[Bug 106928] When starting a match Rocket League crashes on "Go"

[bugzilla-daemon@freedesktop.org]

[-- Attachment #1.1: Type: text/plain, Size: 5888 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=106928

--- Comment #4 from ubizjak@gmail.com ---
(In reply to ubizjak from comment #3)

> [1] https://bugzilla.redhat.com/show_bug.cgi?id=1580019

As reported in [1], full backtrace with debug info reads:

Thread 1 "firefox" received signal SIGSEGV, Segmentation fault.
0x000055b7d4b054b2 in mozalloc_abort(char const*) ()
(gdb) bt
#0  0x000055b7d4b054b2 in mozalloc_abort(char const*) ()
#1  0x000055b7d4af97b6 in
mozilla::detail::ConditionVariableImpl::ConditionVariableImpl() [clone
.cold.16] ()
#2  0x00007f94d056f965 in std::__replacement_assert(char const*, int, char
const*, char const*) (__condition=0x7f94d0786638 "__builtin_expect(__n <
this->size(), true)", __function=<synthetic pointer>, __line=932,
__file=0x7f94d07884a0 "/usr/include/c++/8/bits/stl_vector.h")
    at /usr/include/c++/8/x86_64-redhat-linux/bits/c++config.h:2389
#3  0x00007f94d056f965 in std::vector<r600_sb::value*,
std::allocator<r600_sb::value*> >::operator[](unsigned long) (__n=2,
this=0x7f94d904c820)
    at /usr/include/c++/8/bits/stl_vector.h:932
#4  0x00007f94d056f965 in
r600_sb::expr_handler::fold_alu_op3(r600_sb::alu_node&) (this=0x7f94f3deeea8,
n=...) at sb/sb_expr.cpp:951
#5  0x00007f94d056c0cd in r600_sb::expr_handler::try_fold(r600_sb::node*)
(n=<optimized out>, this=<optimized out>) at sb/sb_expr.cpp:145
#6  0x00007f94d056c0cd in r600_sb::expr_handler::try_fold(r600_sb::value*)
(this=<optimized out>, v=0x7f94d90616f0) at sb/sb_expr.cpp:136
#7  0x00007f94d058e3fc in r600_sb::value_table::add_value(r600_sb::value*)
(this=0x7f94f3deee70, v=<optimized out>, v@entry=0x7f94d90616f0)
    at sb/sb_valtable.cpp:149
#8  0x00007f94d0573381 in r600_sb::gvn::process_op(r600_sb::node&, bool)
(this=0x7ffeac463420, n=..., rewrite=rewrite@entry=true) at sb/sb_gvn.cpp:222
#9  0x00007f94d057356e in r600_sb::gvn::visit(r600_sb::alu_node&, bool)
(this=<optimized out>, n=..., enter=<optimized out>) at sb/sb_gvn.cpp:97
#10 0x00007f94d0577570 in r600_sb::vpass::run_on(r600_sb::container_node&)
(this=0x7ffeac463420, n=...) at sb/sb_ir.h:888
#11 0x00007f94d0577651 in r600_sb::vpass::run() (this=0x7ffeac463420) at
sb/sb_pass.cpp:44
#12 0x00007f94d05670ba in r600_sb_bytecode_process () at sb/sb_core.cpp:205
#13 0x00007f94d0533bcd in r600_pipe_shader_create
(ctx=ctx@entry=0x7f94fa76f000, shader=shader@entry=0x7f94d903f000, key=...) at
r600_shader.c:215
#14 0x00007f94d053de64 in r600_shader_select (ctx=ctx@entry=0x7f94fa76f000,
sel=0x7f94d903c000, dirty=dirty@entry=0x7ffeac464175) at
r600_state_common.c:869
#15 0x00007f94d053f077 in r600_update_derived_state (rctx=0x7f94fa76f000) at
r600_state_common.c:1687
#16 0x00007f94d053f077 in r600_draw_vbo (ctx=0x7f94fa76f000,
info=0x7ffeac464490) at r600_state_common.c:1968
#17 0x00007f94d031e710 in u_vbuf_draw_vbo (mgr=0x7f94f90af000, info=<optimized
out>) at util/u_vbuf.c:1150
#18 0x00007f94d0109a2f in st_draw_vbo (ctx=<optimized out>,
prims=0x7ffeac464550, nr_prims=<optimized out>, ib=0x0,
index_bounds_valid=<optimized out>, min_index=<optimized out>,
max_index=<optimized out>, tfb_vertcount=0x0, stream=0, indirect=0x0) at
state_tracker/st_draw.c:227
#19 0x00007f94d00ce70b in vbo_draw_arrays (ctx=ctx@entry=0x7f94ed8c2000,
mode=mode@entry=4, start=start@entry=1320, count=count@entry=87,
numInstances=numInstances@entry=1, baseInstance=baseInstance@entry=0, drawID=0)
at vbo/vbo_exec_array.c:486
#20 0x00007f94d00ce79a in vbo_exec_DrawArraysInstanced (mode=4, start=1320,
count=87, numInstances=1) at vbo/vbo_exec_array.c:677
#21 0x00007f96a8c92855 in mozilla::WebGLContext::DrawArraysInstanced(unsigned
int, int, int, int, char const*) () at /usr/lib64/firefox/libxul.so
#22 0x00007f96a892f967 in
mozilla::dom::WebGLRenderingContextBinding::drawArrays(JSContext*,
JS::Handle<JSObject*>, mozilla::WebGLContext*, JSJitMethodCallArgs const&) ()
at /usr/lib64/firefox/libxul.so
#23 0x00007f96a8c0e1c9 in mozilla::dom::GenericBindingMethod(JSContext*,
unsigned int, JS::Value*) () at /usr/lib64/firefox/libxul.so
#24 0x000021a97a2b79c6 in  ()
#25 0x0000000000000000 in  ()

