Bug 30030

Summary: Crash in loop_control_visitor::visit_leave(ir_loop*) ()
Product: Mesa Reporter: Magnus Kessler <Magnus.Kessler>
Component: Mesa coreAssignee: Ian Romanick <idr>
Status: VERIFIED FIXED QA Contact:
Severity: normal    
Priority: medium    
Version: git   
Hardware: All   
OS: All   
Whiteboard:
i915 platform: i915 features:
Attachments: landmass fragment shader
landmass "g" vertex shader
landmass geometry shader
landmass vertex shader

Description Magnus Kessler 2010-09-05 06:42:58 UTC
Since commit 8df2dbf91ddfd0c1590e33015e85470b67e69319 the OpenSceneGraph based fgfs (flightgear) crashes in loop_control_visitor::visit_leave(ir_loop*) () with the following backtrace:

#0  0x00007f920dc15785 in *__GI_raise (sig=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007f920dc16c06 in *__GI_abort () at abort.c:92
#2  0x00007f920dc0e305 in *__GI___assert_fail (
    assertion=0x7f920b875c89 "ls != __null", file=<value optimized out>, 
    line=177, function=<value optimized out>) at assert.c:81
#3  0x00007f920b6ddb6f in loop_control_visitor::visit_leave(ir_loop*) ()
   from /usr/lib64/dri/r300_dri.so
#4  0x00007f920b6ceb48 in visit_list_elements(ir_hierarchical_visitor*, exec_list*) () from /usr/lib64/dri/r300_dri.so
#5  0x00007f920b6cf4ff in ir_if::accept(ir_hierarchical_visitor*) ()
   from /usr/lib64/dri/r300_dri.so
#6  0x00007f920b6ceb48 in visit_list_elements(ir_hierarchical_visitor*, exec_list*) () from /usr/lib64/dri/r300_dri.so
#7  0x00007f920b6ceced in ir_function_signature::accept(ir_hierarchical_visitor*) () from /usr/lib64/dri/r300_dri.so
#8  0x00007f920b6ceb48 in visit_list_elements(ir_hierarchical_visitor*, exec_list*) () from /usr/lib64/dri/r300_dri.so
#9  0x00007f920b6ced5c in ir_function::accept(ir_hierarchical_visitor*) ()
   from /usr/lib64/dri/r300_dri.so
#10 0x00007f920b6ceb48 in visit_list_elements(ir_hierarchical_visitor*, exec_list*) () from /usr/lib64/dri/r300_dri.so
#11 0x00007f920b6ddbd5 in set_loop_controls(exec_list*, loop_state*) ()
   from /usr/lib64/dri/r300_dri.so
#12 0x00007f920b6bfcce in do_common_optimization(exec_list*, bool) ()
   from /usr/lib64/dri/r300_dri.so
#13 0x00007f920b6dbe55 in link_shaders(__GLcontextRec*, gl_shader_program*) ()
   from /usr/lib64/dri/r300_dri.so
#14 0x00007f920b6a80ab in _mesa_glsl_link_shader ()
   from /usr/lib64/dri/r300_dri.so
#15 0x00007f920e852add in osg::Program::PerContextProgram::linkProgram (
    this=0x7f91ece190e0, state=<value optimized out>)
    at /usr/src/debug/dev-games/openscenegraph-9999/openscenegraph-9999/src/osg/Program.cpp:518
#16 0x00007f920e851ca0 in osg::Program::apply (this=0x1044bcd0, state=...)
[...]
Comment 1 Ian Romanick 2010-09-06 22:00:43 UTC
I suspect that this has nothing to do with the R300 driver, so I'm changing th component.

Please provide the offending shader.  What's the output with MESA_DEBUG=dump?
Comment 2 Magnus Kessler 2010-09-06 23:28:58 UTC
MESA_DEBUG=dump doesn't produce any additional output, unfortunately.

I have narrowed the crash down to using either one of the "landmass" or "transition" shader effect settings. I'll attach the "landmass" shader files from flightgear fgdata git (http://www.gitorious.org/fg/fgdata/ @commit 909a8210462124f96df790d906c758d915c38b24).
Comment 3 Magnus Kessler 2010-09-06 23:29:57 UTC
Created attachment 38500 [details]
landmass fragment shader
Comment 4 Magnus Kessler 2010-09-06 23:30:54 UTC
Created attachment 38501 [details]
landmass "g" vertex shader
Comment 5 Magnus Kessler 2010-09-06 23:32:03 UTC
Created attachment 38502 [details]
landmass geometry shader
Comment 6 Magnus Kessler 2010-09-06 23:32:46 UTC
Created attachment 38503 [details]
landmass vertex shader
Comment 7 Magnus Kessler 2010-09-07 04:17:03 UTC
Indeed, it's not related to the hardware driver. When enabling shader based effects in flightgear, I get a similar crash on intel GM45 hardware with the i965 driver:

