Bug 43212 - [bisected] intel_mipmap_tree.c:361: intel_miptree_set_image_offset: Assertion `img < mt->level[level].depth' failed.
Summary: [bisected] intel_mipmap_tree.c:361: intel_miptree_set_image_offset: Assertion...
Status: RESOLVED FIXED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/i965 (show other bugs)
Version: git
Hardware: x86-64 (AMD64) Linux (All)
: medium critical
Assignee: Ian Romanick
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 42993
  Show dependency treegraph
 
Reported: 2011-11-23 22:27 UTC by Vinson Lee
Modified: 2012-01-18 12:51 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
proposed patch (646 bytes, patch)
2011-12-07 23:30 UTC, Jin Yang
Details | Splinter Review

Description Vinson Lee 2011-11-23 22:27:53 UTC
-- chipset: GM45
-- system architecture: x86_64
-- xf86-video-intel: 2.15.901
-- xserver: 1.10.4
-- mesa: 24d25b55bf511493e70600cc7c49c0a0e6fc7a32 (master)
-- libdrm: 2.4.27
-- kernel version: 3.2.0-1-generic
-- Linux distribution: Ubuntu 12.04 x86_64

Run piglit test crash-cubemap-order.

$ ./bin/crash-cubemap-order -auto
Mesa: Initializing x86-64 optimizations
crash-cubemap-order: intel_mipmap_tree.c:361: intel_miptree_set_image_offset: Assertion `img < mt->level[level].depth' failed.
Aborted (core dumped)

(gdb) bt
#0  0x00007fefe2d923a5 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007fefe2d95b0b in __GI_abort () at abort.c:92
#2  0x00007fefe2d8ad4d in __GI___assert_fail (assertion=0x7fefe0b759be "img < mt->level[level].depth", 
    file=<optimized out>, line=361, function=<optimized out>) at assert.c:81
#3  0x00007fefe08ee1e4 in intel_miptree_set_image_offset (mt=<optimized out>, level=<optimized out>, 
    img=<optimized out>, x=<optimized out>, y=<optimized out>) at intel_mipmap_tree.c:361
#4  0x00007fefe091a1c1 in brw_miptree_layout (intel=<optimized out>, mt=0x2570890) at brw_tex_layout.c:115
#5  0x00007fefe08edb84 in intel_miptree_create_internal (intel=0x7fefe377a040, target=34067, 
    format=MESA_FORMAT_ARGB8888, first_level=0, last_level=5, width0=32, height0=32, depth0=1) at intel_mipmap_tree.c:119
#6  0x00007fefe08ede90 in intel_miptree_create (intel=0x7fefe377a040, target=34067, format=MESA_FORMAT_ARGB8888, 
    first_level=0, last_level=<optimized out>, width0=<optimized out>, height0=32, depth0=1, 
    expect_accelerated_upload=false) at intel_mipmap_tree.c:169
#7  0x00007fefe08f79fb in intel_miptree_create_for_teximage (intel=0x7fefe377a040, intelObj=0x255d870, 
    intelImage=0x2576620, expect_accelerated_upload=false) at intel_tex_image.c:92
#8  0x00007fefe08f66b1 in intel_alloc_texture_image_buffer (ctx=0x7fefe377a040, image=0x2576620, format=<optimized out>, 
    width=32, height=32, depth=1) at intel_tex.c:94
#9  0x00007fefe0a06809 in _mesa_store_teximage3d (ctx=0x7fefe377a040, target=34070, level=<optimized out>, 
    internalFormat=<optimized out>, width=32, height=32, depth=1, border=0, format=6408, type=5121, 
    pixels=0x7fff9dbb1820, packing=0x7fefe3789900, texObj=0x255d870, texImage=0x2576620) at main/texstore.c:4669
#10 0x00007fefe08f7306 in intelTexImage (ctx=0x7fefe377a040, dims=<optimized out>, target=34070, level=0, 
    internalFormat=6408, width=32, height=32, depth=1, format=6408, type=5121, pixels=0x7fff9dbb1820, 
    unpack=0x7fefe3789900, texObj=0x255d870, texImage=0x2576620, imageSize=<optimized out>) at intel_tex_image.c:225
#11 0x00007fefe08f786f in intelTexImage2D (ctx=<optimized out>, target=<optimized out>, level=<optimized out>, 
    internalFormat=<optimized out>, width=<optimized out>, height=<optimized out>, border=0, format=6408, type=5121, 
    pixels=0x7fff9dbb1820, unpack=0x7fefe3789900, texObj=0x255d870, texImage=0x2576620) at intel_tex_image.c:259
#12 0x00007fefe09f33c7 in teximage (ctx=0x7fefe377a040, dims=2, target=34070, level=0, internalFormat=6408, width=32, 
    height=32, depth=1, border=0, format=6408, type=5121, pixels=0x7fff9dbb1820) at main/teximage.c:2440
#13 0x00007fefe09f3ed8 in _mesa_TexImage2D (target=34070, level=<optimized out>, internalFormat=<optimized out>, 
    width=<optimized out>, height=<optimized out>, border=<optimized out>, format=6408, type=5121, pixels=0x7fff9dbb1820)
    at main/teximage.c:2494
#14 0x00000000004013e9 in init ()
#15 0x000000000040171b in main ()
(gdb) frame 3
#3  0x00007fefe08ee1e4 in intel_miptree_set_image_offset (mt=<optimized out>, level=<optimized out>, 
    img=<optimized out>, x=<optimized out>, y=<optimized out>) at intel_mipmap_tree.c:361
361	   assert(img < mt->level[level].depth);
Comment 1 Vinson Lee 2011-11-23 23:24:33 UTC
d7b33309fe160212f2eb73f471f3aedcb5d0b5c1 is the first bad commit
commit d7b33309fe160212f2eb73f471f3aedcb5d0b5c1
Author: Chad Versace <chad.versace@linux.intel.com>
Date:   Tue Nov 15 09:55:40 2011 -0800

