Bug 77023

Summary: [llvmpipe] SIGSEGV src/gallium/drivers/llvmpipe/lp_texture.c:600
Product: Mesa Reporter: Vinson Lee <vlee>
Component: OtherAssignee: mesa-dev
Status: RESOLVED FIXED QA Contact:
Severity: critical    
Priority: medium CC: brianp, jfonseca, sroland
Version: git   
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:

Description Vinson Lee 2014-04-03 19:00:38 UTC
mesa: c6050ce7da7abff4fc7265f0a61a9b8621f1c061 (master 10.2.0-devel)

$ ./bin/fbo-generatemipmap-3d RGB9_E5 -auto
Segmentation fault (core dumped)

(gdb) bt
#0  0x00007f3e9942e84c in llvmpipe_transfer_unmap (pipe=0xaaf2d0, transfer=0x0) at src/gallium/drivers/llvmpipe/lp_texture.c:600
#1  0x00007f3e995db6a4 in pipe_transfer_unmap (context=0xaaf2d0, transfer=0x0) at src/gallium/auxiliary/util/u_inlines.h:481
#2  0x00007f3e995dbdd0 in st_texture_image_unmap (st=0xb331d0, stImage=0xedc300) at src/mesa/state_tracker/st_texture.c:273
#3  0x00007f3e995cf4cf in st_UnmapTextureImage (ctx=0x7f3e9cec5010, texImage=0xedc300, slice=1) at src/mesa/state_tracker/st_cb_texture.c:224
#4  0x00007f3e99659a71 in generate_mipmap_uncompressed (ctx=0x7f3e9cec5010, target=32879, texObj=0xeea640, srcImage=0xedc300, maxLevel=11)
    at src/mesa/main/mipmap.c:1987
#5  0x00007f3e9965a3c1 in _mesa_generate_mipmap (ctx=0x7f3e9cec5010, target=32879, texObj=0xeea640) at src/mesa/main/mipmap.c:2204
#6  0x00007f3e995d842c in st_generate_mipmap (ctx=0x7f3e9cec5010, target=32879, texObj=0xeea640) at src/mesa/state_tracker/st_gen_mipmap.c:204
#7  0x00007f3e99645e1b in _mesa_GenerateMipmap (target=32879) at src/mesa/main/genmipmap.c:132
#8  0x00007f3e9c9eef1b in stub_glGenerateMipmap (target=32879) at piglit/tests/util/generated_dispatch.c:9591
#9  0x00000000004018bb in create_tex3d () at piglit/tests/fbo/fbo-generatemipmap-3d.c:115
#10 0x0000000000401fbc in piglit_display () at piglit/tests/fbo/fbo-generatemipmap-3d.c:273
#11 0x00007f3e9c9d9b19 in display () at piglit/tests/util/piglit-framework-gl/piglit_glut_framework.c:60
#12 0x00007f3e9c374244 in fghRedrawWindow (window=0xaab820) at freeglut_main.c:231
#13 fghcbDisplayWindow (window=0xaab820, enumerator=0x7fffa577a3c0) at freeglut_main.c:248
#14 0x00007f3e9c377aa9 in fgEnumWindows (enumCallback=enumCallback@entry=0x7f3e9c3741d0 <fghcbDisplayWindow>, enumerator=enumerator@entry=0x7fffa577a3c0)
    at freeglut_structure.c:396
#15 0x00007f3e9c3747fd in fghDisplayAll () at freeglut_main.c:271
#16 glutMainLoopEvent () at freeglut_main.c:1523
#17 0x00007f3e9c374ffd in glutMainLoop () at freeglut_main.c:1571
#18 0x00007f3e9c9d9d48 in run_test (gl_fw=0x7f3e9ccc9360 <glut_fw>, argc=2, argv=0x7fffa577a798)
    at piglit/tests/util/piglit-framework-gl/piglit_glut_framework.c:142
#19 0x00007f3e9c9d7949 in piglit_gl_test_run (argc=2, argv=0x7fffa577a798, config=0x7fffa577a660)
    at piglit/tests/util/piglit-framework-gl.c:191
#20 0x00000000004015ae in main (argc=2, argv=0x7fffa577a798) at piglit/tests/fbo/fbo-generatemipmap-3d.c:42
(gdb) frame 0
#0  0x00007f3e9942e84c in llvmpipe_transfer_unmap (pipe=0xaaf2d0, transfer=0x0) at src/gallium/drivers/llvmpipe/lp_texture.c:600
600	   assert(transfer->resource);
(gdb) print transfer
$1 = (struct pipe_transfer *) 0x0
Comment 1 Brian Paul 2014-04-04 01:42:07 UTC
The problem is we're mapping the same texture (but different slices) multiple times simultaneously.  The state tracker doesn't support that.

This assertion fails if I put it in st_texture.c:

--- a/src/mesa/state_tracker/st_texture.c
+++ b/src/mesa/state_tracker/st_texture.c
@@ -256,6 +256,9 @@ st_texture_image_map(struct st_context *st, struct st_textur
e_image *stImage,
    else
       level = stImage->base.Level;
 
+   /* check that the texture's not already mapped */
+   assert(!stImage->transfer);
+
    return pipe_transfer_map_3d(st->pipe, stImage->pt, level, usage,
                                x, y, z + stImage->base.Face,
                                w, h, d, &stImage->transfer);

Gallium allows mapping multiple slices of a 3D texture, but not Mesa's ctx->Driver.MapTextureImage.
Comment 2 Roland Scheidegger 2014-08-11 18:05:56 UTC
This is fixed (probably by 26c41398cc47c0f72259a34406831443238b7ba9).

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.