Bug 78770

failed tests seem to be cubemap tests for UNSIGNED_SHORT_5_6_5 format

Is that bisect coming?

Sorry for late.
Bisect shows: 6c044231535b93c5d16404528946cad618d96bd9 is the first bad commit
commit 6c044231535b93c5d16404528946cad618d96bd9
Author: Kenneth Graunke <kenneth@whitecape.org>
Date:   Sun Feb 2 02:58:42 2014 -0800

    i965: Bump GL_MAX_CUBE_MAP_TEXTURE_SIZE to 8192.

    Gen4+ supports 8192x8192 cube maps.  Ivybridge and later can actually
    support 16384, but that would place GL_MAX_CUBE_MAP_TEXTURE_SIZE above
    GL_MAX_TEXTURE_SIZE, which seems like a bad idea.

    (Unfortunately, we can't bump GL_MAX_TEXTURE_SIZE to 16384 without
    causing regressions due to awful W-tiled stencil buffer interactions.)

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=74130
    Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
    Reviewed-by: Jordan Justen <jordan.l.justen@intel.com>
    Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>

I tried this test on current Mesa (approximately 8dc4a98c) on IVB and SNB in Firefox, and this test passed.  Ken says that he's able to get segfaults in this test on various platforms.

Can you attach the output from the test?  Maybe a screenshort or something?

How much memory does your test system have?  It's possible that it fails on your system because it can't allocate the 8Kx8K cubemap texture (with full mipmaps, that's a 3GiB texture).

Created attachment 100086 [details]
output

Memory 3G

(In reply to comment #5)
> Created attachment 100086 [details]
> output
> 
> Memory 3G

I'm not getting OUT_OF_MEMORY. For me many of the 'RGB, UNSIGNED_SHORT_5_6_5' format tests fail with INVALID_VALUE for different mipmap levels. For other formats all the tests are passing. This is on a Sandybridge desktop machine.

On Ivybridge and Mesa master, this test hard hangs my system. I can't even switch to VT2. I ran the test with Chrome 38 and X11/EGL/GLES.

hw: Ivybrridge Mobile GT2 0x0166
mesa: master@14bdcc6
chrome: google-chrome-38.0.2125.104-1.x86_64.fc20
chrome cmdline: google-chrome --use-gl=egl

Created attachment 108737 [details]
Backtrace of Chrome segfault

I confirmed Lu Hua's bisect on Ivybridge.

commit 6c044231535b93c5d16404528946cad618d96bd9
Author: Kenneth Graunke <kenneth@whitecape.org>
Date:   Sun Feb 2 02:58:42 2014 -0800

    i965: Bump GL_MAX_CUBE_MAP_TEXTURE_SIZE to 8192.


For me, Chrome segfaults during glTexImage2D. Attached is a backtrace.

Created attachment 108863 [details] [review]
work-in-progress fix

Attached patch fixes the bug. intel_miptree_map_gtt() is not 64-bit safe.

Before submitting the patch to mesa-dev, I need to do a full regression run on Piglit. Also, I'd like to make a more general fix.

(In reply to Chad Versace from comment #9)
> Created attachment 108863 [details] [review] [review]
> work-in-progress fix
> 
> Attached patch fixes the bug. intel_miptree_map_gtt() is not 64-bit safe.
> 
> Before submitting the patch to mesa-dev, I need to do a full regression run
> on Piglit. Also, I'd like to make a more general fix.

I test this patch, it still fails.

diff --git a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
index 8fda25d..511d36b 100644
--- a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
+++ b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
@@ -1769,7 +1769,13 @@ intel_miptree_map_gtt(struct brw_context *brw,
       y += image_y;

       map->stride = mt->pitch;
-      map->ptr = base + y * map->stride + x * mt->cpp;
+
+      /* TODO(chadv): Fix this correctly
+       *
+       * Prevent WebGL Conformance test texture-size-limit from segfaulting on Chrome.
+       * See [https://bugs.freedesktop.org/show_bug.cgi?id=78770].
+       */
+      map->ptr = base + (intptr_t) y * (intptr_t) map->stride + (intptr_t) x * (intptr_t) mt->cpp;
    }

    DBG("%s: %d,%d %dx%d from mt %p (%s) %d,%d = %p/%d\n", __FUNCTION__,

(In reply to lu hua from comment #10)
> (In reply to Chad Versace from comment #9)
> > Created attachment 108863 [details] [review] [review] [review]
> > work-in-progress fix
> > 
> > Attached patch fixes the bug. intel_miptree_map_gtt() is not 64-bit safe.
> > 
> > Before submitting the patch to mesa-dev, I need to do a full regression run
> > on Piglit. Also, I'd like to make a more general fix.
> 
> I test this patch, it still fails.

does it crash or produced 'failed' results?

My patch should fix the crash. It may not fix the test.

I examined the crash for so long that I forgot this bug report was about fixing the test and about the crash :/ I'll continue searching for a fix for the test.

Created attachment 108978 [details]
Test results after fix

I confirmed that my patch DOES fix the test on Ivybridge. Git and hw info below.
I tested Chrome with and without --use-gl=egl.

I'm using the *master* branch of the WebGL Conformance suite, available at https://github.com/KhronosGroup/WebGL. The test file is listed in the chrome cmdline below.