The value of alu_node& n in frame #4, where things go downhill:

(gdb) f 4
#4  r600_sb::expr_handler::fold_alu_op3 (this=0x7f94f3deeea8, n=...) at
sb/sb_expr.cpp:951
951             value* v2 = n.src[2]->gvalue();
(gdb) list
946                             return true;
947             }
948
949             value* v0 = n.src[0]->gvalue();
950             value* v1 = n.src[1]->gvalue();
951             value* v2 = n.src[2]->gvalue();
952
953             /* LDS instructions look like op3 with no dst - don't fold. */
954             if (!n.dst[0])
955                     return false;

(gdb) p n
$1 = (r600_sb::alu_node &) @0x7f94d904c7d0: {<r600_sb::node> = {_vptr.node =
0x7f94d0b692f8 <vtable for r600_sb::alu_node+16>, prev = 0x7f94d904c738, 
    next = 0x7f94d904c938, parent = 0x7f94d904c000, type = r600_sb::NT_OP,
subtype = r600_sb::NST_ALU_INST, flags = r600_sb::NF_EMPTY, pred = 0x0, 
    dst = std::vector of length 1, capacity 1 = {0x7f94d90616f0}, src =
std::vector of length 2, capacity 3 = {0x7f94d905d110, 0x7f94d905cf70}}, bc = {
    op_ptr = 0x7f94d0b628a0 <r600_alu_op_table>, op = 0, src = {{sel = 252,
chan = 2, neg = 0, abs = 0, rel = 0, value = {{i = 0, u = 0, f = 0}}}, {sel =
0, 
        chan = 0, neg = 0, abs = 0, rel = 0, value = {{i = 0, u = 0, f = 0}}},
{sel = 252, chan = 2, neg = 0, abs = 0, rel = 0, value = {{i = 0, u = 0, 
            f = 0}}}}, dst_gpr = 6, dst_chan = 2, dst_rel = 0, clamp = 0, omod
= 0, bank_swizzle = 0, index_mode = 0, last = 1, pred_sel = 0, fog_merge = 0, 
    write_mask = 0, update_exec_mask = 0, update_pred = 0, slot = 2,
lds_idx_offset = 0, slot_flags = AF_VS}}

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 7050 bytes --]

[-- Attachment #2: Type: text/plain, Size: 160 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel