Bug 66432

Summary: [IVB/HSW Bisected]Ogles3conform GL3Tests_transform_feedback_transform_feedback_state_variables.test segfault
Product: Mesa Reporter: lu hua <huax.lu>
Component: Drivers/DRI/i965Assignee: Kenneth Graunke <kenneth>
Status: VERIFIED FIXED QA Contact:
Severity: major    
Priority: high CC: idr, xunx.fang
Version: unspecified   
Hardware: All   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:

Description lu hua 2013-07-01 02:53:48 UTC 
System Environment:
--------------------------
Arch:           x86_64
Platform:       sandybridge/ivybridge/haswell
Libdrm:		(master)libdrm-2.4.45-13-g378bb47a784a3808c9b256fe7a52e10a4fcabf92
Mesa:		(master)adf8afa168fe9fe2e4a2b35afc3003040d05273f
Xserver:	(master)xorg-server-1.14.99.1-130-g77e51d5bbb97eb5c9d9dbff9a7c44d7e53620e68
Xf86_video_intel:(master)2.21.10-67-g3a787da7e888da7e9943be94bd1cb177fe1495ab
Cairo:		(master)7b8fc77bb974fbd4fbc697405a8b6aec748bb7f2
Libva:		(staging)e9e685fe752b9865ba9e28cb63e18ce3f8aed2a0
Libva_intel_driver:(staging)bb24c8a81e512d19aad0359d81f7247e6f20cc29 Kernel:	(drm-intel-nightly) 03d25b4548499254d66f1ee0bae8b796097a41ed

Bug detailed description:
-------------------------
It segfaults on ivybridge/haswell with mesa master branch.It works well on 9.1 branch.
Bisect shows:cf31a19300cbcecddb6bd0f878abb9316ebad2a1 is the first bad commit.
commit cf31a19300cbcecddb6bd0f878abb9316ebad2a1
Author:     Eric Anholt <eric@anholt.net>
AuthorDate: Fri Jun 21 09:57:12 2013 -0700
Commit:     Kenneth Graunke <kenneth@whitecape.org>
CommitDate: Fri Jun 28 13:35:25 2013 -0700

    i965: Drop the system-memory VBO support for i915.

    Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>

output:
Running GTF (Graphics Test Framework)
egl_vendor: Mesa Project
egl_version: 1.4
ConfigID: 7 RGBA bits( 8, 8, 8, 8) Depth bits: 0 Stencil bits: 0
gtf_version: 3.0
mode: egl
arg: /GFX/Test/Ogles3conform/ogles3conform/GTF_ES/glsl/GTF/GTF -width=64 -height=64 -run=/GFX/Test/Ogles3conform/ogles3conform/GTF_ES/glsl/GTF/GL3Tests/transform_feedback/transform_feedback_state_variables.test
gl_renderer: Mesa DRI Intel(R) Haswell Desktop
gl_shading_language_version: OpenGL ES GLSL ES 3.0
gl_version: OpenGL ES 3.0 Mesa 9.2.0-devel (git-adf8afa)
gl_vendor: Intel Open Source Technology Center
gl_extensions: GL_EXT_blend_minmax GL_EXT_multi_draw_arrays GL_EXT_texture_filter_anisotropic GL_EXT_texture_compression_dxt1 GL_EXT_texture_format_BGRA8888 GL_OES_compressed_ETC1_RGB8_texture GL_OES_depth24 GL_OES_element_index_uint GL_OES_fbo_render_mipmap GL_OES_mapbuffer GL_OES_rgb8_rgba8 GL_OES_standard_derivatives GL_OES_stencil8 GL_OES_texture_3D GL_OES_texture_npot GL_OES_EGL_image GL_OES_depth_texture GL_OES_packed_depth_stencil GL_EXT_texture_type_2_10_10_10_REV GL_OES_get_program_binary GL_APPLE_texture_max_level GL_EXT_discard_framebuffer GL_EXT_read_format_bgra GL_NV_fbo_color_attachments GL_OES_vertex_array_object GL_ANGLE_texture_compression_dxt3 GL_ANGLE_texture_compression_dxt5 GL_EXT_texture_rg GL_EXT_unpack_subimage GL_NV_draw_buffers GL_NV_read_buffer GL_EXT_map_buffer_range GL_OES_depth_texture_cube_map GL_EXT_color_buffer_float
stamp: 20130701105107
Zero epsilon: 0.000122, RGBA epsilon: ( 0.004044, 0.004044, 0.004044, 0.004044)
transform_feedback: Start
Segmentation fault (core dumped)

