Bug 90904 - OSX: EXC_BAD_ACCESS when using translate_sse + gallium + softpipe/llvmpipe
Summary: OSX: EXC_BAD_ACCESS when using translate_sse + gallium + softpipe/llvmpipe
Status: RESOLVED FIXED
Alias: None
Product: Mesa
Classification: Unclassified
Component: Mesa core (show other bugs)
Version: git
Hardware: Other All
: medium normal
Assignee: mesa-dev
QA Contact: mesa-dev
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-06-08 20:29 UTC by Julien Isorce
Modified: 2015-06-09 15:24 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Julien Isorce 2015-06-08 20:29:45 UTC
When running es2gears_x11 it crashes with:

* thread #1: tid = 0xbfbac, 0x0000000100801200, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=2, address=0x100801200)
  * frame #0: 0x0000000100801200
    frame #1: 0x0000000101da4290 swrast_dri.so`draw_pt_emit_linear(emit=0x0000000100405cd0, vert_info=0x00007fff5fbfefa8, prim_info=0x00007fff5fbff058) + 448 at draw_pt_emit.c:238
    frame #2: 0x0000000101f3b012 swrast_dri.so`emit(emit=0x0000000100405cd0, vert_info=0x00007fff5fbfefa8, prim_info=0x00007fff5fbff058) + 50 at draw_pt_fetch_shade_pipeline_llvm.c:331
    frame #3: 0x0000000101f3aa82 swrast_dri.so`llvm_pipeline_generic(middle=0x0000000100405bc0, fetch_info=0x0000000000000000, in_prim_info=0x00007fff5fbff058) + 1586 at draw_pt_fetch_shade_pipeline_llvm.c:466
    frame #4: 0x0000000101f3a2b3 swrast_dri.so`llvm_middle_end_linear_run(middle=0x0000000100405bc0, start=0, count=7, prim_flags=0) + 131 at draw_pt_fetch_shade_pipeline_llvm.c:530
    frame #5: 0x0000000101db4de8 swrast_dri.so`vsplit_segment_simple_linear(vsplit=0x000000010102b800, flags=0, istart=0, icount=7) + 104 at draw_pt_vsplit_tmp.h:240
    frame #6: 0x0000000101db1c69 swrast_dri.so`vsplit_run_linear(frontend=0x000000010102b800, start=0, count=7) + 249 at draw_split_tmp.h:60
    frame #7: 0x0000000101da35ba swrast_dri.so`draw_pt_arrays(draw=0x0000000101016200, prim=5, start=0, count=7) + 842 at draw_pt.c:149
    frame #8: 0x0000000101da2c2c swrast_dri.so`draw_vbo(draw=0x0000000101016200, info=0x00007fff5fbff208) + 668 at draw_pt.c:564
    frame #9: 0x0000000101f9027c swrast_dri.so`llvmpipe_draw_vbo(pipe=0x0000000101013e00, info=0x00007fff5fbff328) + 972 at lp_draw_arrays.c:132
    frame #10: 0x0000000101d82059 swrast_dri.so`cso_draw_vbo(cso=0x00000001010d3e00, info=0x00007fff5fbff328) + 89 at cso_context.c:1515
    frame #11: 0x0000000101ad3c34 swrast_dri.so`st_draw_vbo(ctx=0x00000001002cf000, prims=0x00007fff5fbff440, nr_prims=1, ib=0x0000000000000000, index_bounds_valid='\x01', min_index=0, max_index=6, tfb_vertcount=0x0000000000000000, indirect=0x0000000000000000) + 1108 at st_draw.c:286
    frame #12: 0x0000000101a7883f swrast_dri.so`vbo_draw_arrays(ctx=0x00000001002cf000, mode=5, start=0, count=7, numInstances=1, baseInstance=0) + 767 at vbo_exec_array.c:645
    frame #13: 0x0000000101a75304 swrast_dri.so`vbo_exec_DrawArrays(mode=5, start=0, count=7) + 228 at vbo_exec_array.c:797
    frame #14: 0x000000010000adb8 libGLESv2.2.dylib`glDrawArrays(mode=5, first=0, count=7) + 56 at glapi_mapi_tmp.h:1613
    frame #15: 0x0000000100003485 es2gears_x11`draw_gear + 1637
    frame #16: 0x00000001000020b0 es2gears_x11`gears_draw + 928
    frame #17: 0x00000001000042f7 es2gears_x11`_eglutNativeEventLoop + 455
    frame #18: 0x0000000100001a74 es2gears_x11`main + 676
    frame #19: 0x00007fff886ee5c9 libdyld.dylib`start + 1

