[Bug 107892] [Debug mesa only]. crash happens when blit framebuffer

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=107892

--- Comment #15 from vadym <vadym.shovkoplias at globallogic.com> ---
The bug is in brw_meta_mirror_clip_and_scissor() function. For the above case
it calculates coordinates for destination buffer as: 

   dstX0: 0.000000, dstY0: 159.999988, dstX1: 0.000012, dstY1: 160.000000

Then in try_blorp_blit() functions these coordinates rounded to nearest
integer:

   params->x0 = params->wm_inputs.discard_rect.x0 = round(coords->x.dst0);
   params->y0 = params->wm_inputs.discard_rect.y0 = round(coords->y.dst0);
   params->x1 = params->wm_inputs.discard_rect.x1 = round(coords->x.dst1);
   params->y1 = params->wm_inputs.discard_rect.y1 = round(coords->y.dst1);

The result of rounding is:

   params->x0 = 0.0
   params->y0 = 160.0
   params->x1 = 0.0
   params->y1 = 160.0

Then these coordinates goes to gen9_blorp_exec():

   blorp_emit(batch, GENX(3DSTATE_DRAWING_RECTANGLE), rect) {
      rect.ClippedDrawingRectangleXMax = MAX2(params->x1, params->x0) - 1;
      rect.ClippedDrawingRectangleYMax = MAX2(params->y1, params->y0) - 1;
   }

Here MAX2(params->x1, params->x0) equals 0. And 0 - 1 equals UINT_MAX for
unsigned integers.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/intel-3d-bugs/attachments/20180928/941ab111/attachment.html>