(gdb) bt
#0  do_bo_emit_reloc (bo=0x10702f0, offset=496, target_bo=0x0, target_offset=0, read_domains=2, write_domain=2, need_fence=false) at intel_bufmgr_gem.c:1623
#1  0x00007ffff5aaf08d in drm_intel_gem_bo_emit_reloc (bo=<optimized out>, offset=<optimized out>, target_bo=<optimized out>, target_offset=<optimized out>,
    read_domains=<optimized out>, write_domain=<optimized out>) at intel_bufmgr_gem.c:1691
#2  0x00007ffff630dadd in intel_batchbuffer_emit_reloc (intel=0xef7ee0, buffer=0x0, read_domains=<optimized out>, write_domain=<optimized out>, delta=0)
    at intel_batchbuffer.c:290
#3  0x00007ffff63a5d20 in upload_3dstate_so_buffers (brw=0xef7ee0) at gen7_sol_state.c:88
#4  upload_sol_state (brw=0xef7ee0) at gen7_sol_state.c:232
#5  0x00007ffff6372cc2 in brw_upload_state (brw=0xef7ee0) at brw_state_upload.c:516
#6  0x00007ffff633193f in brw_try_draw_prims (max_index=15787576, min_index=4294957816, ib=0x0, nr_prims=<optimized out>, prim=0x7fffffffdae0, arrays=<optimized out>,
    ctx=0xef7ee0) at brw_draw.c:450
#7  brw_draw_prims (ctx=0xef7ee0, prim=0x7fffffffdae0, nr_prims=<optimized out>, ib=0x0, index_bounds_valid=<optimized out>, min_index=0, max_index=1, tfb_vertcount=0x0)
    at brw_draw.c:535
#8  0x00007ffff5e605b9 in vbo_draw_arrays (ctx=0xef7ee0, mode=0, start=0, count=<optimized out>, numInstances=1, baseInstance=<optimized out>)
    at ../../../src/mesa/vbo/vbo_exec_array.c:624
#9  0x00000000005514a5 in drawsimple (program=1, vertices=0x7fffffffdbd0, primitivetype=0, vertexcount=2, discard=1 '\001') at ./Source/GL3Tests/GTFGL3Misc.c:630
#10 0x000000000059e75d in GTFTestGL3_transform_feedback_state_variables_Apply (parent=0x1071670) at ./Source/GL3Tests/GTFTestTransformFeedback.c:3016
#11 0x00000000005226e4 in GTFTestGL3VirtualCallApply (parent=0x1071670, result=0x7fffffffdcef "\001") at ./Source/GL3Tests/GTFTestGL3VirtualCall.c:105
#12 0x000000000051b053 in GTFTestGL3Apply (pTestGL3Test=0x1071670) at ./Source/GL3Tests/GTFTestGL3.c:486
#13 0x000000000042457f in GTFTestEncapsulateApply (pTestEncapsulate=0xffd7f0) at ./Source/GTFTest.c:278
#14 0x000000000042c25a in GTFRunTest (
    run_filename=0xedf9b0 "/GFX/Test/Ogles3conform/ogles3conform/GTF_ES/glsl/GTF/GL3Tests/transform_feedback/transform_feedback_state_variables.test")
    at ./Source/GTFTestDriver.c:317
#15 0x000000000042d0d1 in GTFRunTestDriver (
    run_filename=0xedf9b0 "/GFX/Test/Ogles3conform/ogles3conform/GTF_ES/glsl/GTF/GL3Tests/transform_feedback/transform_feedback_state_variables.test")
    at ./Source/GTFTestDriver.c:679
#16 0x00000000004150ac in GTFRun () at ./Source/GTFMain.c:104
#17 0x000000000044a245 in GTFInitEGL (run=0x415050 <GTFRun>, argc=4, argv=0x7fffffffe148, argcx=0, argvx=0x0) at ./Source/GTFInitEGL.c:390
#18 0x0000000000415f54 in GTFMain (argc=4, argv=0x7fffffffe148) at ./Source/GTFMain.c:323
#19 0x000000000040de92 in main (argc=4, argv=0x7fffffffe148) at ./Source/main.c:197


Reproduce steps:
----------------
1. xinit
2. ./GTF -width=64 -height=64 -run=GL3Tests/transform_feedback/transform_feedback_state_variables.test
Comment 1 Kenneth Graunke 2013-07-02 07:59:04 UTC 
Looks like a little too much code went away.

This patch should fix the issue:
http://lists.freedesktop.org/archives/mesa-dev/2013-July/041337.html

(patch 2 and 3 of that series aren't necessary to fix it, they're just a little tidying as long as I was in that part of the code)
Comment 2 lu hua 2013-07-03 02:48:03 UTC 
(In reply to comment #1)
> Looks like a little too much code went away.
> 
> This patch should fix the issue:
> http://lists.freedesktop.org/archives/mesa-dev/2013-July/041337.html
> 
> (patch 2 and 3 of that series aren't necessary to fix it, they're just a
> little tidying as long as I was in that part of the code)

Fixed by this patch.
Comment 3 lu hua 2013-07-24 07:28:17 UTC 
Fixed on latest branch.
Comment 4 lu hua 2013-07-24 07:28:48 UTC 
Verified.Fixed.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.