Bug 27098 - [wine] Left 4 Dead causes a crash in intel_miptree_pitch_align
Summary: [wine] Left 4 Dead causes a crash in intel_miptree_pitch_align
Status: RESOLVED FIXED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/i965 (show other bugs)
Version: git
Hardware: Other All
: low major
Assignee: Eric Anholt
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-03-15 15:17 UTC by Sven Arvidsson
Modified: 2010-07-17 11:43 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
winedbg backtrace (3.03 KB, text/plain)
2010-03-15 15:17 UTC, Sven Arvidsson
Details
gdb backtrace (21.30 KB, text/plain)
2010-04-06 14:38 UTC, Sven Arvidsson
Details
Band-aid, prevent the crash. (1.71 KB, patch)
2010-07-17 11:31 UTC, Chris Wilson
Details | Splinter Review

Description Sven Arvidsson 2010-03-15 15:17:45 UTC
Created attachment 34089 [details]
winedbg backtrace

The game Left 4 Dead (running in Wine 1.1.32) is causing a crash in intel_miptree_pitch_align. This happens immediately after the game is launched, in the menu.

Not a regression, or at least also a problem in 7.7. 

I'm attaching the backtrace from winedbg, hoping it contains something useful. 

System environment:
-- chipset: G45 / ICH10R
-- system architecture: 32-bit
-- Linux distribution: Debian unstable
-- Machine or mobo model: Asus P5Q-EM
-- Display connector: DVI
-- xf86-video-intel: 318aa9ed799197810e2039dbe3ec51559dcc888c
-- xserver: 1.7.5
-- mesa: d0b35352ed27b1e66785c45ee95a352ed06b47ce
-- drm: 04fd3872ee8bd8d5e2c27740508c67c2d51dbc11
-- kernel: 2.6.33
Comment 1 Eric Anholt 2010-03-17 14:49:28 UTC
Hard to tell anything without gdb output.  Is the crash gone now that intel_miptree_pitch_align is gone in master?
Comment 2 Sven Arvidsson 2010-03-17 15:42:42 UTC
Still crashing, this is the output of winedbg --gdb, not sure if it's of more help?

Program received signal SIGFPE, Arithmetic exception.
0x7cfa2768 in intel_region_alloc (intel=0x7cdefc78, tiling=1, cpp=0, 
    width=1024, height=1024, expect_accelerated_upload=1 '\001')
    at intel_regions.c:190
190	   region = intel_region_alloc_internal(intel, cpp, width, height,
Wine-gdb> bt
#0  0x7cfa2768 in intel_region_alloc (intel=0x7cdefc78, tiling=1, cpp=0, 
    width=1024, height=1024, expect_accelerated_upload=1 '\001')
    at intel_regions.c:190
#1  0x7cfa1c63 in intel_miptree_create (intel=0x7cdefc78, target=3553, 
    base_format=6408, internal_format=35917, first_level=0, last_level=0, 
    width0=1024, height0=1024, depth0=1, cpp=0, compress_byte=0, 
    expect_accelerated_upload=0 '\000') at intel_mipmap_tree.c:143
#2  0x7cfae4c3 in intel_finalize_mipmap_tree (intel=0x7cdefc78, unit=0)
    at intel_tex_validate.c:200
#3  0x7cfc7f20 in brw_validate_textures (brw=0x7cdefc78) at brw_tex.c:56
#4  0x7cfbadb2 in brw_try_draw_prims (ctx=0x7cdefc78, arrays=0x7ce1111c, 
    prim=0x33d428, nr_prims=1, ib=0x33d438, index_bounds_valid=0 '\000', 
    min_index=0, max_index=3) at brw_draw.c:317
#5  brw_draw_prims (ctx=0x7cdefc78, arrays=0x7ce1111c, prim=0x33d428, 
    nr_prims=1, ib=0x33d438, index_bounds_valid=0 '\000', min_index=0, 
    max_index=3) at brw_draw.c:441
#6  0x7d07d59b in vbo_validated_drawrangeelements (ctx=0x7cdefc78, 
    mode=<value optimized out>, index_bounds_valid=<value optimized out>, 
    start=4294967295, end=4294967295, count=6, type=5123, indices=0x19bea0, 
    basevertex=0) at vbo/vbo_exec_array.c:663
#7  0x7d07d721 in vbo_exec_DrawElements (mode=4, count=6, type=5123, 
    indices=0x19bea0) at vbo/vbo_exec_array.c:807
#8  0x7d072089 in neutral_DrawElements (mode=4, count=6, type=5123, 
    indices=0x19bea0) at main/vtxfmt_tmp.h:334
#9  0x7d2cdeba in ?? () from /usr/lib/wine-unstable/wined3d.dll.so
#10 0x7d2a3ec5 in ?? () from /usr/lib/wine-unstable/wined3d.dll.so
#11 0x7d4c8ac3 in ?? () from /usr/lib/wine-unstable/d3d9.dll.so
#12 0x078ca24a in ?? ()

Comment 3 Sven Arvidsson 2010-04-06 14:38:47 UTC
Created attachment 34731 [details]
gdb backtrace

Now using git master 7e246e6aa63979d53731a591f4caee3651c1d96b it crashes in intelTexImage:

(Not sure if the backtrace is helpful, but at least it's captured from gdb this time, not winedbg).