(lldb) di -f
-> 0x100801200:  pushq  %rbx
   0x100801201:  pushq  %rbp
   0x100801202:  movl   %edx, %ebp
   0x100801204:  movq   %r9, %rbx
   0x100801207:  xorl   %eax, %eax
   0x100801209:  cmpl   %eax, %ebp
   0x10080120b:  je     0x10080125e
   0x100801211:  movl   %esi, %eax
   0x100801213:  cmpl   0x478(%rdi), %eax
   0x100801219:  cmovael 0x478(%rdi), %eax



   0           push EBX
   1           push EBP
   2            mov EBP, EDX
   4          mov64 EBX, 
   7            xor EAX, EAX
   9            cmp EBP, EAX
   b    jcc_forward 4
  11            mov EAX, ESI
  13            cmp EAX, [EDI+1144]
  19         cmovcc EAX, [EDI+1144], 3
  20            mov EDX, [EDI+1136]
  27           imul EAX, EDX
  2b            add EAX, [EDI+1128]
  31            cmp EBP, EAX
  34            mov ESI, EAX
  36         movdqu XMM0, [ESI]
  3a         movdqu [EBX], XMM0
  3e         movdqu XMM0, [ESI+16]
  43         movdqu [EBX+16], XMM0
  49            lea EBX, [EBX+32]
  4d            add ESI, [EDI+1136]
  53    prefetchnta [ESI+192]
  5a            dec EBP
  5c            jcc 5
  5e            pop EBP
  5f            pop EBX
  60            ret 

   0           push EBX
   1           push EBP
   2            mov EBP, EDX
   4          mov64 EBX, 
   7            xor EAX, EAX
   9            cmp EBP, EAX
   b    jcc_forward 4
  11            mov ECX, [ESI]
  13            cmp ECX, [EDI+1144]
  19         cmovcc ECX, [EDI+1144], 3
  20            mov EDX, [EDI+1136]
  27           imul ECX, EDX
  2b            add ECX, [EDI+1128]
  31         movdqu XMM0, [ECX]
  35         movdqu [EBX], XMM0
  39         movdqu XMM0, [ECX+16]
  3e         movdqu [EBX+16], XMM0
  44            lea EBX, [EBX+32]
  48            lea ESI, [ESI+4]
  4b            dec EBP
  4d            jcc 5
  4f            pop EBP
  50            pop EBX
  51            ret 

   0           push EBX
   1           push EBP
   2            mov EBP, EDX
   4          mov64 EBX, 
   7            xor EAX, EAX
   9            cmp EBP, EAX
   b    jcc_forward 4
  11        movzx16 ECX, [ESI]
  14            cmp ECX, [EDI+1144]
  1a         cmovcc ECX, [EDI+1144], 3
  21            mov EDX, [EDI+1136]
  28           imul ECX, EDX
  2c            add ECX, [EDI+1128]
  32         movdqu XMM0, [ECX]
  36         movdqu [EBX], XMM0
  3a         movdqu XMM0, [ECX+16]
  3f         movdqu [EBX+16], XMM0
  45            lea EBX, [EBX+32]
  49            lea ESI, [ESI+2]
  4c            dec EBP
  4e            jcc 5
  50            pop EBP
  51            pop EBX
  52            ret 

