Bug 38584

Summary: MESA_GLSL=dump causes SEGV in ir_print_visitor::unique_name
Product: Mesa Reporter: David L. <equinox-freedesktopbugs>
Component: glsl-compilerAssignee: Ian Romanick <idr>
Status: RESOLVED FIXED QA Contact:
Severity: critical    
Priority: medium    
Version: git   
Hardware: All   
OS: All   
Whiteboard:
i915 platform: i915 features:
Attachments: shader source

Description David L. 2011-06-22 19:47:05 UTC
Created attachment 48314 [details]
shader source

running EVE Online on wine with MESA_GLSL=dump crashes on the second shader it sees:

[...]
(declare () int gl_MaxDrawBuffers)
(function order_ps_input
  (signature void
    (parameters
      (declare (in ) (array vec4 12)wine: Unhandled page fault on read access to 0x00000000 at address 0xf6b2dc65 (thread 0023), starting debugger...

Backtrace:
=>0 0xf6be0c65 hash_table_string_hash+0x15(key=0x0(nil)) [/root/gl/mesa/src/glsl/../mesa/program/hash_table.c:189] in r600_dri.so (0x0033a05c)
  1 0xf6be0a0e hash_table_find+0x1d(ht=0x7c8e9ad0, key=0x0(nil)) [/root/gl/mesa/src/glsl/../mesa/program/hash_table.c:114] in r600_dri.so (0x0033a08c)
  2 0xf6bf7805 _mesa_symbol_table_find_symbol+0x34(table=0x7c71f588, name_space=0xffffffff, name=0x0(nil)) [/root/gl/mesa/src/glsl/../mesa/program/symbol_table.c:200] in r600_dri.so (0x0033a0dc)
  3 0xf6c2bf22 ir_print_visitor::unique_name(ir_variable*)+0x81() in r600_dri.so (0x0033a15c)
  4 0xf6c2c146 ir_print_visitor::visit(ir_variable*)+0x115() in r600_dri.so (0x0033a18c)
  5 0xf6c202c4 ir_variable::accept(ir_visitor*)+0x23() in r600_dri.so (0x0033a1dc)
  6 0xf6c2bdbf ir_print_visitor::visit(ir_function_signature*)+0xbe() in r600_dri.so (0x0033a20c)
  7 0xf6c20304 ir_function_signature::accept(ir_visitor*)+0x23() in r600_dri.so (0x0033a25c)
  8 0xf6c2bcaf ir_print_visitor::visit(ir_function*)+0x7e() in r600_dri.so (0x0033a28c)
  9 0xf6c20374 ir_function::accept(ir_visitor*)+0x23() in r600_dri.so (0x0033a2dc)
  10 0xf6c2b6de ir_instruction::print() const+0x3d() in r600_dri.so (0x0033a34c)
  11 0xf6c2b86f _mesa_print_ir+0x14e(instructions=0x7c60a860, state=(nil)) [/root/gl/mesa/src/glsl/ir_print_visitor.cpp:67] in r600_dri.so (0x0033a3ac)
  12 0xf6c04cd0 _mesa_glsl_compile_shader+0x2ff(ctx=0x7c5e7640, shader=0x7c6923b8) [/root/gl/mesa/src/mesa/program/ir_to_mesa.cpp:3219] in r600_dri.so (0x0033a3dc)
  13 0xf6bb13a8 compile_shader+0x77(ctx=0x7c5e7640, shaderObj=<is not available>) [/root/gl/mesa/src/mesa/main/shaderapi.c:848] in r600_dri.so (0x0033a3ec)
  14 0xf6f24a97 glCompileShaderARB+0x26() in libgl.so.1 (0x0033a44c)

mesa 21972c85ea734dbfcf69629c6b0b940efb42d4ba
Comment 1 Ian Romanick 2011-06-24 18:12:28 UTC
I've posted two patches to the mesa-dev mailing list.  Could you verify whether or not they fix this issue for you?  The second patch should fix the segfault that you hit, and the first patch fixes a similar issue that I hit.

