Bug 44970 - [i965]oglc max_values(negative.textureSize.textureCube) segfaults
[i965]oglc max_values(negative.textureSize.textureCube) segfaults
Status: CLOSED FIXED
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/i965
git
All Linux (All)
: high major
Assigned To: Anuj Phogat
Intel 3D Bugs Mailing List
:
Depends on:
Blocks: 42993
  Show dependency treegraph
 
Reported: 2012-01-19 23:10 UTC by fangxun
Modified: 2014-07-02 04:54 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments
piglit test case: validate-texture-size.c (5.50 KB, text/x-csrc)
2012-02-01 19:32 UTC, Anuj Phogat
Details
error log with piglit test case (14.56 KB, application/octet-stream)
2012-02-01 19:48 UTC, Anuj Phogat
Details

Note You need to log in before you can comment on or make changes to this bug.
Description fangxun 2012-01-19 23:10:21 UTC
System Environment:
--------------------------
Arch:           i386
Platform:       Sugarbay
Libdrm:         (master)2.4.30-1-g66518ab5653cfdc840cd69e7b653ec05df060584
Mesa:           (8.0)c85402aba91755808729fadf57a9f92285f4e61a
Xserver:                (server-1.11-branch)xorg-server-1.11.3
Xf86_video_intel:(master)2.17.0-478-g35f81005f91d294e61bb4ced7cbddd1a76ccb324
Kernel:         (drm-intel-fixes) 8109021313c7a3d8947677391ce6ab9cd0bb1d28

Bug detailed description:
------------------------- 
It segfaults on Sandybridge and ironlake.
Below cases also segfault:
max_values(advanced.combinedTexUnits.nonaliased)
max_values(advanced.textureSize.textureCube)

(gdb) bt
#0  _mesa_texstore_rgba_16 (ctx=<optimized out>, dims=<optimized out>, baseInternalFormat=<optimized out>, dstFormat=<optimized out>, dstRowStride=16896,
    dstSlices=0x7fffffffbdc0, srcWidth=512, srcHeight=512, srcDepth=1, srcFormat=6408, srcType=5126, srcAddr=0x2a02360, srcPacking=0x7ffff7cae8c8) at main/texstore.c:2362
#1  0x00007ffff66a900c in store_texsubimage (ctx=0x7ffff7c9f040, texImage=0x2939740, xoffset=0, yoffset=512, zoffset=<optimized out>, width=512, height=<optimized out>,
    depth=1, format=6408, type=5126, pixels=0x2a02360, packing=0x7ffff7cae8c8, caller=0x7ffff684d782 "glTexSubImage2D") at main/texstore.c:4514
#2  0x00007ffff66a919b in _mesa_store_texsubimage2d (ctx=<optimized out>, texImage=<optimized out>, xoffset=<optimized out>, yoffset=<optimized out>, width=<optimized out>,
    height=<optimized out>, format=6408, type=5126, pixels=0x2a02360, packing=0x7ffff7cae8c8) at main/texstore.c:4650
#3  0x00007ffff65b5978 in intelTexSubImage2D (ctx=0x7ffff7c9f040, texImage=0x2939740, xoffset=0, yoffset=512, width=512, height=512, format=6408, type=5126, pixels=0x2a02360,
    packing=0x7ffff7cae8c8) at intel_tex_subimage.c:164
#4  0x00007ffff66a112d in texsubimage (ctx=0x7ffff7c9f040, dims=2, target=34069, level=0, xoffset=0, yoffset=512, zoffset=0, width=512, height=512, depth=1, format=6408,
    type=5126, pixels=0x2a02360) at main/teximage.c:2699
#5  0x00007ffff66a12ca in _mesa_TexSubImage2D (target=<optimized out>, level=<optimized out>, xoffset=<optimized out>, yoffset=<optimized out>, width=<optimized out>,
    height=<optimized out>, format=6408, type=5126, pixels=0x2a02360) at main/teximage.c:2744
#6  0x000000000080b074 in oglConf::gl::TexSubImage(unsigned int, int, int, int, int, int, int, int, unsigned int, unsigned int, void const*) ()
#7  0x000000000069fa9f in oglConf::max_values::validateTextureSize(unsigned int, unsigned int, oglConf::Color const&, int) ()
#8  0x00000000006a21ec in oglConf::max_values::generalTextureSizeTest(unsigned int, bool) ()
#9  0x00000000006a2570 in oglConf::max_values::TestTextureCubeSizeNegative() ()
#10 0x00000000006a12e8 in MaxValuesExec(testParameters*) ()
#11 0x000000000113ee89 in callFunctionHandleExceptionsInner(long (*)(testParameters*), testParameters*, char*) ()
#12 0x000000000113efbf in callFunctionHandleExceptions(long (*)(testParameters*), testParameters*) ()
#13 0x000000000113daf1 in DriverExec(long (*)(testParameters*), testParameters*) ()
#14 0x00000000011218d7 in Driver(std::vector<std::pair<std::string, std::string>, std::allocator<std::pair<std::string, std::string> > > const&, std::vector<driverRec*, std::allocator<driverRec*> > const&, std::vector<boost::shared_ptr<PrePostTestAction>, std::allocator<boost::shared_ptr<PrePostTestAction> > > const&, std::vector<boost::shared_ptr<PrePostTestcaseAction>, std::allocator<boost::shared_ptr<PrePostTestcaseAction> > > const&) ()
#15 0x0000000001121c88 in (anonymous namespace)::MyMessagePump::idle() ()
#16 0x00000000010f1180 in MessagePump::process_messages() ()
#17 0x00000000011225e9 in ExecutionManager::execute_schedules() ()
#18 0x00000000010ab750 in tkShellExecute(std::vector<std::pair<std::string, std::string>, std::allocator<std::pair<std::string, std::string> > > const&, std::vector<std::pair<std::string, std::string>, std::allocator<std::pair<std::string, std::string> > > const&) ()
#19 0x00000000010b48fb in main ()

