Bug 111070 - Processing of SPIR-V shader leads to segmentation fault
Summary: Processing of SPIR-V shader leads to segmentation fault
Status: RESOLVED MOVED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/Vulkan/intel (show other bugs)
Version: git
Hardware: Other All
: medium normal
Assignee: Intel 3D Bugs Mailing List
QA Contact: Intel 3D Bugs Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-07-04 22:54 UTC by Alastair Donaldson
Modified: 2019-09-18 19:50 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments
Amber test exposing the problem (5.28 KB, text/plain)
2019-07-04 22:54 UTC, Alastair Donaldson
Details
backtrace_unreachable-loops-in-switch.amber_debug (46.47 KB, text/plain)
2019-07-05 07:19 UTC, Denis
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Alastair Donaldson 2019-07-04 22:54:16 UTC
Created attachment 144706 [details]
Amber test exposing the problem

Running the attached test using Amber (https://github.com/google/amber):

amber unreachable-loops-in-switch.amber

should lead to the test passing.

Instead, a segmentation fault occurs, with a backtrace starting in libvulkan_intel.so.

Build: Mesa 19.2.0-devel (git-243db4980c) (Debug)
Device: Intel(R) HD Graphics 630 (Kaby Lake GT2)

Bug found using GraphicsFuzz.
Comment 1 Denis 2019-07-05 07:19:45 UTC
Created attachment 144709 [details]
backtrace_unreachable-loops-in-switch.amber_debug

hi, this one crashes starting from 18.0 mesa up to the master.
Core dump with debug symbols attached
Comment 2 asimiklit 2019-07-09 09:09:09 UTC
I am investigating this issue.
Comment 3 asimiklit 2019-07-16 14:05:00 UTC
The issue was found in a 'nir_opt_dead_cf'. This optimization does not optimize all dead blocks (at least by a single invocation). For example on the following nir the condition 'if ssa_5' was optimized but 'if ssa_97' wasn't, due to issue in 'dead_cf_list'. MR which should fix this issue was suggested: 
https://gitlab.freedesktop.org/mesa/mesa/merge_requests/1352

shader: MESA_SHADER_FRAGMENT
inputs: 0
outputs: 0
uniforms: 0
shared: 0
decl_var shader_out INTERP_MODE_NONE vec4 _GLF_color (FRAG_RESULT_DATA0, 0, 0)
decl_function main (0 params)

