Bug 110541

Summary:	malloc() error when compiling shader
Product:	Mesa	Reporter:	Kevin Shanahan <kevin>
Component:	Drivers/DRI/i965	Assignee:	Intel 3D Bugs Mailing List <intel-3d-bugs>
Status:	RESOLVED FIXED	QA Contact:	Intel 3D Bugs Mailing List <intel-3d-bugs>
Severity:	normal
Priority:	medium
Version:	19.0
Hardware:	x86-64 (AMD64)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:
Attachments:	Test program to reproduce the error.

Description Kevin Shanahan 2019-04-29 00:41:01 UTC

Created attachment 144105 [details]
Test program to reproduce the error.

While working on some OpenGL tutorials, I found that on my computer with Intel graphics, the fragment shader has problems - colours were coming out incorrect at first (works fine on my RX580).  When I tried to simplify the shader to narrow down the cause, the program started crashing during compilation of the shader with the error:

   corrupted size vs. prev_size
   Aborted (core dumped)

I compiled a debug version of Mesa (19.0.3) and got the following stack trace of the crash:

[kmshanah@cable test2]$ gdb ./lighting
GNU gdb (GDB) 8.2.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./lighting...done.
(gdb) run
Starting program: /home/kmshanah/projects/sdl/test2/lighting 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[New Thread 0x7ffff4e81700 (LWP 12031)]
malloc(): invalid size (unsorted)

Thread 1 "lighting" received signal SIGABRT, Aborted.
0x00007ffff75af82f in raise () from /usr/lib/libc.so.6
(gdb) bt
#0  0x00007ffff75af82f in raise () from /usr/lib/libc.so.6
#1  0x00007ffff759a672 in abort () from /usr/lib/libc.so.6
#2  0x00007ffff75f1e78 in __libc_message () from /usr/lib/libc.so.6
#3  0x00007ffff75f878a in malloc_printerr () from /usr/lib/libc.so.6
#4  0x00007ffff75fb4a4 in _int_malloc () from /usr/lib/libc.so.6
#5  0x00007ffff75fccda in malloc () from /usr/lib/libc.so.6
#6  0x00007ffff56907ce in ralloc_size (ctx=0x5555555bcbd0, size=size@entry=136) at ../mesa-19.0.3/src/util/ralloc.c:119
#7  0x00007ffff56908a9 in rzalloc_size (ctx=<optimized out>, size=size@entry=136) at ../mesa-19.0.3/src/util/ralloc.c:151
#8  0x00007ffff59a0a9d in nir_intrinsic_instr_create (shader=<optimized out>, op=nir_intrinsic_load_barycentric_pixel) at ../mesa-19.0.3/src/compiler/nir/nir.c:501
#9  0x00007ffff59ad3af in nir_load_barycentric (interp_mode=1, op=<optimized out>, build=0x7fffffffc508) at ../mesa-19.0.3/src/compiler/nir/nir_builder.h:1092
#10 lower_load (intrin=intrin@entry=0x555555c415c0, state=state@entry=0x7fffffffc500, vertex_index=0x0, var=0x555555c22da0, offset=0x555555c22ea0, component=0)
    at ../mesa-19.0.3/src/compiler/nir/nir_lower_io.c:227
#11 0x00007ffff59b357d in lower_interpolate_at (component=<optimized out>, offset=<optimized out>, var=<optimized out>, state=<optimized out>, intrin=<optimized out>)
    at ../mesa-19.0.3/src/compiler/nir/nir_lower_io.c:479
#12 nir_lower_io_block (block=0x555555c32150, state=0x7fffffffc500) at ../mesa-19.0.3/src/compiler/nir/nir_lower_io.c:510
#13 nir_lower_io_impl (options=(unknown: 0), type_size=0x7ffff5b9fe00 <brw::type_size_vec4(glsl_type const*)>, modes=nir_var_shader_in, impl=0x555555c279d0)
    at ../mesa-19.0.3/src/compiler/nir/nir_lower_io.c:554
#14 nir_lower_io (shader=shader@entry=0x5555555bcbd0, modes=modes@entry=nir_var_shader_in, type_size=0x7ffff5b9fe00 <brw::type_size_vec4(glsl_type const*)>, options=(unknown: 0))
    at ../mesa-19.0.3/src/compiler/nir/nir_lower_io.c:573
#15 0x00007ffff5b36f10 in brw_nir_lower_fs_inputs (nir=nir@entry=0x5555555bcbd0, devinfo=devinfo@entry=0x55555561b718, key=key@entry=0x7fffffffdf00)
    at ../mesa-19.0.3/src/intel/compiler/brw_nir.c:455
#16 0x00007ffff5af2754 in brw_compile_fs (compiler=0x55555561d7b0, log_data=log_data@entry=0x5555558065b0, mem_ctx=mem_ctx@entry=0x555555c21fd0, key=key@entry=0x7fffffffdf00, 
    prog_data=prog_data@entry=0x7fffffffdcb0, shader=shader@entry=0x5555555bcbd0, prog=0x555555c29d60, shader_time_index8=-1, shader_time_index16=-1, shader_time_index32=-1, 
    allow_spilling=true, use_rep_send=false, vue_map=0x7fffffffdfb0, error_str=0x7fffffffdca8) at ../mesa-19.0.3/src/intel/compiler/brw_fs.cpp:7604
#17 0x00007ffff55f9778 in brw_codegen_wm_prog (brw=brw@entry=0x5555558065b0, fp=fp@entry=0x555555c29d60, key=key@entry=0x7fffffffdf00, vue_map=0x7fffffffdfb0)
    at ../mesa-19.0.3/src/mesa/drivers/dri/i965/brw_wm.c:184
#18 0x00007ffff55fb746 in brw_fs_precompile (ctx=ctx@entry=0x5555558065b0, prog=0x555555c29d60) at ../mesa-19.0.3/src/mesa/drivers/dri/i965/brw_wm.c:689
#19 0x00007ffff55e40db in brw_shader_precompile (sh_prog=0x555555847e60, ctx=0x5555558065b0) at ../mesa-19.0.3/src/mesa/drivers/dri/i965/brw_link.cpp:56
#20 brw_link_shader (ctx=0x5555558065b0, shProg=0x555555847e60) at ../mesa-19.0.3/src/mesa/drivers/dri/i965/brw_link.cpp:375
#21 0x00007ffff58297da in _mesa_glsl_link_shader (ctx=ctx@entry=0x5555558065b0, prog=prog@entry=0x555555847e60) at ../mesa-19.0.3/src/mesa/program/ir_to_mesa.cpp:3174
#22 0x00007ffff5723e3a in link_program (no_error=<optimized out>, shProg=<optimized out>, ctx=<optimized out>) at ../mesa-19.0.3/src/mesa/main/shaderapi.c:1206
#23 link_program_error (shProg=0x555555847e60, ctx=0x5555558065b0) at ../mesa-19.0.3/src/mesa/main/shaderapi.c:1286
#24 link_program_error (ctx=0x5555558065b0, shProg=0x555555847e60) at ../mesa-19.0.3/src/mesa/main/shaderapi.c:1284
#25 0x0000555555556884 in load_shader (vertexPath=0x555555575f2e "lighting.vs", fragmentPath=0x555555575f22 "lighting.fs", result=0x7fffffffe260) at shader.c:99
#26 0x0000555555572d16 in initGL () at lighting.c:222
#27 0x0000555555572cb2 in init () at lighting.c:208
#28 0x0000555555573f40 in main (argc=1, args=0x7fffffffe878) at lighting.c:544

