Bug 93447

Summary: [r600g] llvm crash because of use of uninitialized stack
Product: Mesa Reporter: Grazvydas Ignotas <notasas>
Component: Drivers/Gallium/r600Assignee: Default DRI bug account <dri-devel>
Status: RESOLVED WONTFIX QA Contact: Default DRI bug account <dri-devel>
Severity: normal    
Priority: medium    
Version: git   
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:
Attachments: hack patch

Description Grazvydas Ignotas 2015-12-19 16:33:50 UTC 
Created attachment 120595 [details]
hack patch

When replaying traces from Bug 92229 with R600_DEBUG=llvm specified a crash will occur (on my system) in LLVMBuildInsertElement() because uninitialized value in Index argument is passed. That value originates from radeon_llvm_emit_prepare_cube_coords() function's coords[3] stack variable. At that time,
 opcode = TGSI_OPCODE_TEX
 target = TGSI_TEXTURE_CUBE
so nothing ever sets coords[3], which is copied to the caller and eventually finds it way to llvm.

Unfortunately I don't have any knowledge about that code, I hope somebody who knows more can take a look. A hack patch is attached but it's most likely wrong.
Comment 1 Michel Dänzer 2015-12-21 02:51:23 UTC 
R600_DEBUG=llvm is currently known broken in many ways and should only be enabled by developers who want to fix it.
Comment 2 Grazvydas Ignotas 2015-12-21 12:57:14 UTC 
I believe this bug can also be triggered by radeonsi though, as it also calls radeon_llvm_emit_prepare_cube_coords(). When target == TGSI_TEXTURE_CUBE and opcode == TGSI_OPCODE_TXF, si_shader.c will take and use garbage value from that function.

Unfortunately I don't have any radeonsi hardware to make a testcase to prove my point. It might also be difficult anyway due to nature of uinitialized variable bugs (it's likely to end up with a value that doesn't cause a crash).
Comment 3 Ilia Mirkin 2015-12-21 13:02:11 UTC 
(In reply to Grazvydas Ignotas from comment #2)
> I believe this bug can also be triggered by radeonsi though, as it also
> calls radeon_llvm_emit_prepare_cube_coords(). When target ==
> TGSI_TEXTURE_CUBE and opcode == TGSI_OPCODE_TXF, si_shader.c will take and
> use garbage value from that function.

You can't texelFetch() on a samplerCube.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.