Bug 31907

Summary: [SEGFAULT] state_tracker/st_mesa_to_tgsi.c:193: return t->outputs[t->outputMapping[index]];
Product: Mesa Reporter: Sven Arvidsson <sa>
Component: Mesa coreAssignee: mesa-dev
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: medium    
Version: git   
Hardware: Other   
OS: All   
URL: http://www.yofrankie.org/
Whiteboard:
i915 platform: i915 features:
Attachments: Backtrace

Description Sven Arvidsson 2010-11-24 15:08:40 UTC 
Created attachment 40560 [details]
Backtrace

As mentioned in bug 28860, I'm getting a segfault in the game Yo Frankie if shaders are enabled:

Program received signal SIGSEGV, Segmentation fault.
0xb6fc2bfc in translate_dst (t=<value optimized out>, 
    inst=<value optimized out>) at state_tracker/st_mesa_to_tgsi.c:193
193	      return t->outputs[t->outputMapping[index]];

Bisecting leads to this commit:

adf35e80d3b3d37b97f0608a5a2f221dbd8c0d64 is the first bad commit
commit adf35e80d3b3d37b97f0608a5a2f221dbd8c0d64
Author: Brian Paul <brianp@vmware.com>
Date:   Thu Oct 21 19:03:38 2010 -0600

    gallium: new CAP, state for primitive restart

:040000 040000 dad0765228ba7c91fb6bd5b13d36dba74da0b2d8 256dec454d077a85a1d9a5e1892dea68a04a07c3 M	src



System environment:
-- system architecture: 32-bit
-- Linux distribution: Debian unstable
-- GPU: RV570
-- Model: Asus EAX1950Pro 256MB
-- Display connector: DVI
-- xf86-video-ati: e9928fe036e9382fd7bc353f3f05531445f08977
-- xserver: 1.9.0.902 (1.9.1 RC 2)
-- mesa: 1197393faa285bee0d99409a1c82f575dbcbc708
-- drm: 2.4.22
-- kernel: 2.6.36
Comment 1 Marek Olšák 2010-12-07 00:56:22 UTC 
I have just tried it here and it didn't crash. Could you please re-test the game on your machine?
Comment 2 Sven Arvidsson 2010-12-07 09:37:25 UTC 
It's still crashing on the same line.

But I just noticed that I get the same crash in softpipe and llvmpipe, so I guess this bug should be reassigned to Mesa core?
Comment 3 Marek Olšák 2010-12-07 10:15:03 UTC 
Yeah, reassigning to Mesa core.
Comment 4 Brian Paul 2010-12-07 14:25:17 UTC 
In gdb:

(gdb) print index

(gdb) print t->outputMapping[index]

(gdb) print t->outputs

thanks.
Comment 5 Sven Arvidsson 2010-12-08 14:22:23 UTC 
I'm not sure if it's important, but the crash isn't reproducible  if --enable-debug is used. This is from a run with optimisations turned off through CFLAGS (values are optimised out otherwise).

(gdb) print index
$1 = 2
(gdb) print t->outputMapping[index]
$2 = 2228224
(gdb) print t->outputs
$3 = {{File = 0, WriteMask = 0, Indirect = 0, Saturate = 0, Predicate = 0, 
    PredNegate = 0, PredSwizzleX = 0, PredSwizzleY = 0, PredSwizzleZ = 0, 
    PredSwizzleW = 0, Index = 0, IndirectIndex = 0, 
    IndirectSwizzle = 0} <repeats 32 times>}
Comment 6 Brian Paul 2010-12-14 15:17:08 UTC 
Can you provide more debugging info?  After the program crashes in gdb, please do:

(gdb) up
(gdb) call _mesa_print_program(program)
Comment 7 Sven Arvidsson 2010-12-16 13:15:22 UTC 
With git from today (290a114) I can't reproduce the crash if the game is launched by gdb, only by attaching after it's started.

I also had to move up three frames in the stack to be able to call _mesa_print_program(program) (but maybe that's self-explanatory?).

Anyway: 

# Fragment Program/Shader 0
  0: MAD_SAT TEMP[1].x, INPUT[3].xxxx, STATE[0].xxxx, STATE[0].yyyy;
  1: LRP OUTPUT[2].xyz, TEMP[1].xxxx, TEMP[0], STATE[1];
  2: MOV OUTPUT[2].w, TEMP[0];
  3: END
Comment 8 Brian Paul 2011-01-12 19:54:52 UTC 
Mesa commit 2fa6012f6a0b02de6093cbccba3bf4432f072e57 may have fixed this.  Can you retest?
Comment 9 Sven Arvidsson 2011-01-13 13:54:14 UTC 
Just tried git master, it's working fine now!

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.