Bug 32309

mesa: a2ab929ab2d7dd4fcbbc5f32c8feabf42cad4d34 (master)

The crash still occurs with Firefox 4.0 Beta 9.

(gdb) bt
#0  0x02e80ac3 in update_tgsi_samplers (softpipe=0xdc74000) at sp_state_derived.c:204
#1  0x02e80c6d in softpipe_update_derived (softpipe=0xdc74000) at sp_state_derived.c:262
#2  0x02e71983 in softpipe_draw_vbo (pipe=0xdc74000, info=0xbfd7a084) at sp_draw_arrays.c:125
#3  0x02f56e24 in st_draw_vbo (ctx=0x93e3000, arrays=0x90df350, prims=0xbfd7a11c, nr_prims=1, ib=0x0, index_bounds_valid=1 '\001', min_index=0, max_index=2)
    at state_tracker/st_draw.c:733
#4  0x03037822 in vbo_draw_arrays (ctx=0x93e3000, mode=4, start=0, count=3, numInstances=1) at vbo/vbo_exec_array.c:588
#5  0x03037979 in vbo_exec_DrawArrays (mode=4, start=0, count=3) at vbo/vbo_exec_array.c:619
#6  0x01141646 in fDrawArrays (this=0xb2a4b360, mode=4, first=0, count=3) at ../../../dist/include/GLContext.h:1279
#7  mozilla::WebGLContext::DrawArrays (this=0xb2a4b360, mode=4, first=0, count=3)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/content/canvas/src/WebGLContextGL.cpp:1245
#8  0x014e7c40 in nsIDOMWebGLRenderingContext_DrawArrays (cx=0xaa3d78a0, argc=3, vp=0xb2cfe140) at dom_quickstubs.cpp:29010
#9  0x01b9777f in CallJSNative (this=0xbfd7a730) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/jscntxtinlines.h:692
#10 CallCompiler::generateNativeStub (this=0xbfd7a730) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/methodjit/MonoIC.cpp:691
#11 0x01b90eef in js::mjit::ic::NativeCall (f=..., ic=<value optimized out>)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/methodjit/MonoIC.cpp:898
#12 0x039ce8cc in ?? ()
#13 0x01b3a5fc in EnterMethodJIT (cx=0xaa3d78a0) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/methodjit/MethodJIT.cpp:748
#14 CheckStackAndEnterMethodJIT (cx=0xaa3d78a0) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/methodjit/MethodJIT.cpp:774
#15 js::mjit::JaegerShot (cx=0xaa3d78a0) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/methodjit/MethodJIT.cpp:791
#16 0x01a00aaf in RunScript (cx=0xaa3d78a0, chain=0xb2339c30, script=0xb24ea240, prev=0xb2cfe088, flags=8, result=0xb2cfe0c8)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/jsinterp.cpp:654
#17 js::Execute (cx=0xaa3d78a0, chain=0xb2339c30, script=0xb24ea240, prev=0xb2cfe088, flags=8, result=0xb2cfe0c8)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/jsinterp.cpp:1023
#18 0x01a1b50d in js::EvalKernel (cx=0xaa3d78a0, argc=1, vp=0xb2cfe0c8, evalType=js::DIRECT_EVAL, caller=0xb2cfe088, scopeobj=0xb2339c30)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/jsobj.cpp:1266
#19 0x01a026dc in js::DirectEval (cx=0xaa3d78a0, evalfun=0xb23750f0, argc=1, vp=0xb2cfe0c8)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/jsinterp.cpp:1368
#20 0x01bb2bf7 in js::mjit::stubs::Eval (f=<value optimized out>, argc=<value optimized out>)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/methodjit/InvokeHelpers.cpp:447
#21 0x03fc35a8 in ?? ()
#22 0x01b3a5fc in EnterMethodJIT (cx=0xaa3d78a0) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/methodjit/MethodJIT.cpp:748
#23 CheckStackAndEnterMethodJIT (cx=0xaa3d78a0) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/methodjit/MethodJIT.cpp:774
#24 js::mjit::JaegerShot (cx=0xaa3d78a0) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/methodjit/MethodJIT.cpp:791
#25 0x01a00aaf in RunScript (cx=0xaa3d78a0, chain=0xb23681e0, script=0xdc61000, prev=0x0, flags=0, result=0x0)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/jsinterp.cpp:654
#26 js::Execute (cx=0xaa3d78a0, chain=0xb23681e0, script=0xdc61000, prev=0x0, flags=0, result=0x0)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/jsinterp.cpp:1023
#27 0x01989a75 in JS_EvaluateUCScriptForPrincipals (cx=0xaa3d78a0, obj=0xb23681e0, principals=0x7d2389c4, chars=0xdc69008, length=5632, 
    filename=0xdbff248 "https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/conformance/draw-arrays-out-of-bounds.html", lineno=35, 
    rval=0x0) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/jsapi.cpp:4920
