(See also https://code.google.com/p/chromium/issues/detail?id=139772) We're running Webkit tests under AddressSanitizer (http://clang.llvm.org/docs/AddressSanitizer.html) and some tests crash with the following buffer underflow report: 01:55:19.656 6769 worker/1 fast/canvas/webgl/uniform-location-length-limits.html crashed, (stderr lines): 01:55:19.657 6769 [7927:7927:3005006286302:ERROR:gles2_cmd_decoder.cc(5109)] PERFORMANCE WARNING: Attribute 0 is disabled. This has signficant performance penalty 01:55:19.657 6769 ================================================================= 01:55:19.657 6769 ==7927== ERROR: AddressSanitizer global-buffer-overflow on address 0x7f0450ad2c5c at pc 0x7f045076a9a3 bp 0x7fff39bc8aa0 sp 0x7fff39bc8a98 01:55:19.657 6769 READ of size 4 at 0x7f0450ad2c5c thread T0 01:55:19.676 6769 #0 0x7f045076a9a3 in swizzle_for_size(int) third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:0 01:55:19.676 6769 #1 0x7f045076abc1 in ir_to_mesa_visitor::visit(ir_dereference_record*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:1547 01:55:19.676 6769 #2 0x7f045076aa3f in ir_to_mesa_visitor::visit(ir_dereference_record*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:1542 01:55:19.676 6769 #3 0x7f045076adbc in ir_to_mesa_visitor::visit(ir_assignment*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:1584 01:55:19.676 6769 #4 0x7f045075fc0c in ir_to_mesa_visitor::visit(ir_function*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:1010 01:55:19.676 6769 #5 0x7f045092900c in visit_exec_list(exec_list*, ir_visitor*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/mesa/MesaLib/src/glsl/ir.cpp:1199 01:55:19.676 6769 #6 0x7f045077275e in get_mesa_program(__GLcontextRec*, gl_shader_program*, gl_shader*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:2621 01:55:19.676 6769 #7 0x7f04507751a5 in _mesa_ir_link_shader /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:2812 01:55:19.676 6769 #8 0x7f0450776140 in _mesa_glsl_link_shader /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:2946 01:55:19.676 6769 #9 0x2b93117 in gpu::gles2::ProgramManager::ProgramInfo::Link(gpu::gles2::ShaderManager*, gpu::gles2::ShaderTranslator*, gpu::gles2::ShaderTranslator*, gpu::gles2::FeatureInfo*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/service/program_manager.cc:514 01:55:19.676 6769 #10 0x2b6bd8c in gpu::gles2::GLES2DecoderImpl::DoLinkProgram(unsigned int) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/service/gles2_cmd_decoder.cc:4735 01:55:19.676 6769 #11 0x2b54375 in gpu::gles2::GLES2DecoderImpl::HandleLinkProgram(unsigned int, gpu::gles2::LinkProgram const&) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/./gpu/command_buffer/service/gles2_cmd_decoder_autogen.h:1437 01:55:19.676 6769 #12 0x2b469de in gpu::gles2::GLES2DecoderImpl::DoCommand(unsigned int, unsigned int, void const*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/service/gles2_cmd_decoder.cc:3217 01:55:19.693 6769 #13 0x2be2780 in gpu::CommandParser::ProcessCommand() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/service/cmd_parser.cc:71 01:55:19.693 6769 #14 0x2b86e44 in gpu::GpuScheduler::PutChanged() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/service/gpu_scheduler.cc:81 01:55:19.693 6769 #15 0x2aface9 in webkit::gpu::GLInProcessContext::PumpCommands() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/webkit/gpu/webgraphicscontext3d_in_process_command_buffer_impl.cc:251 01:55:19.693 6769 #16 0x2b0a3ed in base::internal::InvokeHelper<false, void, base::internal::RunnableAdapter<void (webkit::gpu::GLInProcessContext::*)()>, void ()(webkit::gpu::GLInProcessContext*)>::MakeItSo(base::internal::RunnableAdapter<void (webkit::gpu::GLInProcessContext::*)()>, webkit::gpu::GLInProcessContext*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/./base/bind_internal.h:871 01:55:19.706 6769 #17 0x2b0a2bd in base::internal::Invoker<1, base::internal::BindState<base::internal::RunnableAdapter<void (webkit::gpu::GLInProcessContext::*)()>, void ()(webkit::gpu::GLInProcessContext*), void ()(base::internal::UnretainedWrapper<webkit::gpu::GLInProcessContext>)>, void ()(webkit::gpu::GLInProcessContext*)>::Run(base::internal::BindStateBase*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/./base/bind_internal.h:1172 01:55:19.706 6769 #18 0x2b2b5b1 in gpu::CommandBufferService::FlushSync(int, int) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/service/command_buffer_service.cc:76 01:55:19.706 6769 #19 0x311dc8d in gpu::CommandBufferHelper::FlushSync() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/client/cmd_buffer_helper.cc:9addr2line: '': No such file 01:55:19.707 6769 5 01:55:19.708 6769 #20 0x311dfb8 in gpu::CommandBufferHelper::Finish() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/client/cmd_buffer_helper.cc:121 01:55:19.708 6769 #21 0x31261a2 in gpu::gles2::GLES2Implementation::WaitForCmd() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/client/gles2_implementation.cc:556 01:55:19.708 6769 #22 0x3127339 in gpu::gles2::GLES2Implementation::GetBucketContents(unsigned int, std::vector<signed char, std::allocator<signed char> >*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/client/gles2_implementation.cc:671 01:55:19.708 6769 #23 0x314bd91 in gpu::gles2::CachedProgramInfoManager::ProgramInfo::Update(gpu::gles2::GLES2Implementation*, unsigned int) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/client/program_info_manager.cc:307 01:55:19.708 6769 #24 0x314cc3a in gpu::gles2::CachedProgramInfoManager::GetProgramInfo(gpu::gles2::GLES2Implementation*, unsigned int) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/client/program_info_manager.cc:375 01:55:19.708 6769 #25 0x314d181 in gpu::gles2::CachedProgramInfoManager::GetProgramiv(gpu::gles2::GLES2Implementation*, unsigned int, unsigned int, int*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/client/program_info_manager.cc:393 01:55:19.708 6769 #26 0x312adb8 in gpu::gles2::GLES2Implementation::GetProgramivHelper(unsigned int, unsigned int, int*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/gpu/command_buffer/client/gles2_implementation.cc:1338 01:55:19.709 6769 #27 0x2afff63 in gpu::gles2::GLES2Implementation::GetProgramiv(unsigned int, unsigned int, int*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/./gpu/command_buffer/client/../client/gles2_implementation_autogen.h:597 01:55:19.709 6769 #28 0x14afddb in WebCore::WebGLProgram::cacheInfoIfNeeded() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/html/canvas/WebGLProgram.cpp:190 01:55:19.709 6769 #29 0x14aff8e in WebCore::WebGLProgram::getLinkStatus() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/html/canvas/WebGLProgram.cpp:96 01:55:19.709 6769 #30 0x13f765a in WebCore::WebGLRenderingContext::getProgramParameter(WebCore::WebGLProgram*, unsigned int, int&) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/html/canvas/WebGLRenderingContext.cpp:2647 01:55:19.709 6769 #31 0x3720535 in WebCore::V8WebGLRenderingContext::getProgramParameterCallback(v8::Arguments const&) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:360 01:55:19.709 6769 #32 0xdb4851 in v8::internal::MaybeObject* v8::internal::HandleApiCallHelper<false>(v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>, v8::internal::Isolate*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/v8/src/builtins.cc:1145 01:55:19.709 6769 #33 0x31338a00618e in 01:55:19.709 6769 #34 0x31338a096f79 in 01:55:19.709 6769 #35 0x31338a09cda0 in 01:55:19.718 6769 #36 0x31338a0098ce in 01:55:19.718 