Bug 74071

Summary:	[PNV Bisected]Piglit/spec/OpenGL_2.0/max-samplers segfault
Product:	Mesa	Reporter:	lu hua <huax.lu>
Component:	Drivers/DRI/i915	Assignee:	Ian Romanick <idr>
Status:	VERIFIED FIXED	QA Contact:
Severity:	major
Priority:	high	CC:	idr
Version:	unspecified
Hardware:	All
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:

Description lu hua 2014-01-26 08:18:57 UTC

System Environment:
--------------------------
Platform: Pineview
Libdrm:		(master)libdrm-2.4.52
Mesa:		(master)00c672086c31f94dd96609fa976300781f53792e
Xserver:	(master)xorg-server-1.15.0-558-gc1ce807d9f18f215332d7eeb844e8c640f71c53c
Xf86_video_intel:(master)2.99.907-52-gc9e9c85fc7b21e231c2532fe1c75b92307e112ed
Cairo:		(master)2a7f133639bed86a29dd9693cb78c0aa42eaff30
Libva:		(staging)79ddde6bab54618046f136471c020c08ff4fde50
Libva_intel_driver:(staging)6736a39fce442a8e5abb2a2e99adf56e3965d35f
Kernel:	(drm-intel-nightly) 164a4cb4c1431a0689f85507868356fae24da638

Bug detailed description:
-----------------------------
It segfault on Pineview with mesa master branch. It doesn't happen on mesa 10.0 branch.

Bisect shows: 50ce6f682da57bbbc7b78e99f9aeb9422b05dd6e is the first bad commit
commit 50ce6f682da57bbbc7b78e99f9aeb9422b05dd6e
Author:     Kenneth Graunke <kenneth@whitecape.org>
AuthorDate: Wed Jan 15 10:08:06 2014 -0800
Commit:     Kenneth Graunke <kenneth@whitecape.org>
CommitDate: Wed Jan 22 17:18:55 2014 -0800

    mesa: Bump MAX_TEXTURE_IMAGE_UNITS to 32.

    This allows drivers to optionally support more than 16 texture units.

    Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
    Reviewed-by: Matt Turner <mattst88@gmail.com>
    Reviewed-by: Chris Forbes <chrisf@ijw.co.nz>

output:
GL_MAX_TEXTURE_IMAGE_UNITS = 8
GL_MAX_VERTEX_TEXTURE_IMAGE_UNITS = 32
GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS = 40
Segmentation fault (core dumped)

