[Bug 111083] Crash happens when drawArrays after calling continuously glTexImage3D many times

Mon Jul 8 06:07:59 UTC 2019

https://bugs.freedesktop.org/show_bug.cgi?id=111083

            Bug ID: 111083
           Summary: Crash happens when drawArrays after calling
                    continuously glTexImage3D many times
           Product: Mesa
           Version: 19.0
          Hardware: x86-64 (AMD64)
                OS: All
            Status: NEW
          Severity: major
          Priority: medium
         Component: Drivers/DRI/i965
          Assignee: intel-3d-bugs at lists.freedesktop.org
          Reporter: xinghua.cao at intel.com
        QA Contact: intel-3d-bugs at lists.freedesktop.org

The issue did not happen in old mesa version, but happens on Ubuntu 19.04 with
mesa 19.0.2. It may be a regression.
Steps:
1. git clone https://chromium.googlesource.com/angle/angle && cd angle
3. python scripts/bootstrap.py
4. gclient sync
5. ./build/install-build-deps.sh
6. gn gen out/Debug
7. ninja -C out/Debug
8. cd out/Debug
9. ./angle_end2end_tests
--gtest_filter=Texture3DTestES3.DrawWithLevelsOutsideRangeWithInconsistentDimensions/ES3_OpenGL