6769 #37 0x31338a09e2af in 01:55:19.718 6769 #38 0x31338a023ca7 in 01:55:19.718 6769 #39 0x31338a011217 in 01:55:19.718 6769 #40 0xdfaf3f in v8::internal::Invoke(bool, v8::internal::Handle<v8::internal::JSFunction>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*, bool*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/v8/src/execution.cc:118 01:55:19.718 6769 #41 0xd6e7cd in v8::Script::Run() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/v8/src/api.cc:1613 01:55:19.724 6769 #42 0x18604b5 in WebCore::V8Proxy::runScript(v8::Handle<v8::Script>) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/bindings/v8/V8Proxy.cpp:365 01:55:19.724 6769 #43 0x185f6ce in WebCore::V8Proxy::evaluate(WebCore::ScriptSourceCode const&, WebCore::Node*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/bindings/v8/V8Proxy.cpp:336 01:55:19.724 6769 #44 0x1804e20 in WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/bindings/v8/ScriptController.cpp:204 01:55:19.724 6769 #45 0xa25903 in WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/dom/ScriptElement.cpp:300 01:55:19.724 6769 #46 0xa23501 in WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/dom/ScriptElement.cpp:240 01:55:19.724 6769 #47 0x141e18d in WebCore::HTMLScriptRunner::runScript(WebCore::Element*, WTF::TextPosition const&) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/html/parser/HTMLScriptRunner.cpp:292 01:55:19.724 6769 #48 0x141def2 in WebCore::HTMLScriptRunner::execute(WTF::PassRefPtr<WebCore::Element>, WTF::TextPosition const&) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/html/parser/HTMLScriptRunner.cpp:172 01:55:19.724 6769 #49 0x1416d4b in ~PassRefPtr /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WTF/wtf/PassRefPtr.h:67 01:55:19.724 6769 #50 0x1416ef8 in WebCore::HTMLDocumentParser::canTakeNextToken(WebCore::HTMLDocumentParser::SynchronousMode, WebCore::PumpSession&) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:217 01:55:19.724 6769 #51 0x1416726 in WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:254 01:55:19.724 6769 #52 0x1416ad5 in WebCore::HTMLDocumentParser::resumeParsingAfterYield() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:191 01:55:19.724 6769 #53 0x150a978 in WebCore::ThreadTimers::sharedTimerFiredInternal() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/third_party/WebKit/Source/WebCore/platform/ThreadTimers.cpp:118 01:55:19.724 6769 #54 0x2a9767d in base::internal::InvokeHelper<false, void, base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>, void ()(webkit_glue::WebKitPlatformSupportImpl*)>::MakeItSo(base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>, webkit_glue::WebKitPlatformSupportImpl*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/./base/bind_internal.h:871 01:55:19.724 6769 #55 0x2a974ad in base::internal::Invoker<1, base::internal::BindState<base::internal::RunnableAdapter<void (webkit_glue::WebKitPlatformSupportImpl::*)()>, void ()(webkit_glue::WebKitPlatformSupportImpl*), void ()(base::internal::UnretainedWrapper<webkit_glue::WebKitPlatformSupportImpl>)>, void ()(webkit_glue::WebKitPlatformSupportImpl*)>::Run(base::internal::BindStateBase*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/./base/bind_internal.h:1172 01:55:19.724 6769 #56 0x2e44cad in base::Timer::RunScheduledTask() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/base/timer.cc:184 01:55:19.724 6769 #57 0x2e4529d in base::internal::InvokeHelper<false, void, base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>, void ()(base::BaseTimerTaskInternal*)>::MakeItSo(base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>, base::BaseTimerTaskInternal*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/./base/bind_internal.h:871 01:55:19.724 6769 #58 0x2e45158 in