#28 0x01989fa2 in JS_EvaluateUCScriptForPrincipalsVersion (cx=0xaa3d78a0, obj=0xb23681e0, principals=0x7d2389c4, chars=0xdc69008, length=5632, 
    filename=0xdbff248 "https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/conformance/draw-arrays-out-of-bounds.html", lineno=35, 
    rval=0x0, version=JSVERSION_DEFAULT) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/js/src/jsapi.cpp:4896
#29 0x01241005 in nsJSContext::EvaluateString (this=0xa8f6c9c0, aScript=..., aScopeObject=0xb23681e0, aPrincipal=0x7d2389c0, 
    aURL=0xdbff248 "https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/conformance/draw-arrays-out-of-bounds.html", aLineNo=35, 
    aVersion=0, aRetValue=0x0, aIsUndefined=0xbfd7ac84)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/dom/base/nsJSEnvironment.cpp:1734
#30 0x01101d78 in nsScriptLoader::EvaluateScript (this=0x1a4db280, aRequest=0xb207c190, aScript=...)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/content/base/src/nsScriptLoader.cpp:890
#31 0x0110203f in nsScriptLoader::ProcessRequest (this=0x1a4db280, aRequest=0xb207c190)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/content/base/src/nsScriptLoader.cpp:783
#32 0x01103ce5 in nsScriptLoader::ProcessScriptElement (this=0x1a4db280, aElement=0x64938a34)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/content/base/src/nsScriptLoader.cpp:729
#33 0x0110105a in nsScriptElement::MaybeProcessScript (this=0x64938a34)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/content/base/src/nsScriptElement.cpp:180
#34 0x011a2206 in nsHTMLScriptElement::MaybeProcessScript (this=0x64938a00)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/content/html/content/src/nsHTMLScriptElement.cpp:583
#35 0x011a19cf in nsHTMLScriptElement::DoneAddingChildren (this=0x64938a00, aHaveNotified=1)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/content/html/content/src/nsHTMLScriptElement.cpp:510
#36 0x013142aa in nsHtml5TreeOpExecutor::RunScript (this=0xa2e1bf10, aScriptElement=0x64938a00)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/parser/html/nsHtml5TreeOpExecutor.cpp:730
#37 0x01314d0b in nsHtml5TreeOpExecutor::RunFlushLoop (this=0xa2e1bf10)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/parser/html/nsHtml5TreeOpExecutor.cpp:525
#38 0x01314f21 in nsHtml5ExecutorReflusher::Run (this=0x7d20f3e0)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/parser/html/nsHtml5TreeOpExecutor.cpp:90
#39 0x01895630 in nsThread::ProcessNextEvent (this=0xb74d0ee0, mayWait=0, result=0xbfd7b51c)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/xpcom/threads/nsThread.cpp:633
#40 0x018607ae in NS_ProcessNextEvent_P (thread=<value optimized out>, mayWait=0) at nsThreadUtils.cpp:250
#41 0x0179985b in mozilla::ipc::MessagePump::Run (this=0xb74dc940, aDelegate=0xb74416e0)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/ipc/glue/MessagePump.cpp:110
#42 0x018c8094 in MessageLoop::RunInternal (this=0xb74416e0)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/ipc/chromium/src/base/message_loop.cc:219
#43 0x018c80f8 in RunHandler (this=0xb74416e0) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/ipc/chromium/src/base/message_loop.cc:202
#44 MessageLoop::Run (this=0xb74416e0) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/ipc/chromium/src/base/message_loop.cc:176
#45 0x016ef353 in nsBaseAppShell::Run (this=0xb2aaf380)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:192
#46 0x015b5bae in nsAppStartup::Run (this=0xb2ad04c0)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/toolkit/components/startup/src/nsAppStartup.cpp:191
#47 0x00e22990 in XRE_main (argc=1, argv=0xbfd7bce4, aAppData=0xb740e380)
    at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/toolkit/xre/nsAppRunner.cpp:3695
#48 0x08049382 in main (argc=1, argv=0xbfd7bce4) at /build/buildd/firefox-4.0~b9+build1+nobinonly/build-tree/mozilla/browser/app/nsBrowserApp.cpp:158
(gdb) frame 0
#0  0x02e80ac3 in update_tgsi_samplers (softpipe=0xdc74000) at sp_state_derived.c:204
204	      if (tc->texture) {
(gdb) print tc
$1 = (struct softpipe_tex_tile_cache *) 0x0

