Bug 105438

Summary: Indexing by ivec causes crash
Product: Mesa Reporter: Felix Potthast <mail>
Component: Drivers/DRI/i965Assignee: Intel 3D Bugs Mailing List <intel-3d-bugs>
Status: RESOLVED FIXED QA Contact: Intel 3D Bugs Mailing List <intel-3d-bugs>
Severity: normal    
Priority: medium CC: andriy.khulap
Version: 17.3   
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:

Description Felix Potthast 2018-03-11 17:19:30 UTC
When i index one vector by another unconstantly indexed integer vector, i get a crash. See https://www.shadertoy.com/view/ldGyzR as an example.

I'm using mesa version 17.3.6-1 on Sandy Bridge.
Comment 1 Andriy Khulap 2018-03-29 12:51:37 UTC
I can reproduce this issue on Skylake with most mesa versions: 11.0.0-rc1 .. 17.3.6 .. latest git master in firefox, chrome and chromium browsers.

The crash is caused by the unreachable("not reached"); trap in the end of void
nir_visitor::visit(ir_expression *ir) (src/compiler/glsl/glsl_to_nir.cpp, line 1963).


Issue can be fixed by adding empty case for ir_binop_vector_extract:

diff --git a/src/compiler/glsl/glsl_to_nir.cpp b/src/compiler/glsl/glsl_to_nir.cpp
index c4a6d52a5b..24acfa1f8d 100644
--- a/src/compiler/glsl/glsl_to_nir.cpp
+++ b/src/compiler/glsl/glsl_to_nir.cpp
@@ -1952,6 +1952,9 @@ nir_visitor::visit(ir_expression *ir)
    case ir_quadop_vector:
       result = nir_vec(&b, srcs, ir->type->vector_elements);
       break;
+   case ir_binop_vector_extract:
+      /* Prevent the unreachable trap */
+      break;
 
    default:
       unreachable("not reached");


or by adding its handler to special cases:

diff --git a/src/compiler/glsl/glsl_to_nir.cpp b/src/compiler/glsl/glsl_to_nir.cpp
index c4a6d52a5b..d9efdd7170 100644
--- a/src/compiler/glsl/glsl_to_nir.cpp
+++ b/src/compiler/glsl/glsl_to_nir.cpp
@@ -1493,6 +1493,12 @@ nir_visitor::visit(ir_expression *ir)
       return;
    }
 
+   case ir_binop_vector_extract:
+      assert(ir->num_operands == 2);
+      ir->operands[0]->accept(this);
+      ir->operands[1]->accept(this);
+      return;
+
    default:
       break;
    }
Comment 2 Tapani Pälli 2018-04-03 07:02:42 UTC
I've sent a Piglit test for this, Andriy please send your patch to mesa-dev mailing list.
Comment 3 Denis 2018-05-03 09:37:31 UTC
Hi Tapani. As I can see, fix was sent
https://patchwork.freedesktop.org/patch/214406/
but it is still in "New" state.
Comment 4 Juan A. Suarez 2018-05-10 09:01:34 UTC
Do you mind to test if the following patch also fixes this issue:

https://patchwork.freedesktop.org/patch/221815/
Comment 5 Felix Potthast 2018-05-10 14:22:45 UTC
Piglit's glsl-fs-vec4-indexing-8.shader_test is exactly this bug.
See the commit message:
https://cgit.freedesktop.org/piglit/commit/?id=965b55efbdf37985c731d68259012fdc5cef3d09
Comment 6 Juan A. Suarez 2018-05-14 09:45:28 UTC
Nice! Thanks for confirming.
Comment 7 Sergii Romantsov 2018-07-13 06:36:24 UTC
Hello, Felix.
Seems patch-fix was applied.

Could you, please, close the issue?
Comment 8 Felix Potthast 2018-07-13 08:23:40 UTC
Ah, i didn't notice that, thanks.
I can confirm this is fixed with newest Mesa release.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.