bt:
#0  0xb78e7229 in fetch_texel_2d_f_xrgb8888 (texImage=0x837e0d8, i=0, j=0,
    k=0, texel=0xbfffd378) at swrast/s_texfetch_tmp.h:495
#1  0xb78fcd97 in sample_2d_linear (rgba=<optimized out>,
    texcoord=<optimized out>, img=0x837e0d8, samp=0x8386578, ctx=0xb771401c)
    at swrast/s_texfilter.c:1183
#2  sample_linear_2d (ctx=0xb771401c, samp=0x8386578, tObj=0x8386550, n=1,
    texcoords=0xbfffd4b8, lambda=0xbfffd438, rgba=0xbfffd400)
    at swrast/s_texfilter.c:1397
#3  0xb78d7907 in fetch_texel_lod (ctx=0xb771401c, texcoord=0xbfffd4b8,
    lambda=0, unit=32, color=0xbfffd4d8) at swrast/s_fragprog.c:91
#4  0xb793bfb8 in fetch_texel (color=<optimized out>, lodBias=<optimized out>,
    texcoord=<optimized out>, inst=<optimized out>, machine=<optimized out>,
    ctx=<optimized out>) at program/prog_execute.c:340
#5  _mesa_execute_program (ctx=ctx@entry=0xb771401c,
    program=program@entry=0x8391520, machine=machine@entry=0x8086c40)
    at program/prog_execute.c:1566
#6  0xb78d7c2c in run_program (end=20, span=0xbfffd7bc,
    span@entry=0xb78d75d0 <fetch_texel_deriv>, ctx=ctx@entry=0xb771401c,
    start=<optimized out>) at swrast/s_fragprog.c:222
#7  _swrast_exec_fragment_program (ctx=ctx@entry=0xb771401c,
    span=span@entry=0xbfffd7bc) at swrast/s_fragprog.c:279
#8  0xb78df358 in shade_texture_span (span=0xbfffd7bc, ctx=0xb771401c)
    at swrast/s_span.c:1007
#9  _swrast_write_rgba_span (ctx=ctx@entry=0xb771401c,
    span=span@entry=0xbfffd7bc) at swrast/s_span.c:1261
#10 0xb7908be5 in general_triangle (ctx=0xb771401c, v0=0xb6576020,
    v1=0xb65763a8, v2=0xb6576730) at swrast/s_tritemp.h:819
#11 0xb78d0813 in _swrast_validate_triangle (ctx=0xb771401c, v0=0xb6576020,
    v1=0xb65763a8, v2=0xb6576730) at swrast/s_context.c:362
#12 0xb78d09ce in _swrast_Triangle (ctx=ctx@entry=0xb771401c, v0=0xb6576020,
    v1=0xb65763a8, v2=0xb6576730) at swrast/s_context.c:629
#13 0xb791af3e in triangle_rgba (ctx=0xb771401c, e0=0, e1=1, e2=2)
    at swrast_setup/ss_tritmp.h:176
#14 0xb78a9b47 in _tnl_render_tri_fan_verts (ctx=0xb771401c, start=0, count=4,
    flags=54) at tnl/t_vb_rendertmp.h:279
#15 0xb78ab29f in run_render (ctx=0xb771401c, stage=0x80accf8)
    at tnl/t_vb_render.c:321
#16 0xb78a5cc7 in _tnl_run_pipeline (ctx=ctx@entry=0xb771401c)
    at tnl/t_pipeline.c:163
#17 0xb7a1e792 in intelRunPipeline (ctx=0xb771401c) at intel_tris.c:1097
#18 0xb78a65ff in _tnl_draw_prims (ctx=ctx@entry=0xb771401c, arrays=0x809ac2c,
    prim=prim@entry=0xbffff0e8, nr_prims=nr_prims@entry=1, ib=0x0,
    min_index=0, max_index=3) at tnl/t_draw.c:526
#19 0xb78a6d17 in _tnl_vbo_draw_prims (ctx=0xb771401c, prim=0xbffff0e8,
    nr_prims=1, ib=0x0, index_bounds_valid=1 '\001', min_index=0, max_index=3,
    tfb_vertcount=0x0, indirect=0x0) at tnl/t_draw.c:426
#20 0xb7888754 in vbo_draw_arrays (ctx=ctx@entry=0xb771401c,
    mode=mode@entry=6, start=start@entry=0, count=count@entry=4,
    numInstances=numInstances@entry=1, baseInstance=baseInstance@entry=0)
    at vbo/vbo_exec_array.c:661
#21 0xb7888842 in vbo_exec_DrawArrays (mode=6, start=0, count=4)
    at vbo/vbo_exec_array.c:813
#22 0xb7f1af5d in stub_glDrawArrays (mode=6, first=0, count=4)
    at /GFX/Test/Piglit/piglit/tests/util/generated_dispatch.c:6223
#23 0x080492f0 in draw_rect_core (ix=0, iy=0, iw=20, ih=20)
    at /GFX/Test/Piglit/piglit/tests/texturing/max-samplers.c:135
#24 0x08049403 in piglit_display ()
    at /GFX/Test/Piglit/piglit/tests/texturing/max-samplers.c:170
#25 0xb7f08aff in run_test (gl_fw=0x804c008, argc=1, argv=0xbffff3a4)
    at /GFX/Test/Piglit/piglit/tests/util/piglit-framework-gl/piglit_fbo_framework.c:52
#26 0xb7f069a4 in piglit_gl_test_run (argc=1, argv=0xbffff3a4,
    config=0xbffff2c8)
    at /GFX/Test/Piglit/piglit/tests/util/piglit-framework-gl.c:191
#27 0x0804907d in main (argc=1, argv=0xbffff3a4)
    at /GFX/Test/Piglit/piglit/tests/texturing/max-samplers.c:41

Reproduce steps:
----------------------------
1. xinit
2. bin/max-samplers -fbo -auto

Comment 1 Ian Romanick 2014-01-26 17:08:26 UTC

We should probably just explicitly set the max vertex textures back to 16 in i915_context.c.  That /should/ restore the old behavior.

Comment 2 lu hua 2014-02-17 05:24:21 UTC

It also segfault on Mesa 10.1 branch.

Comment 3 Ian Romanick 2014-02-26 21:50:38 UTC

Fix on the mailing list for review:

http://lists.freedesktop.org/archives/mesa-dev/2014-February/054999.html

Comment 4 Ian Romanick 2014-02-28 23:51:16 UTC

commit 8ba157006fe98bca96b79bea1394b0c33ddf4ad3
Author: Ian Romanick <ian.d.romanick@intel.com>
Date:   Wed Feb 26 12:32:29 2014 -0800

    i915: Only allow 8 vertex texture units
    
    There's no reason to have more vertex texture units than fragment
    texture units on this hardware.  Since increasing the default maximum
    number of texture units from 16 to 32, this has triggered some segfault
    in i915 driver.  There's probably some array or bitfield that isn't
    properly sized now.  This really papers over the bug, but I don't think
    I'll lose any sleep over that.
    
    Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=74071
    Cc: "10.1" <mesa-stable@lists.freedesktop.org>
    Reviewed-by: Matt Turner <mattst88@gmail.com>

Comment 5 lu hua 2014-03-03 04:56:03 UTC

Verified.Fixed.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.