This is weird because we always allocate texture caches for all PIPE_MAX_SAMPLERS and never destroy them until we destroy the context.  So anytime the context is alive, softpipe->tex_cache[i] should be non-null.

Could you also "print *softpipe" at the crash point to see what the rest of the context data looks like?

(gdb) print softpipe
$2 = (struct softpipe_context *) 0xbcf9000
(gdb) print *softpipe
$3 = {pipe = {winsys = 0x0, screen = 0xa4199dd0, priv = 0x0, draw = 0x885b9000, destroy = 0x56a8e44 <softpipe_destroy>, 
    draw_vbo = 0x56a990e <softpipe_draw_vbo>, draw_stream_output = 0x56a97b6 <softpipe_draw_stream_output>, 
    render_condition = 0x56a9294 <softpipe_render_condition>, create_query = 0x56c38dc <softpipe_create_query>, 
    destroy_query = 0x56c395e <softpipe_destroy_query>, begin_query = 0x56c3981 <softpipe_begin_query>, end_query = 0x56c3a99 <softpipe_end_query>, 
    get_query_result = 0x56c3bb9 <softpipe_get_query_result>, create_blend_state = 0x56b8204 <softpipe_create_blend_state>, 
    bind_blend_state = 0x56b821f <softpipe_bind_blend_state>, delete_blend_state = 0x56b8279 <softpipe_delete_blend_state>, 
    create_sampler_state = 0x56b8f3e <softpipe_create_sampler_state>, bind_fragment_sampler_states = 0x58d1927 <pstip_bind_sampler_states>, 
    bind_vertex_sampler_states = 0x56b90c5 <softpipe_bind_vertex_sampler_states>, 
    bind_geometry_sampler_states = 0x56b9207 <softpipe_bind_geometry_sampler_states>, delete_sampler_state = 0x56b9c78 <softpipe_delete_sampler_state>, 
    create_rasterizer_state = 0x56bac14 <softpipe_create_rasterizer_state>, bind_rasterizer_state = 0x56bac2f <softpipe_bind_rasterizer_state>, 
    delete_rasterizer_state = 0x56baca8 <softpipe_delete_rasterizer_state>, 
    create_depth_stencil_alpha_state = 0x56b8313 <softpipe_create_depth_stencil_state>, 
    bind_depth_stencil_alpha_state = 0x56b832e <softpipe_bind_depth_stencil_state>, 
    delete_depth_stencil_alpha_state = 0x56b8367 <softpipe_delete_depth_stencil_state>, create_fs_state = 0x58d17dd <pstip_create_fs_state>, 
    bind_fs_state = 0x58d1851 <pstip_bind_fs_state>, delete_fs_state = 0x58d18a4 <pstip_delete_fs_state>, 
    create_vs_state = 0x56ba2cc <softpipe_create_vs_state>, bind_vs_state = 0x56ba3a1 <softpipe_bind_vs_state>, 
    delete_vs_state = 0x56ba41f <softpipe_delete_vs_state>, create_gs_state = 0x56ba47e <softpipe_create_gs_state>, 
    bind_gs_state = 0x56ba57d <softpipe_bind_gs_state>, delete_gs_state = 0x56ba5fb <softpipe_delete_gs_state>, 
    create_vertex_elements_state = 0x56bb499 <softpipe_create_vertex_elements_state>, 
    bind_vertex_elements_state = 0x56bb520 <softpipe_bind_vertex_elements_state>, 
    delete_vertex_elements_state = 0x56bb599 <softpipe_delete_vertex_elements_state>, 
    create_stream_output_state = 0x56ba848 <softpipe_create_stream_output_state>, bind_stream_output_state = 0x56ba928 <softpipe_bind_stream_output_state>, 
    delete_stream_output_state = 0x56ba998 <softpipe_delete_stream_output_state>, set_blend_color = 0x56b829c <softpipe_set_blend_color>, 
    set_stencil_ref = 0x56b838a <softpipe_set_stencil_ref>, set_sample_mask = 0x56b83c7 <softpipe_set_sample_mask>, 
