From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon@freedesktop.org Subject: [Bug 99419] Crash si_shader_select in Master Of Orion Date: Sun, 15 Jan 2017 15:13:14 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1109017785==" Return-path: Received: from culpepper.freedesktop.org (culpepper.freedesktop.org [131.252.210.165]) by gabe.freedesktop.org (Postfix) with ESMTP id 977B96E1BF for ; Sun, 15 Jan 2017 15:13:14 +0000 (UTC) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============1109017785== Content-Type: multipart/alternative; boundary="14844931940.5d2B6.30269"; charset="UTF-8" --14844931940.5d2B6.30269 Date: Sun, 15 Jan 2017 15:13:14 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated https://bugs.freedesktop.org/show_bug.cgi?id=3D99419 Bug ID: 99419 Summary: Crash si_shader_select in Master Of Orion Product: Mesa Version: git Hardware: Other OS: All Status: NEW Severity: normal Priority: medium Component: Drivers/Gallium/radeonsi Assignee: dri-devel@lists.freedesktop.org Reporter: andreas.schultes@googlemail.com QA Contact: dri-devel@lists.freedesktop.org Created attachment 128966 --> https://bugs.freedesktop.org/attachment.cgi?id=3D128966&action=3Dedit Backtrace To reproduce crash click on a dropdown menu in settings.=20 Crash caused by passing a invalid LLVMTargetMachineRef object in si_shader_selector. Comment in si_shader.h says that should be only used in si_init_shader_selector_async but that is not the case. It is also used in si_build_shader_variant which called here also(see backtrace). memorydump of tm object (frame 10) x/60b sctx->tm 0x6c5b910: 224 219 246 103 41 127 0 0 0x6c5b918: 192 111 254 103 41 127 0 0 0x6c5b920: 0 0 0 0 0 0 0 0 0x6c5b928: 0 0 0 0 0 0 0 0 0x6c5b930: 72 185 197 6 0 0 0 0 0x6c5b938: 74 185 197 6 0 0 0 0 0x6c5b940: 80 185 197 6 0 0 0 0 0x6c5b948: 32 64 0 0 x/60b state->cso->tm 0x6c63ac0: 0 0 0 0 0 0 0 0 0x6c63ac8: 0 0 0 0 0 0 0 128 0x6c63ad0: 0 0 0 0 0 0 0 0 0x6c63ad8: 0 0 0 0 0 0 0 0 0x6c63ae0: 0 0 0 0 0 0 0 0 0x6c63ae8: 0 0 0 0 0 0 0 128 0x6c63af0: 0 0 0 0 0 0 0 0 0x6c63af8: 0 0 0 0 Adding state->cso->tm =3D sctx->tm; in si_shader_select prevents the crash.= I don't think that also fix the bug. There is still an incorrect rendering. //disam shader s_load_dwordx4 s[4:7], s[10:11], 0x0 ; C00A0105 00000000 s_load_dwordx4 s[0:3], s[2:3], 0x0 ; C00A0001 00000000 v_mov_b32_e32 v0, 1.0 ; 7E0002F2 s_waitcnt lgkmcnt(0) ; BF8C007F buffer_load_format_xyzw v[3:6], v4, s[4:7], 0 idxen ; E00C2000 80010304 s_buffer_load_dword s5, s[0:3], 0x4 ; C0220140 00000004 s_buffer_load_dword s9, s[0:3], 0x14 ; C0220240 00000014 s_buffer_load_dword s4, s[0:3], 0x0 ; C0220100 00000000 s_buffer_load_dword s8, s[0:3], 0x10 ; C0220200 00000010 s_buffer_load_dword s6, s[0:3], 0x8 ; C0220180 00000008 s_buffer_load_dword s10, s[0:3], 0x18 ; C0220280 00000018 s_buffer_load_dword s7, s[0:3], 0xc ; C02201C0 0000000C s_buffer_load_dword s0, s[0:3], 0x1c ; C0220000 0000001C s_waitcnt vmcnt(0) lgkmcnt(0) ; BF8C0070 v_mul_f32_e32 v1, s5, v4 ; 0A020805 v_mul_f32_e32 v4, s9, v4 ; 0A080809 v_mac_f32_e32 v1, s4, v3 ; 2C020604 v_mac_f32_e32 v4, s8, v3 ; 2C080608 v_mac_f32_e32 v1, s6, v5 ; 2C020A06 v_mac_f32_e32 v4, s10, v5 ; 2C080A0A v_mac_f32_e32 v1, s7, v6 ; 2C020C07 v_mac_f32_e32 v4, s0, v6 ; 2C080C00 v_mov_b32_e32 v3, 0 ; 7E060280 exp pos0 v1, v4, v3, v0 done ; C40008CF 00030401 s_waitcnt expcnt(0) ; BF8C0F0F --=20 You are receiving this mail because: You are the assignee for the bug.= --14844931940.5d2B6.30269 Date: Sun, 15 Jan 2017 15:13:14 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated
Bug ID 99419
Summary Crash si_shader_select in Master Of Orion
Product Mesa
Version git
Hardware Other
OS All
Status NEW
Severity normal
Priority medium
Component Drivers/Gallium/radeonsi
Assignee dri-devel@lists.freedesktop.org
Reporter andreas.schultes@googlemail.com
QA Contact dri-devel@lists.freedesktop.org 