#0  0x00007ffff4c04785 in *__GI_raise (sig=6)                                                                                                                               
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64                                                                                                                           
#1  0x00007ffff4c05c06 in *__GI_abort () at abort.c:92                                                                                                                      
#2  0x00007ffff4bfd305 in *__GI___assert_fail (                                                                                                                             
    assertion=0x7ffff28c3909 "ls != __null", file=<value optimized out>,                                                                                                    
    line=177, function=<value optimized out>) at assert.c:81                                                                                                                
#3  0x00007ffff27d5aaf in loop_control_visitor::visit_leave (                                                                                                               
    this=0x7fffffffc610, ir=0x7fffde3ad810) at loop_controls.cpp:177                                                                                                        
#4  0x00007ffff27c6d18 in visit_list_elements (v=0x7fffffffc610,                                                                                                            
    l=<value optimized out>) at ir_hv_accept.cpp:48                                                                                                                         
#5  0x00007ffff27c76cf in ir_if::accept (this=0x7fffdd3a5b30, v=0x7fffffffc610)                                                                                             
    at ir_hv_accept.cpp:366                                                                                                                                                 
#6  0x00007ffff27c6d18 in visit_list_elements (v=0x7fffffffc610,                                                                                                            
    l=<value optimized out>) at ir_hv_accept.cpp:48                                                                                                                         
#7  0x00007ffff27c6ebd in ir_function_signature::accept (this=0x7fffdf3ac3e0,                                                                                               
    v=0x7fffffffc610) at ir_hv_accept.cpp:120                                                                                                                               
#8  0x00007ffff27c6d18 in visit_list_elements (v=0x7fffffffc610,                                                                                                            
    l=<value optimized out>) at ir_hv_accept.cpp:48                                                                                                                         
#9  0x00007ffff27c6f2c in ir_function::accept (this=0x7fffdf3ac330,                                                                                                         
    v=0x7fffffffc610) at ir_hv_accept.cpp:132                                                                                                                               
#10 0x00007ffff27c6d18 in visit_list_elements (v=0x7fffffffc610,                                                                                                            
    l=<value optimized out>) at ir_hv_accept.cpp:48                                                                                                                         
#11 0x00007ffff27d5b15 in set_loop_controls (instructions=0x7fffdd024c50,                                                                                                   
    ls=0x7fffdd09ee00) at loop_controls.cpp:291                                                                                                                             
#12 0x00007ffff27b94be in do_common_optimization (ir=0x7fffdd024c50,                                                                                                        
    linked=<value optimized out>) at glsl_parser_extras.cpp:744                                                                                                             
#13 0x00007ffff27d3ea5 in link_shaders (ctx=<value optimized out>,                                                                                                          
    prog=0x7fffdcf95fc0) at linker.cpp:1473
#14 0x00007ffff27a232b in _mesa_glsl_link_shader (ctx=0xfcc8e0, 
    prog=0x7fffdcf95fc0) at program/ir_to_mesa.cpp:2867
#15 0x00007ffff5841add in osg::Program::PerContextProgram::linkProgram (
    this=0x7fffdcf16690, state=<value optimized out>)
    at /usr/src/debug/dev-games/openscenegraph-9999/openscenegraph-9999/src/osg/Program.cpp:518
#16 0x00007ffff5840ca0 in osg::Program::apply (this=0x14628640, state=...)
    at /usr/src/debug/dev-games/openscenegraph-9999/openscenegraph-9999/src/osg/Program.cpp:361
Comment 8 Ian Romanick 2010-09-07 13:02:41 UTC
We found another shader in the OpenGL ES2 conformance test suite that hits the same assertion.  It appears that something is going wrong when there is a loop inside nested if-statements.  The landmass fragment shader hits this after ray_intersect is inlined.
Comment 9 Ian Romanick 2010-09-07 13:42:22 UTC
I added a piglit test case for this bug: glsl-fs-loop-nested-if.shader_test.  The piglit test and the OpenGL ES conformance test are fixed by the following commit.  Could you please verify flightgear is also fixed?

commit 956f049fd24eb5239361e68a1f27e1bebb3315a0
Author: Ian Romanick <ian.d.romanick@intel.com>
Date:   Tue Sep 7 13:33:48 2010 -0700

    glsl2: Early return with visit_continue in loop_analysis::visit(ir_dereferen
    
    Returning early with visit_continue_with_parent prevented the
    then-statements and else-statements of if-statements such as the
    following from being processed:
    
          if (some_var) { ... } else { ... }
    
    Fixes piglit test case glsl-fs-loop-nested-if and bugzilla #30030.
Comment 10 Magnus Kessler 2010-09-07 16:06:52 UTC
Yes, flightgear seems to work fine now with the r300g driver. Thanks!

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.