Bug 81834 - TGSI constant buffer overrun causes assertion failure
Summary: TGSI constant buffer overrun causes assertion failure
Status: RESOLVED FIXED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Mesa core (show other bugs)
Version: git
Hardware: Other All
: medium normal
Assignee: mesa-dev
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-07-28 10:03 UTC by Michel Dänzer
Modified: 2014-08-05 14:40 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
TappyChicken output with MESA_GLSL=dump R600_DEBUG=ps (565.84 KB, text/plain)
2014-07-28 10:03 UTC, Michel Dänzer
Details
backtrace of effects demo with f4b0ab7afd83c811329211eae8167c9bf238870c reverted (31.25 KB, text/plain)
2014-07-29 07:55 UTC, Christoph Haag
Details

Description Michel Dänzer 2014-07-28 10:03:27 UTC
Created attachment 103581 [details]
TappyChicken output with MESA_GLSL=dump R600_DEBUG=ps

Trying to run any Unreal Engine 4 demo fails with this LLVM assertion failure, see the backtrace below:

.../llvm/lib/IR/Instructions.cpp:2377: static llvm::CastInst *llvm::CastInst::Create(Instruction::CastOps, llvm::Value *, llvm::Type *, const llvm::Twine &, llvm::Instruction *): Assertion `castIsValid(op, S, Ty) && "Invalid cast!"' failed.


I'm attaching the output of the TappyChicken demo with MESA_GLSL=dump R600_DEBUG=ps. The TGSI code uses CONST[3][44], but that constant array is declared as having only 5 entries:

DCL CONST[3][0..4]
[...]
  0: MAD TEMP[0].xyz, IMM[1].xxyy, CONST[3][44].wwww, CONST[3][44].xyzz

So I guess something goes wrong when converting from GLSL IR to TGSI.

It seems I can work around this by reverting commit f4b0ab7afd83c811329211eae8167c9bf238870c ('st/mesa: fix incorrect size of UBO declarations'), but I'm not sure it's directly related.


Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffed324700 (LWP 4227)]
0x00007ffff69c6407 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff69c6407 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff69c77e8 in __GI_abort () at abort.c:89
#2  0x00007ffff69bf526 in __assert_fail_base (fmt=0x7ffff6af5d18 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion@entry=0x7ffff0af543f "castIsValid(op, S, Ty) && \"Invalid cast!\"", file=file@entry=0x7ffff0af30d6 "/home/daenzer/src/llvm-git/llvm/lib/IR/Instructions.cpp", 
    line=line@entry=2377, 
    function=function@entry=0x7ffff0af5469 "static llvm::CastInst *llvm::CastInst::Create(Instruction::CastOps, llvm::Value *, llvm::Type *, const llvm::Twine &, llvm::Instruction *)")
    at assert.c:92
#3  0x00007ffff69bf5d2 in __GI___assert_fail (assertion=0x7ffff0af543f "castIsValid(op, S, Ty) && \"Invalid cast!\"", 
    file=0x7ffff0af30d6 "/home/daenzer/src/llvm-git/llvm/lib/IR/Instructions.cpp", line=2377, 
    function=0x7ffff0af5469 "static llvm::CastInst *llvm::CastInst::Create(Instruction::CastOps, llvm::Value *, llvm::Type *, const llvm::Twine &, llvm::Instruction *)") at assert.c:101
#4  0x00007ffff042cf05 in llvm::CastInst::Create (op=<optimized out>, S=<optimized out>, Ty=<optimized out>, Name=..., InsertBefore=<optimized out>)
    at /home/daenzer/src/llvm-git/llvm/lib/IR/Instructions.cpp:2377
#5  0x00007fffefd3ae06 in llvm::IRBuilder<true, llvm::ConstantFolder, llvm::IRBuilderDefaultInserter<true> >::CreateCast (this=0x7fffe881dfb0, Op=<optimized out>, V=0x7fffe8839ac8, 
    DestTy=<optimized out>, Name=...) at /home/daenzer/src/llvm-git/llvm/include/llvm/IR/IRBuilder.h:1213
#6  0x00007ffff0397615 in CreateBitCast (Name=<error reading variable: Cannot access memory at address 0xfefefefefefefeff>, this=<optimized out>, V=<optimized out>, DestTy=<optimized out>)
    at /home/daenzer/src/llvm-git/llvm/include/llvm/IR/IRBuilder.h:1177
#7  LLVMBuildBitCast (B=0x1071, B@entry=0x7fffe881dfb0, Val=0x6, Val@entry=0x7fffe8839ac8, DestTy=0x0, Name=<optimized out>, Name@entry=0x7ffff1e3880d "")
    at /home/daenzer/src/llvm-git/llvm/lib/IR/Core.cpp:2430
#8  0x00007ffff1cfcc35 in bitcast (bld_base=<optimized out>, value=0x7fffe8839ac8, type=TGSI_TYPE_FLOAT) at ../../../../../src/gallium/drivers/radeon/radeon_llvm.h:167
#9  fetch_constant (bld_base=<optimized out>, reg=<optimized out>, type=TGSI_TYPE_FLOAT, swizzle=<optimized out>) at ../../../../../src/gallium/drivers/radeonsi/si_shader.c:646
#10 0x00007ffff1bbee9e in lp_build_emit_fetch (bld_base=0x7fffed31b600, inst=0x7fffe884cd00, src_op=2, chan_index=<optimized out>)
    at ../../../../src/gallium/auxiliary/gallivm/lp_bld_tgsi.c:309
#11 0x00007ffff1bbf3e5 in lp_build_fetch_args (emit_data=<optimized out>, bld_base=<optimized out>) at ../../../../src/gallium/auxiliary/gallivm/lp_bld_tgsi.c:177
#12 lp_build_tgsi_inst_llvm (bld_base=bld_base@entry=0x7fffed31b600, inst=inst@entry=0x7fffe884cd00) at ../../../../src/gallium/auxiliary/gallivm/lp_bld_tgsi.c:249
#13 0x00007ffff1bbf775 in lp_build_tgsi_llvm (bld_base=bld_base@entry=0x7fffed31b600, tokens=<optimized out>) at ../../../../src/gallium/auxiliary/gallivm/lp_bld_tgsi.c:476
#14 0x00007ffff1d00817 in si_pipe_shader_create (ctx=ctx@entry=0x4792530, shader=shader@entry=0x7fffe880d410) at ../../../../../src/gallium/drivers/radeonsi/si_shader.c:2869
#15 0x00007ffff1d0761c in si_shader_select (ctx=ctx@entry=0x4792530, sel=sel@entry=0x7fffe8033450) at ../../../../../src/gallium/drivers/radeonsi/si_state.c:2192
#16 0x00007ffff1d076e7 in si_create_shader_state (ctx=0x4792530, state=0x7fffe8033200, pipe_shader_type=1) at ../../../../../src/gallium/drivers/radeonsi/si_state.c:2224
#17 0x00007ffff190cfc3 in st_translate_fragment_program (st=st@entry=0x4944a10, stfp=stfp@entry=0x7fffe8763760, key=key@entry=0x7fffed323710)
    at ../../../src/mesa/state_tracker/st_program.c:808
#18 0x00007ffff190daa6 in st_get_fp_variant (st=st@entry=0x4944a10, stfp=stfp@entry=0x7fffe8763760, key=key@entry=0x7fffed323710) at ../../../src/mesa/state_tracker/st_program.c:845
#19 0x00007ffff18c4424 in update_fp (st=0x4944a10) at ../../../src/mesa/state_tracker/st_atom_shader.c:96
#20 0x00007ffff18bf5d1 in st_validate_state (st=st@entry=0x4944a10) at ../../../src/mesa/state_tracker/st_atom.c:213
#21 0x00007ffff18c9eb1 in st_Clear (ctx=0x49e15b0, mask=256) at ../../../src/mesa/state_tracker/st_cb_clear.c:446
#22 0x00007ffff16cd778 in _mesa_ClearBufferfv (buffer=6144, drawbuffer=<optimized out>, value=0x7fffed323ba0) at ../../../src/mesa/main/clear.c:536
Comment 1 Christoph Haag 2014-07-29 07:23:32 UTC
In case other people look at this bug, there is another backtrace where it runs into a failed assertion: https://bugs.freedesktop.org/show_bug.cgi?id=75276#c32

