i915 regressions bisected to "vbo/dlist: use a shared index buffer"
I've been looking at i915 regressions between 20.3 and master, and discovered that several of them bisect to commit 4c751ad6 (vbo/dlist: use a shared index buffer
). (I had to apply the patch in !8445 (closed) while bisecting to avoid other crashes.) Reverting that patch fixes several tests:
test name | master | with revert |
---|---|---|
spec/!opengl 1.0/gl-1.0-beginend-coverage/* | crash | pass |
spec/!opengl 1.0/gl-1.0-dlist-materials | fail | pass |
spec/!opengl 1.1/dlist-fdo3129-02 | fail | pass |
spec/!opengl 1.1/gl-1.1-draw-arrays-start | crash | pass |
spec/!opengl 1.4/draw-batch | crash | pass |
spec/!opengl 1.4/gl-1.4-dlist-multidrawarrays | crash | pass |
It seems to be reading out of bounds memory when running the TNL pipeline, which usually crashes, though it occasionally fails.
I haven't managed to track down what exactly is causing the issue, though. I don't know if there's anything wrong with commit 4c751ad6 itself, or if it's just provoking other bugs in the tnl code...
Here is a backtrace from draw-batch -auto -fbo
:
#0 0x00007ffff5cd54e5 in intel_draw_triangle (intel=0x5555556159b0, v0=0x5555569193f8, v1=0x555556918ae0, v2=0x55555f032370) at ../../src/mesa/drivers/dri/i915/intel_tris.c:406
#1 0x00007ffff5cfbf60 in intel_render_triangles_elts (ctx=0x5555556159b0, start=6, count=9, flags=52) at ../../src/mesa/tnl/t_vb_rendertmp.h:183
#2 0x00007ffff5d902d2 in run_render (ctx=0x5555556159b0, stage=0x555555599998) at ../../src/mesa/tnl/t_vb_render.c:323
#3 0x00007ffff5d733c0 in _tnl_run_pipeline (ctx=0x5555556159b0) at ../../src/mesa/tnl/t_pipeline.c:241
#4 0x00007ffff5cfd1c8 in intelRunPipeline (ctx=0x5555556159b0) at ../../src/mesa/drivers/dri/i915/intel_tris.c:1087
#5 0x00007ffff5d72c68 in _tnl_draw_prims (ctx=0x5555556159b0, arrays=0x7fffffffd6f0, prim=0x5555555cebe0, nr_prims=1, ib=0x7fffffffd6d0, index_bounds_valid=1 '\001',
min_index=0, max_index=2, num_instances=1, base_instance=0) at ../../src/mesa/tnl/t_draw.c:523
#6 0x00007ffff5d73b4e in t_rebase_prims (ctx=0x5555556159b0, arrays=0x55555559af80, prim=0x5555555cebe0, nr_prims=1, ib=0x7fffffffd6d0, min_index=6, max_index=8,
num_instances=1, base_instance=0, draw=0x7ffff5d72834 <_tnl_draw_prims>) at ../../src/mesa/tnl/t_rebase.c:234
#7 0x00007ffff5d72a00 in _tnl_draw_prims (ctx=0x5555556159b0, arrays=0x55555559af80, prim=0x5555555cebe0, nr_prims=1, ib=0x5555555d65e8, index_bounds_valid=1 '\001',
min_index=6, max_index=8, num_instances=1, base_instance=0) at ../../src/mesa/tnl/t_draw.c:465
#8 0x00007ffff5d72fd4 in _tnl_draw (ctx=0x5555556159b0, prim=0x5555555cebe0, nr_prims=1, ib=0x5555555d65e8, index_bounds_valid=true, primitive_restart=false, restart_index=0,
min_index=6, max_index=8, num_instances=1, base_instance=0) at ../../src/mesa/tnl/t_draw.c:642
#9 0x00007ffff61ab3cc in vbo_save_playback_vertex_list (ctx=0x5555556159b0, data=0x5555555d65a8) at ../../src/mesa/vbo/vbo_save_draw.c:222
#10 0x00007ffff5e8035a in ext_opcode_execute (ctx=0x5555556159b0, node=0x5555555d65a4) at ../../src/mesa/main/dlist.c:1134
#11 0x00007ffff5f6502b in execute_list (ctx=0x5555556159b0, list=3) at ../../src/mesa/main/dlist.c:11406
#12 0x00007ffff5f71131 in _mesa_CallList (list=3) at ../../src/mesa/main/dlist.c:13860
#13 0x0000555555556f73 in piglit_display () at tests/general/draw-batch.c:179
#14 0x00007ffff7f0804a in enter_event_loop (winsys_fw=0x5555555776c0) at tests/util/piglit-framework-gl/piglit_gbm_framework.c:42
#15 0x00007ffff7f0787c in run_test (gl_fw=0x5555555776c0, argc=1, argv=0x7fffffffe928) at tests/util/piglit-framework-gl/piglit_winsys_framework.c:88
#16 0x00007ffff7ef6203 in piglit_gl_test_run (argc=1, argv=0x7fffffffe928, config=0x7fffffffe7d0) at tests/util/piglit-framework-gl.c:229
#17 0x000055555555626f in main (argc=1, argv=0x7fffffffe928) at tests/general/draw-batch.c:34