    set_clip_state = 0x56b845c <softpipe_set_clip_state>, set_constant_buffer = 0x56ba65a <softpipe_set_constant_buffer>, 
    set_framebuffer_state = 0x56bb02e <softpipe_set_framebuffer_state>, set_polygon_stipple = 0x58d1a6d <pstip_set_polygon_stipple>, 
    set_scissor_state = 0x56b853c <softpipe_set_scissor_state>, set_viewport_state = 0x56b849a <softpipe_set_viewport_state>, 
    set_fragment_sampler_views = 0x58d19bd <pstip_set_sampler_views>, set_vertex_sampler_views = 0x56b9522 <softpipe_set_vertex_sampler_views>, 
    set_geometry_sampler_views = 0x56b9681 <softpipe_set_geometry_sampler_views>, set_vertex_buffers = 0x56bb5bc <softpipe_set_vertex_buffers>, 
    set_index_buffer = 0x56bb674 <softpipe_set_index_buffer>, set_stream_output_buffers = 0x56ba9bb <softpipe_set_stream_output_buffers>, 
    resource_copy_region = 0x593c79e <util_resource_copy_region>, resource_resolve = 0, clear = 0x56c378b <softpipe_clear>, 
    clear_render_target = 0x593caf3 <util_clear_render_target>, clear_depth_stencil = 0x593ccc5 <util_clear_depth_stencil>, 
    flush = 0x56a87d0 <softpipe_flush>, is_resource_referenced = 0x56a9109 <softpipe_is_resource_referenced>, 
    create_sampler_view = 0x56b931e <softpipe_create_sampler_view>, sampler_view_destroy = 0x56b93b5 <softpipe_sampler_view_destroy>, 
    create_surface = 0x56a7ddf <softpipe_create_surface>, surface_destroy = 0x56a7f3e <softpipe_surface_destroy>, 
    get_transfer = 0x56a7fab <softpipe_get_transfer>, transfer_destroy = 0x56a8367 <softpipe_transfer_destroy>, 
    transfer_map = 0x56a839d <softpipe_transfer_map>, transfer_flush_region = 0x593ec85 <u_default_transfer_flush_region>, 
    transfer_unmap = 0x56a8430 <softpipe_transfer_unmap>, transfer_inline_write = 0x593eb34 <u_default_transfer_inline_write>}, blend = 0x8a459430, 
  sampler = {0x0 <repeats 16 times>}, vertex_samplers = {0x0 <repeats 16 times>}, geometry_samplers = {0x0 <repeats 16 times>}, depth_stencil = 0x8a7c22c0, 
  rasterizer = 0x8a7f0620, fs = 0x81e9000, vs = 0x8a7eb780, gs = 0x0, velems = 0xb0fdb400, so = 0x0, blend_color = {color = {0, 0, 0, 0}}, stencil_ref = {
    ref_value = "\000"}, clip = {ucp = {{0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}, {0, 0, 0, 0}}, nr = 0, depth_clamp = 0}, 
  constants = {{0x247e7f40, 0x0 <repeats 31 times>}, {0x0 <repeats 32 times>}, {0x0 <repeats 32 times>}}, framebuffer = {width = 1, height = 1, 
    nr_cbufs = 1, cbufs = {0x8a459460, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, zsbuf = 0x0}, poly_stipple = {stipple = {4294967295 <repeats 32 times>}}, 
  scissor = {minx = 0, miny = 0, maxx = 1, maxy = 1}, sampler_views = {0x0 <repeats 16 times>}, vertex_sampler_views = {0x0 <repeats 16 times>}, 
  geometry_sampler_views = {0x0 <repeats 16 times>}, viewport = {scale = {0.5, 0.5, 0.5, 1}, translate = {0.5, 0.5, 0.5, 0}}, vertex_buffer = {{
      stride = 12, max_index = 5, buffer_offset = 0, buffer = 0x81ec0c0}, {stride = 4, max_index = 5, buffer_offset = 72, buffer = 0x81ec0c0}, {stride = 0, 
      max_index = 0, buffer_offset = 0, buffer = 0x0} <repeats 30 times>}, index_buffer = {index_size = 0, offset = 0, buffer = 0x0}, so_target = {