Reproduce steps:
----------------
1. start X
2. ./oglconform -z -s -suite all -v 2 -test max_values negative.textureSize.textureCube
Comment 1 fangxun 2012-01-20 00:24:15 UTC
This is regression. Bisect fails because some mesa commit build failure.
The first bad commit could be any of:
9c76ba04f845077d51912cc11970232cc9160294
37d24a70daa41bbad9c7a85dd432f561a172e858
3c01aefe5f9b8ffb31bbdd9ed5b200e830478a81
8e34021099527868097b2c877fc32f29aa4d7bb6
c661843ab6adc97b54debaccfb29b897b12ab76d
a7534d8943d74e81299b2ee4edc462baac9d1331
d45814c925dd6c479cfd383b9b59458fc4359cf7
1981042341c6942bbd4d61508a47226c789bc25b
Comment 2 Ian Romanick 2012-01-20 13:11:52 UTC
Running in GDB with current master, I get:

Largest texture size (queried with glGetIntegerv) for target(GL_TEXTURE_CUBE_MAP) is: 2048
Largest texture size for texture(GL_TEXTURE_CUBE_MAP), with internalFormat(GL_RGBA16) is 2050 (queried with proxy texture)
MINOR ERROR: Size reported by texture proxy is greater than reported by glGetIntever using smaller value.
Pixelformat: GL_RGBA16 textureSize: 2048
Mesa: User error: GL_OUT_OF_MEMORY in glTexSubImage2D
oglconform64: intel_mipmap_tree.c:1038: intel_miptree_map: Assertion `!mt->level[level].slice[slice].map' failed.

Program received signal SIGABRT, Aborted.
0x0000003ff0635215 in raise () from /lib64/libc.so.6

It seems that after (correctly) generating a GL_OUT_OF_MEMORY error, we try to use the broken texture.

I'm not sure why this would have worked before.
Comment 3 Anuj Phogat 2012-01-26 10:34:50 UTC
Reproduced this issue on Sandybridge. A patch will be posted on mailing list for review.
Comment 4 Anuj Phogat 2012-02-01 19:10:52 UTC
Following commit fixes oglconform failure on SNB:

commit 15986d21ebaaeedb234b066edba5cf7f6ea87a3c
Author: Anuj Phogat <anuj.phogat@gmail.com>
Date:   Wed Jan 25 19:05:45 2012 -0800

    mesa: fix maximum allowed proxy texture size condition
    
    width, height parameter in glTexImage2D() includes: texture image
    width + 2 * border (if any). So when doing the texture size check
    in _mesa_test_proxy_teximage() width and height should not exceed
    maximum supported size for target texture type.
    i.e. 1 << (ctx->Const.MaxTextureLevels - 1)
    
    Texture border is anyway stripped out before it is given to intel
    or gallium drivers.
    
