Bug 36193 - [i965] brw_eu_emit.c:182: validate_reg: Assertion `execsize >= width' failed.
Summary: [i965] brw_eu_emit.c:182: validate_reg: Assertion `execsize >= width' failed.
Status: RESOLVED FIXED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/i965 (show other bugs)
Version: git
Hardware: x86 (IA32) Linux (All)
: medium critical
Assignee: Intel 3D Bugs Mailing List
QA Contact:
URL:
Whiteboard:
Keywords: NEEDINFO
Depends on:
Blocks:
 
Reported: 2011-04-12 19:34 UTC by Vinson Lee
Modified: 2014-09-03 08:49 UTC (History)
2 users (show)

See Also:
i915 platform:
i915 features:


Attachments
Mesa trace with disabled assertions (5.09 KB, application/octet-stream)
2014-08-23 12:46 UTC, Thomas Weber
Details
Original binary Mesa trace with disabled assertions (43.67 KB, application/octet-stream)
2014-08-27 13:13 UTC, Thomas Weber
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Vinson Lee 2011-04-12 19:34:18 UTC
mesa: 3f7318c1b8d2ad4f4aef66362cdb7b9e8dc89eac (master)

chipset: GM45
xserver-xorg-video-intel: 2:2.14.0-4ubuntu7
kernel version: 2.6.38-8-generic
Linux distribution: Ubuntu 11.04 i386

This assert was triggered with VMware Workstation.

brw_eu_emit.c:182: validate_reg: Assertion `execsize >= width' failed.


(gdb) bt
#0  0x009d1416 in __kernel_vsyscall ()
#1  0x004e5e71 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0x004e934e in abort () at abort.c:92
#3  0x004de888 in __assert_fail (assertion=0x21df86e "execsize >= width", file=0x21df860 "brw_eu_emit.c", line=182, function=0x21dfebc "validate_reg") at assert.c:81
#4  0x01f98193 in validate_reg (insn=<value optimized out>, reg=...) at brw_eu_emit.c:182
#5  0x01f98287 in brw_set_src0 (insn=0x1ea60c8, reg=...) at brw_eu_emit.c:219
#6  0x01f98ddf in brw_alu2 (p=0x1ea5e38, opcode=<value optimized out>, dest=..., src0=..., src1=...) at brw_eu_emit.c:684
#7  0x01f8fef6 in compute_offset (c=0x1ea5e38) at brw_clip_unfilled.c:189
#8  brw_emit_unfilled_clip (c=0x1ea5e38) at brw_clip_unfilled.c:478
#9  0x01f882e5 in compile_clip_prog (brw=0xde990f0, key=0x1ecd26c) at brw_clip.c:115
#10 0x01f88649 in upload_clip_prog (brw=0xde990f0) at brw_clip.c:276
#11 0x01fa9d45 in brw_validate_state (brw=0xde990f0) at brw_state_upload.c:407
#12 0x01f95313 in brw_try_draw_prims (ctx=0xde990f0, arrays=0xcab7ba8, prim=0x1ecd3dc, nr_prims=1, ib=0x1ecd3f0, index_bounds_valid=0 '\000', min_index=4294967295, max_index=4294967295)
    at brw_draw.c:365
#13 brw_draw_prims (ctx=0xde990f0, arrays=0xcab7ba8, prim=0x1ecd3dc, nr_prims=1, ib=0x1ecd3f0, index_bounds_valid=0 '\000', min_index=4294967295, max_index=4294967295) at brw_draw.c:450
#14 0x0208b6ed in vbo_validated_drawrangeelements (ctx=0xde990f0, mode=4, index_bounds_valid=0 '\000', start=4294967295, end=4294967295, count=3456, type=5123, indices=0x0, basevertex=0, 
    numInstances=1) at vbo/vbo_exec_array.c:850
#15 0x0208bb0a in vbo_exec_DrawElements (mode=4, count=3456, type=5123, indices=0x0) at vbo/vbo_exec_array.c:1009

