Bug 76299 - Segfault in intelTexImage
Summary: Segfault in intelTexImage
Status: RESOLVED FIXED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/i965 (show other bugs)
Version: 10.1
Hardware: x86 (IA32) Linux (All)
: medium major
Assignee: Intel 3D Bugs Mailing List
QA Contact: Intel 3D Bugs Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-03-18 01:59 UTC by Luke-Jr
Modified: 2016-11-03 22:20 UTC (History)
4 users (show)

See Also:
i915 platform:
i915 features:


Attachments
apitrace trace --api gl armagetronad (775.72 KB, application/octet-stream)
2014-03-19 00:08 UTC, Luke-Jr
Details
workaround/hack (532 bytes, patch)
2014-04-29 03:33 UTC, Luke-Jr
Details | Splinter Review
Proposed patch to fix an MMX memory alignment issue (2.09 KB, patch)
2014-09-05 05:03 UTC, Jason Ekstrand
Details | Splinter Review

Description Luke-Jr 2014-03-18 01:59:57 UTC
Both Quake4 and Armagetron Advanced segfault in the same part of Mesa:

#0  0xf6f22a1f in rgba8_copy (dst=0xf597f000, src=0x8969bc8, bytes=16) at intel_tex_subimage.c:205
#1  0xf6f22d4a in ytile_copy (x0=0, x1=0, x2=128, x3=128, y0=0, y1=32, dst=0xf597f000 "", src=0x8969bc8 "", 
    src_pitch=1024, swizzle_bit=64, mem_copy=0xf6f229f6 <rgba8_copy>) at intel_tex_subimage.c:323
#2  0xf6f23114 in ytile_copy_faster (x0=0, x1=0, x2=128, x3=128, y0=0, y1=32, dst=0xf597f000 "", src=0x8969bc8 "", 
    src_pitch=1024, swizzle_bit=64, mem_copy=0xf6f229f6 <rgba8_copy>) at intel_tex_subimage.c:398
#3  0xf6f23440 in linear_to_tiled (xt1=0, xt2=1024, yt1=0, yt2=256, dst=0xf597f000 "", src=0x8969bc8 "", 
    dst_pitch=1024, src_pitch=1024, has_swizzling=true, tiling=2, mem_copy=0xf6f229f6 <rgba8_copy>)
    at intel_tex_subimage.c:493
#4  0xf6f239e1 in intel_texsubimage_tiled_memcpy (ctx=0xf734301c, dims=2, texImage=0x89641d0, xoffset=0, yoffset=0, 
    zoffset=0, width=256, height=256, depth=1, format=6408, type=5121, pixels=0x8969bc8, packing=0xf735b8c8, 
    for_glTexImage=true) at intel_tex_subimage.c:643
#5  0xf6f21f3f in intelTexImage (ctx=0xf734301c, dims=2, texImage=0x89641d0, format=6408, type=5121, 
    pixels=0x8969bc8, unpack=0xf735b8c8) at intel_tex_image.c:177
#6  0xf6d20d51 in teximage (ctx=0xf734301c, compressed=0 '\000', dims=2, target=3553, level=0, 
    internalFormat=32856, width=256, height=256, depth=1, border=0, format=6408, type=5121, imageSize=0, 
    pixels=0x8969bc8) at main/teximage.c:3243
#7  0xf6d20ed7 in _mesa_TexImage2D (target=3553, level=0, internalFormat=32856, width=256, height=256, border=0, 
    format=6408, type=5121, pixels=0x8969bc8) at main/teximage.c:3282
#8  0x43c6c0dc in gluBuild2DMipmapLevelsCore (target=3553, internalFormat=32856, width=256, height=256, 
    widthPowerOf2=256, heightPowerOf2=256, format=6408, type=5121, userLevel=0, baseLevel=0, maxLevel=8, 
    data=0x8969bc8) at /var/tmp/portage/media-libs/glu-9.0.0/work/glu-9.0.0/src/libutil/mipmap.c:3873
#9  0x43c6e6cd in gluBuild2DMipmaps (target=3553, internalFormat=32856, width=256, height=256, format=6408, 
    type=5121, data=0x8969bc8) at /var/tmp/portage/media-libs/glu-9.0.0/work/glu-9.0.0/src/libutil/mipmap.c:4606
#10 0x08153a44 in rISurfaceTexture::Upload (this=0x820baa0, surface=...)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/render/rTexture.cpp:514
#11 0x08153d81 in rFileTexture::OnSelect (this=0x820baa0)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/render/rTexture.cpp:708
#12 0x08153b11 in rISurfaceTexture::OnSelect (this=0x820baa0, enforce=true)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/render/rTexture.cpp:558
