From mboxrd@z Thu Jan 1 00:00:00 1970
From: bugzilla-daemon@freedesktop.org
Subject: [Bug 108498] ir_dereference_record nullptr segfault in radeonsi_dri.so
Date: Fri, 19 Oct 2018 12:55:27 +0000
Message-ID:
Bug ID
108498
Summary
ir_dereference_record nullptr segfault in radeonsi_dri.so
Product
Mesa
Version
18.1
Hardware
x86-64 (AMD64)
OS
Linux (All)
Status
NEW
Severity
normal
Priority
medium
Component
Drivers/Gallium/radeonsi
Assignee
dri-devel@lists.freedesktop.org
Reporter
claude@mathr.co.uk
QA Contact
dri-devel@lists.freedesktop.org
Created attachment 142095 [details]
tarball of GLSL source code for use in Fragmentarium
I'm using $ apt-cache policy libgl1-mesa-dri
libgl1-mesa-dri:
Installed: 18.1.7-1
Candidate: 18.1.7-1
Version table:
18.2.0-1 1
1 http://ftp.uk.debia=
n.org/debian experimental/main amd64 Packages
18.1.9-1 500
500 http://ftp.uk.debia=
n.org/debian unstable/main amd64 Packages
*** 18.1.7-1 990
990 http://ftp.uk.debia=
n.org/debian buster/main amd64 Packages
100 /var/lib/dpkg/status
I will try to compile upstream Mesa soon to see if it is a Debian-specific
issue, or whether it has already been fixed in a later version.
Fragmentarium (from https://=
github.com/3Dickulus/FragM ) crashes inside
radeonsi_dri.so when I try to compile part of a large shader project (~50kB=
of
GLSL transcluded from the main 'raymond/example.frag'). The problematic pa=
rt
is the last half of 'raymond/Raymond-Trace.frag' in the attached tarball,
setting #if 0 stops it from crashing and emits an error message in the shad=
er
compile log about missing function definitions (this is expected, the hard
crash with #if 1 is not).
It seems to be caused by something that passes a nullptr as a field name in
compiler/glsl/ir.cpp:1401, gdb backtrace is large:
Thread 1 "Fragmentarium-2" received signal SIGSEGV, Segmentation =
fault.
__strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:173
173 ../sysdeps/x86_64/multiarch/../strcmp.S: No such file or directory.
(gdb) bt
#0 0x00007ffff64c40b6 in __strcmp_ssse3 () at
../sysdeps/x86_64/multiarch/../strcmp.S:173
#1 0x00007fffe24c7d6d in glsl_type::field_type(char const*) const
(this=3D<optimized out>, name=3Dname@entry=3D0x0) at
../../../src/compiler/glsl_types.cpp:1228
#2 0x00007fffe24cba3f in
ir_dereference_record::ir_dereference_record(ir_rvalue*, char const*)
(this=3D0x555556f46e00, value=3D<optimized out>, field=3D0x0) at
../../../src/compiler/glsl/ir.cpp:1401
#3 0x00007fffe24ce720 in ir_dereference_record::clone(void*, hash_table*)
const (this=3D<optimized out>, mem_ctx=3D<optimized out>, ht=3D=
<optimized out>) at
../../../src/compiler/glsl/list.h:58
#4 0x00007fffe2456ab4 in ast_expression::do_hir(exec_list*,
_mesa_glsl_parse_state*, bool) (this=3D0x555556d12bf8,
instructions=3D0x555556f459d0, state=3D0x555556341530, needs_rvalue=3D<o=
ptimized
out>)
at ../../../src/compiler/glsl/ast.h:86
#5 0x00007fffe2458b43 in ast_expression_statement::hir(exec_list*,
_mesa_glsl_parse_state*) (this=3D<optimized out>, instructions=3D<=
optimized out>,
state=3D<optimized out>)
at ../../../src/compiler/glsl/ast_to_hir.cpp:2228
#6 0x00007fffe2458b9f in ast_compound_statement::hir(exec_list*,
_mesa_glsl_parse_state*) (this=3D0x555556d12cc8, instructions=3D0x555556f45=
9d0,
state=3D0x555556341530)
at ../../../src/compiler/glsl/ast_to_hir.cpp:2244
#7 0x00007fffe2460f0e in ast_iteration_statement::hir(exec_list*,
_mesa_glsl_parse_state*) (this=3D0x555556d12d28, instructions=3D<optimiz=
ed out>,
state=3D0x555556341530)
at ../../../src/compiler/glsl/ast_to_hir.cpp:6902
#8 0x00007fffe2458b9f in ast_compound_statement::hir(exec_list*,
_mesa_glsl_parse_state*) (this=3D0x555556d12e70, instructions=3D0x555556ff6=
690,
state=3D0x555556341530)
at ../../../src/compiler/glsl/ast_to_hir.cpp:2244
#9 0x00007fffe245f462 in ast_function_definition::hir(exec_list*,
_mesa_glsl_parse_state*) (this=3D0x555556d12ed0, instructions=3D<optimiz=
ed out>,
state=3D0x555556341530)
at ../../../src/compiler/glsl/ast_to_hir.cpp:6182
#10 0x00007fffe2455b70 in _mesa_ast_to_hir(exec_list*, _mesa_glsl_parse_sta=
te*)
(instructions=3D0x5555564c7570, state=3D0x555556341530) at
../../../src/compiler/glsl/ast_to_hir.cpp:156
#11 0x00007fffe24b9551 in _mesa_glsl_compile_shader(gl_context*, gl_shader*,
bool, bool, bool) (ctx=3Dctx@entry=3D0x55555604a230,
shader=3Dshader@entry=3D0x555556496b40, dump_ast=3Ddump_ast@entry=
=3Dfalse,
dump_hir=3Ddump_hir@entry=3Dfalse, force_recompile=3Dforce_recompile=
4;entry=3Dfalse) at
../../../src/compiler/glsl/glsl_parser_extras.cpp:2106
#12 0x00007fffe235b4d0 in _mesa_compile_shader (ctx=3D0x55555604a230,
sh=3D0x555556496b40) at ../../../src/mesa/main/shaderapi.c:1131
#13 0x00007ffff748697f in QOpenGLFunctions::glCompileShader(unsigned int)
(this=3D<optimized out>, shader=3D6) at opengl/qopenglfunctions.h:1280
#14 0x00007ffff748697f in QOpenGLShaderPrivate::compile(QOpenGLShader*)
(this=3Dthis@entry=3D0x555556485120, q=3Dq@entry=3D0x5555563adf10) =
at
opengl/qopenglshaderprogram.cpp:352
#15 0x00007ffff7487275 in QOpenGLShader::compileSourceCode(char const*)
(this=3Dthis@entry=3D0x5555563adf10, source=3Dsource@entry=3D0x5555=
56b80488 "#version
330 compatibility\n// #donotrun\n\nconst float pi =3D 3.141592653589793;\nc=
onst
vec3 X =3D vec3(1.0, 0.0, 0.0);\nconst vec3 Y =3D vec3(0.0, 1.0, 0.0);\ncon=
st vec3
Z =3D vec3(0.0, 0.0, 1.0);\n\n// #donotrun\n\n"...) at
opengl/qopenglshaderprogram.cpp:678
#16 0x00007ffff748ce2e in
QOpenGLShaderProgram::addShaderFromSourceCode(QFlags<QOpenGLShader::Shad=
erTypeBit>,
char const*) (this=3Dthis@entry=3D0x7fffec005bf0, type=3D..., source=3D=
0x555556b80488
"#version 330 compatibility\n// #donotrun\n\nconst float pi =3D
3.141592653589793;\nconst vec3 X =3D vec3(1.0, 0.0, 0.0);\nconst vec3 Y =3D
vec3(0.0, 1.0, 0.0);\nconst vec3 Z =3D vec3(0.0, 0.0, 1.0);\n\n//
#donotrun\n\n"...)
at opengl/qopenglshaderprogram.cpp:980
#17 0x00007ffff748cf8b in
QOpenGLShaderProgram::addShaderFromSourceCode(QFlags<QOpenGLShader::Shad=
erTypeBit>,
QString const&) (this=3D0x7fffec005bf0, type=3D..., source=3D...)
at ../../include/QtCore/../../src/corelib/tools/qarraydata.h:206
#18 0x00005555555e0acd in
Fragmentarium::GUI::DisplayWidget::initFragmentShader() (this=3D0x5555558e0=
c00)
at
/home/claude/code/github.com/3Dickulus/FragM/Fragmentarium-Source/Fragmenta=
rium/GUI/DisplayWidget.cpp:439
#19 0x00005555555deeaf in
Fragmentarium::GUI::DisplayWidget::setFragmentShader(Fragmentarium::Parser:=
:FragmentSource)
(this=3D0x5555558e0c00, fs=3D...)
at
/home/claude/code/github.com/3Dickulus/FragM/Fragmentarium-Source/Fragmenta=
rium/GUI/DisplayWidget.cpp:183
#20 0x000055555561b6f2 in Fragmentarium::GUI::MainWindow::initializeFragmen=
t()
(this=3D0x555555852650) at
/home/claude/code/github.com/3Dickulus/FragM/Fragmentarium-Source/Fragmenta=
rium/GUI/MainWindow.cpp:2239
#21 0x0000555555684895 in
Fragmentarium::GUI::MainWindow::qt_static_metacall(QObject*, QMetaObject::C=
all,
int, void**) (_o=3D0x555555852650, _c=3DQMetaObject::InvokeMetaMethod, _id=
=3D35,
_a=3D0x7fffffffcfd0)
at
/home/claude/code/github.com/3Dickulus/FragM/Fragmentarium-Source/build/Fra=
gmentarium-2.5.0_autogen/S5HU6OSMQS/moc_MainWindow.cpp:456
#22 0x00007ffff6b107cb in QMetaObject::activate(QObject*, int, int, void**)=
()
at /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#23 0x00007ffff7731ef2 in QAction::triggered(bool) () at
/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#24 0x00007ffff7734500 in QAction::activate(QAction::ActionEvent) () at
/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#25 0x00007ffff781fd2d in () at /usr/lib/x86_64-linux-gnu/libQt5Widgets.so=
.5
#26 0x00007ffff781ff65 in QAbstractButton::mouseReleaseEvent(QMouseEvent*) =
()
at /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#27 0x00007ffff7909cba in QToolButton::mouseReleaseEvent(QMouseEvent*) () at
/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#28 0x00007ffff77767d8 in QWidget::event(QEvent*) () at
/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#29 0x00007ffff7909d63 in QToolButton::event(QEvent*) () at
/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#30 0x00007ffff77384a1 in QApplicationPrivate::notify_helper(QObject*, QEve=
nt*)
() at /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#31 0x00007ffff773fd28 in QApplication::notify(QObject*, QEvent*) () at
/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#32 0x00007ffff6ae7589 in QCoreApplication::notifyInternal2(QObject*, QEven=
t*)
() at /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#33 0x00007ffff773f029 in QApplicationPrivate::sendMouseEvent(QWidget*,
QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, =
bool) () at
/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#34 0x00007ffff7791314 in () at /usr/lib/x86_64-linux-gnu/libQt5Widgets.so=
.5
#35 0x00007ffff7793e9e in () at /usr/lib/x86_64-linux-gnu/libQt5Widgets.so=
.5
#36 0x00007ffff77384a1 in QApplicationPrivate::notify_helper(QObject*, QEve=
nt*)
() at /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
#37 0x00007ffff773fae0 in QApplication::notify(QObject*, QEvent*) () at
/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5
---Type <return> to continue, or q <return> to quit---
#38 0x00007ffff6ae7589 in QCoreApplication::notifyInternal2(QObject*, QEven=
t*)
() at /usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#39 0x00007ffff716baab in QCoreApplication::sendSpontaneousEvent(QObject*,
QEvent*) (event=3D0x7fffffffd8a0, receiver=3D0x555555aec440) at
../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:237
#40 0x00007ffff716baab in
QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::Mo=
useEvent*)
(e=3D0x55555602a370) at kernel/qguiapplication.cpp:2081
#41 0x00007ffff716d9a5 in
QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePriv=
ate::WindowSystemEvent*)
(e=3De@entry=3D0x55555602a370) at kernel/qguiapplication.cpp:1816
#42 0x00007ffff71480db in
QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::Proces=
sEventsFlag>)
(flags=3D...) at kernel/qwindowsysteminterface.cpp:1032
#43 0x00007ffff2830eeb in
QPAEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFl=
ag>)
(this=3D0x5555557ffb90, flags=3D...) at qeventdispatcher_glib.cpp:70
#44 0x00007ffff6ae625b in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at
/usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#45 0x00007ffff6aee3d2 in QCoreApplication::exec() () at
/usr/lib/x86_64-linux-gnu/libQt5Core.so.5
#46 0x00005555555d35f3 in main(int, char**) (argc=3D1, argv=3D0x7fffffffe15=
8) at
/home/claude/code/github.com/3Dickulus/FragM/Fragmentarium-Source/Fragmenta=
rium/Main.cpp:199