glxinfo gives the following driver info:

    Vendor: Intel Open Source Technology Center (0x8086)
    Device: Mesa DRI Intel(R) HD Graphics 515 (Skylake GT2)  (0x191e)
    Version: 19.0.3
    Accelerated: yes
    Video memory: 3072MB
    Unified memory: yes
    Preferred profile: core (0x1)
    Max core profile version: 4.5
    Max compat profile version: 3.0
    Max GLES1 profile version: 1.1
    Max GLES[23] profile version: 3.2

I will attach my small test program.

Comment 1 Kenneth Graunke 2019-04-29 05:09:18 UTC

Hi Kevin,

I believe I fixed this bug a little while ago on Mesa master.  We made some pretty invasive changes to how we handled samples in structs, and it broke some things.  I'm trying to get the fixes backported to 19.x but unfortunately missed 19.0.3...

Comment 2 Kevin Shanahan 2019-04-29 06:04:33 UTC

(In reply to Kenneth Graunke from comment #1)
> Hi Kevin,
> 
> I believe I fixed this bug a little while ago on Mesa master.  We made some
> pretty invasive changes to how we handled samples in structs, and it broke
> some things.  I'm trying to get the fixes backported to 19.x but
> unfortunately missed 19.0.3...

This may or may not still be relevant (haven't figured out all the things I need to try out master branch), but I got as far as finding an out-of-bounds write in brw_nir_setup_glsl_uniform().  I added:

  assert(uniform_index < stage_prog_data->nr_params);

Just before:

  stage_prog_data->param[uniform_index++] = BRW_PARAM_UNIFORM(idx);

And this assert does fire.  But I think I'll try building master before going any further with debugging this.

Comment 3 Kevin Shanahan 2019-04-29 09:23:00 UTC

Thanks, I can confirm that this is fixed in master.

Comment 4 Tapani Pälli 2019-06-12 06:59:34 UTC

As per comment #3, I'm resolving this as fixed.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.