Bug 111286 - Mesa glsl compiler crashes in "tropico 6" game on an assertion
Summary: Mesa glsl compiler crashes in "tropico 6" game on an assertion
Status: NEW
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/i965 (show other bugs)
Version: git
Hardware: Other All
: medium normal
Assignee: Intel 3D Bugs Mailing List
QA Contact: Intel 3D Bugs Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-08-02 14:58 UTC by andrii simiklit
Modified: 2019-08-08 12:58 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description andrii simiklit 2019-08-02 14:58:09 UTC
Tested just on KBL and SKL

The issue was bisected to commit:
156306e5e62fb4fda0e829c5798fffdf7eb1907c

I am investigating this issue. 

Mesa compiler guys please don't steal my bug)))
Comment 1 andrii simiklit 2019-08-08 12:58:16 UTC
So shader_test which could reproduce this issue is here:
https://gitlab.freedesktop.org/mesa/piglit/merge_requests/108

Suggested mesa fix:
https://gitlab.freedesktop.org/mesa/mesa/merge_requests/1615

The problem happens when shader tries to copy some part of the array of inputs
to some temp array and then uses these temp array elements like here:

[fragment shader]
uniform int idx;
in vec4 vs_data[3];
out vec4 out_put;

void main()
{
   vec4 temp[2];
   temp[0] = vs_data[0];
   temp[1] = vs_data[1];
   temp[2] = vs_data[2];
   out_put = temp[idx];
}

1. optimization find_array_copies creates a copy_deref for temp[*] = vs_data[*] regardless that these arrays have different lengths.
2. nir_opt_copy_prop_vars tries to prevent copying and use the original array instead and crashes here:
"assert(glsl_get_length(parent->type) ==
             glsl_get_length(leader_parent->type));"

The crash call stack:
libc.so.6!__GI___assert_fail(...)
nir_build_deref_follower(...)
specialize_wildcards(...)
load_from_deref_entry_value(...)
try_load_from_entry(...)
copy_prop_vars_block(...)
copy_prop_vars_cf_node(...)
copy_prop_vars_cf_node(...)
nir_copy_prop_vars_impl(...)
nir_opt_copy_prop_vars(...)
brw_nir_optimize(...)
brw_preprocess_nir(...)
brw_create_nir(...)
brw_link_shader(...)


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.