Bug 36193 - [i965] brw_eu_emit.c:182: validate_reg: Assertion `execsize >= width' failed.
Summary: [i965] brw_eu_emit.c:182: validate_reg: Assertion `execsize >= width' failed.
Status: RESOLVED FIXED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/i965 (show other bugs)
Version: git
Hardware: x86 (IA32) Linux (All)
: medium critical
Assignee: Intel 3D Bugs Mailing List
QA Contact:
URL:
Whiteboard:
Keywords: NEEDINFO
Depends on:
Blocks:
 
Reported: 2011-04-12 19:34 UTC by Vinson Lee
Modified: 2014-09-03 08:49 UTC (History)
2 users (show)

See Also:
i915 platform:
i915 features:


Attachments
Mesa trace with disabled assertions (5.09 KB, application/octet-stream)
2014-08-23 12:46 UTC, Thomas Weber
Details
Original binary Mesa trace with disabled assertions (43.67 KB, application/octet-stream)
2014-08-27 13:13 UTC, Thomas Weber
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Vinson Lee 2011-04-12 19:34:18 UTC
mesa: 3f7318c1b8d2ad4f4aef66362cdb7b9e8dc89eac (master)

chipset: GM45
xserver-xorg-video-intel: 2:2.14.0-4ubuntu7
kernel version: 2.6.38-8-generic
Linux distribution: Ubuntu 11.04 i386

This assert was triggered with VMware Workstation.

brw_eu_emit.c:182: validate_reg: Assertion `execsize >= width' failed.


(gdb) bt
#0  0x009d1416 in __kernel_vsyscall ()
#1  0x004e5e71 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0x004e934e in abort () at abort.c:92
#3  0x004de888 in __assert_fail (assertion=0x21df86e "execsize >= width", file=0x21df860 "brw_eu_emit.c", line=182, function=0x21dfebc "validate_reg") at assert.c:81
#4  0x01f98193 in validate_reg (insn=<value optimized out>, reg=...) at brw_eu_emit.c:182
#5  0x01f98287 in brw_set_src0 (insn=0x1ea60c8, reg=...) at brw_eu_emit.c:219
#6  0x01f98ddf in brw_alu2 (p=0x1ea5e38, opcode=<value optimized out>, dest=..., src0=..., src1=...) at brw_eu_emit.c:684
#7  0x01f8fef6 in compute_offset (c=0x1ea5e38) at brw_clip_unfilled.c:189
#8  brw_emit_unfilled_clip (c=0x1ea5e38) at brw_clip_unfilled.c:478
#9  0x01f882e5 in compile_clip_prog (brw=0xde990f0, key=0x1ecd26c) at brw_clip.c:115
#10 0x01f88649 in upload_clip_prog (brw=0xde990f0) at brw_clip.c:276
#11 0x01fa9d45 in brw_validate_state (brw=0xde990f0) at brw_state_upload.c:407
#12 0x01f95313 in brw_try_draw_prims (ctx=0xde990f0, arrays=0xcab7ba8, prim=0x1ecd3dc, nr_prims=1, ib=0x1ecd3f0, index_bounds_valid=0 '\000', min_index=4294967295, max_index=4294967295)
    at brw_draw.c:365
#13 brw_draw_prims (ctx=0xde990f0, arrays=0xcab7ba8, prim=0x1ecd3dc, nr_prims=1, ib=0x1ecd3f0, index_bounds_valid=0 '\000', min_index=4294967295, max_index=4294967295) at brw_draw.c:450
#14 0x0208b6ed in vbo_validated_drawrangeelements (ctx=0xde990f0, mode=4, index_bounds_valid=0 '\000', start=4294967295, end=4294967295, count=3456, type=5123, indices=0x0, basevertex=0, 
    numInstances=1) at vbo/vbo_exec_array.c:850
#15 0x0208bb0a in vbo_exec_DrawElements (mode=4, count=3456, type=5123, indices=0x0) at vbo/vbo_exec_array.c:1009

(gdb) frame 4
#4  0x01f98193 in validate_reg (insn=<value optimized out>, reg=...) at brw_eu_emit.c:182
182	   assert(execsize >= width);
(gdb) info locals
hstride_for_reg = {0, 1, 2, 4}
vstride_for_reg = {0, 1, 2, 4, 8, 16, 32, 64, 128, 256}
width_for_reg = {1, 2, 4, 8, 16}
execsize_for_reg = {1, 2, 4, 8, 16}
width = 4
hstride = <value optimized out>
vstride = 4
execsize = <value optimized out>
__PRETTY_FUNCTION__ = "validate_reg"
(gdb) l
177		  insn->header.execution_size < Elements(execsize_for_reg));
178	   execsize = execsize_for_reg[insn->header.execution_size];
179	
180	   /* Restrictions from 3.3.10: Register Region Restrictions. */
181	   /* 3. */
182	   assert(execsize >= width);
183	
184	   /* 4. */
185	   if (execsize == width && hstride != 0) {
186	      assert(vstride == -1 || vstride == width * hstride);
(gdb) print insn
$5 = <value optimized out>
Comment 1 Ian Romanick 2011-04-13 17:14:32 UTC
Is this a regression?  If so, could you bisect?
Comment 2 Vinson Lee 2011-08-08 15:15:06 UTC
mesa: db726b048e8858af226dbd0f0fda72d0be01394e (master)

Saw this crash again while running VMware Workstation.

(gdb) bt
[...]
#17 0x0124245d in validate_reg (insn=<value optimized out>, reg=...) at brw_eu_emit.c:193
#18 0x012427a6 in brw_set_src0 (p=<value optimized out>, insn=0x32dd728, reg=...) at brw_eu_emit.c:233
#19 0x012434ce in brw_alu2 (p=0x32dd498, opcode=<value optimized out>, dest=..., src0=..., src1=...) at brw_eu_emit.c:755
#20 0x01239ffa in compute_offset (c=0x32dd498) at brw_clip_unfilled.c:187
#21 brw_emit_unfilled_clip (c=0x32dd498) at brw_clip_unfilled.c:469
#22 0x012324bd in compile_clip_prog (brw=0xd5eb530, key=0x33048dc) at brw_clip.c:120
#23 0x01232665 in upload_clip_prog (brw=0xd5eb530) at brw_clip.c:274
#24 0x01256559 in brw_validate_state (brw=0xd5eb530) at brw_state_upload.c:480
#25 0x0123f332 in brw_try_draw_prims (ctx=0xd5eb530, arrays=0xc9a1474, prim=0x3304a0c, nr_prims=1, ib=0x3304a20, index_bounds_valid=0 '\000', min_index=0, max_index=624) at brw_draw.c:340
#26 brw_draw_prims (ctx=0xd5eb530, arrays=0xc9a1474, prim=0x3304a0c, nr_prims=1, ib=0x3304a20, index_bounds_valid=0 '\000', min_index=0, max_index=624) at brw_draw.c:431
#27 0x0134c664 in vbo_validated_drawrangeelements (ctx=0xd5eb530, mode=4, index_bounds_valid=0 '\000', start=4294967295, end=4294967295, count=3456, type=5123, indices=0x0, basevertex=0, 
    numInstances=1) at vbo/vbo_exec_array.c:846
#28 0x0134c8d5 in vbo_exec_DrawElements (mode=4, count=3456, type=5123, indices=0x0) at vbo/vbo_exec_array.c:1003
[...]
(gdb) frame 17
#17 0x0124245d in validate_reg (insn=<value optimized out>, reg=...) at brw_eu_emit.c:193
193	   assert(execsize >= width);
(gdb) info locals
hstride_for_reg = {0, 1, 2, 4}
vstride_for_reg = {0, 1, 2, 4, 8, 16, 32, 64, 128, 256}
width_for_reg = {1, 2, 4, 8, 16}
execsize_for_reg = {1, 2, 4, 8, 16}
width = 4
hstride = <value optimized out>
vstride = 4
execsize = 2
__PRETTY_FUNCTION__ = "validate_reg"
Comment 3 Magnus Kessler 2013-04-15 15:32:53 UTC
I encountered this bug with a very recent version of mesa (git-02b808b). It was triggered by the osgmanipulator example program from OpenSceneGraph-3.1.6+. Simply click around whilst holding the Control key until the program crashes.