The crash cause: angle_end2end_tests:
../src/mesa/drivers/dri/i965/intel_mipmap_tree.c:1939:
miptree_layer_range_length: Assertion `start_layer < total_num_layers' failed
start_layer and total_num_layers are all equal to 1 here.
Crash stack:
#0  miptree_layer_range_length (num_layers=1, start_layer=1, level=2,
mt=0x5555571dc050) at ../src/mesa/drivers/dri/i965/intel_mipmap_tree.c:1939
#1  intel_miptree_prepare_access (brw=brw at entry=0x5555570e59b0,
mt=mt at entry=0x5555571dc050, start_level=<optimized out>, num_levels=<optimized
out>, num_levels at entry=1, start_layer=start_layer at entry=1, 
    num_layers=num_layers at entry=1, aux_usage=ISL_AUX_USAGE_CCS_E,
fast_clear_supported=true) at
../src/mesa/drivers/dri/i965/intel_mipmap_tree.c:2393
#2  0x00007ffff4000cc3 in brw_blorp_copy_miptrees
(brw=brw at entry=0x5555570e59b0, src_mt=src_mt at entry=0x5555571d2be0,
src_level=<optimized out>, src_level at entry=2, src_layer=src_layer at entry=1, 
    dst_mt=dst_mt at entry=0x5555571dc050, dst_level=<optimized out>,
dst_level at entry=2, dst_layer=<optimized out>, src_x=<optimized out>,
src_y=<optimized out>, dst_x=<optimized out>, 
    dst_y=<optimized out>, src_width=<optimized out>, src_height=<optimized
out>) at ../src/mesa/drivers/dri/i965/brw_blorp.c:497
#3  0x00007ffff40409d1 in intel_miptree_copy_slice
(brw=brw at entry=0x5555570e59b0, src_mt=src_mt at entry=0x5555571d2be0,
src_level=src_level at entry=2, src_layer=src_layer at entry=1, 
    dst_mt=dst_mt at entry=0x5555571dc050, dst_level=dst_level at entry=2,
dst_layer=1) at ../src/mesa/drivers/dri/i965/intel_mipmap_tree.c:1550
#4  0x00007ffff4040d00 in intel_miptree_copy_teximage
(brw=brw at entry=0x5555570e59b0, intelImage=intelImage at entry=0x5555571d4240,
dst_mt=0x5555571dc050)
    at ../src/mesa/drivers/dri/i965/intel_mipmap_tree.c:1638
#5  0x00007ffff4049bb0 in intel_finalize_mipmap_tree
(brw=brw at entry=0x5555570e59b0, tObj=0x5555571d1e10) at
../src/mesa/drivers/dri/i965/intel_tex_validate.c:155
#6  0x00007ffff4049e34 in brw_validate_textures (brw=brw at entry=0x5555570e59b0)
at ../src/mesa/drivers/dri/i965/intel_tex_validate.c:195
#7  0x00007ffff400d4a6 in brw_prepare_drawing (max_index=5, min_index=0,
index_bounds_valid=<optimized out>, ib=0x0, ctx=0x5555570e59b0) at
../src/mesa/drivers/dri/i965/brw_draw.c:811
#8  brw_draw_prims (ctx=0x5555570e59b0, prims=0x7fffffffd080, nr_prims=1,
ib=0x0, index_bounds_valid=<optimized out>, min_index=<optimized out>,
max_index=<optimized out>, gl_xfb_obj=0x0, stream=0, 
    indirect=0x0) at ../src/mesa/drivers/dri/i965/brw_draw.c:1133
#9  0x00007ffff426d8ea in _mesa_draw_arrays (drawID=0, baseInstance=0,
numInstances=1, count=6, start=0, mode=4, ctx=0x5555570e59b0) at
../src/mesa/main/draw.c:407
#10 _mesa_draw_arrays (ctx=0x5555570e59b0, mode=4, start=0, count=6,
numInstances=1, baseInstance=0, drawID=0) at ../src/mesa/main/draw.c:384
#11 0x00007ffff426d99c in _mesa_DrawArrays (mode=4, start=0, count=6) at
../src/mesa/main/draw.c:564
#12 0x00007ffff62b21da in rx::ContextGL::drawArrays (this=0x55555718e6d0,
context=0x5555571b3ac0, mode=gl::PrimitiveMode::Triangles, first=0, count=6) at
../../src/libANGLE/renderer/gl/ContextGL.cpp:277
#13 0x00007ffff5d56fe2 in gl::Context::drawArrays (this=0x5555571b3ac0,
mode=gl::PrimitiveMode::Triangles, first=0, count=6) at
../../src/libANGLE/Context.inl.h:100
#14 0x00007ffff5d5233c in gl::DrawArrays (mode=4, first=0, count=6) at
../../src/libGLESv2/entry_points_gles_2_0_autogen.cpp:683
#15 0x0000555556a9852a in ANGLETestBase::drawQuad (this=0x555556cba9d0,
program=3, Python Exception <class 'gdb.error'> There is no member named
_M_dataplus.: 
positionAttribName=, positionAttribZ=0.5, positionAttribXYScale=1,
useVertexBuffer=false, useInstancedDrawCalls=false, 
    numInstances=0) at ../../src/tests/test_utils/ANGLETest.cpp:789
#16 0x0000555556a981e7 in ANGLETestBase::drawQuad (this=0x555556cba9d0,
program=3, Python Exception <class 'gdb.error'> There is no member named
_M_dataplus.: 
positionAttribName=, positionAttribZ=0.5, positionAttribXYScale=1,
useVertexBuffer=false)
    at ../../src/tests/test_utils/ANGLETest.cpp:718
#17 0x0000555556a98189 in ANGLETestBase::drawQuad (this=0x555556cba9d0,
program=3, Python Exception <class 'gdb.error'> There is no member named
_M_dataplus.: 
positionAttribName=, positionAttribZ=0.5, positionAttribXYScale=1) at
../../src/tests/test_utils/ANGLETest.cpp:709
#18 0x0000555556a98145 in ANGLETestBase::drawQuad (this=0x555556cba9d0,
program=3, Python Exception <class 'gdb.error'> There is no member named
_M_dataplus.: 
positionAttribName=, positionAttribZ=0.5) at
../../src/tests/test_utils/ANGLETest.cpp:700
#19 0x0000555556870bcc in (anonymous
namespace)::Texture3DTestES3_DrawWithLevelsOutsideRangeWithInconsistentDimensions_Test::TestBody
(this=0x555556cba9d0)
    at ../../src/tests/gl_tests/TextureTest.cpp:2236
......


The test case code is as below, you could see more details in
src/tests/gl_tests/TextureTest.cpp of ANGLE project.
glActiveTexture(GL_TEXTURE0);
glBindTexture(GL_TEXTURE_3D, mTexture3D);
...
// Two levels that are initially unused.
glTexImage3D(GL_TEXTURE_3D, 0, GL_RGBA8, 8, 8, 8, 0, GL_RGBA, GL_UNSIGNED_BYTE,
             texDataRed.data());
glTexImage3D(GL_TEXTURE_3D, 2, GL_RGBA8, 2, 2, 2, 0, GL_RGBA, GL_UNSIGNED_BYTE,
             texDataCyan.data());
// One level that is used - only this level should affect completeness.
glTexImage3D(GL_TEXTURE_3D, 1, GL_RGBA8, 2, 2, 2, 0, GL_RGBA, GL_UNSIGNED_BYTE,
             texDataGreen.data());
glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_BASE_LEVEL, 1);
glTexParameteri(GL_TEXTURE_3D, GL_TEXTURE_MAX_LEVEL, 1);
drawQuad(mProgram, "position", 0.5f);

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/intel-3d-bugs/attachments/20190708/108e4c70/attachment-0001.html>