Bug 102518

Summary: [apitrace,backtrace] Crash in _mesa_is_bufferobj during load of "XCOM 2: War of the Chosen"
Product: Mesa Reporter: Kai <kai>
Component: Mesa coreAssignee: mesa-dev
Status: RESOLVED NOTOURBUG QA Contact: mesa-dev
Severity: normal    
Priority: medium CC: mdiluzio
Version: gitKeywords: have-backtrace
Hardware: Other   
OS: All   
Whiteboard:
i915 platform: i915 features:
Bug Depends on:    
Bug Blocks: 77449    
Attachments: Core file of the crash

Description Kai 2017-09-02 13:11:53 UTC
Created attachment 133939 [details]
Core file of the crash

When launching the new "War of the Chosen" expansion for XCOM2 I experience a segmentation fault in _mesa_is_bufferobj during the initial load before the main menu (about two thirds into the loading according to the bar on the loading screen).

The following backtrace was generated from the MiniDump file, the game generated. Conversion of MiniDump to core format was done with minidump-2-core from [0] (the two missing symbols should be from the XCOM2WotC binary as I have debugging symbols installed for everything else).
> Core was generated by `~/.local/share/Steam/SteamApps/common/XCOM 2/XCOM2WotC/bin/XCOM2WotC'.
> #0  0x00007fb38c36efb5 in _mesa_is_bufferobj (obj=0x3fffe0000) at ../../../src/mesa/main/bufferobj.h:71
> 71      ../../../src/mesa/main/bufferobj.h: No such file or directory.
> [Current thread is 1 (LWP 7053)]
> (gdb) bt full
> #0  0x00007fb38c36efb5 in _mesa_is_bufferobj (obj=0x3fffe0000) at ../../../src/mesa/main/bufferobj.h:71
>         array_bit = 8589934592
> #1  0x00007fb38c36efb5 in vertex_attrib_binding (ctx=ctx@entry=0x8c93a50, vao=vao@entry=0x7fb218defad0, attribIndex=attribIndex@entry=33, bindingIndex=bindingIndex@entry=33) at ../../../src/mesa/main/varray.c:143
>         array_bit = 8589934592
> #2  0x00007fb38c3704d2 in vertex_attrib_binding (bindingIndex=33, attribIndex=33, vao=0x7fb218defad0, ctx=0x8c93a50) at ../../../src/mesa/main/varray.c:140
>         array = 0x7fb218df0748
>         vao = 0x7fb218defad0
>         array = <optimized out>
>         effectiveStride = <optimized out>
> #3  0x00007fb38c3704d2 in update_array (ctx=0x8c93a50, attrib=33, format=6408, size=4, type=5126, stride=0, normalized=0 '\000', integer=0 '\000', doubles=0 '\000', ptr=0x0, sizeMax=5) at ../../../src/mesa/main/varray.c:566
>         vao = 0x7fb218defad0
>         array = <optimized out>
>         effectiveStride = <optimized out>
> #4  0x00007fb38c3712ce in _mesa_VertexAttribPointer_no_error (index=<optimized out>, size=<optimized out>, type=<optimized out>, normalized=<optimized out>, stride=<optimized out>, ptr=<optimized out>) at ../../../src/mesa/main/varray.c:932
>         ctx = <optimized out>
> #5  0x000000000244b9c7 in  ()
> #6  0x00000000030e258f in  ()
> #7  0x00007fb3a284f494 in start_thread (arg=0x7fb2db7fe700) at pthread_create.c:333
>         __res = <optimized out>
>         pd = 0x7fb2db7fe700
>         now = <optimized out>
>         unwind_buf = 
>               {cancel_jmp_buf = {{jmp_buf = {140406163498752, -7954418935509843714, 0, 140730246251631, 0, 140409527283776, 7996577511008600318, 7997125298794627326}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
>         not_first_call = <optimized out>
>         pagesize_m1 = <optimized out>
>         sp = <optimized out>
>         freesize = <optimized out>
>         __PRETTY_FUNCTION__ = "start_thread"
> #8  0x00007fb39c5f7abf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