Created attachment 128966 [deta=
ils]
Backtrace

To reproduce crash click on a dropdown menu in settings.=20

Crash caused by passing a invalid LLVMTargetMachineRef object in
si_shader_selector. Comment in si_shader.h says that should be only used in
si_init_shader_selector_async but that is not the case. It is also used in
si_build_shader_variant which called here also(see backtrace).

memorydump of tm object (frame 10)

x/60b sctx->tm
0x6c5b910:      224     219     246     103     41      127     0       0
0x6c5b918:      192     111     254     103     41      127     0       0
0x6c5b920:      0       0       0       0       0       0       0       0
0x6c5b928:      0       0       0       0       0       0       0       0
0x6c5b930:      72      185     197     6       0       0       0       0
0x6c5b938:      74      185     197     6       0       0       0       0
0x6c5b940:      80      185     197     6       0       0       0       0
0x6c5b948:      32      64      0       0

x/60b state->cso->tm
0x6c63ac0:      0       0       0       0       0       0       0       0
0x6c63ac8:      0       0       0       0       0       0       0       128
0x6c63ad0:      0       0       0       0       0       0       0       0
0x6c63ad8:      0       0       0       0       0       0       0       0
0x6c63ae0:      0       0       0       0       0       0       0       0
0x6c63ae8:      0       0       0       0       0       0       0       128
0x6c63af0:      0       0       0       0       0       0       0       0
0x6c63af8:      0       0       0       0

Adding state->cso->tm =3D sctx->tm; in si_shader_select prevents t=
he crash. I
don't think that also fix the bug. There is still an incorrect rendering.

//disam shader
s_load_dwordx4 s[4:7], s[10:11], 0x0                ; C00A0105 00000000
s_load_dwordx4 s[0:3], s[2:3], 0x0                  ; C00A0001 00000000
v_mov_b32_e32 v0, 1.0                               ; 7E0002F2
s_waitcnt lgkmcnt(0)                                ; BF8C007F
buffer_load_format_xyzw v[3:6], v4, s[4:7], 0 idxen ; E00C2000 80010304
s_buffer_load_dword s5, s[0:3], 0x4                 ; C0220140 00000004
s_buffer_load_dword s9, s[0:3], 0x14                ; C0220240 00000014
s_buffer_load_dword s4, s[0:3], 0x0                 ; C0220100 00000000
s_buffer_load_dword s8, s[0:3], 0x10                ; C0220200 00000010
s_buffer_load_dword s6, s[0:3], 0x8                 ; C0220180 00000008
s_buffer_load_dword s10, s[0:3], 0x18               ; C0220280 00000018
s_buffer_load_dword s7, s[0:3], 0xc                 ; C02201C0 0000000C
s_buffer_load_dword s0, s[0:3], 0x1c                ; C0220000 0000001C
s_waitcnt vmcnt(0) lgkmcnt(0)                       ; BF8C0070
v_mul_f32_e32 v1, s5, v4                            ; 0A020805
v_mul_f32_e32 v4, s9, v4                            ; 0A080809
v_mac_f32_e32 v1, s4, v3                            ; 2C020604
v_mac_f32_e32 v4, s8, v3                            ; 2C080608
v_mac_f32_e32 v1, s6, v5                            ; 2C020A06
v_mac_f32_e32 v4, s10, v5                           ; 2C080A0A
v_mac_f32_e32 v1, s7, v6                            ; 2C020C07
v_mac_f32_e32 v4, s0, v6                            ; 2C080C00
v_mov_b32_e32 v3, 0                                 ; 7E060280
exp pos0 v1, v4, v3, v0 done                        ; C40008CF 00030401
s_waitcnt expcnt(0)                                 ; BF8C0F0F

You are receiving this mail because:
  • You are the assignee for the bug.
= --14844931940.5d2B6.30269-- --===============1109017785== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlz dHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCg== --===============1109017785==--