#0  0x00007ffff5ef55b5 in raise () from /lib64/libc.so.6
#1  0x00007ffff5ef6a38 in abort () from /lib64/libc.so.6
#2  0x00007ffff5eee632 in ?? () from /lib64/libc.so.6
#3  0x00007ffff5eee6e2 in __assert_fail () from /lib64/libc.so.6
#4  0x00007ffff2c5c7cf in validate_reg (insn=0x7fffec207a80, reg=...) at brw_eu_emit.c:207
#5  0x00007ffff2c5c9f9 in brw_set_src0 (p=0x7ffff0b1dde0, insn=0x7fffec207a80, reg=...) at brw_eu_emit.c:261
#6  0x00007ffff2c5e30f in brw_alu2 (p=0x7ffff0b1dde0, opcode=65, dest=..., src0=..., src1=...) at brw_eu_emit.c:768
#7  0x00007ffff2c5f52a in brw_MUL (p=0x7ffff0b1dde0, dest=..., src0=..., src1=...) at brw_eu_emit.c:1010
#8  0x00007ffff2c4e7be in compute_offset (c=0x7ffff0b1dde0) at brw_clip_unfilled.c:200
#9  0x00007ffff2c4f741 in brw_emit_unfilled_clip (c=0x7ffff0b1dde0) at brw_clip_unfilled.c:496
#10 0x00007ffff2c4860e in compile_clip_prog (brw=0x6dc690, key=0x7ffff0b1e0c0) at brw_clip.c:95
#11 0x00007ffff2c48c19 in brw_upload_clip_prog (brw=0x6dc690) at brw_clip.c:250
#12 0x00007ffff2ca7a5f in brw_upload_state (brw=0x6dc690) at brw_state_upload.c:497
#13 0x00007ffff2c57330 in brw_try_draw_prims (ctx=0x6dc690, arrays=0x73f7f0, prim=0x7fffec007a00, nr_prims=1, ib=0x0, 
    min_index=0, max_index=3) at brw_draw.c:501
#14 0x00007ffff2c576a1 in brw_draw_prims (ctx=0x6dc690, prim=0x7fffec007a00, nr_prims=1, ib=0x0, index_bounds_valid=1 '\001', 
    min_index=0, max_index=3, tfb_vertcount=0x0) at brw_draw.c:589
#15 0x00007ffff26ee127 in vbo_save_playback_vertex_list (ctx=0x6dc690, data=0x7fffec01e410)
    at ../../../src/mesa/vbo/vbo_save_draw.c:315
#16 0x00007ffff258f87b in ext_opcode_execute (ctx=0x6dc690, node=0x7fffec01e408) at ../../../src/mesa/main/dlist.c:599
#17 0x00007ffff25a3ddb in execute_list (ctx=0x6dc690, list=5) at ../../../src/mesa/main/dlist.c:7327
#18 0x00007ffff25a9471 in _mesa_CallList (list=5) at ../../../src/mesa/main/dlist.c:8723
#19 0x00007ffff73031c4 in draw (renderInfo=..., this=<optimized out>)
    at /usr/src/debug/dev-games/openscenegraph-9999/openscenegraph-9999/include/osg/Drawable:893

(gdb) frame 4
#4  0x00007ffff2c5c7cf in validate_reg (insn=0x7fffec207a80, reg=...) at brw_eu_emit.c:207
207        assert(execsize >= width);

(gdb) info locals
hstride_for_reg = {0, 1, 2, 4}
vstride_for_reg = {0, 1, 2, 4, 8, 16, 32, 64, 128, 256}
width_for_reg = {1, 2, 4, 8, 16}
execsize_for_reg = {1, 2, 4, 8, 16}
width = 4
hstride = 1
vstride = 4
execsize = 2
__PRETTY_FUNCTION__ = "validate_reg"

(gdb) l
202               insn->header.execution_size < Elements(execsize_for_reg));
203        execsize = execsize_for_reg[insn->header.execution_size];
204
205        /* Restrictions from 3.3.10: Register Region Restrictions. */
206        /* 3. */
207        assert(execsize >= width);
208
209        /* 4. */
210        if (execsize == width && hstride != 0) {
211           assert(vstride == -1 || vstride == width * hstride);
Comment 4 Thomas Weber 2014-05-06 09:28:41 UTC
I am also seeing this bug [1]. Given its age, I don't think bisection will lead very far (in fact, I tried to bisect it but stumbled across a lot of issues, like .c files not in the build tree where they should be, etc.).

