From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon@freedesktop.org Subject: [Bug 82828] Regression: Crash in 3Dmark2001 Date: Sat, 30 Aug 2014 17:54:27 +0000 Message-ID: References: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1065692140==" Return-path: Received: from culpepper.freedesktop.org (unknown [131.252.210.165]) by gabe.freedesktop.org (Postfix) with ESMTP id 293596E353 for ; Sat, 30 Aug 2014 10:54:27 -0700 (PDT) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============1065692140== Content-Type: multipart/alternative; boundary="1409421267.58e43.11619"; charset="us-ascii" --1409421267.58e43.11619 Date: Sat, 30 Aug 2014 17:54:27 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable https://bugs.freedesktop.org/show_bug.cgi?id=3D82828 --- Comment #6 from Connor Abbott --- (In reply to comment #5) > Created attachment 105451 [details] > full backtrace from piglit crash >=20 > (In reply to comment #4) > > All the crashes are in the same place, right? > >=20 > > Can you run it under gdb and print out n2 and the contents of > > g->nodes[n].adjacency_list (it's an array with g->nodes[n].adjacency_co= unt > > elements) after the segfault? How about the former before the ra_simpli= fy() > > call in the ra_allocate() call that's segfaulting? (If you don't know h= ow to > > do this, see > > http://stackoverflow.com/questions/2956889/how-to-set-a-counter-for-a-g= db- > > breakpoint) > >=20 > > I'm guessing that it's segfaulting because n2 is some bogus value. n2 c= omes > > from the adjacency_list, which is something generated before the alloca= tor > > actually runs by code I didn't touch and then never modified afterward,= and > > the code that's segfaulting wasn't modified by the commit in question, = so > > the two most likely options I see are that either this is exposing a bug > > somewhere else (like in r300g) or the new ra_simplify() is somehow > > corrupting the adjacency_list. I don't know how r300g sets up the regis= ter > > conflicts and register classes, though, so I can't guess why it works f= ine > > on i965 but fails for r300g. >=20 > OK, so not sure if I know what I'm doing but selecting one random crashing > piglit test >=20 > /bin/shader_runner tests/shaders/glsl-fs-loop-continue.shader_test -auto >=20 > Program received signal SIGSEGV, Segmentation fault. > 0xb76391a9 in ra_select (g=3D0x80c2058) at > ../../src/mesa/program/register_allocate.c:525 > 525 BITSET_TEST(g->regs->regs[r].conflicts, g->nodes[n2].reg)) { >=20 > print n2 > $2 =3D 0 >=20 > print n > $7 =3D 1 >=20 > print g->nodes[n].adjacency_count > $1 =3D 3 >=20 > print g->nodes[n].adjacency_list > $3 =3D (unsigned int *) 0x80c1b58 >=20 > print g->nodes[n].adjacency_list[0] > $4 =3D 1 >=20 > print g->nodes[n].adjacency_list[1] > $5 =3D 0 >=20 > print g->nodes[n].adjacency_list[2] > $6 =3D 2 >=20 > full backtrace attached. Can you print out the value of g->nodes[n2].reg? I think it may be NO_REG (0xffffffff), even though it shouldn't be (if a node is not on the stack, t= hen it's supposed to be assigned a register already). (In reply to comment #5) > Created attachment 105451 [details] > full backtrace from piglit crash >=20 > (In reply to comment #4) > > All the crashes are in the same place, right? > >=20 > > Can you run it under gdb and print out n2 and the contents of > > g->nodes[n].adjacency_list (it's an array with g->nodes[n].adjacency_co= unt > > elements) after the segfault? How about the former before the ra_simpli= fy() > > call in the ra_allocate() call that's segfaulting? (If you don't know h= ow to > > do this, see > > http://stackoverflow.com/questions/2956889/how-to-set-a-counter-for-a-g= db- > > breakpoint) > >=20 > > I'm guessing that it's segfaulting because n2 is some bogus value. n2 c= omes > > from the adjacency_list, which is something generated before the alloca= tor > > actually runs by code I didn't touch and then never modified afterward,= and > > the code that's segfaulting wasn't modified by the commit in question, = so > > the two most likely options I see are that either this is exposing a bug > > somewhere else (like in r300g) or the new ra_simplify() is somehow > > corrupting the adjacency_list. I don't know how r300g sets up the regis= ter > > conflicts and register classes, though, so I can't guess why it works f= ine > > on i965 but fails for r300g. >=20 > OK, so not sure if I know what I'm doing but selecting one random crashing > piglit test >=20 > /bin/shader_runner tests/shaders/glsl-fs-loop-continue.shader_test -auto >=20 > Program received signal SIGSEGV, Segmentation fault. > 0xb76391a9 in ra_select (g=3D0x80c2058) at > ../../src/mesa/program/register_allocate.c:525 > 525 BITSET_TEST(g->regs->regs[r].conflicts, g->nodes[n2].reg)) { >=20 > print n2 > $2 =3D 0 >=20 > print n > $7 =3D 1 >=20 > print g->nodes[n].adjacency_count > $1 =3D 3 >=20 > print g->nodes[n].adjacency_list > $3 =3D (unsigned int *) 0x80c1b58 >=20 > print g->nodes[n].adjacency_list[0] > $4 =3D 1 >=20 > print g->nodes[n].adjacency_list[1] > $5 =3D 0 >=20 > print g->nodes[n].adjacency_list[2] > $6 =3D 2 >=20 > full backtrace attached. --=20 You are receiving this mail because: You are the assignee for the bug. --1409421267.58e43.11619 Date: Sat, 30 Aug 2014 17:54:27 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Comment= # 6 on bug 82828<= /a> from Connor Abbott
(In reply to comment #5=
)
> Created attachment 105451 [details]
> full backtrace from piglit crash
>=20
> (In reply to comment #4)
> > All the crashes are in the same place, right?
> >=20
> > Can you run it under gdb and print out n2 and the contents of
> > g->nodes[n].adjacency_list (it's an array with g->nodes[n].=
adjacency_count
> > elements) after the segfault? How about the former before the ra_=
simplify()
> > call in the ra_allocate() call that's segfaulting? (If you don't =
know how to
> > do this, see
> > http://stackoverflow.com/questions/2956889/how-to-set-=
a-counter-for-a-gdb-
> > breakpoint)
> >=20
> > I'm guessing that it's segfaulting because n2 is some bogus value=
. n2 comes
> > from the adjacency_list, which is something generated before the =
allocator
> > actually runs by code I didn't touch and then never modified afte=
rward, and
> > the code that's segfaulting wasn't modified by the commit in ques=
tion, so
> > the two most likely options I see are that either this is exposin=
g a bug
> > somewhere else (like in r300g) or the new ra_simplify() is somehow
> > corrupting the adjacency_list. I don't know how r300g sets up the=
 register
> > conflicts and register classes, though, so I can't guess why it w=
orks fine
> > on i965 but fails for r300g.
>=20
> OK, so not sure if I know what I'm doing but selecting one random cras=
hing
> piglit test
>=20
> /bin/shader_runner tests/shaders/glsl-fs-loop-continue.shader_test -au=
to
>=20
> Program received signal SIGSEGV, Segmentation fault.
> 0xb76391a9 in ra_select (g=3D0x80c2058) at
> ../../src/mesa/program/register_allocate.c:525
> 525			BITSET_TEST(g->regs->regs[r].conflicts, g->nodes[n2].re=
g)) {
>=20
> print n2
> $2 =3D 0
>=20
> print n
> $7 =3D 1
>=20
> print g->nodes[n].adjacency_count
> $1 =3D 3
>=20
> print g->nodes[n].adjacency_list
> $3 =3D (unsigned int *) 0x80c1b58
>=20
> print g->nodes[n].adjacency_list[0]
> $4 =3D 1
>=20
> print g->nodes[n].adjacency_list[1]
> $5 =3D 0
>=20
> print g->nodes[n].adjacency_list[2]
> $6 =3D 2
>=20
> full backtrace attached.