impl main {
        decl_var  INTERP_MODE_NONE int i
        decl_var  INTERP_MODE_NONE float[1] data
        decl_var  INTERP_MODE_NONE bool fall
        decl_var  INTERP_MODE_NONE bool cont
        decl_var  INTERP_MODE_NONE bool cont@0
        decl_var  INTERP_MODE_NONE bool cont@1
        decl_var  INTERP_MODE_NONE vec4 out@_GLF_color-temp
        block block_0:
        /* preds: */
        vec1 32 ssa_0 = load_const (0x00000001 /* 0.000000 */)
        vec1 32 ssa_1 = load_const (0x40000000 /* 2.000000 */)
        vec1 1 ssa_2 = load_const (true)
        vec1 32 ssa_3 = load_const (0x00000000 /* 0.000000 */)
        vec1 32 ssa_4 = load_const (0x3f800000 /* 1.000000 */)
        vec1 1 ssa_5 = load_const (false)
        vec4 32 ssa_8 = load_const (0x3f800000 /* 1.000000 */, 0x00000000 /* 0.000000 */, 0x00000000 /* 0.000000 */, 0x3f800000 /* 1.000000 */)
        /* succs: block_1 */
        loop {
                block block_1:
                /* preds: block_0 block_23 */
                vec1 1 ssa_13 = phi block_0: ssa_5, block_23: ssa_2
                vec1 32 ssa_14 = phi block_0: ssa_3, block_23: ssa_88
                vec1 32 ssa_19 = iadd ssa_14, ssa_0
                vec1 32 ssa_88 = bcsel ssa_13, ssa_19, ssa_14
                vec1 1 ssa_26 = ilt ssa_88, ssa_0
                /* succs: block_2 block_3 */
                if ssa_26 {
                        block block_2:
                        /* preds: block_1 */
                        /* succs: block_4 */
                } else {
                        block block_3:
                        /* preds: block_1 */
                        break
                        /* succs: block_24 */
                }
                block block_4:
                /* preds: block_2 */
                vec1 32 ssa_29 = deref_var &data (function_temp float[1]) 
                vec1 32 ssa_30 = deref_array &(*ssa_29)[ssa_88] (function_temp float) /* &data[ssa_88] */
                vec1 32 ssa_31 = intrinsic load_deref (ssa_30) (0) /* access=0 */
                vec1 32 ssa_34 = deref_array &(*ssa_29)[0] (function_temp float) /* &data[0] */
                vec1 32 ssa_35 = intrinsic load_deref (ssa_34) (0) /* access=0 */
                vec1 1 ssa_36 = flt ssa_31, ssa_35
                /* succs: block_5 block_22 */
                if ssa_36 {
                        block block_5:
                        /* preds: block_4 */
                        /* succs: block_6 block_7 */
                        if ssa_5 {
                                block block_6:
                                /* preds: block_5 */
                                vec1 32 ssa_39 = i2f32 ssa_88
                                vec1 1 ssa_40 = fge ssa_39, ssa_4
                                /* succs: block_8 */
                        } else {
                                block block_7:
                                /* preds: block_5 */
                                /* succs: block_8 */
                        }
                        block block_8:
                        /* preds: block_6 block_7 */
                        vec1 1 ssa_95 = load_const (false)
                        vec1 1 ssa_96 = load_const (false)
                        vec1 1 ssa_97 = load_const (false)
                        /* succs: block_9 block_17 */
                        if ssa_97 {
                                block block_9:
                                /* preds: block_8 */
                                /* succs: block_10 */
                                loop {
                                        block block_10:
                                        /* preds: block_9 block_13 */
                                        vec1 1 ssa_54 = phi block_9: ssa_5, block_13: ssa_2
                                        /* succs: block_11 block_12 */
                                        if ssa_2 {
                                                block block_11:
                                                /* preds: block_10 */
                                                /* succs: block_13 */
                                        } else {
                                                block block_12:
                                                /* preds: block_10 */
                                                break
                                                /* succs: block_14 */
                                        }
                                        block block_13:
                                        /* preds: block_11 */
                                        continue
                                        /* succs: block_10 */
                                }
                                block block_14:
                                /* preds: block_12 */
                                /* succs: block_15 */
                                loop {
                                        block block_15:
                                        /* preds: block_14 block_15 */
                                        vec1 1 ssa_61 = phi block_14: ssa_5, block_15: ssa_2
                                        continue
                                        /* succs: block_15 */
                                }
                                block block_16:
                                /* preds: */
                                /* succs: block_18 */
                        } else {
                                block block_17:
                                /* preds: block_8 */
                                /* succs: block_18 */
                        }
                        block block_18:
                        /* preds: block_16 block_17 */
                        vec1 1 ssa_91 = load_const (true)
                        vec1 1 ssa_98 = load_const (true)
                        vec1 1 ssa_99 = load_const (true)
                        vec1 1 ssa_100 = load_const (true)
                        /* succs: block_19 block_20 */
                        if ssa_100 {
                                block block_19:
                                /* preds: block_18 */
                                intrinsic store_deref (ssa_34, ssa_1) (1, 0) /* wrmask=x */ /* access=0 */
                                /* succs: block_21 */
                        } else {
                                block block_20:
                                /* preds: block_18 */
                                /* succs: block_21 */
                        }
                        block block_21:
                        /* preds: block_19 block_20 */
                        /* succs: block_23 */
                } else {
                        block block_22:
                        /* preds: block_4 */
                        /* succs: block_23 */
                }
                block block_23:
                /* preds: block_21 block_22 */
                continue
                /* succs: block_1 */
        }
        block block_24:
        /* preds: block_3 */
        vec1 32 ssa_81 = deref_var &_GLF_color (shader_out vec4) 
        intrinsic store_deref (ssa_81, ssa_8) (15, 0) /* wrmask=xyzw */ /* access=0 */
        /* succs: block_25 */
        block block_25:
}
Comment 4 Alastair Donaldson 2019-08-16 16:25:14 UTC
Any thoughts on how to fix this one?
Comment 5 Juan A. Suarez 2019-08-30 08:08:28 UTC
(In reply to Alastair Donaldson from comment #4)
> Any thoughts on how to fix this one?

https://gitlab.freedesktop.org/mesa/mesa/merge_requests/1717 fixes this issue too
Comment 6 Juan A. Suarez 2019-08-30 08:10:47 UTC
(In reply to Juan A. Suarez from comment #5)
> (In reply to Alastair Donaldson from comment #4)
> > Any thoughts on how to fix this one?
> 
> https://gitlab.freedesktop.org/mesa/mesa/merge_requests/1717 fixes this
> issue too

Sorry, forget this, my mistake
Comment 7 Juan A. Suarez 2019-08-30 08:19:53 UTC
(In reply to Alastair Donaldson from comment #4)
> Any thoughts on how to fix this one?

https://gitlab.freedesktop.org/mesa/mesa/merge_requests/1352 should fix this
Comment 8 GitLab Migration User 2019-09-18 19:50:01 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/mesa/mesa/issues/846.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.