Thread 1 (Thread 0xb75c86c0 (LWP 24538)):
#0  memcpy () at ../sysdeps/i386/i686/memcpy.S:75
No locals.
#1  0x08b50020 in ?? ()
No symbol table info available.
#2  0x7cccf3b1 in intelTexImage (ctx=0x75d2ffe0, dims=<value optimized out>, 
    target=3553, level=0, internalFormat=35917, width=1024, height=1024, 
    depth=1, border=0, format=0, type=0, pixels=0x8b50020, unpack=0x7d8178c4, 
    texObj=0x79a3d348, texImage=0x8bd1000, imageSize=524288, 
    compressed=1 '\001') at intel_tex_image.c:527
        dst = <value optimized out>
        postConvWidth = 1024
        postConvHeight = 1024
        texelBytes = 0
---Type <return> to continue, or q <return> to quit---
        sizeInBytes = <value optimized out>
        dstRowStride = 8192
        srcRowStride = 1024
        __FUNCTION__ = "intelTexImage"
        __PRETTY_FUNCTION__ = "intelTexImage"
#3  0x7cccfea2 in intelCompressedTexImage2D (ctx=0x7d808b40, target=3553, 
    level=0, internalFormat=35917, width=1024, height=1024, border=0, 
    imageSize=524288, data=0x8b50020, texObj=0x79a3d348, texImage=0x79dc6d30)
    at intel_tex_image.c:618
No locals.
#4  0x7cd80270 in _mesa_CompressedTexImage2DARB (target=3553, level=0, 
    internalFormat=35917, width=1024, height=1024, border=0, imageSize=524288, 
    data=0x8b50020) at main/teximage.c:3460
        texObj = 0x79a3d348
        texImage = <value optimized out>
        error = <value optimized out>
        ctx = 0x7d808b40
Comment 4 Sven Arvidsson 2010-04-23 12:02:11 UTC
(In reply to comment #3)
> Created an attachment (id=34731) [details]
> gdb backtrace
> 
> Now using git master 7e246e6aa63979d53731a591f4caee3651c1d96b it crashes in
> intelTexImage:

Never mind this, it's back to crashing in intel_region_alloc again. "aligned_pitch / cpp" results in a divide by zero, I guess there should be an assert somewhere down the line to catch this?

cpp = 0 comes from the call to intel_compressed_num_bytes in line 168 in intel_tex_validate.c.

intel_compressed_num_bytes returns 0 if none of the formats match. Simply making it return 2 (or 4) will get the game running, but obviously with corrupt textures.

I guess the next step is figuring out which format the game uses, and properly adding it to the function.
Comment 5 Sven Arvidsson 2010-04-23 13:05:55 UTC
Okay so _mesa_get_format_name returns MESA_FORMAT_SRGB_DXT1.
Comment 6 Sven Arvidsson 2010-04-27 07:09:15 UTC
Bug can be worked around by launching the game with:

MESA_EXTENSION_OVERRIDE=-GL_EXT_texture_sRGB
Comment 7 Sven Arvidsson 2010-05-01 17:10:49 UTC
Enabling debugging in intelChooseTextureFormat, this is the last line:
 intelChooseTextureFormat intFmt=0x8c4d format=0x0 type=0x0

0x8c4d is GL_COMPRESSED_SRGB_ALPHA_S3TC_DXT1_EXT
Comment 8 Chris Wilson 2010-07-17 11:31:13 UTC
Created attachment 37156 [details] [review]
Band-aid, prevent the crash.
Comment 9 Chris Wilson 2010-07-17 11:43:37 UTC
commit 7554b83a21bd62b20df5a7327b69f08108ac9ab6
Author: Eric Anholt <eric@anholt.net>
Date:   Thu May 13 14:48:13 2010 -0700

    intel: Handle arbitrary compressed formats in intel_compressed_num_bytes.
    
    Note that we don't support arbitrary block size for compressed quite
    yet -- block height of 4 is hard-coded all over the place.
    
    Bug #27098 (srgb dxt1 producing a bytes per pixel of 0).


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.