info registers shows:
> (gdb) info registers 
> rax            0x3fffe0000      17179738112
> rbx            0x7fb218defad0   140402898172624
> rcx            0x21     33
> rdx            0x21     33
> rsi            0x7fb218defad0   140402898172624
> rdi            0x8c93a50        147405392
> rbp            0x7fb218defef0   0x7fb218defef0
> rsp            0x7fb2db7fd720   0x7fb2db7fd720
> r8             0x1406   5126
> r9             0x0      0
> r10            0x0      0
> r11            0x0      0
> r12            0x8c93a50        147405392
> r13            0x21     33
> r14            0x200000000      8589934592
> r15            0x0      0
> rip            0x7fb38c36efb5   0x7fb38c36efb5 <vertex_attrib_binding+53>
> eflags         0x10206  [ PF IF RF ]
> cs             0x33     51
> ss             0x0      0
> ds             0x0      0
> es             0x0      0
> fs             0x0      0
> gs             0x0      0

The crash occurs with and without mesa_glthread=true set. I uninstalled all mods to ensure nothing from a third party interferes.

The full stack (fully updated Debian testing as a base) is:
GPU: Hawaii PRO [Radeon R9 290] (ChipID = 0x67b1)
Mesa: Git:master/39a69f0692
libdrm: 2.4.82-1
LLVM: SVN:trunk/r311644 (6.0 devel)
X.Org: 2:1.19.3-2
Linux: 4.12.10
Firmware (firmware-amd-graphics): 20170823-1
libclc: Git:master/7331b0a1fa
DDX (xserver-xorg-video-amdgpu): 1.3.0-1

Let me know, if you need anything else.


[0] <https://github.com/couchbaselabs/breakpad/blob/master/src/tools/linux/md2core/minidump-2-core.cc>
Comment 1 Kai 2017-09-02 14:07:49 UTC
I've created an Apitrace, which is available at <https://c.1und1.de/272476645/BP4bKyxIRCejFEqUhvT3yw> and should show all OpenGL commands right up until the crash. The replay shows the same I'm seeing when launching the game.
Comment 2 Timothy Arceri 2017-09-02 23:31:08 UTC
It's hitting an error in the no error path. Did you force no error via the env var?
Comment 3 Kai 2017-09-03 08:04:49 UTC
(In reply to Timothy Arceri from comment #2)
> It's hitting an error in the no error path. Did you force no error via the
> env var?

No, absolutely not. Unless setting GALLIUM_HUD=fps does set that as well. But I doubt it. I just ran the game without that environment variable (or any other environment variable for that matter) and got the crash again, with an similar backtrace:
> Core was generated by `/home/kai/.local/share/Steam/SteamApps/common/XCOM 2/XCOM2WotC/bin/XCOM2WotC'.
> #0  0x00007f103b46ffb5 in _mesa_is_bufferobj (obj=0x3fffe0000) at ../../../src/mesa/main/bufferobj.h:71
> 71      ../../../src/mesa/main/bufferobj.h: No such file or directory.
> [Current thread is 1 (LWP 3491)]
> (gdb) bt full
> #0  0x00007f103b46ffb5 in _mesa_is_bufferobj (obj=0x3fffe0000) at ../../../src/mesa/main/bufferobj.h:71
>         array_bit = 8589934592
> #1  0x00007f103b46ffb5 in vertex_attrib_binding (ctx=ctx@entry=0x8a9d240, vao=vao@entry=0x7f0ed926f4c0, attribIndex=attribIndex@entry=33, bindingIndex=bindingIndex@entry=33) at ../../../src/mesa/main/varray.c:143
>         array_bit = 8589934592
> #2  0x00007f103b4714d2 in vertex_attrib_binding (bindingIndex=33, attribIndex=33, vao=0x7f0ed926f4c0, ctx=0x8a9d240) at ../../../src/mesa/main/varray.c:140
>         array = 0x7f0ed9270138
>         vao = 0x7f0ed926f4c0
>         array = <optimized out>
>         effectiveStride = <optimized out>
> #3  0x00007f103b4714d2 in update_array (ctx=0x8a9d240, attrib=33, format=6408, size=4, type=5126, stride=0, normalized=0 '\000', integer=0 '\000', doubles=0 '\000', ptr=0x0, sizeMax=5) at ../../../src/mesa/main/varray.c:566
>         vao = 0x7f0ed926f4c0
>         array = <optimized out>
>         effectiveStride = <optimized out>
> #4  0x00007f103b4722ce in _mesa_VertexAttribPointer_no_error (index=<optimized out>, size=<optimized out>, type=<optimized out>, normalized=<optimized out>, stride=<optimized out>, ptr=<optimized out>) at ../../../src/mesa/main/varray.c:932
>         ctx = <optimized out>
> #5  0x000000000244b9c7 in  ()
> #6  0x00000000030e258f in  ()
> #7  0x00007f1051950494 in start_thread (arg=0x7f0f93565700) at pthread_create.c:333
>         __res = <optimized out>
>         pd = 0x7f0f93565700
>         now = <optimized out>
>         unwind_buf = 
>               {cancel_jmp_buf = {{jmp_buf = {139704873146112, 5829145187633785263, 0, 140731612099327, 0, 139708089712704, -5838232997335733841, -5853013188703098449}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
>         not_first_call = <optimized out>
>         pagesize_m1 = <optimized out>
>         sp = <optimized out>
>         freesize = <optimized out>
>         __PRETTY_FUNCTION__ = "start_thread"
> #8  0x00007f104b6f8abf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97
Comment 4 Marc Di Luzio 2017-09-04 10:17:43 UTC
FWIW to clear up some confusion - our launch scripts turns on KHR_no_error for WOTC for the extra performance.

See /path/to/install/dir/XCOM2WotC/config/extra-environment.sh:2
export MESA_NO_ERROR=1

I'll take a look and see if we're hitting a GL error at this stage.
Comment 5 Marc Di Luzio 2017-09-04 10:42:08 UTC
It appears some errors slipped through.

Example:
[GL_DEBUG] Error message from OpenGL API call with id 1281: GL_INVALID_VALUE error generated. <index> out of range.

We'll handle this, I'd think it should be safe to assume this is an application bug. From what I understand using a KHR_no_error context is a trust handshake that you won't trigger any error states.
Comment 6 Timothy Arceri 2017-09-04 11:02:37 UTC
(In reply to Marc Di Luzio from comment #4)
> FWIW to clear up some confusion - our launch scripts turns on KHR_no_error
> for WOTC for the extra performance.
> 
> See /path/to/install/dir/XCOM2WotC/config/extra-environment.sh:2
> export MESA_NO_ERROR=1
> 
> I'll take a look and see if we're hitting a GL error at this stage.

O(In reply to Marc Di Luzio from comment #5)
> It appears some errors slipped through.
> 
> Example:
> [GL_DEBUG] Error message from OpenGL API call with id 1281: GL_INVALID_VALUE
> error generated. <index> out of range.
> 
> We'll handle this, I'd think it should be safe to assume this is an
> application bug. From what I understand using a KHR_no_error context is a
> trust handshake that you won't trigger any error states.

Thanks for confirming. Making as resolved.
Comment 7 Kai 2017-09-04 11:20:34 UTC
I can confirm, that commenting out the export of MESA_NO_ERROR=1 in XCOM2WotC/config/extra-environment.sh lets me launch the game. This was tested on (fully updated Debian testing as a base):
GPU: Hawaii PRO [Radeon R9 290] (ChipID = 0x67b1)
Mesa: Git:master/39a69f0692
libdrm: 2.4.82-1
LLVM: SVN:trunk/r312410 (6.0 devel)
X.Org: 2:1.19.3-2
Linux: 4.12.10
Firmware (firmware-amd-graphics): 20170823-1
libclc: Git:master/7331b0a1fa
DDX (xserver-xorg-video-amdgpu): 1.3.0-1
Comment 8 Marc Di Luzio 2017-09-04 16:17:07 UTC
Cheers Kai.

That line is being removed from the default branch as we speak, while we sort out the actual error on our side. Apologies for any wasted time.
Comment 9 Marc Di Luzio 2017-09-20 16:11:51 UTC
Quick update, this has now been pushed live.

Apologies for the long wait on that.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.