Bug 93538

Summary: Recursive call to vbo_exec_FlushVertices in i965 driver causing assertion failure/stack overflow
Product: Mesa Reporter: hakkikt
Component: Drivers/DRI/i965Assignee: Ian Romanick <idr>
Status: RESOLVED FIXED QA Contact: Intel 3D Bugs Mailing List <intel-3d-bugs>
Severity: normal    
Priority: medium CC: nroberts
Version: 11.0   
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:

Description hakkikt 2015-12-29 22:56:55 UTC 
When displaying an image with Gliv the application crashes in vbo_exec_FlushVertices or a stack that recurses through this method multiple times.

All releases I have tried since 10.2.8 include this fault.

Compiled with DEBUG the assertion catches the bug instead of segfaulting.

$ gdb gliv
GNU gdb (Gentoo 7.10 vanilla) 7.10
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://bugs.gentoo.org/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from gliv...(no debugging symbols found)...done.
(gdb) run sample_outgoing_15cps/output/*
Starting program: /usr/bin/gliv sample_outgoing_15cps/output/*
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

(gliv:6407): Gtk-WARNING **: Unable to locate theme engine in module_path: "clearlooks",
Mesa warning: couldn't open libtxc_dxtn.so, software DXTn compression/decompression unavailable
[New Thread 0x7fffeb0fe700 (LWP 6421)]
gliv: /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/vbo/vbo_exec_api.c:1178: vbo_exec_FlushVertices: Assertion `exec->flush_call_depth == 1' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff528bd6e in raise () from /lib64/libc.so.6
(gdb) bt
#0  0x00007ffff528bd6e in raise () from /lib64/libc.so.6
#1  0x00007ffff528d4e1 in abort () from /lib64/libc.so.6
#2  0x00007ffff5284152 in ?? () from /lib64/libc.so.6
#3  0x00007ffff5284216 in __assert_fail () from /lib64/libc.so.6
#4  0x00007fffed3b332a in vbo_exec_FlushVertices (ctx=0x555555a4c830, flags=<optimized out>)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/vbo/vbo_exec_api.c:1178
#5  0x00007fffed27fc4e in enable_texture (ctx=0x555555a4c830, state=<optimized out>, texBit=<optimized out>)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/main/enable.c:228
#6  0x00007fffed2808fd in _mesa_set_enable (ctx=0x555555a4c830, cap=3553, state=<optimized out>)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/main/enable.c:686
#7  0x00007fffed441182 in _mesa_meta_begin (ctx=ctx@entry=0x555555a4c830, state=state@entry=4294967295)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/drivers/common/meta.c:633
#8  0x00007fffed6409d7 in brw_meta_resolve_color (brw=brw@entry=0x555555a4c830, mt=mt@entry=0x555555c55c90)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/drivers/dri/i965/brw_meta_fast_clear.c:682
#9  0x00007fffed6bb9a5 in intel_miptree_resolve_color (mt=0x555555c55c90, brw=0x555555a4c830)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/drivers/dri/i965/intel_mipmap_tree.c:1933
#10 intel_miptree_map_raw (brw=brw@entry=0x555555a4c830, mt=mt@entry=0x555555c55c90)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/drivers/dri/i965/intel_mipmap_tree.c:2068
#11 0x00007fffed6bd8cb in intel_miptree_map_gtt (slice=0, level=<optimized out>, map=0x555555cf7e40, mt=0x555555c55c90, brw=0x555555a4c830)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/drivers/dri/i965/intel_mipmap_tree.c:2110
#12 intel_miptree_map (brw=0x555555a4c830, mt=0x555555c55c90, level=<optimized out>, slice=0, x=x@entry=0, y=y@entry=0, w=w@entry=623, h=h@entry=479, mode=3, 
    out_ptr=out_ptr@entry=0x7fffffffc458, out_stride=out_stride@entry=0x7fffffffc460)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/drivers/dri/i965/intel_mipmap_tree.c:2704
#13 0x00007fffed6b7d7e in intel_map_renderbuffer (ctx=<optimized out>, rb=0x555555ab1850, x=0, y=0, w=623, h=479, mode=3, out_map=0x555555ab18c8, 
    out_stride=0x555555ab18d0) at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/drivers/dri/i965/intel_fbo.c:184
#14 0x00007fffed40a5b7 in map_attachment (ctx=ctx@entry=0x555555a4c830, fb=fb@entry=0x555555ab1330, buffer=<optimized out>)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/swrast/s_renderbuffer.c:578
#15 0x00007fffed40ae9b in _swrast_map_renderbuffers (ctx=0x555555a4c830)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/swrast/s_renderbuffer.c:663
#16 0x00007fffed3fe8d8 in _swrast_render_start (ctx=ctx@entry=0x555555a4c830)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/swrast/s_context.c:895
#17 0x00007fffed435161 in _swsetup_RenderStart (ctx=0x555555a4c830)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/swrast_setup/ss_context.c:202
#18 0x00007fffed3e25cd in run_render (ctx=0x555555a4c830, stage=<optimized out>)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/tnl/t_vb_render.c:277
#19 0x00007fffed3d6d6d in _tnl_run_pipeline (ctx=0x555555a4c830) at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/tnl/t_pipeline.c:241
#20 0x00007fffed3d62d6 in _tnl_draw_prims (ctx=ctx@entry=0x555555a4c830, prim=prim@entry=0x555555aac228, nr_prims=nr_prims@entry=1, ib=ib@entry=0x0, 
    index_bounds_valid=index_bounds_valid@entry=1 '\001', min_index=0, max_index=3, tfb_vertcount=tfb_vertcount@entry=0x0, stream=stream@entry=0, 
    indirect=indirect@entry=0x0) at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/tnl/t_draw.c:520
#21 0x00007fffed5d07d3 in brw_draw_prims (ctx=0x555555a4c830, prims=0x555555aac228, nr_prims=1, ib=0x0, index_bounds_valid=<optimized out>, min_index=0, 
    max_index=3, unused_tfb_object=0x0, stream=0, indirect=0x0)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/drivers/dri/i965/brw_draw.c:587
#22 0x00007fffed3b7a17 in vbo_exec_vtx_flush (exec=exec@entry=0x555555aaba48, keepUnmapped=<optimized out>)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/vbo/vbo_exec_draw.c:408
#23 0x00007fffed399b5c in vbo_exec_FlushVertices_internal (exec=0x555555aaba48, unmap=<optimized out>)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/vbo/vbo_exec_api.c:568
#24 0x00007fffed3b32d4 in vbo_exec_FlushVertices (ctx=0x555555a4c830, flags=1)
    at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/vbo/vbo_exec_api.c:1191
#25 0x00007fffed293836 in _mesa_RenderMode (mode=7168) at /var/tmp/portage/media-libs/mesa-11.0.6/work/mesa-11.0.6/src/mesa/main/feedback.c:420
#26 0x00005555555736a8 in matrix_tile_visible ()
#27 0x000055555557ec9a in draw_current_image ()
#28 0x000055555557f91f in ?? ()
#29 0x000055555557f739 in refresh ()
#30 0x000055555557fc6f in render ()
#31 0x0000555555576503 in ?? ()
#32 0x0000555555577168 in load_first_image ()
#33 0x000055555557e771 in ?? ()
#34 0x00007ffff5d72441 in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
#35 0x00007ffff5d727f8 in ?? () from /usr/lib64/libglib-2.0.so.0
#36 0x00007ffff5d72c52 in g_main_loop_run () from /usr/lib64/libglib-2.0.so.0
#37 0x00007ffff68ae482 in gtk_main () from /usr/lib64/libgtk-x11-2.0.so.0
#38 0x0000555555564d6a in main ()
Comment 1 Neil Roberts 2016-02-04 17:43:54 UTC 
It looks like gliv is using glRenderMode(GL_SELECT) and when switching back to GL_RENDER Mesa flushes the vertices. GL_SELECT uses the software rendering fallback which tries to map the render buffers. Mapping the render buffers causes it to resolve the fast clear which is a meta operation which does rendering and so also tries to flush the vertices, thus making infinite recursion.

Seems like a tricky one to fix.
Comment 2 Kenneth Graunke 2017-09-15 02:12:33 UTC 
We no longer use Meta for resolves, so this bug should be fixed.  If not, feel free to reopen.

Also, please, please, please don't use software that uses glRenderMode(GL_SELECT).  It's a legacy GL 1.x feature that's been deprecated forever, and we never implemented in our drivers, so you get nasty software fallbacks.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.