[Bug 93790] [HSW] Use after free with compute programs
bugzilla-daemon at freedesktop.org
bugzilla-daemon at freedesktop.org
Thu Jan 21 13:06:42 PST 2016
https://bugs.freedesktop.org/show_bug.cgi?id=93790
--- Comment #6 from Ilia Mirkin <imirkin at alum.mit.edu> ---
(In reply to Mark Janes from comment #5)
> I have not seen piglit.spec.arb_shader_image_load_store.semantics fail since
> it was fixed in piglit 9bd8454
OK, well I'm at the latest piglit, here's the rest of my system:
Mesa commit daa0fd7843df
00:02.0 VGA compatible controller [0300]: Intel Corporation Xeon E3-1200 v3/4th
Gen Core Processor Integrated Graphics Controller [8086:0412] (rev 06)
./configure --prefix=/home/ilia/install --with-dri-drivers=i965,nouveau
--with-gallium-drivers=nouveau,swrast --enable-gallium-llvm --enable-gles1
--enable-gles2 --with-egl-platforms=drm,x11 --enable-texture-float
--enable-debug CFLAGS='-fno-omit-frame-pointer -O2 -g'
CXXFLAGS='-fno-omit-frame-pointer -O2 -g'
LD_LIBRARY_PATH=/home/ilia/install/lib64:/home/ilia/install/lib valgrind
bin/arb_shader_image_load_store-semantics -fbo -auto
... lots of output ....
PIGLIT: {"subtest": {"imageStore/Compute shader/r8i/image1D test" : "pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/r8i/image2D test" : "pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/r8i/image3D test" : "pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/r8i/image2DRect test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/r8i/imageCube test" : "pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/r8i/imageBuffer test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/r8i/image1DArray test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/r8i/image2DArray test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/r8i/imageCubeArray test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/rgba16/image1D test" : "pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/rgba16/image2D test" : "pass"}}
==12712== Invalid read of size 4
==12712== at 0xCB75549: get_pipeline_state_l3_weights (gen7_l3_state.c:311)
==12712== by 0xCB75549: emit_l3_state (gen7_l3_state.c:480)
==12712== by 0xCB5B87E: check_and_emit_atom (brw_state_upload.c:771)
==12712== by 0xCB5B87E: brw_upload_pipeline_state (brw_state_upload.c:882)
==12712== by 0xCB5B87E: brw_upload_compute_state (brw_state_upload.c:942)
==12712== by 0xCB39207: brw_dispatch_compute_common.part.2
(brw_compute.c:140)
==12712== by 0xC83501B: _mesa_DispatchCompute (compute.c:44)
==12712== by 0x406135: draw_grid (grid.c:349)
==12712== by 0x403A65: run_test (semantics.c:337)
==12712== by 0x403BBD: piglit_init (semantics.c:368)
==12712== by 0x4F6F75D: run_test (piglit_fbo_framework.c:50)
==12712== by 0x4F55AC4: piglit_gl_test_run (piglit-framework-gl.c:199)
==12712== by 0x402E20: main (semantics.c:55)
==12712== Address 0xe4a1cf4 is 212 bytes inside a block of size 512 free'd
==12712== at 0x4C2B1DC: free (vg_replace_malloc.c:473)
==12712== by 0xCB57C10: brw_clear_cache (brw_state_cache.c:374)
==12712== by 0xC83501B: _mesa_DispatchCompute (compute.c:44)
==12712== by 0x406135: draw_grid (grid.c:349)
==12712== by 0x403A65: run_test (semantics.c:337)
==12712== by 0x403BBD: piglit_init (semantics.c:368)
==12712== by 0x4F6F75D: run_test (piglit_fbo_framework.c:50)
==12712== by 0x4F55AC4: piglit_gl_test_run (piglit-framework-gl.c:199)
==12712== by 0x402E20: main (semantics.c:55)
==12712==
==12712== Invalid read of size 4