Is there something else I could do? I can easily reproduce the issue.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=743885
Comment 5 Matt Turner 2014-08-11 03:19:11 UTC
(In reply to comment #4)
> I am also seeing this bug [1]. Given its age, I don't think bisection will
> lead very far (in fact, I tried to bisect it but stumbled across a lot of
> issues, like .c files not in the build tree where they should be, etc.).
> 
> Is there something else I could do? I can easily reproduce the issue.
> 
> [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=743885

Yes, if you could provide an apitrace that reproduces the issue it would help a lot.
Comment 6 Thomas Weber 2014-08-20 09:18:07 UTC
I tried with apitrace[1], but all I get are empty tracefiles (I have verified that glxgears works). It seems that the crash of Octave prevents the trace file from being written.

[1] https://github.com/apitrace is the correct one, isn't it?
Comment 7 Matt Turner 2014-08-20 20:22:37 UTC
(In reply to comment #6)
> I tried with apitrace[1], but all I get are empty tracefiles (I have
> verified that glxgears works). It seems that the crash of Octave prevents
> the trace file from being written.
> 
> [1] https://github.com/apitrace is the correct one, isn't it?

Yes, that's right.

To capture the trace, try running a release build of Mesa (i.e., one without assertions) or perhaps an older version that does not have this bug.
Comment 8 Thomas Weber 2014-08-23 12:46:11 UTC
Created attachment 105150 [details]
Mesa trace with disabled assertions
Comment 9 Thomas Weber 2014-08-23 12:46:45 UTC
Okay, here is the trace.
Mesa: d682ebec0bb8716dfa7747c46d5bfad732ead06c

configure call:
./configure   --prefix=/usr \
              --enable-driglx-direct \
              --enable-gles1 \
              --enable-gles2 \
              --enable-glx-tls \
              --with-dri-driverdir=/usr/lib/dri \
              --with-egl-platforms='drm x11' \
              --enable-debug \
              --with-dri-drivers=i965 \
              --with-gallium-drivers="" \
              CPPFLAGS=-DNDEBUG CFLAGS="-g -O0" CXXFLAGS="-g -O0"

I used the compiled libraries as described at http://x.debian.net/howto/build-mesa.html.
Attached is the trace without assertions.
Comment 10 Matt Turner 2014-08-23 16:26:27 UTC
(In reply to comment #8)
> Created attachment 105150 [details]
> Mesa trace with disabled assertions

Sorry, this doesn't look like a valid trace. (I can't replay it after xz -d with glretrace).
Comment 11 Thomas Weber 2014-08-27 13:11:45 UTC
Ah sorry. The previous upload (octave-cli.trace.txt.lzma) is a dumped trace. I will upload the original binary trace file as well.
Comment 12 Thomas Weber 2014-08-27 13:13:39 UTC
Created attachment 105334 [details]
Original binary Mesa trace with disabled assertions
Comment 13 Kenneth Graunke 2014-08-31 09:00:51 UTC
Oh hey, I happened to fix this a while back when looking at a different bug.

commit b7679639bcc8ac72cb08c48f9cda8eecd6a9c1e5
Author: Kenneth Graunke <kenneth@whitecape.org>
Date:   Tue Aug 5 23:57:17 2014 -0700

    i965/clip: Fix brw_clip_unfilled.c/compute_offset's assembly.
    
    Due to the destination register width of 1 or 2, these instructions get
    ExecSize 1 or 2.  But dir and offset (used as src0) are both registers
    of width 4, violating the execsize >= width assertion.
    
    I honestly don't think this could have ever worked.
    
    Fixes Piglit's polygon-offset and polygon-mode-offset tests on Gen4-5.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70441
    Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
    Reviewed-by: Chris Forbes <chrisf@ijw.co.nz>

The fix will be in 10.3, and I've nominated it for stable releases as well, so it may end up in 10.2.x at some point.
Comment 14 Thomas Weber 2014-09-03 08:49:51 UTC
I cannot confirm that the patch fixes the problem. I have updated my whole system and now I no longer see an assertion, but my whole X server is taken down - which means that I have no idea where the problem lies. This happens with our without supplying NDEBUG as parameter.
However, as written in comment #9, I was using master of as d682ebec0bb8716dfa7747c46d5bfad732ead06c, which should include Kenneth's patch from comment 13, shouldn't it?


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.