Bug 103579 - Vertex shader causes compiler to crash in SPIRV-to-NIR
Summary: Vertex shader causes compiler to crash in SPIRV-to-NIR
Status: RESOLVED FIXED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/Vulkan/Common (show other bugs)
Version: git
Hardware: Other All
: medium normal
Assignee: mesa-dev
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-11-05 13:24 UTC by maister
Modified: 2017-12-10 01:36 UTC (History)
4 users (show)

See Also:
i915 platform:
i915 features:


Attachments
Repro shader (2.38 KB, application/octet-stream)
2017-11-05 13:24 UTC, maister
Details

Note You need to log in before you can comment on or make changes to this bug.
Description maister 2017-11-05 13:24:11 UTC
Created attachment 135247 [details]
Repro shader

The attached vertex shader crashes when trying to emit code for

         %23 = OpLoad %19 %22 (gl_InstanceIndex)

with backtrace:
#0  0x00007ffff4a15f66 in vtn_pointer_to_offset (b=0x555556fb88b0, ptr=0x555557023280, index_out=0x7fffffffb2d0, end_idx_out=0x7fffffffb2c8) at spirv/vtn_variables.c:521
#1  0x00007ffff4a16e91 in vtn_block_load (b=0x555556fb88b0, src=0x555557023280) at spirv/vtn_variables.c:838
#2  0x00007ffff4a17211 in vtn_variable_load (b=0x555556fb88b0, src=0x555557023280) at spirv/vtn_variables.c:927
#3  0x00007ffff4a18f3d in vtn_handle_variables (b=0x555556fb88b0, opcode=SpvOpLoad, w=0x5555570249c8, count=4) at spirv/vtn_variables.c:1841
#4  0x00007ffff4a088fe in vtn_handle_body_instruction (b=0x555556fb88b0, opcode=SpvOpLoad, w=0x5555570249c8, count=4) at spirv/spirv_to_nir.c:3092
#5  0x00007ffff4a00cb0 in vtn_foreach_instruction (b=0x555556fb88b0, start=0x555557024764, end=0x555557024a78, handler=0x7ffff4a08834 <vtn_handle_body_instruction>) at spirv/spirv_to_nir.c:244
#6  0x00007ffff4a0e9e2 in vtn_emit_cf_list (b=0x555556fb88b0, cf_list=0x555556fa9ef0, switch_fall_var=0x0, has_switch_break=0x0, handler=0x7ffff4a08834 <vtn_handle_body_instruction>) at spirv/vtn_cfg.c:600
#7  0x00007ffff4a0f20e in vtn_function_emit (b=0x555556fb88b0, func=0x555556fa9ed0, instruction_handler=0x7ffff4a08834 <vtn_handle_body_instruction>) at spirv/vtn_cfg.c:775
#8  0x00007ffff4a08d9f in spirv_to_nir (words=0x555557024748, word_count=608, spec=0x0, num_spec=0, stage=MESA_SHADER_VERTEX, entry_point_name=0x555555bdb9b8 "main", ext=0x7fffffffb820, options=0x7ffff4a4fd20 <nir_options>) at spirv/spirv_to_nir.c:3376
#9  0x00007ffff494e318 in radv_shader_compile_to_nir (device=0x555556e2d400, module=0x5555570240e0, entrypoint_name=0x555555bdb9b8 "main", stage=MESA_SHADER_VERTEX, spec_info=0x0) at radv_shader.c:209
#10 0x00007ffff4948d80 in radv_create_shaders (pipeline=0x555556fce9f0, device=0x555556e2d400, cache=0x555556e354f0, key=..., pStages=0x7fffffffbc10) at radv_pipeline.c:1821
#11 0x00007ffff4949869 in radv_pipeline_init (pipeline=0x555556fce9f0, device=0x555556e2d400, cache=0x555556e354f0, pCreateInfo=0x555556fb40c8, extra=0x0, alloc=0x555556e2d408) at radv_pipeline.c:1983
#12 0x00007ffff494a738 in radv_graphics_pipeline_create (_device=0x555556e2d400, _cache=0x555556e354f0, pCreateInfo=0x555556fb40c8, extra=0x0, pAllocator=0x0, pPipeline=0x555557047c70) at radv_pipeline.c:2260
#13 0x00007ffff494a7f6 in radv_CreateGraphicsPipelines (_device=0x555556e2d400, pipelineCache=0x555556e354f0, count=1, pCreateInfos=0x555556fb40c8, pAllocator=0x0, pPipelines=0x555557047c70) at radv_pipeline.c:2285
Comment 1 Bas Nieuwenhuizen 2017-12-03 14:41:20 UTC
I could not get it to crash at that place anymore (though I'm pretty sure it did when looking at that bug earlier ...

It now crashes for me at

  %80 = OpLoad %_struct_65 %67

and this is because it is loading the entire UBO block struct without any indexing. (By the way, SPIR-V is really messed up here, requiring the Block decoration on the type instead of the variable ... After loading it is clearly not usefully a block, what if you store the same thing as function local var)

Patch is on the way.
Comment 2 Bas Nieuwenhuizen 2017-12-10 01:36:25 UTC
A patch that fixes compilation is in master:

https://cgit.freedesktop.org/mesa/mesa/commit/?id=b926da241a4221376afe195c476f6a05621e5c75


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.