Bug 111286

Summary: Mesa glsl compiler crashes in "tropico 6" game on an assertion
Product: Mesa Reporter: andrii simiklit <andrey.simiklit.1989>
Component: Drivers/DRI/i965Assignee: Intel 3D Bugs Mailing List <intel-3d-bugs>
Status: RESOLVED FIXED QA Contact: Intel 3D Bugs Mailing List <intel-3d-bugs>
Severity: normal    
Priority: medium    
Version: git   
Hardware: Other   
OS: All   
Whiteboard:
i915 platform: i915 features:

Description andrii simiklit 2019-08-02 14:58:09 UTC
Tested just on KBL and SKL

The issue was bisected to commit:
156306e5e62fb4fda0e829c5798fffdf7eb1907c

I am investigating this issue. 

Mesa compiler guys please don't steal my bug)))
Comment 1 andrii simiklit 2019-08-08 12:58:16 UTC
So shader_test which could reproduce this issue is here:
https://gitlab.freedesktop.org/mesa/piglit/merge_requests/108

Suggested mesa fix:
https://gitlab.freedesktop.org/mesa/mesa/merge_requests/1615

The problem happens when shader tries to copy some part of the array of inputs
to some temp array and then uses these temp array elements like here:

[fragment shader]
uniform int idx;
in vec4 vs_data[3];
out vec4 out_put;

void main()
{
   vec4 temp[2];
   temp[0] = vs_data[0];
   temp[1] = vs_data[1];
   temp[2] = vs_data[2];
   out_put = temp[idx];
}

1. optimization find_array_copies creates a copy_deref for temp[*] = vs_data[*] regardless that these arrays have different lengths.
2. nir_opt_copy_prop_vars tries to prevent copying and use the original array instead and crashes here:
"assert(glsl_get_length(parent->type) ==
             glsl_get_length(leader_parent->type));"

The crash call stack:
libc.so.6!__GI___assert_fail(...)
nir_build_deref_follower(...)
specialize_wildcards(...)
load_from_deref_entry_value(...)
try_load_from_entry(...)
copy_prop_vars_block(...)
copy_prop_vars_cf_node(...)
copy_prop_vars_cf_node(...)
nir_copy_prop_vars_impl(...)
nir_opt_copy_prop_vars(...)
brw_nir_optimize(...)
brw_preprocess_nir(...)
brw_create_nir(...)
brw_link_shader(...)
Comment 2 andrii simiklit 2019-09-10 09:00:06 UTC
Should be fixed by commit: ff2225cf88d8773c599277362306a4bcf4ba6b01
"nir/find_array_copies: Reject copies with mismatched lengths"

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.