Bug 81834 - TGSI constant buffer overrun causes assertion failure
Summary: TGSI constant buffer overrun causes assertion failure
Status: RESOLVED FIXED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Mesa core (show other bugs)
Version: git
Hardware: Other All
: medium normal
Assignee: mesa-dev
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-07-28 10:03 UTC by Michel Dänzer
Modified: 2014-08-05 14:40 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
TappyChicken output with MESA_GLSL=dump R600_DEBUG=ps (565.84 KB, text/plain)
2014-07-28 10:03 UTC, Michel Dänzer
Details
backtrace of effects demo with f4b0ab7afd83c811329211eae8167c9bf238870c reverted (31.25 KB, text/plain)
2014-07-29 07:55 UTC, Christoph Haag
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Michel Dänzer 2014-07-28 10:03:27 UTC
Created attachment 103581 [details]
TappyChicken output with MESA_GLSL=dump R600_DEBUG=ps

Trying to run any Unreal Engine 4 demo fails with this LLVM assertion failure, see the backtrace below:

.../llvm/lib/IR/Instructions.cpp:2377: static llvm::CastInst *llvm::CastInst::Create(Instruction::CastOps, llvm::Value *, llvm::Type *, const llvm::Twine &, llvm::Instruction *): Assertion `castIsValid(op, S, Ty) && "Invalid cast!"' failed.


I'm attaching the output of the TappyChicken demo with MESA_GLSL=dump R600_DEBUG=ps. The TGSI code uses CONST[3][44], but that constant array is declared as having only 5 entries:

DCL CONST[3][0..4]
[...]
  0: MAD TEMP[0].xyz, IMM[1].xxyy, CONST[3][44].wwww, CONST[3][44].xyzz

So I guess something goes wrong when converting from GLSL IR to TGSI.

It seems I can work around this by reverting commit f4b0ab7afd83c811329211eae8167c9bf238870c ('st/mesa: fix incorrect size of UBO declarations'), but I'm not sure it's directly related.


Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffed324700 (LWP 4227)]
0x00007ffff69c6407 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff69c6407 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff69c77e8 in __GI_abort () at abort.c:89
#2  0x00007ffff69bf526 in __assert_fail_base (fmt=0x7ffff6af5d18 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion@entry=0x7ffff0af543f "castIsValid(op, S, Ty) && \"Invalid cast!\"", file=file@entry=0x7ffff0af30d6 "/home/daenzer/src/llvm-git/llvm/lib/IR/Instructions.cpp", 
    line=line@entry=2377, 
    function=function@entry=0x7ffff0af5469 "static llvm::CastInst *llvm::CastInst::Create(Instruction::CastOps, llvm::Value *, llvm::Type *, const llvm::Twine &, llvm::Instruction *)")
    at assert.c:92
#3  0x00007ffff69bf5d2 in __GI___assert_fail (assertion=0x7ffff0af543f "castIsValid(op, S, Ty) && \"Invalid cast!\"", 
    file=0x7ffff0af30d6 "/home/daenzer/src/llvm-git/llvm/lib/IR/Instructions.cpp", line=2377, 
    function=0x7ffff0af5469 "static llvm::CastInst *llvm::CastInst::Create(Instruction::CastOps, llvm::Value *, llvm::Type *, const llvm::Twine &, llvm::Instruction *)") at assert.c:101
#4  0x00007ffff042cf05 in llvm::CastInst::Create (op=<optimized out>, S=<optimized out>, Ty=<optimized out>, Name=..., InsertBefore=<optimized out>)
    at /home/daenzer/src/llvm-git/llvm/lib/IR/Instructions.cpp:2377
#5  0x00007fffefd3ae06 in llvm::IRBuilder<true, llvm::ConstantFolder, llvm::IRBuilderDefaultInserter<true> >::CreateCast (this=0x7fffe881dfb0, Op=<optimized out>, V=0x7fffe8839ac8, 
    DestTy=<optimized out>, Name=...) at /home/daenzer/src/llvm-git/llvm/include/llvm/IR/IRBuilder.h:1213
#6  0x00007ffff0397615 in CreateBitCast (Name=<error reading variable: Cannot access memory at address 0xfefefefefefefeff>, this=<optimized out>, V=<optimized out>, DestTy=<optimized out>)
    at /home/daenzer/src/llvm-git/llvm/include/llvm/IR/IRBuilder.h:1177
#7  LLVMBuildBitCast (B=0x1071, B@entry=0x7fffe881dfb0, Val=0x6, Val@entry=0x7fffe8839ac8, DestTy=0x0, Name=<optimized out>, Name@entry=0x7ffff1e3880d "")
    at /home/daenzer/src/llvm-git/llvm/lib/IR/Core.cpp:2430
#8  0x00007ffff1cfcc35 in bitcast (bld_base=<optimized out>, value=0x7fffe8839ac8, type=TGSI_TYPE_FLOAT) at ../../../../../src/gallium/drivers/radeon/radeon_llvm.h:167
#9  fetch_constant (bld_base=<optimized out>, reg=<optimized out>, type=TGSI_TYPE_FLOAT, swizzle=<optimized out>) at ../../../../../src/gallium/drivers/radeonsi/si_shader.c:646
#10 0x00007ffff1bbee9e in lp_build_emit_fetch (bld_base=0x7fffed31b600, inst=0x7fffe884cd00, src_op=2, chan_index=<optimized out>)
    at ../../../../src/gallium/auxiliary/gallivm/lp_bld_tgsi.c:309
#11 0x00007ffff1bbf3e5 in lp_build_fetch_args (emit_data=<optimized out>, bld_base=<optimized out>) at ../../../../src/gallium/auxiliary/gallivm/lp_bld_tgsi.c:177
#12 lp_build_tgsi_inst_llvm (bld_base=bld_base@entry=0x7fffed31b600, inst=inst@entry=0x7fffe884cd00) at ../../../../src/gallium/auxiliary/gallivm/lp_bld_tgsi.c:249
#13 0x00007ffff1bbf775 in lp_build_tgsi_llvm (bld_base=bld_base@entry=0x7fffed31b600, tokens=<optimized out>) at ../../../../src/gallium/auxiliary/gallivm/lp_bld_tgsi.c:476
#14 0x00007ffff1d00817 in si_pipe_shader_create (ctx=ctx@entry=0x4792530, shader=shader@entry=0x7fffe880d410) at ../../../../../src/gallium/drivers/radeonsi/si_shader.c:2869
#15 0x00007ffff1d0761c in si_shader_select (ctx=ctx@entry=0x4792530, sel=sel@entry=0x7fffe8033450) at ../../../../../src/gallium/drivers/radeonsi/si_state.c:2192
#16 0x00007ffff1d076e7 in si_create_shader_state (ctx=0x4792530, state=0x7fffe8033200, pipe_shader_type=1) at ../../../../../src/gallium/drivers/radeonsi/si_state.c:2224
#17 0x00007ffff190cfc3 in st_translate_fragment_program (st=st@entry=0x4944a10, stfp=stfp@entry=0x7fffe8763760, key=key@entry=0x7fffed323710)
    at ../../../src/mesa/state_tracker/st_program.c:808
#18 0x00007ffff190daa6 in st_get_fp_variant (st=st@entry=0x4944a10, stfp=stfp@entry=0x7fffe8763760, key=key@entry=0x7fffed323710) at ../../../src/mesa/state_tracker/st_program.c:845
#19 0x00007ffff18c4424 in update_fp (st=0x4944a10) at ../../../src/mesa/state_tracker/st_atom_shader.c:96
#20 0x00007ffff18bf5d1 in st_validate_state (st=st@entry=0x4944a10) at ../../../src/mesa/state_tracker/st_atom.c:213
#21 0x00007ffff18c9eb1 in st_Clear (ctx=0x49e15b0, mask=256) at ../../../src/mesa/state_tracker/st_cb_clear.c:446
#22 0x00007ffff16cd778 in _mesa_ClearBufferfv (buffer=6144, drawbuffer=<optimized out>, value=0x7fffed323ba0) at ../../../src/mesa/main/clear.c:536
Comment 1 Christoph Haag 2014-07-29 07:23:32 UTC
In case other people look at this bug, there is another backtrace where it runs into a failed assertion: https://bugs.freedesktop.org/show_bug.cgi?id=75276#c32