#13 0x0814a047 in rFont::OnSelect (this=0x820baa0, enforce=true)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/render/rFont.cpp:133
#14 0x0804ed28 in rITexture::Select (this=0x820baa0, enforce=true)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/render/rTexture.h:309
#15 0x0814a2f1 in rFont::Render (this=0x820baa0, c=80 'P', left=-0.225000009, top=0.654999971, right=-0.175000012, 
    bot=0.544999957)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/render/rFont.cpp:175
#16 0x0814aa4e in rTextField::FlushLine (this=0xffffbcd8, len=9, newline=true)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/render/rFont.cpp:343
#17 0x0814aad4 in rTextField::FlushLine (this=0xffffbcd8, newline=true)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/render/rFont.cpp:370
#18 0x0814a5a3 in rTextField::~rTextField (this=0xffffbcd8, __in_chrg=<optimized out>)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/render/rFont.cpp:250
#19 0x0814afd5 in DisplayText (x=0, y=0.599999964, w=0.0500000007, h=0.109999999, text=0x834e4c0 "Play Game", 
    center=0, cursor=0, cursorPos=0, colorMode=rTextField::COLOR_USE)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/render/rFont.cpp:564
#20 0x08144f4c in uMenuItem::DisplayText (this=0x86e8e50, x=0, y=0.599999964, text=0x834e4c0 "Play Game", 
    selected=true, alpha=1, center=0, c=0, cp=0, colorMode=rTextField::COLOR_USE)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/ui/uMenu.cpp:551
#21 0x08144fa8 in uMenuItem::DisplayTextSpecial (this=0x86e8e50, x=0, y=0.599999964, text=0x834e4c0 "Play Game", 
    selected=true, alpha=1, center=0)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/ui/uMenu.cpp:568
#22 0x08146366 in uMenuItemSubmenu::Render (this=0x86e8e50, x=0, y=0.599999964, alpha=1, selected=true)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/ui/uMenu.cpp:981
#23 0x081442b6 in uMenu::OnEnter (this=0xffffc048)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/ui/uMenu.cpp:287
#24 0x0807fc26 in uMenu::Enter (this=0xffffc048)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/ui/uMenu.h:106
#25 0x0807844a in MainMenu (ingame=false)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/tron/gGame.cpp:2686
#26 0x08050bd2 in main (argc=1, argv=0xffffc604)
    at /var/tmp/portage/games-action/armagetronad-0.2.8.3.2/work/armagetronad-0.2.8.3.2/src/tron/gArmagetron.cpp:685
Comment 1 Samuel Iglesias Gonsálvez 2014-03-18 14:28:33 UTC
I have installed Armagetron Advance from the repositories of my Debian Jessie installation. However, I couldn't reproduce this bug with neither Mesa 9.2.2 nor Mesa 10.2.0-devel (git-63e7b51) on a SandyBridge system.

Could you give more details about your setup? Can you test it on top of Mesa git master?
Comment 2 Luke-Jr 2014-03-18 18:20:00 UTC
My apologies, I forgot to include that info...

CPU: Intel(R) Core(TM) i7-4771 CPU @ 3.50GHz
Kernel: Linux 3.12.14
OS: Gentoo
Mesa: 10.1.0
Xorg-server: 1.15.0
xf86-video-intel: 2.21.15

Perhaps also worth noting, that with the stable versions (Mesa 9.1.6, xorg-server 1.14.3), attempting to run Quake4 caused X itself to crash (segfault, trying to dereference 0x1) although Armagetron worked. My upgrades were an attempt to get a fix for that.

I could potentially try the git mesa ebuild from the x11 overlay, but I prefer to run only stable code usually. Is mesa git stable? :)
Comment 3 Matt Turner 2014-03-18 22:33:20 UTC
Can you post an apitrace?
Comment 4 Luke-Jr 2014-03-18 22:57:05 UTC
(In reply to comment #3)
> Can you post an apitrace?

