Bug 52574 - crash in memcpy_texture because of NULL dstAddr (gl_texture_image.Data)
Summary: crash in memcpy_texture because of NULL dstAddr (gl_texture_image.Data)
Status: RESOLVED WONTFIX
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/R600 (show other bugs)
Version: 7.11
Hardware: x86-64 (AMD64) FreeBSD
: medium major
Assignee: Default DRI bug account
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-07-27 09:06 UTC by Andriy Gapon
Modified: 2014-07-07 16:06 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments

Description Andriy Gapon 2012-07-27 09:06:43 UTC
Useful part of stack trace:
(gdb) bt
#0  0x0000000802e452f6 in memcpy () from /lib/libc.so.7
#1  0x0000000817fff011 in memcpy_texture (ctx=0x82c4a8000, dimensions=0, dstFormat=MESA_FORMAT_ARGB8888_REV, dstAddr=0x0, dstXoffset=0, dstYoffset=0, 
    dstZoffset=0, dstRowStride=4352, dstImageOffsets=0x82b1d78c8, srcWidth=1056, srcHeight=33, srcDepth=1, srcFormat=32993, srcType=5121, 
    srcAddr=0x83beff000, srcPacking=0x82c4b7690) at main/texstore.c:994
#2  0x00000008180082ca in _mesa_texstore_argb8888 (ctx=0x82c4a8000, dims=2, baseInternalFormat=6408, dstFormat=MESA_FORMAT_ARGB8888, dstAddr=0x0, 
    dstXoffset=0, dstYoffset=0, dstZoffset=0, dstRowStride=4352, dstImageOffsets=0x82b1d78c8, srcWidth=1056, srcHeight=33, srcDepth=1, 
    srcFormat=32993, srcType=5121, srcAddr=0x83beff000, srcPacking=0x82c4b7690) at main/texstore.c:1430
#3  0x00000008180091fb in _mesa_texstore (ctx=<optimized out>, dims=<optimized out>, baseInternalFormat=<optimized out>, dstFormat=<optimized out>, 
    dstAddr=<optimized out>, dstXoffset=<optimized out>, dstYoffset=0, dstZoffset=0, dstRowStride=4352, dstImageOffsets=0x82b1d78c8, srcWidth=1056, 
    srcHeight=33, srcDepth=1, srcFormat=32993, srcType=5121, srcAddr=0x83beff000, srcPacking=0x82c4b7690) at main/texstore.c:4478
#4  0x0000000817f8a4c7 in radeon_store_teximage (ctx=0x82c4a8000, dims=2, xoffset=0, yoffset=0, zoffset=0, width=1056, height=33, depth=1, 
    imageSize=0, format=32993, type=5121, pixels=0x83beff000, packing=0x82c4b7690, texObj=0x844c11500, texImage=0x82ba98ec0, compressed=0)
    at radeon_texture.c:749
#5  0x0000000817f8ab1b in radeon_teximage (ctx=0x82c4a8000, dims=2, target=<optimized out>, level=0, internalFormat=<optimized out>, width=1056, 
    height=33, depth=1, imageSize=0, format=32993, type=5121, pixels=<optimized out>, packing=0x82c4b7690, texObj=0x844c11500, texImage=0x82ba98ec0, 
    compressed=0) at radeon_texture.c:834
#6  0x0000000817f8b6e7 in radeonTexImage2D (ctx=<optimized out>, target=<optimized out>, level=<optimized out>, internalFormat=<optimized out>, 
    width=<optimized out>, height=<optimized out>, border=0, format=32993, type=5121, pixels=0x83beff000, packing=0x82c4b7690, texObj=0x844c11500, 
    texImage=0x82ba98ec0) at radeon_texture.c:867
#7  0x0000000817ffad91 in teximage (ctx=0x82c4a8000, dims=2, target=3553, level=0, internalFormat=4, width=1056, height=33, depth=1, border=0, 
    format=32993, type=5121, pixels=0x83beff000) at main/teximage.c:2505
#8  0x0000000817ffafc9 in _mesa_TexImage2D (target=3553, level=0, internalFormat=4, width=1056, height=33, border=0, format=32993, type=5121, 
    pixels=0x83beff000) at main/teximage.c:2559
#9  0x0000000803e46622 in __glXDRIbindTexImage () from /usr/local/lib/xorg/modules/extensions/libglx.so
#10 0x0000000803e3a7d8 in __glXDisp_BindTexImageEXT () from /usr/local/lib/xorg/modules/extensions/libglx.so
#11 0x0000000803e3b020 in __glXDisp_VendorPrivate () from /usr/local/lib/xorg/modules/extensions/libglx.so
#12 0x0000000803e3d22d in __glXDispatch () from /usr/local/lib/xorg/modules/extensions/libglx.so