   0           push EBX
   1           push EBP
   2            mov EBP, EDX
   4          mov64 EBX, 
   7            xor EAX, EAX
   9            cmp EBP, EAX
   b    jcc_forward 4
  11         movzx8 ECX, [ESI]
  14            cmp ECX, [EDI+1144]
  1a         cmovcc ECX, [EDI+1144], 3
  21            mov EDX, [EDI+1136]
  28           imul ECX, EDX
  2c            add ECX, [EDI+1128]
  32         movdqu XMM0, [ECX]
  36         movdqu [EBX], XMM0
  3a         movdqu XMM0, [ECX+16]
  3f         movdqu [EBX+16], XMM0
  45            lea EBX, [EBX+32]
  49            lea ESI, [ESI+1]
  4c            dec EBP
  4e            jcc 5
  50            pop EBP
  51            pop EBX
  52            ret 
disassemble 0x100801200 0x100801261

disassemble 0x100843600 0x100843652

disassemble 0x1010c4200 0x1010c4253

disassemble 0x100843a00 0x100843a53

It crashes when calling:

translate->run(translate,
                  0,
                  count,
                  draw->start_instance,
                  draw->instance_id,
                  hw_verts);


If it fails "on -> 0x100801200:  pushq  %rbx" I guess something went wrong before.
Comment 1 Julien Isorce 2015-06-08 20:33:25 UTC
It works fine if I add deactivate sse, i.e. setting GALLIUM_NOSSE=1 and with either GALLIUM_DRIVER=softpipe or llvmpipe.

Configure options:
CFLAGS="-g -O0" CXXFLAGS="-g -O0" ./configure --disable-vdpau --disable-va --enable-asm --with-gallium-drivers=swrast --enable-dri3 --enable-gles2 --enable-gles1 --enable-glx --enable-opengl --enable-gallium-osmesa --with-egl-platforms=x11 --enable-debug --prefix=/usr/local --enable-gallium-llvm --disable-omx --disable-llvm-shared-libs

es2_info:
EGL_VERSION: 1.4 (DRI2)
EGL_VENDOR: Mesa Project
EGL_EXTENSIONS:
    EGL_MESA_configless_context, EGL_KHR_get_all_proc_addresses, 
    EGL_KHR_surfaceless_context
EGL_CLIENT_APIS: OpenGL OpenGL_ES OpenGL_ES2 OpenGL_ES3 
GL_VERSION: OpenGL ES 3.0 Mesa 10.7.0-devel (git-950728c)
GL_RENDERER: Gallium 0.4 on llvmpipe (LLVM 3.4, 128 bits)
GL_EXTENSIONS:
    GL_EXT_blend_minmax, GL_EXT_multi_draw_arrays, 
    GL_EXT_texture_format_BGRA8888, GL_OES_compressed_ETC1_RGB8_texture, 
    GL_OES_depth24, GL_OES_element_index_uint, GL_OES_fbo_render_mipmap, 
    GL_OES_mapbuffer, GL_OES_rgb8_rgba8, GL_OES_standard_derivatives, 
    GL_OES_stencil8, GL_OES_texture_3D, GL_OES_texture_npot, 
    GL_OES_EGL_image, GL_OES_depth_texture, GL_OES_packed_depth_stencil, 
    GL_EXT_texture_type_2_10_10_10_REV, GL_OES_get_program_binary, 
    GL_APPLE_texture_max_level, GL_EXT_discard_framebuffer, 
    GL_EXT_read_format_bgra, GL_NV_fbo_color_attachments, 
    GL_OES_EGL_image_external, GL_OES_EGL_sync, GL_OES_vertex_array_object, 
    GL_EXT_texture_rg, GL_EXT_unpack_subimage, GL_NV_draw_buffers, 
    GL_NV_read_buffer, GL_EXT_draw_buffers, GL_EXT_map_buffer_range, 
    GL_OES_depth_texture_cube_map, GL_OES_surfaceless_context, 
    GL_EXT_color_buffer_float, GL_EXT_separate_shader_objects, 
    GL_EXT_shader_integer_mix, GL_KHR_context_flush_control
Comment 2 Jose Fonseca 2015-06-08 20:56:43 UTC
Probably the old (non-LLVM) JIT machine code generator doesn't support MacOSX.

