Bug 45877 - [bisected regression] Oglc fbo(negative.invalidParams3) Segmentation fault
[bisected regression] Oglc fbo(negative.invalidParams3) Segmentation fault
Status: VERIFIED FIXED
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/i965
git
All Linux (All)
: high major
Assigned To: Eric Anholt
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-02-10 02:59 UTC by lu hua
Modified: 2012-11-22 08:36 UTC (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description lu hua 2012-02-10 02:59:01 UTC
System Environment:
--------------------------
Arch:        i386      
Platform:    surgabay  
Libdrm:      (master)2.4.31-1-g2cfac57d364d0166ed9472b086c16aea376f495a
Mesa:        (8.0)65526d54aa2599b069bd443d3e6e9762e613042d
Xserver:           (server-1.11-branch)xorg-server-1.11.3
Xf86_video_intel:  (master)2.17.0-645-g6193f2f00fa7205f9d736340318c66d116dca53e
Kernel:            (drm-intel-fixes) 617cf884810b44384fe8e9431e9babeb80a2ff37

Bug detailed description:
------------------------- 
It fails on Mesa master branch.
Bisect shows  140632190cf41e6a035ca199b181091d4ed46986 is the first bad commit
commit 140632190cf41e6a035ca199b181091d4ed46986
Author:     Eric Anholt <eric@anholt.net>
AuthorDate: Mon Jan 30 08:50:14 2012 -0800
Commit:     Eric Anholt <eric@anholt.net>
CommitDate: Fri Feb 3 11:07:02 2012 +0100

    glsl: Throw an error when faced with a duplicated switch() case label.

    The error message I chose matches gcc's error.  Fixes piglit
    switch-case-duplicated.vert.

    NOTE: This is a candidate for the 8.0 branch.

    Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>


Reproduce steps:
----------------
1. start X
2. ./oglconform -z -s -suite all -v 2 -test int-textures advanced.logicop
Comment 1 lu hua 2012-02-12 19:05:03 UTC
About right system environment and detail info as below: 


It segfaults on surgabay and Ironlake.

System Environment:
--------------------------
Arch:         i386      
Platform:     surgabay / Ironlake
Libdrm:		(master)2.4.31-1-g2cfac57d364d0166ed9472b086c16aea376f495a
Mesa:		(master)26de5273acf1ebe6730b5e72b55b3bcceba167c6
Xserver:(master)xorg-server-1.11.99.902-3-g85cecd981191f9c3dab0fb13310d91eff643d423
Xf86_video_intel: (master)2.17.0-644-g4d8369f8e60fd4f5a0ef49f3e9866ea5ecb21927
Kernel:	(drm-intel-testing) 396ee23db6b76354e487fd2cfdacbd989442f81d


Backtrace:
#0  0xb7be7744 in _mesa_ReadnPixelsARB (x=0, y=0, width=16, height=16,
    format=36248, type=5125, bufSize=2147483647, pixels=0xa16a658)
    at main/readpix.c:619
#1  0xb7be790f in _mesa_ReadPixels (x=0, y=0, width=16, height=16,
    format=36248, type=5125, pixels=0xa16a658) at main/readpix.c:675
#2  0x084e2f6f in (anonymous namespace)::AdvancedLogicOp32<unsigned int> ()
#3  0x084eb58f in (anonymous namespace)::Test_AdvancedLogicOp() ()
#4  0x084e992c in TextureIntegerExec(testParameters*) ()
#5  0x08e39698 in callFunctionHandleExceptionsInner(long (*)(testParameters*), testParameters*, char*) ()
#6  0x08e397e7 in callFunctionHandleExceptions(long (*)(testParameters*), testParameters*) ()
#7  0x08e38299 in DriverExec(long (*)(testParameters*), testParameters*) ()
#8  0x08e1964f in Driver(std::vector<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > const&, std::vector<driverRec*, std::allocator<driverRec*> > const&, std::vector<boost::shared_ptr<PrePostTestAction>, std::allocator<boost::shared_ptr<PrePostTestAction> > > const&, std::vector<boost::shared_ptr<PrePostTestcaseAction>, std::allocator<boost::shared_ptr<PrePostTestcaseAction> > > const&) ()
#9  0x08e19d7e in (anonymous namespace)::MyMessagePump::idle() ()
---Type <return> to continue, or q <return> to quit---
#10 0x08dec50a in MessagePump::process_messages() ()
#11 0x08e1a2b8 in ExecutionManager::execute_schedules() ()
#12 0x08da667b in tkShellExecute(std::vector<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > const&, std::vector<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > const&) ()
#13 0x08db0012 in main ()
Comment 2 lu hua 2012-02-13 00:19:13 UTC
Additional information:

It pass on mesa 8.0 branch. 

