Bug 22528

Summary: r300 crashes inside radeonTexSubImage2D
Product: Mesa Reporter: Fabio Pedretti <pedretti.fabio>
Component: Drivers/DRI/r300Assignee: Default DRI bug account <dri-devel>
Status: RESOLVED FIXED QA Contact:
Severity: major    
Priority: medium    
Version: git   
Hardware: x86 (IA32)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:
Attachments: full console output with mesa master git 2009-06-29 (commit 928a5684)
gzipped full console output with DEBUG_CMDBUF defined to 1 and RADEON_DEBUG=all

Description Fabio Pedretti 2009-06-29 02:15:37 UTC
Created attachment 27216 [details]
full console output with mesa master git 2009-06-29 (commit 928a5684)   

[This issue was already reported in bug 21814 comment 14]

When running the Windows game PANZERS PHASE TWO under wine the game crashes with the following backtrace. The game starts fine when using sw render. Full console output is attached.

I am using 2009-06-29 mesa master git (up to 928a5684) under a RV530 with no KMS:
GL_RENDERER   = Mesa DRI R300 (RV530 71C5) 20090101 x86/MMX/SSE2 TCL

Backtrace:
=>1 0x7d523e78 radeon_teximage_map+0x38(image=0x63bd4f20, write_enable=0x1) [/home/fabio/sorgenti/ati-drivers/mesa-compiled/src/mesa/drivers/dri/r300/../radeon/radeon_bo_drm.h:148] in r300_dri.so (0x0032e3a4)
  2 0x7d525076 radeon_texsubimage+0x96(ctx=<register EDI not in topmost frame>, dims=0x2, target=0xde1, level=0x0, xoffset=0x0, yoffset=0x0, zoffset=0x0, width=0x800, height=0x800, depth=0x1, imageSize=0x0, format=0x1907, type=0x8363, pixels=<register ESI not in topmost frame>, packing=0x7d7d968c, texObj=0x63bd4c18, texImage=0x63bd4f20, compressed=0x0) [/home/fabio/sorgenti/ati-drivers/mesa-compiled/src/mesa/drivers/dri/r300/radeon_texture.c:751] in r300_dri.so (0x0032e404)
  3 0x7d525406 radeonTexSubImage2D+0x86(ctx=0x7d7cc788, target=0xde1, level=0x0, xoffset=0x0, yoffset=0x0, width=0x800, height=0x800, format=0x1907, type=0x8363, pixels=0x5450040, packing=0x7d7d968c, texObj=0x63bd4c18, texImage=0x63bd4f20) [/home/fabio/sorgenti/ati-drivers/mesa-compiled/src/mesa/drivers/dri/r300/radeon_texture.c:817] in r300_dri.so (0x0032e454)
  4 0x7d5aa99c _mesa_TexSubImage2D+0x21c(target=0xde1, level=0x0, xoffset=0x0, yoffset=0x0, width=0x800, height=0x800, format=0x1907, type=0x8363, pixels=0x5450040) [/home/fabio/sorgenti/ati-drivers/mesa-compiled/src/mesa/main/teximage.c:2947] in r300_dri.so (0x0032e4b4)
  5 0x7e90159e in wined3d (+0x9159e) (0x0032e564)
  6 0x7e907f40 in wined3d (+0x97f40) (0x0032e724)
  7 0x7e8fee88 in wined3d (+0x8ee88) (0x0032e754)
  8 0x7e9142df in wined3d (+0xa42df) (0x0032e794)
  9 0x7e8f2208 in wined3d (+0x82208) (0x0032e824)
  10 0x7e88c6b8 ActivateContext+0x548() in wined3d (0x0032eae4)
  11 0x7e8c7152 drawPrimitive+0x1b2() in wined3d (0x0032ee64)
  12 0x7e89ae8c in wined3d (+0x2ae8c) (0x0032eea4)
  13 0x7e98490f in d3d9 (+0x490f) (0x0032eed4)
  14 0x0058b0e2 in panzers_phase_2 (+0x18b0e2) (0x00dec930)
  15 0x00139a68 (0x0077b040)
  16 0x00549aa0 in panzers_phase_2 (+0x149aa0) (0x00546500)
  17 0x74030000 (0x00a0b983)
  18 0x00000000 (0x00000000)
0x7d523e78 radeon_teximage_map+0x38 [/home/fabio/sorgenti/ati-drivers/mesa-compiled/src/mesa/drivers/dri/r300/../radeon/radeon_bo_drm.h:148] in r300_dri.so: movl	0x1c(%edx),%eax
148	    return bo->bom->funcs->bo_map(bo, write);
Comment 1 Nicolai Hähnle 2009-07-12 04:04:05 UTC
What about most recent Git? Is the bug still there?

Can the crash be reproduced using a demo or similar? How? I don't own that game and it seems likely that other developers who might look into that bug don't own it either.
Comment 2 Stefan Dösinger 2009-07-12 05:57:57 UTC
I'll test current git when I have time, but it may take a while. I am away from home right now, and we're in the process or finishing another CrossOver Games release, so I'll be quite busy the next time.

I don't think there is a Team Fortress 2 demo, but maybe the Half Life 2 Demo can be used. The HL2 demo certainly is a good test app, because it is the simplest game based on Valve's Source engine, but still covers all major part of the newer games. It is available free of charge by installing Steam(www.steampowered.com), and then using Steam to download the HL2 demo.

If everything else fails I can donate TF2 to a few Mesa developers for testing.

Comment 3 Fabio Pedretti 2009-07-20 01:55:08 UTC
Apparently the demos use a protection library not supported by wine:
http://bugs.winehq.org/show_bug.cgi?id=3260

The full game got an updated patch (1.08) that remove the protection but this is not available for the demos.

I found however a way to reproduce the problem with the demo + the patch for the full game. Note that due to this hack the demo will not be playable (e.g., whith swrender, after reaching the menu it prints an error message that maps are corrupted).

1) download and install the demo from:
http://files.filefront.com/Codename+Panzers+Phase+Two+Demo/;3932312;/fileinfo.html
2) enter the Run directory inside the main game directory and unzip this file which contains the patch + zlib dll and a tga file required by the patch:
http://rapidshare.com/files/257867465/panzers-2-demo-patch-1.08.zip.html
3) run the game with:
wine PANZERS_PHASE_2_1.08.exe
from the Run directory
Comment 4 Fabio Pedretti 2009-07-21 08:50:56 UTC
Created attachment 27884 [details]
gzipped full console output with DEBUG_CMDBUF defined to 1 and RADEON_DEBUG=all

Also attaching the game console output (gzipped since it's too big) after recompiling mesa with DEBUG_CMDBUF defined to 1 in radeon_common.c and game run with the following command line: 
RADEON_DEBUG=all wine PANZERS_PHASE_2.exe > ~/panzers-2-output.txt 2>&1
Comment 5 Adam Jackson 2009-08-24 12:32:35 UTC
Mass version move, cvs -> git
Comment 6 Fabio Pedretti 2009-10-20 01:24:59 UTC
After update to Ubuntu 9.10 and wine 1.1.31 the game then crashed with:
r300VertexProgUpdateParams:Params exhausted

Thanks to Maciej this is now fixed with:
http://cgit.freedesktop.org/mesa/mesa/commit/?h=mesa_7_6_branch&id=3594b53c0173ac810106f667604bf94b5cfc4a1e

Don't know if the original bug with different bugtrace is also fixed, or simply hidden behind different wine codepath, however the game now runs fine, albeit being extremely slow (1 frame every 3s). Ig needed I can provide the debug output when run with RADEON_DEBUG=all which is 29MB in size.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.