System Environment: -------------------------- Arch: i386 Platform: Pineview Libdrm: (master)2.4.31-1-g2cfac57d364d0166ed9472b086c16aea376f495a Mesa: (8.0)e86d90eb208292916c8a04c5d75499492003dd16 Xserver: (server-1.11-branch)xorg-server-1.11.3 Xf86_video_intel: (master)2.17.0-644-g4d8369f8e60fd4f5a0ef49f3e9866ea5ecb21927 Kernel: (drm-intel-fixes) 617cf884810b44384fe8e9431e9babeb80a2ff37 Bug detailed description: ------------------------- It segfaults at mesa 8.0 branch on pineview. It also segfaults on mesa master branch. shad-compiler(advanced.TestTexture1D_VertShader) shad-compiler(advanced.TestTexture1DProj_vec2_VertShader) shad-compiler(advanced.TestTexture1DProj_vec4_VertShader) shad-compiler(advanced.TestTexture1DLod_VertShader) shad-compiler(advanced.TestTexture1DProjLod_vec2_VertShader) shad-compiler(advanced.TestTexture1DProjLod_vec4_VertShader) shad-compiler(advanced.TestTexture2D_VertShader) shad-compiler(advanced.TestTexture2DProj_vec3_VertShader) shad-compiler(advanced.TestTexture2DProj_vec4_VertShader) shad-compiler(advanced.TestTexture2DLod_VertShader) shad-compiler(advanced.TestTexture2DProjLod_vec3_VertShader) shad-compiler(advanced.TestTexture2DProjLod_vec4_VertShader) shad-compiler(advanced.TestTexture3D_VertShader)__1Vis shad-compiler(advanced.TestTexture3DLod_VertShader) shad-compiler(advanced.TestTexture3DProjLod_VertShader) shad-compiler(advanced.TestTextureCube_VertShader) shad-compiler(advanced.TestTextureCubeLod_VertShader) shad-compiler(advanced.TestShadow1D_VertShader) shad-compiler(advanced.TestShadow1DProj_VertShader) shad-compiler(advanced.TestShadow2DProj_VertShader) shad-compiler(advanced.TestShadow1DLod_VertShader) shad-compiler(advanced.TestShadow1DProjLod_VertShader) shad-compiler(advanced.TestShadow2DProjLod_VertShader) (gdb) bt #0 0xb7c1f534 in fetch_texel_1d_f_argb8888 (texImage=0xa046b28, i=511, j=0, k=0, texel=0xbfffdd48) at swrast/s_texfetch_tmp.h:430 #1 0xb7c2b670 in sample_1d_nearest (ctx=0x9d9e5a0, tObj=0x9d93a48, n=1, texcoords=0xbfffdd38, lambda=0xbfffdc88, rgba=0xbfffdd48) at swrast/s_texfilter.c:823 #2 sample_nearest_1d (ctx=0x9d9e5a0, tObj=0x9d93a48, n=1, texcoords=0xbfffdd38, lambda=0xbfffdc88, rgba=0xbfffdd48) at swrast/s_texfilter.c:964 #3 0xb7bd99cb in vp_fetch_texel (ctx=0x9d9e5a0, texcoord=0xbfffdd38, lambda=0, unit=0, color=0xbfffdd48) at tnl/t_vb_program.c:200 #4 0xb7c027d9 in fetch_texel (ctx=0x9d9e5a0, program=0xa04f960, machine=0x9f57500) at program/prog_execute.c:408 #5 _mesa_execute_program (ctx=0x9d9e5a0, program=0xa04f960, machine=0x9f57500) at program/prog_execute.c:1662 #6 0xb7bd9e45 in run_vp (ctx=0x9d9e5a0, stage=0x9e15a88) at tnl/t_vb_program.c:392 #7 0xb7bd8693 in _tnl_run_pipeline (ctx=0x9d9e5a0) at tnl/t_pipeline.c:163 #8 0xb7aff3a0 in intelRunPipeline (ctx=0x9d9e5a0) at intel_tris.c:1095 #9 0xb7bd8c98 in _tnl_draw_prims (ctx=0x9d9e5a0, arrays=0x9e03780, prim=0x9e02068, nr_prims=1, ib=0x0, min_index=0, max_index=3) at tnl/t_draw.c:523 #10 0xb7bd9969 in _tnl_vbo_draw_prims (ctx=0x9d9e5a0, arrays=0x9e03780, prim=0x9e02068, nr_prims=1, ib=0x0, index_bounds_valid=1 '\001', min_index=0, max_index=3, tfb_vertcount=0x0) at tnl/t_draw.c:423 #11 0xb7bc992a in vbo_exec_vtx_flush (exec=0x9e01c48, keepUnmapped=1 '\001') at vbo/vbo_exec_draw.c:407 #12 0xb7bc5d27 in vbo_exec_FlushVertices_internal (exec=0x9e01c48, unmap=<value optimized out>) at vbo/vbo_exec_api.c:444 #13 0xb7bc5d5f in vbo_exec_FlushVertices (ctx=0x9d9e5a0, flags=1) at vbo/vbo_exec_api.c:1195 #14 0xb7b7baf9 in _mesa_ReadnPixelsARB (x=0, y=0, width=1, height=1, format=6408, type=5126, bufSize=2147483647, pixels=0xbfffe33c) at main/readpix.c:740 #15 0xb7b7bdb3 in _mesa_ReadPixels (x=0, y=0, width=1, height=1, format=6408, type=5126, pixels=0xbfffe33c) at main/readpix.c:826 #16 0x083c74b8 in DrawWithTexture(char*, float*, float*, float*, float*) () #17 0x083e8178 in Tex1DDrawLoop(char*, float*, float*, float*, unsigned char, unsigned char) () #18 0x083e95d1 in TestTexture1D_VertShader() () #19 0x083ec597 in ShaderCompilerExec(testParameters*) () #20 0x08e11998 in callFunctionHandleExceptionsInner(long (*)(testParameters*), testParameters*, char*) () #21 0x08e11ae7 in callFunctionHandleExceptions(long (*)(testParameters*), testParameters*) () #22 0x08e10599 in DriverExec(long (*)(testParameters*), testParameters*) () #23 0x08df1959 in Driver(std::vector<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > const&, std::vector<driverRec*, std::allocator<driverRec*> > const&, std::vector<boost::shared_ptr<PrePostTestAction>, std::allocator<boost::shared_ptr<PrePostTestAction> > > const&, std::vector<boost::shared_ptr<PrePostTestcaseAction>, std::allocator<boost::shared_ptr<PrePostTestcaseAction> > > const&) () #24 0x08df1d6e in (anonymous namespace)::MyMessagePump::idle() () #25 0x08dc4b6a in MessagePump::process_messages() () #26 0x08df25b8 in ExecutionManager::execute_schedules() () #27 0x08d7edeb in tkShellExecute(std::vector<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > const&, std::vector<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > const&) () #28 0x08d88552 in main () Bisect fails due to some mesa commit build failure. The last known bad commit is Mesa(8.0)c85402aba91755808729fadf57a9f92285f4e61a, the last known good commit is Mesa(7.11)7722a54e60c9da080b557d6596e4c9d363ead515. Reproduce steps: ---------------- 1. start X 2. ./oglconform z -s -suite all -v 2 -test shad-compiler advanced.TestTexture1D_VertShader
I was easily able to bisect this to the commit below. This commit actually starts triggering an assertion failure. A later commit (0f3f6cf) removes the assertion, and converts the assertion failure to the reported segfault. commit 68da4b50e9b6aa72a9b155f650952620063e1b94 Author: Brian Paul <brianp@vmware.com> Date: Sun Oct 23 10:44:47 2011 -0600 mesa: add swrast_texture_image::Buffer In the past, swrast_texture_image::Data has been overloaded. It could either point to malloc'd memory storing texture data, or it could point to a current mapping of GPU memory. Now, Buffer always points to malloc'd memory (if we're not using GPU memory) and Data always points to mapped memory. The next step would be to rename Data -> Map. This change also involves adding swrast functions for mapping textures and renderbuffers prior to rendering to setup the Data pointer. Plus, corresponding functions to unmap texures and renderbuffers. This is very much like similar code in the dri drivers.
After some tracing and watchpoint setting, I've figure out what's happening, but I'm not sure what the right fix is. Before calling _tnl_run_pipeline, the i915 driver maps all textures used in vertex shaders (via intel_tex_map_images). Later run_vp tries to map the textures again (via _swrast_map_texture). However, this just replaces the actual mappings with NULL pointers. When the pointers are dereferened, the segfault occurs. I believe setting swrast_texture_image::Buffer in intel_tex_map_images would work around the problem, but I have a hard time believing this is the right fix.
*** Bug 45885 has been marked as a duplicate of this bug. ***
*** Bug 45886 has been marked as a duplicate of this bug. ***
Hmm. do we just no longer need to wrap the tnl with our texture mapping now?
Please confirm that this is seen on an SNB or newer platform.
I think it just impacts PNV. Closing as won't fix.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.