Bug 27098

Hard to tell anything without gdb output.  Is the crash gone now that intel_miptree_pitch_align is gone in master?

Still crashing, this is the output of winedbg --gdb, not sure if it's of more help?

Program received signal SIGFPE, Arithmetic exception.
0x7cfa2768 in intel_region_alloc (intel=0x7cdefc78, tiling=1, cpp=0, 
    width=1024, height=1024, expect_accelerated_upload=1 '\001')
    at intel_regions.c:190
190	   region = intel_region_alloc_internal(intel, cpp, width, height,
Wine-gdb> bt
#0  0x7cfa2768 in intel_region_alloc (intel=0x7cdefc78, tiling=1, cpp=0, 
    width=1024, height=1024, expect_accelerated_upload=1 '\001')
    at intel_regions.c:190
#1  0x7cfa1c63 in intel_miptree_create (intel=0x7cdefc78, target=3553, 
    base_format=6408, internal_format=35917, first_level=0, last_level=0, 
    width0=1024, height0=1024, depth0=1, cpp=0, compress_byte=0, 
    expect_accelerated_upload=0 '\000') at intel_mipmap_tree.c:143
#2  0x7cfae4c3 in intel_finalize_mipmap_tree (intel=0x7cdefc78, unit=0)
    at intel_tex_validate.c:200
#3  0x7cfc7f20 in brw_validate_textures (brw=0x7cdefc78) at brw_tex.c:56
#4  0x7cfbadb2 in brw_try_draw_prims (ctx=0x7cdefc78, arrays=0x7ce1111c, 
    prim=0x33d428, nr_prims=1, ib=0x33d438, index_bounds_valid=0 '\000', 
    min_index=0, max_index=3) at brw_draw.c:317
#5  brw_draw_prims (ctx=0x7cdefc78, arrays=0x7ce1111c, prim=0x33d428, 
    nr_prims=1, ib=0x33d438, index_bounds_valid=0 '\000', min_index=0, 
    max_index=3) at brw_draw.c:441
#6  0x7d07d59b in vbo_validated_drawrangeelements (ctx=0x7cdefc78, 
    mode=<value optimized out>, index_bounds_valid=<value optimized out>, 
    start=4294967295, end=4294967295, count=6, type=5123, indices=0x19bea0, 
    basevertex=0) at vbo/vbo_exec_array.c:663
#7  0x7d07d721 in vbo_exec_DrawElements (mode=4, count=6, type=5123, 
    indices=0x19bea0) at vbo/vbo_exec_array.c:807
#8  0x7d072089 in neutral_DrawElements (mode=4, count=6, type=5123, 
    indices=0x19bea0) at main/vtxfmt_tmp.h:334
#9  0x7d2cdeba in ?? () from /usr/lib/wine-unstable/wined3d.dll.so
#10 0x7d2a3ec5 in ?? () from /usr/lib/wine-unstable/wined3d.dll.so
#11 0x7d4c8ac3 in ?? () from /usr/lib/wine-unstable/d3d9.dll.so
#12 0x078ca24a in ?? ()

Created attachment 34731 [details]
gdb backtrace

Now using git master 7e246e6aa63979d53731a591f4caee3651c1d96b it crashes in intelTexImage:

(Not sure if the backtrace is helpful, but at least it's captured from gdb this time, not winedbg).

Thread 1 (Thread 0xb75c86c0 (LWP 24538)):
#0  memcpy () at ../sysdeps/i386/i686/memcpy.S:75
No locals.
#1  0x08b50020 in ?? ()
No symbol table info available.
#2  0x7cccf3b1 in intelTexImage (ctx=0x75d2ffe0, dims=<value optimized out>, 
    target=3553, level=0, internalFormat=35917, width=1024, height=1024, 
    depth=1, border=0, format=0, type=0, pixels=0x8b50020, unpack=0x7d8178c4, 
    texObj=0x79a3d348, texImage=0x8bd1000, imageSize=524288, 
    compressed=1 '\001') at intel_tex_image.c:527
        dst = <value optimized out>
        postConvWidth = 1024
        postConvHeight = 1024
        texelBytes = 0
---Type <return> to continue, or q <return> to quit---
        sizeInBytes = <value optimized out>
        dstRowStride = 8192
        srcRowStride = 1024
        __FUNCTION__ = "intelTexImage"
        __PRETTY_FUNCTION__ = "intelTexImage"
#3  0x7cccfea2 in intelCompressedTexImage2D (ctx=0x7d808b40, target=3553, 
    level=0, internalFormat=35917, width=1024, height=1024, border=0, 
    imageSize=524288, data=0x8b50020, texObj=0x79a3d348, texImage=0x79dc6d30)
    at intel_tex_image.c:618
No locals.
#4  0x7cd80270 in _mesa_CompressedTexImage2DARB (target=3553, level=0, 
    internalFormat=35917, width=1024, height=1024, border=0, imageSize=524288, 
    data=0x8b50020) at main/teximage.c:3460
        texObj = 0x79a3d348
        texImage = <value optimized out>
        error = <value optimized out>
        ctx = 0x7d808b40

(In reply to comment #3)
> Created an attachment (id=34731) [details]
> gdb backtrace
> 
> Now using git master 7e246e6aa63979d53731a591f4caee3651c1d96b it crashes in
> intelTexImage:

Never mind this, it's back to crashing in intel_region_alloc again. "aligned_pitch / cpp" results in a divide by zero, I guess there should be an assert somewhere down the line to catch this?

cpp = 0 comes from the call to intel_compressed_num_bytes in line 168 in intel_tex_validate.c.

intel_compressed_num_bytes returns 0 if none of the formats match. Simply making it return 2 (or 4) will get the game running, but obviously with corrupt textures.

I guess the next step is figuring out which format the game uses, and properly adding it to the function.

Okay so _mesa_get_format_name returns MESA_FORMAT_SRGB_DXT1.

Bug can be worked around by launching the game with:

MESA_EXTENSION_OVERRIDE=-GL_EXT_texture_sRGB

Enabling debugging in intelChooseTextureFormat, this is the last line:
 intelChooseTextureFormat intFmt=0x8c4d format=0x0 type=0x0

0x8c4d is GL_COMPRESSED_SRGB_ALPHA_S3TC_DXT1_EXT

Created attachment 37156 [details] [review]
Band-aid, prevent the crash.

commit 7554b83a21bd62b20df5a7327b69f08108ac9ab6
Author: Eric Anholt <eric@anholt.net>
Date:   Thu May 13 14:48:13 2010 -0700

    intel: Handle arbitrary compressed formats in intel_compressed_num_bytes.
    
    Note that we don't support arbitrary block size for compressed quite
    yet -- block height of 4 is hard-coded all over the place.
    
    Bug #27098 (srgb dxt1 producing a bytes per pixel of 0).