Bug 94073

Summary: Miscompilation of abs_vec3_vert_xvary_ref.vert in WebGL conformance
Product: Mesa Reporter: Thomas Daede <bztdlinux>
Component: Drivers/DRI/i965Assignee: Jason Ekstrand <jason>
Status: RESOLVED FIXED QA Contact: Intel 3D Bugs Mailing List <intel-3d-bugs>
Severity: normal    
Priority: medium    
Version: 11.0   
Hardware: Other   
OS: All   
Whiteboard:
i915 platform: i915 features:
Attachments: NIR before and after out-of-SSA

Description Thomas Daede 2016-02-10 06:07:31 UTC 
The test abs_vec3_vert_xvary.test.html fails due to the reference vertex shader being miscompiled. The test can be reproduced by visiting this page with Firefox (preferably Nightly).

https://www.khronos.org/registry/webgl/conformance-suites/1.0.2/conformance/ogles/GL/abs/abs_001_to_006.html

The test passes on Chromium, but the vertex shader submitted is the same, checked with apitrace. It's unclear what is causing the behavior difference.

The error happens between the SSA and final NIR stages. Note that ssa_16 is dropped and never used, leading to the blue channel never having the absolute value applied:

https://pastebin.mozilla.org/8859127

Trivial modifications to the shader make it compile correctly. For example, replacing

if((c[2] < 0.0)) c[2] *= -1.0;

with

float x = c.b;
if (x < 0.0) x *= -1.0;
c.b = x;

This is one of a series of similar failures on the Khronos test. The entire test can be accessed here: https://www.khronos.org/registry/webgl/conformance-suites/1.0.2/webgl-conformance-tests.html
Comment 1 Matt Turner 2016-02-10 06:15:00 UTC 
Created attachment 121637 [details]
NIR before and after out-of-SSA

Please attach files in bugzilla and never link to a pastebin, as pastebins come and go and files expire.
Comment 2 Jason Ekstrand 2016-02-10 06:51:06 UTC 
Gut feeling is that this is actually a bug in lower_vev_to_movs not out_of_ssa.  I'll look into it.
Comment 3 Jason Ekstrand 2016-02-10 20:13:08 UTC 
Turns out it's a use-after-free in lower_vec_to_movs.  I've got a patch that I'll be sending out as soon as Jenkins gives me the green light.
Comment 4 Jason Ekstrand 2016-02-11 01:24:45 UTC 
I pushed the fix with a review from Matt.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.