Can you print out the value of g->nodes[n2].reg? I think it may be NO_REG
(0xffffffff), even though it shouldn't be (if a node is not on the stack, t=
hen
it's supposed to be assigned a register already).

(In reply to comment #5)
> Created attachment 105451 [details]
> full backtrace from piglit crash
>=20
> (In reply to comment #4)
> > All the crashes are in the same place, right?
> >=20
> > Can you run it under gdb and print out n2 and the contents of
> > g->nodes[n].adjacency_list (it's an array with g->nodes[n].=
adjacency_count
> > elements) after the segfault? How about the former before the ra_=
simplify()
> > call in the ra_allocate() call that's segfaulting? (If you don't =
know how to
> > do this, see
> > http://stackoverflow.com/questions/2956889/how-to-set-=
a-counter-for-a-gdb-
> > breakpoint)
> >=20
> > I'm guessing that it's segfaulting because n2 is some bogus value=
. n2 comes
> > from the adjacency_list, which is something generated before the =
allocator
> > actually runs by code I didn't touch and then never modified afte=
rward, and
> > the code that's segfaulting wasn't modified by the commit in ques=
tion, so
> > the two most likely options I see are that either this is exposin=
g a bug
> > somewhere else (like in r300g) or the new ra_simplify() is somehow
> > corrupting the adjacency_list. I don't know how r300g sets up the=
 register
> > conflicts and register classes, though, so I can't guess why it w=
orks fine
> > on i965 but fails for r300g.
>=20
> OK, so not sure if I know what I'm doing but selecting one random cras=
hing
> piglit test
>=20
> /bin/shader_runner tests/shaders/glsl-fs-loop-continue.shader_test -au=
to
>=20
> Program received signal SIGSEGV, Segmentation fault.
> 0xb76391a9 in ra_select (g=3D0x80c2058) at
> ../../src/mesa/program/register_allocate.c:525
> 525			BITSET_TEST(g->regs->regs[r].conflicts, g->nodes[n2].re=
g)) {
>=20
> print n2
> $2 =3D 0
>=20
> print n
> $7 =3D 1
>=20
> print g->nodes[n].adjacency_count
> $1 =3D 3
>=20
> print g->nodes[n].adjacency_list
> $3 =3D (unsigned int *) 0x80c1b58
>=20
> print g->nodes[n].adjacency_list[0]
> $4 =3D 1
>=20
> print g->nodes[n].adjacency_list[1]
> $5 =3D 0
>=20
> print g->nodes[n].adjacency_list[2]
> $6 =3D 2
>=20
> full backtrace attached.


You are receiving this mail because: =20=20=20=20=20=20
  • You are the assignee for the bug.
--1409421267.58e43.11619-- --===============1065692140== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/dri-devel --===============1065692140==--