Ticket #462 (closed Bug: Will Not Fix)
Image pixel buffer corruption with evas_object_image_data_update_add
| Reported by: | rsanders256 | Owned by: | raster |
|---|---|---|---|
| Priority: | Major | Milestone: | |
| Component: | evas | Keywords: | |
| Cc: | Blocked By: | ||
| Blocking: |
Description
After calling evas_object_image_data_update_add, I am seeing memory corruption in the pixel buffer. I'm not sure if this is my problem, a bug in evas, a bug in DirectFB, or a bug in VMWare. I've traced down through the calls and the corruption occurs when stretch blit is performed. It's 100% repeatable on my machine. I have attached a small sample application (this is distilled from trunk/TEST/orig/evas). Also included is a screenshot of the corruption (ebug.png), output of the program (output.txt), svn info output (svn_info.txt), and ldd output (ldd_output.txt).
It does not matter if any actual changes were made to the buffer prior to calling evas_object_image_data_update_add, and it does not seem to matter what area is given as parameters. The test application as delivered does not modify the buffer, it simply gets a pointer to the image data, does an update add, then releases the pointer. If the update_add is not performed, but the pointer get/release is, the corruption does not occur.
I originally found the bug in the test application from trunk/TEST/orig/evas and have distilled it down to the minimum required to reproduce. The corruption is readily visible in the first few pixel rows.
I am running an svn grab from last week (43471) on DirectFB 1.4.2. This is running inside a VMWare virtual machine, Debian GNU/Linux 5.0 x64. gcc version 4.3.2
Here's the critical section of code from the application:
void loop(void)
{
int *data;
data = evas_object_image_data_get(test_pattern, 1);
if ( data )
{
int fw, fh;
evas_object_image_size_get(test_pattern, &fw, &fh);
if ( 0 )
{
// ... ommited ...
}
evas_object_image_data_update_add(test_pattern, 0, 0, fw, fh);
evas_object_image_data_set(test_pattern, data);
}
}
Attachments
Change History
comment:2 Changed 18 months ago by raster
- Status changed from new to closed
- Resolution set to Will Not Fix
hmm sorry to take so long, but i'm back onto bugs for efl 1.0.0 - as such dfb engine has basically bitrotted over time and no one bothers looking at it - i know i don't use it and it has no maintainer or anyone looking after it. as such the gl engine does all the gfx you may need - with opengl full acceleration. it's a first class citizen and looked after. i highly suggest checking it out. otherwise as such the dfb engine has been documented as in "disrepair" - no intention of fixing this unfortunately. if anything the intention of ultimately killing dfb off as dfb itself never really gained a lot of traction. :(
I'm not able to attach files. test_pattern.png is available from svn: trunk/TEST/orig/evas/data
Source for test.c:
#include <stdio.h> #include <stdlib.h> #include <math.h> #include <unistd.h> #include <string.h> #include <directfb/directfb.h> #include "Evas.h" #include "Evas_Engine_DirectFB.h" static Evas *evas = NULL; //static int const win_w = 240; //static int const win_h = 320; static int const win_w = 640; static int const win_h = 480; static double start_time = 0.0; static Evas_Object *test_pattern = NULL; double get_time(void) { struct timeval timev; gettimeofday(&timev, NULL); return(double)timev.tv_sec + (((double)timev.tv_usec) / 1000000); } void loop(void) { int *data; data = evas_object_image_data_get(test_pattern, 1); if ( data ) { int fw, fh; evas_object_image_size_get(test_pattern, &fw, &fh); if ( 0 ) { double t = get_time() - start_time; int x, y; printf( "data(%p) fw(%d) fh(%d) \n", data, fw, fh ); for ( y = 0; y < fh; y++ ) { for ( x = 0; x < fw-100; x++ ) { data[(y * fw) + x] = (((x * y / 10) + (int)(t * 1000))) | 0xff000000; } } } evas_object_image_data_update_add(test_pattern, 0, 0, fw, fh); evas_object_image_data_set(test_pattern, data); } } void setup(void) { Evas_Object *ob; int iw, ih; ob = evas_object_image_add(evas); evas_object_image_file_set(ob, "data/test_pattern.png", NULL); evas_object_move(ob, 0,0 ); evas_object_image_size_get(ob, &iw, &ih); evas_object_resize(ob, iw, ih); printf( "iw(%d) ih(%d) \n", iw, ih ); evas_object_image_fill_set(ob, 0, 0, iw, ih); evas_object_layer_set(ob, 5); evas_object_show(ob); test_pattern = ob; } #define DFBCHECK(x...) \ { \ err = x; \ if (err != DFB_OK) { \ fprintf( stderr, "%s <%d>:\n\t", __FILE__, __LINE__ ); \ DirectFBErrorFatal( #x, err ); \ } \ } int main(int argc, char *argv[]) { IDirectFB *dfb = NULL; IDirectFBSurface *primary; IDirectFBDisplayLayer *layer; DFBResult err; DFBSurfaceDescription dsc; DFBDisplayLayerConfig layer_config; DFBCHECK(DirectFBInit(&argc, &argv)); /* create the super interface */ DFBCHECK(DirectFBCreate(&dfb)); dfb->SetCooperativeLevel(dfb, DFSCL_FULLSCREEN); DFBCHECK(dfb->GetDisplayLayer(dfb, DLID_PRIMARY, &layer)); layer->GetConfiguration(layer, &layer_config); printf( "lw(%d) lh(%d)\n", layer_config.width, layer_config.height ); /* get the primary surface, i.e. the surface of the primary layer we have * exclusive access to */ memset(&dsc, 0, sizeof(DFBSurfaceDescription)); dsc.flags = DSDESC_CAPS | DSDESC_WIDTH | DSDESC_HEIGHT; dsc.width = layer_config.width; dsc.height = layer_config.height; dsc.caps = DSCAPS_PRIMARY; DFBCHECK(dfb->CreateSurface(dfb, &dsc, &primary)); evas_init(); evas = evas_new(); evas_output_method_set(evas, evas_render_method_lookup("directfb")); evas_output_size_set(evas, win_w, win_h); evas_output_viewport_set(evas, 0, 0, win_w, win_h); { Evas_Engine_Info_DirectFB *einfo; einfo = (Evas_Engine_Info_DirectFB *) evas_engine_info_get(evas); einfo->info.dfb = dfb; einfo->info.surface = primary; einfo->info.surface->SetDrawingFlags(einfo->info.surface, DSDRAW_BLEND); evas_engine_info_set(evas, (Evas_Engine_Info *) einfo); } setup(); start_time = get_time(); for ( ; ; ) { loop(); evas_render(evas); } layer->Release(layer); primary->Release(primary); dfb->Release(dfb); evas_shutdown(); return 0; }svn info:
Program output:
rs-debian:/home/sanderrx/t/test# make gcc -Wall -Werror -ggdb3 `pkg-config --libs --cflags directfb evas ecore ecore-evas` test.c -lm -o dfbtest rs-debian:/home/sanderrx/t/test# ./dfbtest ~~~~~~~~~~~~~~~~~~~~~~~~~~| DirectFB 1.4.2 |~~~~~~~~~~~~~~~~~~~~~~~~~~ (c) 2001-2009 The world wide DirectFB Open Source Community (c) 2000-2004 Convergence (integrated media) GmbH ---------------------------------------------------------------- (*) DirectFB/Core: Single Application Core. (2009-11-11 07:07) [ DEBUG ] (*) Direct/Memcpy: Using Generic 64bit memcpy() (*) Direct/Thread: Started 'VT Switcher' (-1) [CRITICAL OTHER/OTHER 0/0] <8388608>... (*) Direct/Thread: Started 'VT Flusher' (-1) [DEFAULT OTHER/OTHER 0/0] <8388608>... (*) DirectFB/FBDev: Found 'VESA VGA' (ID 0) with frame buffer at 0xd0000000, 2400k (MMIO 0x00000000, 0k) (*) Direct/Thread: Started 'PS/2 Input' (-1) [INPUT OTHER/OTHER 0/0] <8388608>... (*) DirectFB/Input: IMPS/2 Mouse 1.0 (directfb.org) (*) Direct/Thread: Started 'Linux Input' (-1) [INPUT OTHER/OTHER 0/0] <8388608>... (*) DirectFB/Input: Macintosh mouse button emulatio (1) 0.1 (directfb.org) (*) Direct/Thread: Started 'Linux Input' (-1) [INPUT OTHER/OTHER 0/0] <8388608>... (*) DirectFB/Input: AT Translated Set 2 keyboard (2) 0.1 (directfb.org) (*) Direct/Thread: Started 'Linux Input' (-1) [INPUT OTHER/OTHER 0/0] <8388608>... (*) DirectFB/Input: Power Button (FF) (3) 0.1 (directfb.org) (*) Direct/Thread: Started 'Linux Input' (-1) [INPUT OTHER/OTHER 0/0] <8388608>... (*) DirectFB/Input: Sleep Button (CM) (4) 0.1 (directfb.org) (*) Direct/Thread: Started 'Linux Input' (-1) [INPUT OTHER/OTHER 0/0] <8388608>... (*) DirectFB/Input: PC Speaker (5) 0.1 (directfb.org) (*) Direct/Thread: Started 'Linux Input' (-1) [INPUT OTHER/OTHER 0/0] <8388608>... (*) DirectFB/Input: ImPS/2 Generic Wheel Mouse (6) 0.1 (directfb.org) (*) Direct/Thread: Started 'Keyboard Input' (4155) [INPUT OTHER/OTHER 0/0] <8388608>... (*) DirectFB/Input: Keyboard 0.9 (directfb.org) (*) DirectFB/Genefx: MMX detected and enabled (*) DirectFB/Graphics: MMX Software Rasterizer 0.6 (directfb.org) (*) DirectFB/Core/WM: Default 0.3 (directfb.org) lw(640) lh(480) iw(573) ih(430)