You are right, after reverting f4b0ab7afd83c811329211eae8167c9bf238870c this does not happen anymore.

With the TappyChicken demo, I then get bug 80880 too.
Comment 2 Christoph Haag 2014-07-29 07:55:04 UTC
Created attachment 103628 [details]
backtrace of effects demo with f4b0ab7afd83c811329211eae8167c9bf238870c reverted

The effects cave demo is having yet another crash. But I also managed to get the assertion error from bug 80880, so it's random which fails first. In this case it runs for a few seconds with the music playing, but black window contents.

Might be because of the revert or not...
Comment 3 Michel Dänzer 2014-07-29 08:06:01 UTC
(In reply to comment #2)
> The effects cave demo is having yet another crash.
[...]
> Might be because of the revert or not...

I don't think it's related to the revert. Looks like the kernel fails to provide CPU access to a BO for storing shader machine code. What kernel are you using?
Comment 4 Christoph Haag 2014-07-29 16:01:46 UTC
(In reply to comment #3)
> (In reply to comment #2)
> > The effects cave demo is having yet another crash.
> [...]
> > Might be because of the revert or not...
> 
> I don't think it's related to the revert. Looks like the kernel fails to
> provide CPU access to a BO for storing shader machine code. What kernel are
> you using?

3.16-rc7 mainline.

Should I create a new bug report?
Comment 5 Michel Dänzer 2014-07-30 06:22:51 UTC
(In reply to comment #4)
> Should I create a new bug report?

Yes, please.
Comment 6 Michel Dänzer 2014-08-05 14:40:21 UTC
Module: Mesa
Branch: master
Commit: 3347c634d0508af93445b1ac1bdec1f55e2b2ae0
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=3347c634d0508af93445b1ac1bdec1f55e2b2ae0

Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Tue Aug  5 15:19:11 2014 +0900

glsl_to_tgsi: Fix typo shader_program -> shader

This was a regression introduced by commit
f4b0ab7afd83c811329211eae8167c9bf238870c ('st/mesa: fix incorrect size
of UBO declarations') which caused an assertion failure while compiling
shaders of e.g. UE4 demos.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.