Lua, please test this fix on SNB and IVB.

hardware: Ivybrridge Mobile GT2 0x0166
os: Fedora 20
webgl-conformance: master@52f0dc2
mesa: master@93a92d2 + my patch

google-chrome: 38.0.2125.104 (Official Build 290379)
google-chrome-cmdline: /opt/google/chrome/chrome --user-data-dir=/tmp/chadv/debug/fdo-78770/xdg_config_home/chrome --disable-gpu-watchdog --use-gl=egl --in-process-gpu --flag-switches-begin --flag-switches-end --disable-gpu-watchdog --use-gl=egl --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,11,13,15 --disable-accelerated-video-decode --gpu-vendor-id=0x8086 --gpu-device-id=0x0166 --gpu-driver-vendor --gpu-driver-version ~/proj/hh/default/src/webgl/sdk/tests/conformance/textures/texture-size-limit.html

Created attachment 108983 [details] [review]
Proposed fix

Attached is proposed fix that I plan to submit to mesa-dev after validation. I've also pushed the fix as a git tag:

    web: https://github.com/chadversary/mesa/tree/bug/fdo-78770/v02
    git: git fetch git://github.com/chadversary/mesa bug/fdo-78770/v02

Michael or Lu Hua, please validate.

Created attachment 109012 [details]
output

Test with the patch, attach the output.

Chrome version: 27.0.1453.81
hardware: SNB 23bit
os:Fedora release 20

Lu Hua, from your test output it looks like the context is lost before the conformance suite ever reaches the texture-size-limit test. Though, the I am looking at a screenshot of a webpage, so maybe I'm interpreting it incorrectly.

Also, my patch affects only 64-bit systems. You're running on a 32-bit system.

Created attachment 109076 [details]
output(64 bit)

It also fails on my 64 bit machine(SNB).

I think what chad is fixing and this are two different bugs. This bug is about this test failing for some reason on SandyBridge 32 bit machine, while the original intention of Chad fix was to resolve crash on 64 bit machines I atleast tested this patch on my machine (Intel(R) Core(TM) i7-4600U CPU @ 2.10GHz) and the test doesn't crash and passes all the tests. Also, note that I am using Chromium version 40.0

lu hua, can you check the result on your 64 bit sandybridge machine without this fix?

Created attachment 109262 [details]
output(without patch)

Test on SNB(64 bit) latest mesa master branch, attached the output.
Maybe it has two bad commit?

With Chad's patch this test is passing (all of subtests) for me on a 64bit Sandybridge laptop both on Chromium and Firefox.

lu hua,
Can you try with a later version of chromium on your 64 bit machine and see ?

(In reply to kalyank from comment #22)
> lu hua,
> Can you try with a later version of chromium on your 64 bit machine and see ?

OK, I will try it.

I test chrome 33, it still fail.
Installed chrome 38, "[1117/155214:ERROR:nss_util.cc(94)] Failed to create /root/.pki/nssdb directory.", chrome start fail, need more investigation.

(In reply to lu hua from comment #24)
> I test chrome 33, it still fail.
> Installed chrome 38, "[1117/155214:ERROR:nss_util.cc(94)] Failed to create
> /root/.pki/nssdb directory.", chrome start fail, need more investigation.

 Lu, you're running Chrome as root? Don't do that.

Patch submitted to mesa-dev: http://www.mail-archive.com/mesa-dev@lists.freedesktop.org/msg70153.html

Kalyan and Tapani confirmed that my patch fixes the test on 64-bit Sandybridge. I confirmed the fix on 64-bit Ivybridge.

Still waiting for a QA update on 32-bit Sandybridge with a modern Chromium.

Patch is committed to Mesa master as

commit b69c7c5dac4e2615e89cef773173484421830a8f
Author: Chad Versace <chad.versace@linux.intel.com>
Date:   Tue Nov 18 15:41:35 2014 -0800

    i965: Fix segfault in WebGL Conformance on Ivybridge
    
    Fixes regression of WebGL Conformance test texture-size-limit [1] on
    Ivybridge Mobile GT2 0x0166 with Google Chrome R38.
    
    Regression introduced by
    
        commit 6c044231535b93c5d16404528946cad618d96bd9
        Author: Kenneth Graunke <kenneth@whitecape.org>
        Date:   Sun Feb 2 02:58:42 2014 -0800
    
            i965: Bump GL_MAX_CUBE_MAP_TEXTURE_SIZE to 8192.
    
    The test regressed because the pointer offset arithmetic in
    intel_miptree_map_gtt() overflows for large textures. The pointer
    arithmetic is not 64-bit safe.
    
    [1] https://github.com/KhronosGroup/WebGL/blob/52f0dc240f04dce31b1b8e2b8107fe2b8332dc90/sdk/tests/conformance/textures/texture-size-limit.html
    
    Cc: "10.3 10.4" <mesa-stable@lists.freedesktop.org>
    Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=78770
    Fixes: Intel CHRMOS-1377
    Reported-by: Lu Hua <huax.lu@intel.com>
    Reviewed-by: Ian Romanic <ian.d.romanick@intel.com>
    Signed-off-by: Chad Versace <chad.versace@linux.intel.com>

Lu, please test Sandybridge 32-bit with Chromium 39 or 40. Those are the currently maintained versions for Linux. Any older version is dead.

My patch should fix the bug on Chrome OS, because Chrome OS is 64-bit.

Patch is submitted to Google. See [https://chromium-review.googlesource.com/#/c/230564/].

Summary of discussion:
  - Lu originally filed the bug against Sandybridge without specifying 32-bit or 64-bit.
  - Tapani confirms my patch fixes Sandybridge 64-bit.
  - Kalyan and me confirm that my patch fixes Ivybridge 64-bit.
  - Lu is now trying to confirm the patch on Sandybridge 32-bit with Chrome 27, which is over a year old and unmaintained.

I'm closing this bug based on the above.

Lu, if feel that that the bug is unresolved, then please open a new bug specifically against 32-bit Sandybridge and document the Chrome version. I don't have time to work on 32-bit Sandybridge bugs, though.

Test on latest mesa master branch and chrome 39. It works well. Sorry for late.