From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon@freedesktop.org Subject: [Bug 97909] X-Plane 10 crashes with SIGSEGV on radeonsi Date: Fri, 04 Nov 2016 20:20:49 +0000 Message-ID: References: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1921249974==" Return-path: Received: from culpepper.freedesktop.org (culpepper.freedesktop.org [IPv6:2610:10:20:722:a800:ff:fe98:4b55]) by gabe.freedesktop.org (Postfix) with ESMTP id 56B8D6EA8D for ; Fri, 4 Nov 2016 20:20:49 +0000 (UTC) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============1921249974== Content-Type: multipart/alternative; boundary="14782908490.a7Ea228e5.23025"; charset="UTF-8" --14782908490.a7Ea228e5.23025 Date: Fri, 4 Nov 2016 20:20:49 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated https://bugs.freedesktop.org/show_bug.cgi?id=3D97909 --- Comment #5 from Nicolai H=C3=A4hnle --- Okay, so I could reproduce this after all with the web demo. There is a bug in X-Plane and also questionable behaviour of the driver. The bug in X-Plane is that it uses GL_AMD_pinned_memory with a size that is not= a multiple of a page; as per the spec, the driver is allowed to reject that, = and we do (apparently unlike the closed source driver...). X-Plane doesn't check this error condition, and continues rendering, hence the crash, which would also happen with a simple sequence of: glGenBuffers(1, &bo); glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, bo); glDrawElements(...); Somewhat surprisingly, the OpenGL spec never states that a draw call that g= oes outside the element/index buffer should flag a GL_INVALID_OPERATION. There = is also no mention of this in the GL_ARB_robust_buffer_access_behavior extensi= on, which is surprising. The patch you provide may or may not go in the right direction - I'm not su= re. If we want to check that, we should do it in api_validate.c, but I'm not convinced that we should. Meanwhile, that check wouldn't properly fix the i= ssue in X-Plane. To work around the bug in X-Plane, you need to run with: MESA_EXTENSION_OVERRIDE=3D-GL_AMD_pinned_memory ./X-Plane-x86_64 --force_run which will work with an unmodified driver. --=20 You are receiving this mail because: You are the assignee for the bug.= --14782908490.a7Ea228e5.23025 Date: Fri, 4 Nov 2016 20:20:49 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated

Comment= # 5 on bug 97909<= /a> from Nicolai H=C3=A4hnle
Okay, so I could reproduce this after all with the web demo.

There is a bug in X-Plane and also questionable behaviour of the driver. The
bug in X-Plane is that it uses GL_AMD_pinned_memory with a size that is not=
 a
multiple of a page; as per the spec, the driver is allowed to reject that, =
and
we do (apparently unlike the closed source driver...). X-Plane doesn't check
this error condition, and continues rendering, hence the crash, which would
also happen with a simple sequence of:

  glGenBuffers(1, &bo);
  glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, bo);
  glDrawElements(...);

Somewhat surprisingly, the OpenGL spec never states that a draw call that g=
oes
outside the element/index buffer should flag a GL_INVALID_OPERATION. There =
is
also no mention of this in the GL_ARB_robust_buffer_access_behavior extensi=
on,
which is surprising.

The patch you provide may or may not go in the right direction - I'm not su=
re.
If we want to check that, we should do it in api_validate.c, but I'm not
convinced that we should. Meanwhile, that check wouldn't properly fix the i=
ssue
in X-Plane. To work around the bug in X-Plane, you need to run with:

MESA_EXTENSION_OVERRIDE=3D-GL_AMD_pinned_memory ./X-Plane-x86_64 --force_run

which will work with an unmodified driver.


You are receiving this mail because:
  • You are the assignee for the bug.
= --14782908490.a7Ea228e5.23025-- --===============1921249974== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlz dHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCg== --===============1921249974==--