You are right, after reverting f4b0ab7afd83c811329211eae8167c9bf238870c this does not happen anymore.

With the TappyChicken demo, I then get bug 80880 too.
Comment 2 Christoph Haag 2014-07-29 07:55:04 UTC
Created attachment 103628 [details]
backtrace of effects demo with f4b0ab7afd83c811329211eae8167c9bf238870c reverted

The effects cave demo is having yet another crash. But I also managed to get the assertion error from bug 80880, so it's random which fails first. In this case it runs for a few seconds with the music playing, but black window contents.

Might be because of the revert or not...
Comment 3 Michel Dänzer 2014-07-29 08:06:01 UTC
(In reply to comment #2)
> The effects cave demo is having yet another crash.
[...]
> Might be because of the revert or not...

I don't think it's related to the revert. Looks like the kernel fails to provide CPU access to a BO for storing shader machine code. What kernel are you using?
Comment 4 Christoph Haag 2014-07-29 16:01:46 UTC
(In reply to comment #3)
> (In reply to comment #2)
> > The effects cave demo is having yet another crash.
> [...]
> > Might be because of the revert or not...
> 
> I don't think it's related to the revert. Looks like the kernel fails to
> provide CPU access to a BO for storing shader machine code. What kernel are
> you using?

3.16-rc7 mainline.

Should I create a new bug report?
Comment 5 Michel Dänzer 2014-07-30 06:22:51 UTC
(In reply to comment #4)
> Should I create a new bug report?

Yes, please.
Comment 6 Michel Dänzer 2014-08-05 14:40:21 UTC
Module: Mesa
Branch: master
Commit: 3347c634d0508af93445b1ac1bdec1f55e2b2ae0
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=3347c634d0508af93445b1ac1bdec1f55e2b2ae0

Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Tue Aug  5 15:19:11 2014 +0900

glsl_to_tgsi: Fix typo shader_program -> shader

This was a regression introduced by commit
f4b0ab7afd83c811329211eae8167c9bf238870c ('st/mesa: fix incorrect size
of UBO declarations') which caused an assertion failure while compiling
shaders of e.g. UE4 demos.


bug/show.html.tmpl processed on Mar 30, 2017 at 04:48:20.
(provided by the Example extension).