In frame 5 the following inconsistency can be observed:
(gdb) p *(radeonTexObj*)texObj
$12 = {base = {Mutex = 0x8363736a0, RefCount = 3, Name = 10721, Target = 3553, Sampler = {Name = 0, RefCount = 0, WrapS = 33071, WrapT = 33071, 
      WrapR = 10497, MinFilter = 9728, MagFilter = 9728, BorderColor = {f = {0, 0, 0, 0}, ui = {0, 0, 0, 0}, i = {0, 0, 0, 0}}, MinLod = -1000, 
      MaxLod = 1000, LodBias = 0, MaxAnisotropy = 1, CompareMode = 0, CompareFunc = 515, CompareFailValue = 0, sRGBDecode = 35401, 
      CubeMapSeamless = 0 '\000', DepthMode = 6409, _CompleteTexture = 0 '\000'}, Priority = 1, BaseLevel = 0, MaxLevel = 1000, _MaxLevel = 10, 
    _MaxLambda = 10, CropRect = {0, 0, 0, 0}, Swizzle = {6403, 6404, 6405, 6406}, _Swizzle = 1672, GenerateMipmap = 0 '\000', _Complete = 1 '\001', 
    _RenderToTexture = 0 '\000', Purgeable = 0 '\000', Image = {{0x82ba98ec0, 0x0 <repeats 14 times>}, {0x0 <repeats 15 times>}, {
        0x0 <repeats 15 times>}, {0x0 <repeats 15 times>}, {0x0 <repeats 15 times>}, {0x0 <repeats 15 times>}}, BufferObject = 0x0, 
    BufferObjectFormat = 0, Palette = {InternalFormat = 0, _BaseFormat = 0, Size = 0, TableF = 0x0, TableUB = 0x0, RedSize = 0 '\000', 
      GreenSize = 0 '\000', BlueSize = 0 '\000', AlphaSize = 0 '\000', LuminanceSize = 0 '\000', IntensitySize = 0 '\000'}, DriverData = 0x0}, 
  mt = 0x846d87b00, validated = 0 '\000', minLod = 0, maxLod = 0, override_offset = 3398523648, image_override = 1 '\001', tile_bits = 0, 
  bo = 0x839e88480, pp_txfilter = 0, pp_txformat = 0, pp_txformat_x = 0, pp_txsize = 0, pp_txpitch = 0, pp_border_color = 0, pp_cubic_faces = 0, 
  pp_txfilter_1 = 0, SQ_TEX_RESOURCE0 = 553158401, SQ_TEX_RESOURCE1 = 1744830496, SQ_TEX_RESOURCE2 = 0, SQ_TEX_RESOURCE3 = 1088, 
  SQ_TEX_RESOURCE4 = 101335040, SQ_TEX_RESOURCE5 = 0, SQ_TEX_RESOURCE6 = 2147483648, SQ_TEX_RESOURCE7 = 0, SQ_TEX_SAMPLER0 = 12582930, 
  SQ_TEX_SAMPLER1 = 4228841472, SQ_TEX_SAMPLER2 = 2147483648, TD_PS_SAMPLER0_BORDER_RED = 0, TD_PS_SAMPLER0_BORDER_GREEN = 0, 
  TD_PS_SAMPLER0_BORDER_BLUE = 0, TD_PS_SAMPLER0_BORDER_ALPHA = 0, border_fallback = 0 '\000'}
(gdb) p *(radeon_texture_image*)texImage
$14 = {base = {InternalFormat = 4, _BaseFormat = 6408, TexFormat = MESA_FORMAT_ARGB8888, Border = 0, Width = 1056, Height = 33, Depth = 1, 
    Width2 = 1056, Height2 = 33, Depth2 = 1, WidthLog2 = 10, HeightLog2 = 5, DepthLog2 = 0, MaxLog2 = 10, WidthScale = 1056, HeightScale = 33, 
    DepthScale = 1, IsClientData = 0 '\000', _IsPowerOfTwo = 0 '\000', TexObject = 0x844c11500, 
    FetchTexelc = 0x81810268f <fetch_texel_float_to_chan>, FetchTexelf = 0x8180fe1d7 <fetch_texel_2d_f_argb8888>, RowStride = 1056, 
    ImageOffsets = 0x82b1d78c8, Data = 0x0, DriverData = 0x0}, mt = 0x0, bo = 0x0, mtlevel = 0, mtface = 0}

As you can see (a) texObj has bo set, but (b) texImage has neither bo nor mt set.

Because of (a) the Data field is _not_ set in radeon_teximage(), because of (b) the field is not set in radeon_teximage_map() call made from radeon_store_teximage.  Thus Data remains NULL.

I am not sure if there is a simple logic error somewhere in radeon_teximage or radeon_store_teximage, or if the discrepancy between texImage and texObj means that there is a bug some place else.

I see that the code in git master is quite different, but unfortunately I do not have an opportunity to test it.
Comment 1 Andriy Gapon 2012-07-27 09:17:54 UTC
Just notice that the following message appeared in Xorg.log before the crash:
__glXDRIbindTexImage: Failed to register texture offset override
Not sure if this is related.
Comment 2 Andreas Boll 2012-11-02 16:19:12 UTC
Note: classic r600 driver has been abandoned.
Please use r600g (gallium driver) instead.

Is this still an issue with a newer driver/kernel?
Comment 3 Andriy Gapon 2012-11-04 11:42:48 UTC
Is KMS needed for r600g?
Comment 4 Alex Deucher 2012-11-04 14:34:57 UTC
(In reply to comment #3)
> Is KMS needed for r600g?

Yes, KMS is required for r600g.  Support for UMS in general is deprecated.
Comment 5 Andriy Gapon 2012-11-04 15:27:55 UTC
That was my impression, thank you for the confirmation.
(please see the Platform header of this report)
Unfortunately, FreeBSD doesn't have KMS support for ati yet...
Comment 6 Andreas Boll 2014-07-07 16:06:15 UTC
The classic r600 driver has been abandoned long ago.
It was replaced by the Gallium driver r600g.

If you have issues with r600g please file a new bug report with component Drivers/Gallium/r600

Thanks.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.