base::internal::Invoker<1, base::internal::BindState<base::internal::RunnableAdapter<void (base::BaseTimerTaskInternal::*)()>, void ()(base::BaseTimerTaskInternal*), void ()(base::internal::OwnedWrapper<base::BaseTimerTaskInternal>)>, void ()(base::BaseTimerTaskInternal*)>::Run(base::internal::BindStateBase*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/./base/bind_internal.h:1172 01:55:19.724 6769 #59 0xa4b523 in MessageLoop::RunTask(base::PendingTask const&) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/base/message_loop.cc:461 01:55:19.725 6769 #60 0xa4bd3d in MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/base/message_loop.cc:472 01:55:19.725 6769 #61 0xa4c212 in MessageLoop::DoWork() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/base/message_loop.cc:648 01:55:19.725 6769 #62 0xaa7cc5 in base::MessagePumpGlib::HandleDispatch() /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/base/message_pump_glib.cc:268 01:55:19.725 6769 #63 0xaa6dc9 in (anonymous namespace)::WorkSourceDispatch(_GSource*, int (*)(void*), void*) /mnt/data/b/build/slave/Webkit_Linux_ASAN/build/src/base/message_pump_glib.cc:105 01:55:19.725 6769 0x7f0450ad2c5c is located 4 bytes to the left of global variable 'swizzle_for_size(int)::size_swizzles (third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp)' (0x7f0450ad2c60) of size 16 01:55:19.725 6769 0x7f0450ad2c5c is located 53 bytes to the right of global variable '.str74 (third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp)' (0x7f0450ad2c20) of size 7 01:55:19.725 6769 '.str74 (third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp)' is ascii string '%s[%d]' 01:55:19.725 6769 ==7927== ABORTING 01:55:19.725 6769 Stats: 668M malloced (680M for red zones) by 1503178 calls 01:55:19.725 6769 Stats: 5M realloced by 6982 calls 01:55:19.725 6769 Stats: 281M freed by 1114295 calls 01:55:19.725 6769 Stats: 173M really freed by 626504 calls 01:55:19.725 6769 Stats: 1032M (264381 full pages) mmaped in 258 calls 01:55:19.725 6769 mmaps by size class: 8:720852; 9:155629; 10:16380; 11:4094; 12:2048; 13:2560; 14:2048; 15:768; 16:3584; 17:224; 18:128; 19:40; 20:16; 21:88; 22:44; 01:55:19.725 6769 mallocs by size class: 8:1281100; 9:171552; 10:26987; 11:6638; 12:2369; 13:4225; 14:3860; 15:1423; 16:4217; 17:390; 18:192; 19:78; 20:15; 21:88; 22:44; 01:55:19.728 6769 frees by size class: 8:1028304; 9:43047; 10:24931; 11:5126; 12:2134; 13:4055; 14:3333; 15:1298; 16:1517; 17:340; 18:124; 19:76; 20:10; 01:55:19.728 6769 rfrees by size class: 8:579526; 9:21342; 10:14535; 11:3236; 12:1485; 13:2190; 14:1959; 15:731; 16:1181; 17:187; 18:72; 19:51; 20:9; 01:55:19.728 6769 Stats: malloc large: 807 small slow: 6915 01:55:19.728 6769 Shadow byte and word: 01:55:19.733 6769 0x1fe08a15a58b: f9 01:55:19.733 6769 0x1fe08a15a588: f9 f9 f9 f9 00 00 f9 f9 01:55:19.733 6769 More shadow bytes: 01:55:19.733 6769 0x1fe08a15a568: f9 f9 f9 f9 00 00 00 00 01:55:19.733 6769 0x1fe08a15a570: 00 00 00 00 00 00 00 00 01:55:19.733 6769 0x1fe08a15a578: 00 00 00 00 00 00 00 04 01:55:19.733 6769 0x1fe08a15a580: f9 f9 f9 f9 07 f9 f9 f9 01:55:19.733 6769 =>0x1fe08a15a588: f9 f9 f9 f9 00 00 f9 f9 01:55:19.733 6769 0x1fe08a15a590: f9 f9 f9 f9 00 00 00 00 01:55:19.733 6769 0x1fe08a15a598: 00 04 f9 f9 f9 f9 f9 f9 01:55:19.733 6769 0x1fe08a15a5a0: 00 00 00 00 00 04 f9 f9 01:55:19.733 6769 0x1fe08a15a5a8: f9 f9 f9 f9 00 06 f9 f9 01:55:20.101 6748 fast/canvas/webgl/uniform-location-length-limits.html -> unexpected crash This is most likely to occur because 0 is passed as an argument to swizzle_for_size(). Unfortunately it may be hard to check whether the latest Mesa has this bug, so if there's no obvious way to fix this (I'm not familiar with the code, so I see none), I can only suggest to run Mesa tests under AddressSanitizer.
