[Bug 111286] Mesa glsl compiler crashes in "tropico 6" game on an assertion

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=111286

--- Comment #1 from andrii simiklit <andrey.simiklit.1989 at gmail.com> ---
So shader_test which could reproduce this issue is here:
https://gitlab.freedesktop.org/mesa/piglit/merge_requests/108

Suggested mesa fix:
https://gitlab.freedesktop.org/mesa/mesa/merge_requests/1615

The problem happens when shader tries to copy some part of the array of inputs
to some temp array and then uses these temp array elements like here:

[fragment shader]
uniform int idx;
in vec4 vs_data[3];
out vec4 out_put;

void main()
{
   vec4 temp[2];
   temp[0] = vs_data[0];
   temp[1] = vs_data[1];
   temp[2] = vs_data[2];
   out_put = temp[idx];
}

1. optimization find_array_copies creates a copy_deref for temp[*] = vs_data[*]
regardless that these arrays have different lengths.
2. nir_opt_copy_prop_vars tries to prevent copying and use the original array
instead and crashes here:
"assert(glsl_get_length(parent->type) ==
             glsl_get_length(leader_parent->type));"

The crash call stack:
libc.so.6!__GI___assert_fail(...)
nir_build_deref_follower(...)
specialize_wildcards(...)
load_from_deref_entry_value(...)
try_load_from_entry(...)
copy_prop_vars_block(...)
copy_prop_vars_cf_node(...)
copy_prop_vars_cf_node(...)
nir_copy_prop_vars_impl(...)
nir_opt_copy_prop_vars(...)
brw_nir_optimize(...)
brw_preprocess_nir(...)
brw_create_nir(...)
brw_link_shader(...)

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/intel-3d-bugs/attachments/20190808/540e9f33/attachment.html>