    intel: Kill intel_mipmap_level::nr_images [v4]
    
    For all texture targets except GL_TEXTURE_CUBE_MAP, the 'nr_images' and
    'depth' fields of intel_mipmap_level were identical.  In the exceptional
    case, nr_images == 6 and depth == 1.
    
    It is simple to determine if a texture is a cube or not, so the presence
    of two fields here was not helpful. Worse, it was confusing. When we
    eventually implement GL_ARB_texture_cube_map_array, this mess would have
    become even more confusing.
    
    This patch removes 'nr_images' and assigns to 'depth' a consistent
    meaning: depth is the number of 2D slices at each miplevel.  The exact
    semantics of depth varies according to the texture target:
       - For GL_TEXTURE_CUBE_MAP, depth is 6.
       - For GL_TEXTURE_2D_ARRAY, depth is the number of array slices. It is
         identical for all miplevels in the texture.
       - For GL_TEXTURE_3D, it is the texture's depth at each miplevel. Its
         value, like width and height, varies with miplevel.
       - For other texture types, depth is 1.
    
    As a consequence, parameters were removed from the following function
    signatures:
        intel_miptree_set_level_info
            Remove 'nr_images'.
    
        i945_miptree_layout
        brw_miptree_layout_texture
        brw_miptree_layout_texture_array
            Remove 'slices'.
    
    v2:
       - Replace "It's" with "Its".
       - Remove all hunks in intel_fbo.c. The hunks were spurious and sneaked
         in during a rebase.
       - Remove unneeded hunk in intel_tex_map_image_for_swrast(). It was
         a little refactor of the for-loop's upper bound.
    
    v4:
       In intel_miptree_get_image_offset(), document the conditions under
       which different if-branches are taken.
    
    Reviewed-by: Eric Anholt <eric@anholt.net>
    Signed-off-by: Chad Versace <chad.versace@linux.intel.com>

:040000 040000 dcafec8fa2c8c6f9a8b321c951954116eeb1a579 9249cef859b11ae01459cf540120dbb065cac838 M	src
bisect run success
Comment 2 Jin Yang 2011-12-07 23:30:19 UTC
Created attachment 54213 [details] [review]
proposed patch
Comment 3 Jin Yang 2011-12-07 23:32:26 UTC
I have also encounter this bug. cubemap texture should have depth=6 while not 1.
proposed fix for it.
(In reply to comment #2)
> Created attachment 54213 [details] [review]
> proposed patch
Comment 4 Ian Romanick 2012-01-17 14:13:31 UTC
There are a couple cases missed by attachment #54213 [details] [review].  I've posted an updated patch to the mesa-dev mailing list that should fix this issue.

http://lists.freedesktop.org/archives/mesa-dev/2012-January/017672.html
Comment 5 Ian Romanick 2012-01-18 12:51:47 UTC
This bug should be fixed by the following commit on Mesa master.

commit 8a472427559ea33186c71dfbab8254651fec3077
Author: Ian Romanick <ian.d.romanick@intel.com>
Date:   Tue Jan 17 12:41:15 2012 -0800

    intel: Set depth to 6 for cubemaps
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=41216
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=43212
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=43250
    Signed-off-by: Ian Romanick <ian.d.romanick@intel.com>
    Reviewed-by: Chad Versace <chad.versace@linux.intel.com>
    Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
    Cc: Jin Yang <jin.a.yang@intel.com>


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.