==12712== at 0xCB75551: get_pipeline_state_l3_weights (gen7_l3_state.c:311)
==12712== by 0xCB75551: emit_l3_state (gen7_l3_state.c:480)
==12712== by 0xCB5B87E: check_and_emit_atom (brw_state_upload.c:771)
==12712== by 0xCB5B87E: brw_upload_pipeline_state (brw_state_upload.c:882)
==12712== by 0xCB5B87E: brw_upload_compute_state (brw_state_upload.c:942)
==12712== by 0xCB39207: brw_dispatch_compute_common.part.2
(brw_compute.c:140)
==12712== by 0xC83501B: _mesa_DispatchCompute (compute.c:44)
==12712== by 0x406135: draw_grid (grid.c:349)
==12712== by 0x403A65: run_test (semantics.c:337)
==12712== by 0x403BBD: piglit_init (semantics.c:368)
==12712== by 0x4F6F75D: run_test (piglit_fbo_framework.c:50)
==12712== by 0x4F55AC4: piglit_gl_test_run (piglit-framework-gl.c:199)
==12712== by 0x402E20: main (semantics.c:55)
==12712== Address 0xe4a1cec is 204 bytes inside a block of size 512 free'd
==12712== at 0x4C2B1DC: free (vg_replace_malloc.c:473)
==12712== by 0xCB57C10: brw_clear_cache (brw_state_cache.c:374)
==12712== by 0xC83501B: _mesa_DispatchCompute (compute.c:44)
==12712== by 0x406135: draw_grid (grid.c:349)
==12712== by 0x403A65: run_test (semantics.c:337)
==12712== by 0x403BBD: piglit_init (semantics.c:368)
==12712== by 0x4F6F75D: run_test (piglit_fbo_framework.c:50)
==12712== by 0x4F55AC4: piglit_gl_test_run (piglit-framework-gl.c:199)
==12712== by 0x402E20: main (semantics.c:55)
==12712==
==12712== Invalid read of size 4
==12712== at 0xCB7550A: get_pipeline_state_l3_weights (gen7_l3_state.c:312)
==12712== by 0xCB7550A: emit_l3_state (gen7_l3_state.c:480)
==12712== by 0xCB5B87E: check_and_emit_atom (brw_state_upload.c:771)
==12712== by 0xCB5B87E: brw_upload_pipeline_state (brw_state_upload.c:882)
==12712== by 0xCB5B87E: brw_upload_compute_state (brw_state_upload.c:942)
==12712== by 0xCB39207: brw_dispatch_compute_common.part.2
(brw_compute.c:140)
==12712== by 0xC83501B: _mesa_DispatchCompute (compute.c:44)
==12712== by 0x406135: draw_grid (grid.c:349)
==12712== by 0x403A65: run_test (semantics.c:337)
==12712== by 0x403BBD: piglit_init (semantics.c:368)
==12712== by 0x4F6F75D: run_test (piglit_fbo_framework.c:50)
==12712== by 0x4F55AC4: piglit_gl_test_run (piglit-framework-gl.c:199)
==12712== by 0x402E20: main (semantics.c:55)
==12712== Address 0xe4a1cf8 is 216 bytes inside a block of size 512 free'd
==12712== at 0x4C2B1DC: free (vg_replace_malloc.c:473)
==12712== by 0xCB57C10: brw_clear_cache (brw_state_cache.c:374)
==12712== by 0xC83501B: _mesa_DispatchCompute (compute.c:44)
==12712== by 0x406135: draw_grid (grid.c:349)
==12712== by 0x403A65: run_test (semantics.c:337)
==12712== by 0x403BBD: piglit_init (semantics.c:368)
==12712== by 0x4F6F75D: run_test (piglit_fbo_framework.c:50)
==12712== by 0x4F55AC4: piglit_gl_test_run (piglit-framework-gl.c:199)
==12712== by 0x402E20: main (semantics.c:55)
==12712==
==12712== Invalid read of size 4
==12712== at 0xCB63262: update_stage_texture_surfaces
(brw_wm_surface_state.c:838)
==12712== by 0xCB6336A: brw_update_texture_surfaces
(brw_wm_surface_state.c:879)
==12712== by 0xCB5B87E: check_and_emit_atom (brw_state_upload.c:771)
==12712== by 0xCB5B87E: brw_upload_pipeline_state (brw_state_upload.c:882)
==12712== by 0xCB5B87E: brw_upload_compute_state (brw_state_upload.c:942)
==12712== by 0xCB39207: brw_dispatch_compute_common.part.2
(brw_compute.c:140)
==12712== by 0xC83501B: _mesa_DispatchCompute (compute.c:44)
==12712== by 0x406135: draw_grid (grid.c:349)