This patch should work around it:

diff --git a/src/gallium/auxiliary/translate/translate_sse.c b/src/gallium/auxiliary/translate/translate_sse.c
index c7b6c36..24da890 100644
--- a/src/gallium/auxiliary/translate/translate_sse.c
+++ b/src/gallium/auxiliary/translate/translate_sse.c
@@ -35,7 +35,7 @@
 #include "translate.h"
 
 
-#if (defined(PIPE_ARCH_X86) || defined(PIPE_ARCH_X86_64)) && !defined(PIPE_SUBSYSTEM_EMBEDDED)
+#if (defined(PIPE_ARCH_X86) || defined(PIPE_ARCH_X86_64)) && !defined(PIPE_SUBSYSTEM_EMBEDDED) && !defined(PIPE_OS_APPLE)
 
 #include "rtasm/rtasm_cpu.h"
 #include "rtasm/rtasm_x86sse.h"


But I suspect the real problem is in src/gallium/auxiliary/rtasm/rtasm_execmem.c . Instead of the above patch, maybe this one will fix it:

diff --git a/src/gallium/auxiliary/rtasm/rtasm_execmem.c b/src/gallium/auxiliary/rtasm/rtasm_execmem.c
index 8c3dbef..f935879 100644
--- a/src/gallium/auxiliary/rtasm/rtasm_execmem.c
+++ b/src/gallium/auxiliary/rtasm/rtasm_execmem.c
@@ -49,7 +49,7 @@
 #include <windows.h>
 #endif
 
-#if defined(PIPE_OS_LINUX) || defined(PIPE_OS_BSD) || defined(PIPE_OS_SOLARIS) || defined(PIPE_OS_HAIKU) || defined(PIPE_OS_CYGWIN)
+#if defined(PIPE_OS_LINUX) || defined(PIPE_OS_BSD) || defined(PIPE_OS_SOLARIS) || defined(PIPE_OS_HAIKU) || defined(PIPE_OS_CYGWIN) || defined(PIPE_OS_APPLE)
 
 
 /*
Comment 3 Julien Isorce 2015-06-08 21:48:12 UTC
(In reply to José Fonseca from comment #2)
> diff --git a/src/gallium/auxiliary/rtasm/rtasm_execmem.c
> b/src/gallium/auxiliary/rtasm/rtasm_execmem.c
> index 8c3dbef..f935879 100644
> --- a/src/gallium/auxiliary/rtasm/rtasm_execmem.c
> +++ b/src/gallium/auxiliary/rtasm/rtasm_execmem.c
> @@ -49,7 +49,7 @@
>  #include <windows.h>
>  #endif
>  
> -#if defined(PIPE_OS_LINUX) || defined(PIPE_OS_BSD) ||
> defined(PIPE_OS_SOLARIS) || defined(PIPE_OS_HAIKU) || defined(PIPE_OS_CYGWIN)
> +#if defined(PIPE_OS_LINUX) || defined(PIPE_OS_BSD) ||
> defined(PIPE_OS_SOLARIS) || defined(PIPE_OS_HAIKU) ||
> defined(PIPE_OS_CYGWIN) || defined(PIPE_OS_APPLE)
>  

Ah great I see now, I tested your later solution and it works! Thx
Comment 4 Jose Fonseca 2015-06-09 15:24:05 UTC
Fix pushed as commit 65bd4159b35c7213e0ac27c6299495e08a105ab4


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct.