<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><span class="vcard"><a class="email" href="mailto:eero.t.tamminen@intel.com" title="Eero Tamminen <eero.t.tamminen@intel.com>"> <span class="fn">Eero Tamminen</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - GfxBench AztecRuins Vulkan version Segfault"
href="https://bugs.freedesktop.org/show_bug.cgi?id=109304">bug 109304</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Keywords</td>
<td>
</td>
<td>regression
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - GfxBench AztecRuins Vulkan version Segfault"
href="https://bugs.freedesktop.org/show_bug.cgi?id=109304#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - GfxBench AztecRuins Vulkan version Segfault"
href="https://bugs.freedesktop.org/show_bug.cgi?id=109304">bug 109304</a>
from <span class="vcard"><a class="email" href="mailto:eero.t.tamminen@intel.com" title="Eero Tamminen <eero.t.tamminen@intel.com>"> <span class="fn">Eero Tamminen</span></a>
</span></b>
<pre>Gdb tells:
--------------------------------------
(gdb) bt
#0 try_lower_tex_ycbcr (tex=0x7fffef8e2430, builder=0x7ffff3327b70,
layout=0x7fffef8249c0)
at src/intel/vulkan/anv_nir_lower_ycbcr_textures.c:328
#1 anv_nir_lower_ycbcr_textures (shader=shader@entry=0x7fffee3037e0,
layout=layout@entry=0x7fffef8249c0)
at src/intel/vulkan/anv_nir_lower_ycbcr_textures.c:464
#2 0x00007ffff23d7730 in anv_pipeline_lower_nir
(pipeline=pipeline@entry=0x7fffef005620,
mem_ctx=mem_ctx@entry=0x7fffef133700, stage=stage@entry=0x7ffff33313b0,
layout=layout@entry=0x7fffef8249c0)
at src/intel/vulkan/anv_pipeline.c:500
#3 0x00007ffff23d9fef in anv_pipeline_compile_graphics
(pipeline=pipeline@entry=0x7fffef005620,
cache=cache@entry=0x7fffef0d1300, info=info@entry=0x7ffff33371d0)
at src/intel/vulkan/anv_pipeline.c:1034
#4 0x00007ffff23db7bc in anv_pipeline_init
(pipeline=pipeline@entry=0x7fffef005620,
device=device@entry=0x7fffec37f460, cache=cache@entry=0x7fffef0d1300,
pCreateInfo=pCreateInfo@entry=0x7ffff33371d0, alloc=0x7fffec37f468,
alloc@entry=0x0)
at src/intel/vulkan/anv_pipeline.c:1463
#5 0x00007ffff24fa676 in gen9_graphics_pipeline_create
(pPipeline=0x7fffee3562d0, pAllocator=0x0,
pCreateInfo=0x7ffff33371d0, cache=0x7fffef0d1300, _device=0x7fffec37f460)
at src/intel/vulkan/genX_pipeline.c:1787
#6 gen9_CreateGraphicsPipelines (_device=0x7fffec37f460,
pipelineCache=0x7fffef0d1300, count=1,
pCreateInfos=<optimized out>, pAllocator=0x0, pPipelines=0x7fffee3562d0)
at src/intel/vulkan/genX_pipeline.c:2001
(gdb) disassemble try_lower_tex_ycbcr
0x00007ffff23d1549 <+281>: mov 0x80(%r14),%ecx
0x00007ffff23d1550 <+288>: mov 0x78(%r14),%rsi
323:
0x00007ffff23d1581 <+337>: lea 0x44f7f8(%rip),%rcx
0x00007ffff23d1588 <+344>: lea 0x44f489(%rip),%rsi
0x00007ffff23d158f <+351>: lea 0x44f52a(%rip),%rdi
0x00007ffff23d1596 <+358>: mov $0x143,%edx
0x00007ffff23d159b <+363>: callq 0x7ffff239bbf0 <__assert_fail@plt>
0x00007ffff23d15a0 <+368>: test %eax,%eax
0x00007ffff23d15a2 <+370>: js 0x7ffff23d1581
<anv_nir_lower_ycbcr_textures+337>
0x00007ffff23d15a4 <+372>: cltq
0x00007ffff23d15a6 <+374>: shl $0x6,%rax
0x00007ffff23d15aa <+378>: add %rax,%rsi
324-327:
0x00007ffff23d162c <+508>: movslq 0x3c(%rdx),%rax
0x00007ffff23d163c <+524>: shl $0x4,%rax
328:
=> 0x00007ffff23d2458 <+4136>: mov 0x3c,%eax
0x00007ffff23d245f <+4143>: ud2
0x00007ffff23d2461 <+4145>: nopl 0x0(%rax)
(gdb) info registers rdx rax eax
rdx 0x7fffef424aa0 140737207487136
rax 0x5 5
eax 0x5 5
(gdb) up
#1 anv_nir_lower_ycbcr_textures (shader=shader@entry=0x7fffee3037e0,
layout=layout@entry=0x7fffef8249c0)
at src/intel/vulkan/anv_nir_lower_ycbcr_textures.c:464
464 in src/intel/vulkan/anv_nir_lower_ycbcr_textures.c
(gdb) info locals
tex = <optimized out>
instr = 0x7fffef8e2430
__next = 0x7fffeef001c0
block = <optimized out>
function_progress = false
builder = {cursor = {option = nir_cursor_before_block, {block = 0x0, instr =
0x0}}, exact = false,
shader = 0x7fffee3037e0, impl = 0x7fffef919690}
function = <optimized out>
progress = <optimized out>
(gdb) print *instr
$2 = {node = {next = 0x7fffeef001c0, prev = 0x7fffeef00090}, block =
0x7fffef92d170,
type = nir_instr_type_tex, pass_flags = 1 '\001', index = 0}
(gdb) print *__next
$3 = {node = {next = 0x7fffeef002f0, prev = 0x7fffef8e2430}, block =
0x7fffef92d170,
type = nir_instr_type_alu, pass_flags = 1 '\001', index = 0}
--------------------------------------
Source code corresponding to try_lower_tex_ycbcr disassembly around the crash
is:
--------------------------------------
322: int deref_src_idx = nir_tex_instr_src_index(tex,
nir_tex_src_texture_deref);
323: assert(deref_src_idx >= 0);
324: nir_deref_instr *deref = nir_src_as_deref(tex->src[deref_src_idx].src);
326: nir_variable *var = nir_deref_instr_get_variable(deref);
327: const struct anv_descriptor_set_layout *set_layout =
328: layout->set[var->data.descriptor_set].layout;
--------------------------------------
To me it seems that deref got invalid address.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>