I don't know what that is...
Comment 5 Luke-Jr 2014-03-19 00:07:37 UTC
Same problem with Mesa from git.
Comment 6 Luke-Jr 2014-03-19 00:08:45 UTC
Created attachment 96022 [details]
apitrace trace --api gl armagetronad
Comment 7 Matt Turner 2014-03-19 00:12:33 UTC
(In reply to comment #6)
> Created attachment 96022 [details]
> apitrace trace --api gl armagetronad

Thanks. When you replay this, you get the segfault you mentioned? It's not segfaulting for me.
Comment 8 Luke-Jr 2014-03-19 00:13:54 UTC
When it comes to the part where the program segfaults, I get a dialog:
    Couldn't execute the replay file 'armagetronad.trace'
Comment 9 Luke-Jr 2014-03-19 04:44:48 UTC
For whatever reason, I do *not* get the segfault when I run in a bare X server (ie, without KDE). Instead, I get software rendering (if my radeons! are seen by Linux) or just hanging (if I "remove" the radeons before I start X, so DRI doesn't have a fit).

I should mention that a year ago, on the same system but with a Sandy Bridge motherboard/CPU, this all worked great...
Comment 10 Luke-Jr 2014-03-19 04:52:40 UTC
I found that by deleting my Armagetron config, it would start and run.
I can now consistently reproduce this crash by setting TrueColour Textures to On (it defaults to Off) and applying the settings (can only be done via Screen Mode settings).
Comment 11 Luke-Jr 2014-04-29 03:33:40 UTC
Created attachment 98153 [details] [review]
workaround/hack

After a few hours of debugging, I found the problem lies in rgba8_copy_16, which appears to use SSSE3 for a faster 128-bit and 512-bit memcpy. For some reason, this code segfaults on my platform (Haswell i7-4771 in x86_32 mode). Removing the SSSE3 code "fixes" the problem, and all 3 games (Armagetron, Quake, and Quake 4) work again.
Comment 12 Luke-Jr 2014-05-23 09:12:29 UTC
FWIW, it seems Qt is discovering SSSE3 issues on Haswell also: https://bugreports.qt-project.org/browse/QTBUG-34499
Comment 13 Matt Turner 2014-05-23 16:24:29 UTC
(In reply to comment #12)
> FWIW, it seems Qt is discovering SSSE3 issues on Haswell also:
> https://bugreports.qt-project.org/browse/QTBUG-34499

Totally irrelevant. That bug is about a compile error.
Comment 14 Jason Ekstrand 2014-09-05 05:03:48 UTC
Created attachment 105775 [details] [review]
Proposed patch to fix an MMX memory alignment issue

Could you please re-test with the attached patch.  Thanks!
Comment 15 Luke-Jr 2014-09-05 05:16:57 UTC
Maybe. Do you know off-hand if it will be a valid test with the radeon driver? I got tired of Intel's daily PC hangs and put an AMD card in... :/
Comment 16 Matt Turner 2014-09-05 05:22:25 UTC
(In reply to comment #15)
> Maybe. Do you know off-hand if it will be a valid test with the radeon
> driver? I got tired of Intel's daily PC hangs and put an AMD card in... :/

No. It's a patch to the i965 driver (the driver you filed the bug against..)
Comment 17 Luke-Jr 2014-09-05 05:31:02 UTC
Ok, might be a while then. I'm currently enjoying 43 days of uptime since switching to AMD :x

I'll try to remember to test this next time I have to reboot for some reason.
Comment 18 Matt Turner 2015-10-01 22:22:53 UTC
We're seeing an assertion failure in the ES2-CTS.gtf.GL2FixedTests.scissor.scissor conformance test that looks a lot like the same issue as reported here. Unfortunately it is not reproducible when the test is run by itself, but only appears when run as part of the whole CTS process.

Cc'ing Ian.
Comment 19 Matt Turner 2016-11-03 22:20:09 UTC
I suspect this was fixed by

commit 6cc7aec5b05ff19d9bdf2b33c993257625d7c9fc
Author: Jason Ekstrand <jason.ekstrand@intel.com>
Date:   Thu Apr 7 11:36:47 2016 -0700

    i965/tiled_memcopy: Get rid of the direction parameter to get_memcpy

or the prior few commits.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.