http://marc.info/?l=mesa3d-dev&m=130896214323707&w=2
http://marc.info/?l=mesa3d-dev&m=130896218123735&w=2
Comment 2 David L. 2011-06-24 22:05:54 UTC
(In reply to comment #1)
> I've posted two patches to the mesa-dev mailing list.  Could you verify whether
> or not they fix this issue for you?  The second patch should fix the segfault
> that you hit, and the first patch fixes a similar issue that I hit.
> 
> http://marc.info/?l=mesa3d-dev&m=130896214323707&w=2
> http://marc.info/?l=mesa3d-dev&m=130896218123735&w=2

no such luck, it's var->name that's NULL. sorry for not looking into it deeper earlier; i got it work-arounded with

diff --git a/src/glsl/ir_print_visitor.cpp b/src/glsl/ir_print_visitor.cpp
index 5248330..20db268 100644
--- a/src/glsl/ir_print_visitor.cpp
+++ b/src/glsl/ir_print_visitor.cpp
@@ -108,6 +108,9 @@ ir_print_visitor::unique_name(ir_variable *var)
    if (name != NULL)
       return name;
 
+   if (!var->name) {
+      return "<<var->name == NULL>>";
+   }
    /* If there's no conflict, just use the original name */
    if (_mesa_symbol_table_find_symbol(this->symbols, -1, var->name) == NULL) {
       name = var->name;


... and it gets triggered like this:
(function order_ps_input
  (signature void
    (parameters
      (declare (in ) (array vec4 12) <<var->name == NULL>>)
    )
    (
    ))

(it's always order_ps_input, the GLSL source says:
#version 120
uniform vec4 VC[256];
uniform vec4 posFixup;
void order_ps_input(in vec4[12]);
ivec4 A0;
vec4 OUT[12];
[...]
Comment 3 Ian Romanick 2011-06-27 14:28:44 UTC
(In reply to comment #2)
> (In reply to comment #1)
> > I've posted two patches to the mesa-dev mailing list.  Could you verify whether
> > or not they fix this issue for you?  The second patch should fix the segfault
> > that you hit, and the first patch fixes a similar issue that I hit.
> > 
> > http://marc.info/?l=mesa3d-dev&m=130896214323707&w=2
> > http://marc.info/?l=mesa3d-dev&m=130896218123735&w=2
> 
> no such luck, it's var->name that's NULL. sorry for not looking into it deeper
> earlier; i got it work-arounded with

Nope, I should have been paying more attention.  I should have also run it on the provided shader after making my fix (instead of just running it before).  How about:

http://marc.info/?l=mesa3d-dev&m=130920996000346&w=2
http://marc.info/?l=mesa3d-dev&m=130920999500426&w=2
Comment 4 Ian Romanick 2011-07-07 14:18:40 UTC
Fixed on master by the commits below.  These have been cherry-picked to 7.11 (f28cf18 and b8972db) and 7.10 (7424f9c and cd73c06).

commit 174cef7fee7d400fc89a3ce68b7791d2aa3eb90f
Author: Ian Romanick <ian.d.romanick@intel.com>
Date:   Fri Jun 24 17:30:41 2011 -0700

    glsl: Don't choke when printing an anonymous function parameter
    
    NOTE: This is a candidate for the 7.10 and 7.11 branches.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38584
    Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>

commit dbda466fc05a6262ba857a7887e16347cf3d3e96
Author: Ian Romanick <ian.d.romanick@intel.com>
Date:   Fri Jun 24 17:12:31 2011 -0700

    ir_to_mesa: Allocate temporary instructions on the visitor's ralloc context
    
    And don't delete them.  Let ralloc clean them up.  Deleting the
    temporary IR leaves dangling references in the prog_instruction.  That
    results in a bad dereference when printing the IR with MESA_GLSL=dump.
    
    NOTE: This is a candidate for the 7.10 and 7.11 branches.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38584
    Reviewed-by: Eric Anholt <eric@anholt.net>
    Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.