(gdb) frame 4
#4  0x01f98193 in validate_reg (insn=<value optimized out>, reg=...) at brw_eu_emit.c:182
182	   assert(execsize >= width);
(gdb) info locals
hstride_for_reg = {0, 1, 2, 4}
vstride_for_reg = {0, 1, 2, 4, 8, 16, 32, 64, 128, 256}
width_for_reg = {1, 2, 4, 8, 16}
execsize_for_reg = {1, 2, 4, 8, 16}
width = 4
hstride = <value optimized out>
vstride = 4
execsize = <value optimized out>
__PRETTY_FUNCTION__ = "validate_reg"
(gdb) l
177		  insn->header.execution_size < Elements(execsize_for_reg));
178	   execsize = execsize_for_reg[insn->header.execution_size];
179	
180	   /* Restrictions from 3.3.10: Register Region Restrictions. */
181	   /* 3. */
182	   assert(execsize >= width);
183	
184	   /* 4. */
185	   if (execsize == width && hstride != 0) {
186	      assert(vstride == -1 || vstride == width * hstride);
(gdb) print insn
$5 = <value optimized out>
Comment 1 Ian Romanick 2011-04-13 17:14:32 UTC
Is this a regression?  If so, could you bisect?
Comment 2 Vinson Lee 2011-08-08 15:15:06 UTC
mesa: db726b048e8858af226dbd0f0fda72d0be01394e (master)

Saw this crash again while running VMware Workstation.

(gdb) bt
[...]
#17 0x0124245d in validate_reg (insn=<value optimized out>, reg=...) at brw_eu_emit.c:193
#18 0x012427a6 in brw_set_src0 (p=<value optimized out>, insn=0x32dd728, reg=...) at brw_eu_emit.c:233
#19 0x012434ce in brw_alu2 (p=0x32dd498, opcode=<value optimized out>, dest=..., src0=..., src1=...) at brw_eu_emit.c:755
#20 0x01239ffa in compute_offset (c=0x32dd498) at brw_clip_unfilled.c:187
#21 brw_emit_unfilled_clip (c=0x32dd498) at brw_clip_unfilled.c:469
#22 0x012324bd in compile_clip_prog (brw=0xd5eb530, key=0x33048dc) at brw_clip.c:120
#23 0x01232665 in upload_clip_prog (brw=0xd5eb530) at brw_clip.c:274
#24 0x01256559 in brw_validate_state (brw=0xd5eb530) at brw_state_upload.c:480
#25 0x0123f332 in brw_try_draw_prims (ctx=0xd5eb530, arrays=0xc9a1474, prim=0x3304a0c, nr_prims=1, ib=0x3304a20, index_bounds_valid=0 '\000', min_index=0, max_index=624) at brw_draw.c:340
#26 brw_draw_prims (ctx=0xd5eb530, arrays=0xc9a1474, prim=0x3304a0c, nr_prims=1, ib=0x3304a20, index_bounds_valid=0 '\000', min_index=0, max_index=624) at brw_draw.c:431
#27 0x0134c664 in vbo_validated_drawrangeelements (ctx=0xd5eb530, mode=4, index_bounds_valid=0 '\000', start=4294967295, end=4294967295, count=3456, type=5123, indices=0x0, basevertex=0, 
    numInstances=1) at vbo/vbo_exec_array.c:846
#28 0x0134c8d5 in vbo_exec_DrawElements (mode=4, count=3456, type=5123, indices=0x0) at vbo/vbo_exec_array.c:1003
[...]
(gdb) frame 17
#17 0x0124245d in validate_reg (insn=<value optimized out>, reg=...) at brw_eu_emit.c:193
193	   assert(execsize >= width);
(gdb) info locals
hstride_for_reg = {0, 1, 2, 4}
vstride_for_reg = {0, 1, 2, 4, 8, 16, 32, 64, 128, 256}
width_for_reg = {1, 2, 4, 8, 16}
execsize_for_reg = {1, 2, 4, 8, 16}
width = 4
hstride = <value optimized out>
vstride = 4
execsize = 2
__PRETTY_FUNCTION__ = "validate_reg"
Comment 3 Magnus Kessler 2013-04-15 15:32:53 UTC
I encountered this bug with a very recent version of mesa (git-02b808b). It was triggered by the osgmanipulator example program from OpenSceneGraph-3.1.6+. Simply click around whilst holding the Control key until the program crashes.