The swizzle_for_size() function is (unchanged from Mesa 7.9 to today): static int swizzle_for_size(int size) { int size_swizzles[4] = { MAKE_SWIZZLE4(SWIZZLE_X, SWIZZLE_X, SWIZZLE_X, SWIZZLE_X), MAKE_SWIZZLE4(SWIZZLE_X, SWIZZLE_Y, SWIZZLE_Y, SWIZZLE_Y), MAKE_SWIZZLE4(SWIZZLE_X, SWIZZLE_Y, SWIZZLE_Z, SWIZZLE_Z), MAKE_SWIZZLE4(SWIZZLE_X, SWIZZLE_Y, SWIZZLE_Z, SWIZZLE_W), }; assert((size >= 1) && (size <= 4)); return size_swizzles[size - 1]; } My guess is that if something's going wrong, you're running a non-debug build and the assertion is a no-op. Can you rebuild Mesa for debugging and retest? If you can find the value of 'size' for this failure, that'd be helpful.
Is there a way to have AddressSanitizer drop into a debugger (like --db-attach=yes in Valgrind) when it hits an error? It would be interesting to go up to the topmost ir_to_mesa_visitor::visit(ir_dereference_record*) frame and print ir->type->name. It seems like the only way this could happen is if either is_scalar or is_vector is true and vector_elements is zero.
I've managed to reproduce this locally. Inserting fprintf() calls into third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp shows that swizzle_for_size(0) is really called for some ir type named Nesting2: ir->type->name: Nesting2 swizzle_for_size(0) ================================================================= ==5641== ERROR: AddressSanitizer global-buffer-overflow on address 0x7fcd7760bc7c at pc 0x7fcd771ed9b3 bp 0x7fff035d6e10 sp 0x7fff035d6e08 READ of size 4 at 0x7fcd7760bc7c thread T0 #0 0x7fcd771ed9b2 in swizzle_for_size(int) /usr/local/google/chrome-asan/src/out/Release/../../third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:319 #1 0x7fcd771ed701 in ir_to_mesa_visitor::visit(ir_dereference_record*) /usr/local/google/chrome-asan/src/out/Release/../../third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:1547 #2 0x7fcd771edadd in ir_to_mesa_visitor::visit(ir_assignment*) /usr/local/google/chrome-asan/src/out/Release/../../third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:1591 #3 0x7fcd771dca42 in ir_to_mesa_visitor::visit(ir_function*) /usr/local/google/chrome-asan/src/out/Release/../../third_party/mesa/MesaLib/src/mesa/program/ir_to_mesa.cpp:1020 #4 0x7fcd77412d29 in visit_exec_list(exec_list*, ir_visitor*) /usr/local/google/chrome-asan/src/out/Release/../../third_party/mesa/MesaLib/src/glsl/ir.cpp:1200 ... Please let me know how else I can help.
In order to attach the debugger to a program instrumented with ASan one needs to run it with ASAN_OPTIONS=sleep_before_dying=100 (which means sleep for 100 seconds) and then attach gdb to the PID obtained from the log.
This bug was already fixed on the 7.9 branch by the commit listed below. I similar patch is also on the 7.10. You just need to update... and I recommend updating to either 8.0.x or 9.0. The 7.x release series is no longer actively supported. commit 0d98ceb4bfc9f0ac5462e060fa1d66c9b8b7d031 Author: Ian Romanick <ian.d.romanick@intel.com> Date: Mon Dec 13 15:42:46 2010 -0800 ir_to_mesa: Don't generate swizzles for record derefs of non-scalar/vectors This is the same as what the array dereference handler does. Fixes piglit test glsl-link-struct-array (bugzilla #31648). NOTE: This is a candidate for the 7.9 and 7.10 branches. (cherry picked from commit 2d577ee730c30caacf711babde6542766aa0b655) *** This bug has been marked as a duplicate of bug 31648 ***
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.