Below cases have same bisect info: 

fbo(negative.completness3)
fbo(negative.completness4)
fbo(negative.fboCompletness1)
fbo(negative.fboCompletness2)
fbo(negative.invalidParams3)
fbo(negative.invalidParams4)
fbo(negative.noTexSize)
int-textures(advanced.logicop)
int-textures(negative.typeFormatMismatch.readpixels)
fbo(negative.noRbSize)
Comment 3 Gordon Jin 2012-03-31 18:20:09 UTC
Ian? Eric?
Comment 4 Ian Romanick 2012-07-20 17:33:52 UTC
I tried the test named in the subject and a handful from the description, and I was not able to reproduce the failure on Sandybridge mobile.  Lu, can you confirm?
Comment 5 lu hua 2012-07-23 07:10:23 UTC
This issue has been fixed.
Comment 6 lu hua 2012-07-23 07:10:58 UTC
Verified.Fixed
Comment 7 lu hua 2012-09-05 03:56:40 UTC
fbo(negative.invalidParams3) and fbo(negative.invalidParams4) still Segmentation fault on mesa master branch. And also Segmentation fault on mesa 9.0 branch(commit: 284fe97515998178962b5abb4ed0b828b3497c77)

(gdb) bt
#0  0xb7b286ac in _mesa_ReadnPixelsARB (x=0, y=0, width=1, height=1,
    format=6408, type=5126, bufSize=2147483647, pixels=0xa4d78c0)
    at main/readpix.c:709
#1  0xb7b28883 in _mesa_ReadPixels (x=0, y=0, width=1, height=1, format=6408,
    type=5126, pixels=0xa4d78c0) at main/readpix.c:765
#2  0xb7dedc05 in shared_dispatch_stub_256 (x=0, y=0, width=1, height=1,
    format=6408, type=5126, pixels=0xa4d78c0)
    at ../../../src/mapi/shared-glapi/glapi_mapi_tmp.h:14673
#3  0x081c407a in conform::(anonymous namespace)::ReadBufferNegativeTest::Run()
    ()
#4  0x09168299 in conform::SubcaseBase::RunSubcase(boost::shared_ptr<conform::SubcaseBase> (*)()) ()
#5  0x091689cf in conform::ExecuteTest(testParameters*, conform::TestInfoBase&, conform::TestCaseInfo const*, unsigned int) ()
#6  0x081e4cff in FramebufferObjectExec(testParameters*) ()
#7  0x090aaaca in callFunctionHandleExceptionsInner(long (*)(testParameters*), testParameters*, char*) ()
#8  0x090aac46 in callFunctionHandleExceptions(long (*)(testParameters*), testParameters*) ()
#9  0x090a9778 in DriverExec(long (*)(testParameters*), testParameters*) ()
#10 0x09083d17 in Driver(std::vector<std::pair<std::string, std::string>, std::allocator<std::pair<std::string, std::string> > > const&, std::vector<driverRec*, std::allocator<driverRec*> > const&, std::vector<boost::shared_ptr<PrePostTestAction>, std::allocator<boost::shared_ptr<PrePostTestAction> > > const&, std::vector<boost::shared_ptr<PrePostTestcaseAction>, std::allocator<boost::shared_ptr<PrePostTestcaseAction> > > const&) ()
#11 0x090844ae in (anonymous namespace)::MyMessagePump::idle() ()
#12 0x090560a3 in MessagePump::process_messages() ()
#13 0x09083014 in ExecutionManager::execute_schedules() ()
#14 0x09024438 in tkShellExecute(std::vector<std::pair<std::string, std::string>, std::allocator<std::pair<std::string, std::string> > > const&, std::vector<std::pair<std::string, std::string>, std::allocator<std::pair<std::string, std::string> > > const&) ()
#15 0x0806e558 in main ()
Comment 8 Eric Anholt 2012-11-13 22:12:28 UTC
This bisect result has no relation to the segfault (looks like it was b8f7eef4ef84d53d32d08a70dc7daec623cf7eab that broke things), and you need to figure out what resulted in that bisect so that you can produce working bisects in the future.  It delayed fixing this bug by 9 months.

Patches on the mailing list.
Comment 9 Eric Anholt 2012-11-17 21:11:46 UTC
commit 5c99697f74c68f7e170564d791b95d986a18774a
Author: Eric Anholt <eric@anholt.net>
Date:   Tue Nov 13 13:39:37 2012 -0800

    mesa: Fix segfault on reading from a missing color read buffer.
Comment 10 lu hua 2012-11-19 02:14:38 UTC
Verified. Fixed by commit 5c99697f74c68f7e170564d791b95d986a18774a.
Comment 11 lu hua 2012-11-22 08:36:24 UTC
(In reply to comment #8)
> This bisect result has no relation to the segfault (looks like it was
> b8f7eef4ef84d53d32d08a70dc7daec623cf7eab that broke things), and you need to
> figure out what resulted in that bisect so that you can produce working
> bisects in the future.  It delayed fixing this bug by 9 months.
> 
> Patches on the mailing list.

I tried to check the bisect result. The results are as below:
The result on commit 01a5a2c9d761d4c9d72c236084efee700dcb28b8(ahead of bisect commit):
fbo(negative.fboCompletness1)    FAIL
fbo(negative.fboCompletness2)    FAIL
fbo(negative.completness3)    FAIL
fbo(negative.completness4)    FAIL
fbo(negative.invalidParams3)    PASS
fbo(negative.invalidParams4)    PASS
fbo(negative.noTexSize)    FAIL
fbo(negative.noRbSize)    FAIL
int-textures(advanced.logicop)    NSPT
int-textures(negative.typeFormatMismatch.readpixels)    NSPT

The result on commit 140632190cf41e6a035ca199b181091d4ed46986(bisect commit):
fbo(negative.fboCompletness1)   NFIN
fbo(negative.fboCompletness2)    NFIN
fbo(negative.completness3)    NFIN
fbo(negative.completness4)    NFIN
fbo(negative.invalidParams3)    NFIN
fbo(negative.invalidParams4)    NFIN
fbo(negative.noTexSize)    NFIN
fbo(negative.noRbSize)    NFIN
int-textures(advanced.logicop)    NFIN
int-textures(negative.typeFormatMismatch.readpixels)    NFIN