==12712== by 0x403A65: run_test (semantics.c:337)
==12712== by 0x403BBD: piglit_init (semantics.c:368)
==12712== by 0x4F6F75D: run_test (piglit_fbo_framework.c:50)
==12712== by 0x4F55AC4: piglit_gl_test_run (piglit-framework-gl.c:199)
==12712== by 0x402E20: main (semantics.c:55)
==12712== Address 0xe4a1cc8 is 168 bytes inside a block of size 512 free'd
==12712== at 0x4C2B1DC: free (vg_replace_malloc.c:473)
==12712== by 0xCB57C10: brw_clear_cache (brw_state_cache.c:374)
==12712== by 0xC83501B: _mesa_DispatchCompute (compute.c:44)
==12712== by 0x406135: draw_grid (grid.c:349)
==12712== by 0x403A65: run_test (semantics.c:337)
==12712== by 0x403BBD: piglit_init (semantics.c:368)
==12712== by 0x4F6F75D: run_test (piglit_fbo_framework.c:50)
==12712== by 0x4F55AC4: piglit_gl_test_run (piglit-framework-gl.c:199)
==12712== by 0x402E20: main (semantics.c:55)
==12712==
==12712== Invalid read of size 4
==12712== at 0xCB63262: update_stage_texture_surfaces
(brw_wm_surface_state.c:838)
==12712== by 0xCB633DB: brw_update_texture_surfaces
(brw_wm_surface_state.c:883)
==12712== by 0xCB5B87E: check_and_emit_atom (brw_state_upload.c:771)
==12712== by 0xCB5B87E: brw_upload_pipeline_state (brw_state_upload.c:882)
==12712== by 0xCB5B87E: brw_upload_compute_state (brw_state_upload.c:942)
==12712== by 0xCB39207: brw_dispatch_compute_common.part.2
(brw_compute.c:140)
==12712== by 0xC83501B: _mesa_DispatchCompute (compute.c:44)
==12712== by 0x406135: draw_grid (grid.c:349)
==12712== by 0x403A65: run_test (semantics.c:337)
==12712== by 0x403BBD: piglit_init (semantics.c:368)
==12712== by 0x4F6F75D: run_test (piglit_fbo_framework.c:50)
==12712== by 0x4F55AC4: piglit_gl_test_run (piglit-framework-gl.c:199)
==12712== by 0x402E20: main (semantics.c:55)
==12712== Address 0xe47b240 is 160 bytes inside a block of size 520 free'd
==12712== at 0x4C2B1DC: free (vg_replace_malloc.c:473)
==12712== by 0xCB57C10: brw_clear_cache (brw_state_cache.c:374)
==12712== by 0xC83501B: _mesa_DispatchCompute (compute.c:44)
==12712== by 0x406135: draw_grid (grid.c:349)
==12712== by 0x403A65: run_test (semantics.c:337)
==12712== by 0x403BBD: piglit_init (semantics.c:368)
==12712== by 0x4F6F75D: run_test (piglit_fbo_framework.c:50)
==12712== by 0x4F55AC4: piglit_gl_test_run (piglit-framework-gl.c:199)
==12712== by 0x402E20: main (semantics.c:55)
==12712==
PIGLIT: {"subtest": {"imageStore/Compute shader/rgba16/image3D test" : "pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/rgba16/image2DRect test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/rgba16/imageCube test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/rgba16/imageBuffer test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/rgba16/image1DArray test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/rgba16/image2DArray test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/rgba16/imageCubeArray test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/rgb10_a2/image1D test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/rgb10_a2/image2D test" :
"pass"}}
PIGLIT: {"subtest": {"imageStore/Compute shader/rgb10_a2/image3D test" :
"pass"}}
So it hardly happens every draw. I don't know what triggers it... (Also this is
not the first time I see the l3 thing, but it doesn't happen each time either.)
--
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/intel-3d-bugs/attachments/20160121/ed679a1a/attachment-0001.html>
More information about the intel-3d-bugs
mailing list