#0  0x00007ffff5ef55b5 in raise () from /lib64/libc.so.6
#1  0x00007ffff5ef6a38 in abort () from /lib64/libc.so.6
#2  0x00007ffff5eee632 in ?? () from /lib64/libc.so.6
#3  0x00007ffff5eee6e2 in __assert_fail () from /lib64/libc.so.6
#4  0x00007ffff2c5c7cf in validate_reg (insn=0x7fffec207a80, reg=...) at brw_eu_emit.c:207
#5  0x00007ffff2c5c9f9 in brw_set_src0 (p=0x7ffff0b1dde0, insn=0x7fffec207a80, reg=...) at brw_eu_emit.c:261
#6  0x00007ffff2c5e30f in brw_alu2 (p=0x7ffff0b1dde0, opcode=65, dest=..., src0=..., src1=...) at brw_eu_emit.c:768
#7  0x00007ffff2c5f52a in brw_MUL (p=0x7ffff0b1dde0, dest=..., src0=..., src1=...) at brw_eu_emit.c:1010
#8  0x00007ffff2c4e7be in compute_offset (c=0x7ffff0b1dde0) at brw_clip_unfilled.c:200
#9  0x00007ffff2c4f741 in brw_emit_unfilled_clip (c=0x7ffff0b1dde0) at brw_clip_unfilled.c:496
#10 0x00007ffff2c4860e in compile_clip_prog (brw=0x6dc690, key=0x7ffff0b1e0c0) at brw_clip.c:95
#11 0x00007ffff2c48c19 in brw_upload_clip_prog (brw=0x6dc690) at brw_clip.c:250
#12 0x00007ffff2ca7a5f in brw_upload_state (brw=0x6dc690) at brw_state_upload.c:497
#13 0x00007ffff2c57330 in brw_try_draw_prims (ctx=0x6dc690, arrays=0x73f7f0, prim=0x7fffec007a00, nr_prims=1, ib=0x0, 
    min_index=0, max_index=3) at brw_draw.c:501
#14 0x00007ffff2c576a1 in brw_draw_prims (ctx=0x6dc690, prim=0x7fffec007a00, nr_prims=1, ib=0x0, index_bounds_valid=1 '\001', 
    min_index=0, max_index=3, tfb_vertcount=0x0) at brw_draw.c:589
#15 0x00007ffff26ee127 in vbo_save_playback_vertex_list (ctx=0x6dc690, data=0x7fffec01e410)
    at ../../../src/mesa/vbo/vbo_save_draw.c:315
#16 0x00007ffff258f87b in ext_opcode_execute (ctx=0x6dc690, node=0x7fffec01e408) at ../../../src/mesa/main/dlist.c:599
#17 0x00007ffff25a3ddb in execute_list (ctx=0x6dc690, list=5) at ../../../src/mesa/main/dlist.c:7327
#18 0x00007ffff25a9471 in _mesa_CallList (list=5) at ../../../src/mesa/main/dlist.c:8723
#19 0x00007ffff73031c4 in draw (renderInfo=..., this=<optimized out>)
    at /usr/src/debug/dev-games/openscenegraph-9999/openscenegraph-9999/include/osg/Drawable:893

(gdb) frame 4
#4  0x00007ffff2c5c7cf in validate_reg (insn=0x7fffec207a80, reg=...) at brw_eu_emit.c:207
207        assert(execsize >= width);

(gdb) info locals
hstride_for_reg = {0, 1, 2, 4}
vstride_for_reg = {0, 1, 2, 4, 8, 16, 32, 64, 128, 256}
width_for_reg = {1, 2, 4, 8, 16}
execsize_for_reg = {1, 2, 4, 8, 16}
width = 4
hstride = 1
vstride = 4
execsize = 2
__PRETTY_FUNCTION__ = "validate_reg"

(gdb) l
202               insn->header.execution_size < Elements(execsize_for_reg));
203        execsize = execsize_for_reg[insn->header.execution_size];
204
205        /* Restrictions from 3.3.10: Register Region Restrictions. */
206        /* 3. */
207        assert(execsize >= width);
208
209        /* 4. */
210        if (execsize == width && hstride != 0) {
211           assert(vstride == -1 || vstride == width * hstride);
Comment 4 Thomas Weber 2014-05-06 09:28:41 UTC
I am also seeing this bug [1]. Given its age, I don't think bisection will lead very far (in fact, I tried to bisect it but stumbled across a lot of issues, like .c files not in the build tree where they should be, etc.).

Is there something else I could do? I can easily reproduce the issue.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=743885
Comment 5 Matt Turner 2014-08-11 03:19:11 UTC
(In reply to comment #4)
> I am also seeing this bug [1]. Given its age, I don't think bisection will
> lead very far (in fact, I tried to bisect it but stumbled across a lot of
> issues, like .c files not in the build tree where they should be, etc.).
> 
> Is there something else I could do? I can easily reproduce the issue.
> 
> [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=743885

Yes, if you could provide an apitrace that reproduces the issue it would help a lot.
Comment 6 Thomas Weber 2014-08-20 09:18:07 UTC
I tried with apitrace[1], but all I get are empty tracefiles (I have verified that glxgears works). It seems that the crash of Octave prevents the trace file from being written.

[1] https://github.com/apitrace is the correct one, isn't it?
Comment 7 Matt Turner 2014-08-20 20:22:37 UTC
(In reply to comment #6)
> I tried with apitrace[1], but all I get are empty tracefiles (I have
> verified that glxgears works). It seems that the crash of Octave prevents
> the trace file from being written.
> 
> [1] https://github.com/apitrace is the correct one, isn't it?

Yes, that's right.

To capture the trace, try running a release build of Mesa (i.e., one without assertions) or perhaps an older version that does not have this bug.
Comment 8 Thomas Weber 2014-08-23 12:46:11 UTC
Created attachment 105150 [details]
Mesa trace with disabled assertions
Comment 9 Thomas Weber 2014-08-23 12:46:45 UTC
Okay, here is the trace.
Mesa: d682ebec0bb8716dfa7747c46d5bfad732ead06c

configure call:
./configure   --prefix=/usr \
              --enable-driglx-direct \
              --enable-gles1 \
              --enable-gles2 \
              --enable-glx-tls \
              --with-dri-driverdir=/usr/lib/dri \
              --with-egl-platforms='drm x11' \
              --enable-debug \
              --with-dri-drivers=i965 \
              --with-gallium-drivers="" \
              CPPFLAGS=-DNDEBUG CFLAGS="-g -O0" CXXFLAGS="-g -O0"

I used the compiled libraries as described at http://x.debian.net/howto/build-mesa.html.
Attached is the trace without assertions.
Comment 10 Matt Turner 2014-08-23 16:26:27 UTC
(In reply to comment #8)
> Created attachment 105150 [details]
> Mesa trace with disabled assertions

Sorry, this doesn't look like a valid trace. (I can't replay it after xz -d with glretrace).
Comment 11 Thomas Weber 2014-08-27 13:11:45 UTC
Ah sorry. The previous upload (octave-cli.trace.txt.lzma) is a dumped trace. I will upload the original binary trace file as well.
Comment 12 Thomas Weber 2014-08-27 13:13:39 UTC
Created attachment 105334 [details]
Original binary Mesa trace with disabled assertions
Comment 13 Kenneth Graunke 2014-08-31 09:00:51 UTC
Oh hey, I happened to fix this a while back when looking at a different bug.

commit b7679639bcc8ac72cb08c48f9cda8eecd6a9c1e5
Author: Kenneth Graunke <kenneth@whitecape.org>
Date:   Tue Aug 5 23:57:17 2014 -0700

    i965/clip: Fix brw_clip_unfilled.c/compute_offset's assembly.
    
    Due to the destination register width of 1 or 2, these instructions get
    ExecSize 1 or 2.  But dir and offset (used as src0) are both registers
    of width 4, violating the execsize >= width assertion.
    
    I honestly don't think this could have ever worked.
    
    Fixes Piglit's polygon-offset and polygon-mode-offset tests on Gen4-5.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70441
    Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
    Reviewed-by: Chris Forbes <chrisf@ijw.co.nz>

The fix will be in 10.3, and I've nominated it for stable releases as well, so it may end up in 10.2.x at some point.
Comment 14 Thomas Weber 2014-09-03 08:49:51 UTC
I cannot confirm that the patch fixes the problem. I have updated my whole system and now I no longer see an assertion, but my whole X server is taken down - which means that I have no idea where the problem lies. This happens with our without supplying NDEBUG as parameter.
However, as written in comment #9, I was using master of as d682ebec0bb8716dfa7747c46d5bfad732ead06c, which should include Kenneth's patch from comment 13, shouldn't it?


bug/show.html.tmpl processed on Mar 26, 2017 at 03:24:17.
(provided by the Example extension).