From patchwork Fri Jun 29 07:16:24 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: bugzilla-daemon@freedesktop.org X-Patchwork-Id: 10495657 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 03B8F60325 for ; Fri, 29 Jun 2018 07:16:27 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D6F9E29BF1 for ; Fri, 29 Jun 2018 07:16:26 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C8C5229C00; Fri, 29 Jun 2018 07:16:26 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=2.0 tests=BAYES_00,HTML_MESSAGE, MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED, URIBL_BLACK autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 4C2D829BF1 for ; Fri, 29 Jun 2018 07:16:26 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 882866EF36; Fri, 29 Jun 2018 07:16:25 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from culpepper.freedesktop.org (culpepper.freedesktop.org [IPv6:2610:10:20:722:a800:ff:fe98:4b55]) by gabe.freedesktop.org (Postfix) with ESMTP id 3C2EE6EF36 for ; Fri, 29 Jun 2018 07:16:24 +0000 (UTC) Received: by culpepper.freedesktop.org (Postfix, from userid 33) id 3920172139; Fri, 29 Jun 2018 07:16:24 +0000 (UTC) From: bugzilla-daemon@freedesktop.org To: dri-devel@lists.freedesktop.org Subject: [Bug 106928] When starting a match Rocket League crashes on "Go" Date: Fri, 29 Jun 2018 07:16:24 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Mesa X-Bugzilla-Component: Drivers/Gallium/r600 X-Bugzilla-Version: 18.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: ubizjak@gmail.com X-Bugzilla-Status: NEW X-Bugzilla-Resolution: X-Bugzilla-Priority: medium X-Bugzilla-Assigned-To: dri-devel@lists.freedesktop.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP https://bugs.freedesktop.org/show_bug.cgi?id=106928 --- Comment #11 from ubizjak@gmail.com --- (In reply to Roland Scheidegger from comment #9) > (In reply to ubizjak from comment #7) > > Please configure the build with: > > > > CXXFLAGS="-Wp,-D_GLIBCXX_ASSERTIONS" ./autogen.sh > > That didn't do anything neither. However I figured out the problem more or > less in the code, and some googling said that using -D_GLIBCXX_DEBUG should > make it trigger reliably, and indeed it does... Great ;) > The issue is that (you already showed that actually) > src = std::vector of length 2, capacity 3 = {0x7f94d905d110, 0x7f94d905cf70}} > And trying to access element src[2]. > There's an early exit in the function if src.size() is < 3. Since this > didn't hit, apparently fold_assoc() resized the vector. And indeed it can do > that (there's an explicit n->src.resize(2) somewhere, and it would still > return false in this case). > > I think something like this should do: > diff --git a/src/gallium/drivers/r600/sb/sb_expr.cpp > b/src/gallium/drivers/r600/sb/sb_expr.cpp > index 1df78da660..c77b9f2d7d 100644 > --- a/src/gallium/drivers/r600/sb/sb_expr.cpp > +++ b/src/gallium/drivers/r600/sb/sb_expr.cpp > @@ -945,6 +945,8 @@ bool expr_handler::fold_alu_op3(alu_node& n) { > if (!sh.safe_math && (n.bc.op_ptr->flags & AF_M_ASSOC)) { > if (fold_assoc(&n)) > return true; > + else if (n.src.size() < 3) > + return fold_alu_op2(n); > } > > value* v0 = n.src[0]->gvalue(); I wonder if we should fix expr_handler::fold_assoc instead. Digging through the code, fold_assoc is called only from expr_handler::fold_alu_op2 and expr_handler::fold_alu_op3. When true is returned, it triggers an early exit from expr_handler::fold_alu_op{2,3} functions. The part we are looking for in expr_handler::fold_assoc is: } else { // MULADD => ADD n->src[0] = n->src[2]; n->bc.src[0] = n->bc.src[2]; n->src[1] = sh.get_const_value(cr); memset(&n->bc.src[1], 0, sizeof(bc_alu_src)); n->src.resize(2); n->bc.set_op(ALU_OP2_ADD); } So, let's call fold_alu_op2 here and return true to trigger early exit in expr_handler::fold_alu_op3. This is what the code a couple of lines above the presented code does when an operand degenerates to mov. The (effectively the same patch as yours) proposed patch would be: WDYT? On a side note, maybe -D_GLIBCXX_ASSERTIONS should be added to mesa testsuite. This is the flag that Fedora 28 builds use by default now, so it would be beneficial to catch these bugs early in the development cycle, before they reach users. diff --git a/src/gallium/drivers/r600/sb/sb_expr.cpp b/src/gallium/drivers/r600/sb/sb_expr.cpp index 7a5d62c8e8..a609d1377f 100644 --- a/src/gallium/drivers/r600/sb/sb_expr.cpp +++ b/src/gallium/drivers/r600/sb/sb_expr.cpp @@ -714,6 +714,8 @@ bool expr_handler::fold_assoc(alu_node *n) { n->src.resize(2); n->bc.set_op(ALU_OP2_ADD); + fold_alu_op2(*n); + return true; } } else if (last_arg >= 0) { n->src[0] = a->src[last_arg];