Bug 65919

Summary: [ILK Bisected]Piglit spec_EXT_framebuffer_blit_fbo-sys-blit segfault
Product: Mesa Reporter: lu hua <huax.lu>
Component: Drivers/DRI/i965Assignee: Kenneth Graunke <kenneth>
Status: VERIFIED FIXED QA Contact:
Severity: major    
Priority: high CC: idr, xunx.fang
Version: unspecified   
Hardware: All   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:
Bug Depends on:    
Bug Blocks: 67224    

Description lu hua 2013-06-19 03:18:08 UTC 
ystem Environment:
--------------------------
Arch:           i386
Platform:       Ironlake
Libdrm:		(master)libdrm-2.4.45-7-ga0178c00c70f4b47e09ed7564fc2ccde611231a0
Mesa:		(master)eb2021507556633cd6ba64cda26653e3c43e80df
Xserver:(master)xorg-server-1.14.99.1-119-gc21344add2fc589df83b29be5831c36a372201bd
Xf86_video_intel:(master)2.21.9-28-g7ebcf94736926d4c7bb5ba1627be0a62b15c1663
Cairo:		(master)c51b850bd836c2bec0a1bcc7b32136dc21bc2360
Libva:		(staging)e468728f9e49603f91ccbce3a232aa3bd98d1fd4
Libva_intel_driver:(staging)10658d92ca78c748b7a19c4314f9d3e75cdeafc2
Kernel:	(drm-intel-nightly) c18149d146c06bd0c62871a6626adbc7c80e4aa4

Bug detailed description:
-------------------------
It segfault on ironlake with mesa master branch.It works well on mesa 9.1 branch.
spec_EXT_framebuffer_blit_fbo-sys-sub-blit also segfault with same bisect commit.

Bisect shows: b0e3c3b852e2e24d55f1ea2073c463de1f963d76 is the first bad commit.
commit b0e3c3b852e2e24d55f1ea2073c463de1f963d76
Author:     Eric Anholt <eric@anholt.net>
AuthorDate: Mon Jun 3 20:50:50 2013 -0700
Commit:     Eric Anholt <eric@anholt.net>
CommitDate: Mon Jun 17 15:43:23 2013 -0700

    intel: Directly implement blit glBlitFramebuffer instead of awkward reuse.

    This gets us support for blitting to attachment types other than
    textures.

    v2: fix up comments from review by Kenneth.

    Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
    Acked-by: Paul Berry <stereotype441@gmail.com>

output:
Segmentation fault (core dumped)

bt:
#0  intel_miptree_blit (intel=intel@entry=0x80606b8, src_mt=0x82e9868, src_level=0, src_slice=0, src_x=src_x@entry=0, src_y=src_y@entry=0, src_flip=true, dst_mt=0x0,
    dst_level=0, dst_slice=0, dst_x=dst_x@entry=0, dst_y=dst_y@entry=0, dst_flip=true, width=128, height=height@entry=128, logicop=logicop@entry=5379) at intel_blit.c:165
#1  0xb7b90999 in intel_blit_framebuffer_with_blitter (filter=9729, mask=16384, dstY1=128, dstX1=128, dstY0=0, dstX0=0, srcY1=128, srcX1=128, srcY0=0, srcX0=0, ctx=0x80606b8)
    at intel_fbo.c:808
#2  intel_blit_framebuffer (ctx=0x80606b8, srcX0=0, srcY0=0, srcX1=128, srcY1=128, dstX0=0, dstY0=0, dstX1=128, dstY1=128, mask=16384, filter=9729) at intel_fbo.c:844
#3  0xb781b51c in _mesa_BlitFramebuffer (srcX0=0, srcY0=0, srcX1=128, srcY1=128, dstX0=0, dstY0=0, dstX1=128, dstY1=128, mask=16384, filter=9729)
    at ../../../src/mesa/main/fbobject.c:3368
#4  0xb7f1559a in stub_glBlitFramebuffer (srcX0=0, srcY0=0, srcX1=128, srcY1=128, dstX0=0, dstY0=0, dstX1=128, dstY1=128, mask=16384, filter=9729)
    at /GFX/Test/Piglit/piglit/tests/util/generated_dispatch.c:1724
#5  0x08048a92 in piglit_display () at /GFX/Test/Piglit/piglit/tests/fbo/fbo-sys-blit.c:56
#6  0xb7f10c87 in process_next_event (x11_fw=0x804a008) at /GFX/Test/Piglit/piglit/tests/util/piglit-framework-gl/piglit_x11_framework.c:118
#7  0xb7f10d3d in enter_event_loop (winsys_fw=0x804a008) at /GFX/Test/Piglit/piglit/tests/util/piglit-framework-gl/piglit_x11_framework.c:134
#8  0xb7f10390 in run_test (gl_fw=0x804a008, argc=1, argv=0xbffff334) at /GFX/Test/Piglit/piglit/tests/util/piglit-framework-gl/piglit_winsys_framework.c:69
#9  0xb7f0d0be in piglit_gl_test_run (argc=1, argv=0xbffff334, config=0xbffff268) at /GFX/Test/Piglit/piglit/tests/util/piglit-framework-gl.c:137
#10 0x08048998 in main (argc=2, argv=0xbffff334) at /GFX/Test/Piglit/piglit/tests/fbo/fbo-sys-blit.c:41


Reproduce steps:
----------------
1. xinit
2. ./bin/fbo-sys-blit -auto
Comment 1 Kenneth Graunke 2013-08-06 19:11:23 UTC 
I can confirm that it begins segfaulting with the bisected commit.

On my Ironlake, it appears to fail before the bad commit.
Comment 2 Kenneth Graunke 2013-08-06 21:35:57 UTC 
Patch on mailing list:
http://lists.freedesktop.org/archives/mesa-dev/2013-August/042843.html
Comment 3 Kenneth Graunke 2013-08-06 21:37:16 UTC 
Oh, another note:

You can actually reproduce this on Ivybridge if you comment out the brw_blorp_blit_framebuffer().  The reason it only shows up on Ironlake is that fbo-sys-blit succeeds with blorp on Gen6+ and never hits the BLT path.
Comment 4 Kenneth Graunke 2013-08-14 17:53:31 UTC 
commit fb3d62fe3d4fc40ba4ad9804d8b6f451316c9ae2
Author: Kenneth Graunke <kenneth@whitecape.org>
Date:   Tue Aug 6 14:36:09 2013 -0700

    i965: Remember to call intel_prepare_render() before blitting.
    
    Otherwise, blits to the window system buffer may cause crashes,
    since dst_irb->mt may be NULL.
    
    This code is lifted straight out of brw_blorp_framebuffer()'s
    try_blorp_blit() helper.
    
    Fixes crashes in Piglit's fbo-sys-blit on systems without BLORP.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=65919
    Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
    Reviewed-by: Ian Romanick <idr@freedesktop.org>
    Reviewed-by: Chad Versace <chad.versace@linux.intel.com>
    Cc: "9.2" <mesa-stable@lists.freedesktop.org>
Comment 5 lu hua 2013-08-16 02:20:15 UTC 
Verified.Fixed.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.