    This patch fixes Intel oglconform test case: max_values
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44970
    
    Note: This is a candidate for mesa 8.0 branch.
    
    Signed-off-by: Anuj Phogat <anuj.phogat@gmail.com>
    Reviewed-by: Ian Romanick <idr@freedesktop.org>
    Reviewed-by: Jose Fonseca <jfonseca@vmware.com>

Link for the patch: http://lists.freedesktop.org/archives/mesa-dev/2012-January/018295.html
Comment 5 Anuj Phogat 2012-02-01 19:32:24 UTC
Created attachment 56489 [details]
piglit test case: validate-texture-size.c

Above patch fixes the oglconform test failure. But the errors reported in oglconform failure stays unfixed on mesa master. This is confirmed by a piglit test case (attached) I developed to reproduce errors thrown by oglconform test. test case will also be posted on mailing list for review.
Comment 6 Anuj Phogat 2012-02-01 19:48:41 UTC
Created attachment 56490 [details]
error log with piglit test case

These errors logs are recorded on Sandybridge. Driver throws assertion failure or segfaults/BUS ERROR with large texture sizes. Error logs change with different texture internal formats and with multiple times execution of the same test. It is observed that driver is unable to handle the texture sizes much below the maximum supported sizes for GL_TEXTURE_2D & GL_TEXTURE_CUBE_MAP.
Comment 7 Ian Romanick 2012-02-02 10:56:50 UTC
Fixed on 8.0 branch by:

commit b38640082cdf0d271c7d3da83d45dfa5f3a7b8d3
Author: Anuj Phogat <anuj.phogat@gmail.com>
Date:   Wed Jan 25 19:05:45 2012 -0800

    mesa: fix maximum allowed proxy texture size condition
    
    width, height parameter in glTexImage2D() includes: texture image
    width + 2 * border (if any). So when doing the texture size check
    in _mesa_test_proxy_teximage() width and height should not exceed
    maximum supported size for target texture type.
    i.e. 1 << (ctx->Const.MaxTextureLevels - 1)
    
    Texture border is anyway stripped out before it is given to intel
    or gallium drivers.
    
    This patch fixes Intel oglconform test case: max_values
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44970
    
    Note: This is a candidate for mesa 8.0 branch.
    
    Signed-off-by: Anuj Phogat <anuj.phogat@gmail.com>
    Reviewed-by: Ian Romanick <idr@freedesktop.org>
    Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
    (cherry picked from commit 15986d21ebaaeedb234b066edba5cf7f6ea87a3c)
Comment 8 fangxun 2012-02-07 02:21:20 UTC
max_values(negative.textureSize.textureCube) passes on Sandybridge and ironlake, but max_values(advanced.combinedTexUnits.nonaliased)
and max_values(advanced.textureSize.textureCube) still segfaults.
Comment 9 Anuj Phogat 2012-02-09 15:46:22 UTC
Further debugging  uncovers an error while preparing buffer map:
intel_region_map( ) => drm_intel_gem_bo_map_gtt( ) => drmIoctl() returns -1
"Error preparing buffer map" 
strerror(errno) = 0x4dd6c234
bo_gem->gtt_virtual=0x0
region->map = 0x0
dstMap = 0x0 in store_texsubimage()
which results in error "GL_OUT_OF_MEMORY in glTexSubImage" .
Comment 10 Eric Anholt 2013-04-08 20:25:39 UTC
Please retest with:

commit ca9a7d975af228cabb79c3040ec67f26f94f90a2
Author: Eric Anholt <eric@anholt.net>
Date:   Tue Apr 2 17:28:41 2013 -0700

    intel: Avoid making tiled miptrees we won't be able to blit.

(passes before and after on my ivb)
Comment 11 Kenneth Graunke 2014-02-02 08:27:55 UTC
oglconform's max-values negative.textureSize.textureCube, advanced.textureSize.textureCube, and advanced.combinedTexUnits.nonaliased all pass with Mesa master on Ivybridge.

I'm going to call this fixed.