    buffer = {0x0, 0x0, 0x0, 0x0}, offset = {0, 0, 0, 0}, so_count = {0, 0, 0, 0}, num_buffers = 0}, so_stats = {num_primitives_written = 0, 
    primitives_storage_needed = 0}, num_samplers = 0, num_sampler_views = 0, num_vertex_samplers = 0, num_vertex_sampler_views = 0, 
  num_geometry_samplers = 0, num_geometry_sampler_views = 0, num_vertex_buffers = 2, dirty = 13295, occlusion_count = 0, active_query_count = 0, 
  mapped_vbuffer = {0x0 <repeats 32 times>}, mapped_constants = {{0xb051d900, 0x0 <repeats 31 times>}, {0x0 <repeats 32 times>}, {0x0 <repeats 32 times>}}, 
  const_buffer_size = {{16, 0 <repeats 31 times>}, {0 <repeats 32 times>}, {0 <repeats 32 times>}}, vertex_info = {num_attribs = 0, hwfmt = {0, 0, 0, 0}, 
    size = 0, attrib = {{interp_mode = 0, emit = 0, src_index = 0} <repeats 32 times>}}, vertex_info_vbuf = {num_attribs = 0, hwfmt = {0, 0, 0, 0}, 
    size = 0, attrib = {{interp_mode = 0, emit = 0, src_index = 0} <repeats 32 times>}}, psize_slot = 0, reduced_api_prim = 4, cull_mode = 0, 
  reduced_prim = 0, cliprect = {minx = 0, miny = 0, maxx = 0, maxy = 0}, line_stipple_counter = 0, render_cond_query = 0x0, render_cond_mode = 0, quad = {
    shade = 0x8a7b9c60, depth_test = 0x8a7b9c80, blend = 0x8a7b9ca0, pstipple = 0x8a7b9cc0, first = 0x0}, tgsi = {geom_samplers_list = {
      0x0 <repeats 16 times>}, vert_samplers_list = {0x0 <repeats 16 times>}, frag_samplers_list = {0x0 <repeats 16 times>}}, fs_machine = 0xb0f01000, 
  draw = 0x885b9000, vbuf_backend = 0x8a544100, vbuf = 0xaa3197c0, dirty_render_cache = 1 '\001', cbuf_cache = {0xbcfa000, 0xbcfd000, 0x88534000, 
    0x88547000, 0x8855a000, 0x8856d000, 0x88580000, 0x88593000}, zsbuf_cache = 0x885a6000, tex_timestamp = 0, tex_cache = {0xb600000, 0xb200000, 0xae00000, 
    0xaa00000, 0xa600000, 0xa200000, 0x9e00000, 0x9a00000, 0x9600000, 0x9200000, 0x8e00000, 0x8a00000, 0x8600000, 0x8200000, 0xb7800000, 0xb7c00000}, 
  vertex_tex_cache = {0xb8000000, 0xb8400000, 0xb8800000, 0xb8c00000, 0xb9000000, 0xb9400000, 0xb9800000, 0xb9c00000, 0xba000000, 0xba400000, 0xba800000, 
    0xbac00000, 0xbb000000, 0xbb400000, 0xbb800000, 0xbbc00000}, geometry_tex_cache = {0xbc000000, 0xbc400000, 0xbc800000, 0xbcc00000, 0xbd000000, 
    0xbd400000, 0xbd800000, 0xbdc00000, 0xbe000000, 0xbe400000, 0xbe800000, 0xbec00000, 0xbf000000, 0xbf400000, 0xbfb00000, 0x0}, use_sse = 1, dump_fs = 0, 
  dump_gs = 0, no_rast = 0}

Can you test again?  I've added some null ptr checking in commit 5b58b8c579f06edc2e5ead011e2544eadfbfb77a

mesa: 5b58b8c579f06edc2e5ead011e2544eadfbfb77a (master)

WebGL Conformance Test Runner now crashes at sp_tex_tile_cache.c:147 with tc=0x0.

src/gallium/drivers/softpipe/sp_tex_tile_cache.c
   140  void
   141  sp_tex_tile_cache_set_sampler_view(struct softpipe_tex_tile_cache *tc,
   142                                     struct pipe_sampler_view *view)
   143  {
   144     struct pipe_resource *texture = view ? view->texture : NULL;
   145     uint i;
   146  
   147     assert(!tc->transfer);

I can't reproduce this. Vinson can you confirm that the crash is gone?