL version string: 3.0 Mesa 10.0.1
OpenGL shading language version string: 1.30
OpenGL context flags: (none)

$ uname -a
Linux debian 3.12.8 #39 SMP PREEMPT Thu Jan 16 10:06:30 EET 2014 x86_64 GNU/Linux

[edwintorok]

I have bisected the crash to this commit: 4b466a9, i.e. 4b466a9^ works, and 4b466a9 segfaults.
Reverting that commit on top of master would cause a double free though.

I put the code in Parser::close inside an #if 0 as a workaround, do some of the values there share pointers to cause the double frees?

[jrfonseca]

I followed your steps, but I couldn't repro.

I have bisected the crash to this commit: 4b466a9, i.e. 4b466a9^ works, and 4b466a9 segfaults.

This doesn't make much sense: change 4b466a9 shouldn't affect the behavior of glretrace at all.

I put the code in Parser::close inside an #if 0 as a workaround, do some of the values there share pointers to cause the double frees?

There shouldn't be double frees.

I suspect the problem is another sort of memory corruption.

[amonakov]

@edwintorok, could you please make the trace file that induces the crash available (in addition to the C source code)?

[edwintorok]

I've uploaded the trace here: http://etorok.net/minc.trace. It crashes every time with Mesa 10.0.1.
However I just re-tested with Mesa 10.0.2, and it doesn't crash anymore, and valgrind is clean too.
So apparently it was this bug in Mesa, not apitrace, sorry for the confusion: https://bugs.freedesktop.org/show_bug.cgi?id=73761#c1