Bug 73755

mesa: 1c5e2965a0de296240dd8f5af12482164416b7f1 (master)


$ ./bin/fbo-missing-attachment-blit es2 from -auto
Testing blit from buffer with missing attachment to complete buffer...
Segmentation fault (core dumped)


Program terminated with signal 11, Segmentation fault.
#0  0x00007fbbe37acf85 in sp_find_cached_tile (tc=0x15f9040, addr=...) at sp_tile_cache.c:499
499	      assert(pt->resource);
(gdb) bt
#0  0x00007fbbe37acf85 in sp_find_cached_tile (tc=0x15f9040, addr=...) at sp_tile_cache.c:499
#1  0x00007fbbe378ff5a in sp_get_cached_tile (tc=0x15f9040, x=8, y=8) at sp_tile_cache.h:152
#2  0x00007fbbe3797c31 in single_output_color (qs=0x1617610, quads=0x16ca5e0, nr=4) at sp_quad_blend.c:1180
#3  0x00007fbbe379807e in choose_blend_quad (qs=0x1617610, quads=0x16ca5e0, nr=4) at sp_quad_blend.c:1280
#4  0x00007fbbe378fcca in shade_quads (qs=0x1619c40, quads=0x16ca5e0, nr=4) at sp_quad_fs.c:146
#5  0x00007fbbe378dc73 in depth_test_quads_fallback (qs=0x1619c70, quads=0x16ca5e0, nr=4) at sp_quad_depth_test.c:829
#6  0x00007fbbe378f929 in choose_depth_test (qs=0x1619c70, quads=0x16ca5e0, nr=4) at sp_quad_depth_test.c:952
#7  0x00007fbbe3798f8a in flush_spans (setup=0x16c80e0) at sp_setup.c:250
#8  0x00007fbbe379a39a in subtriangle (setup=0x16c80e0, eleft=0x16c8138, eright=0x16c8120, lines=16) at sp_setup.c:754
#9  0x00007fbbe379a68c in sp_setup_tri (setup=0x16c80e0, v0=0x177db10, v1=0x177db20, v2=0x177db30) at sp_setup.c:844
#10 0x00007fbbe378a879 in sp_vbuf_draw_arrays (vbr=0x16c8040, start=0, nr=4) at sp_prim_vbuf.c:451
#11 0x00007fbbe36769a1 in draw_pt_emit_linear (emit=0x1622a20, vert_info=0x7fff1096af60, prim_info=0x7fff1096b090) at draw/draw_pt_emit.c:258
#12 0x00007fbbe3679596 in emit (emit=0x1622a20, vert_info=0x7fff1096af60, prim_info=0x7fff1096b090) at draw/draw_pt_fetch_shade_pipeline.c:183
#13 0x00007fbbe3679b70 in fetch_pipeline_generic (middle=0x16228e0, fetch_info=0x0, in_prim_info=0x7fff1096b090) at draw/draw_pt_fetch_shade_pipeline.c:336
#14 0x00007fbbe3679cc6 in fetch_pipeline_linear_run (middle=0x16228e0, start=0, count=4, prim_flags=0) at draw/draw_pt_fetch_shade_pipeline.c:397
#15 0x00007fbbe3682478 in vsplit_segment_simple_linear (vsplit=0x16c2420, flags=0, istart=0, icount=4) at draw/draw_pt_vsplit_tmp.h:240
#16 0x00007fbbe368276f in vsplit_run_linear (frontend=0x16c2420, start=0, count=4) at draw/draw_split_tmp.h:60
#17 0x00007fbbe36750e5 in draw_pt_arrays (draw=0x16b7790, prim=5, start=0, count=4) at draw/draw_pt.c:149
#18 0x00007fbbe3675ece in draw_vbo (draw=0x16b7790, info=0x7fff1096b1f0) at draw/draw_pt.c:562
#19 0x00007fbbe37892fc in softpipe_draw_vbo (pipe=0x161ed00, info=0x7fff1096b340) at sp_draw_arrays.c:131
#20 0x00007fbbe365acaa in cso_draw_vbo (cso=0x17213b0, info=0x7fff1096b340) at cso_cache/cso_context.c:1400
#21 0x00007fbbe3535025 in st_draw_vbo (ctx=0x7fbbe16eb010, prims=0x7fff1096b410, nr_prims=1, ib=0x0, index_bounds_valid=1 '\001', min_index=0, max_index=3, 
    tfb_vertcount=0x0, indirect=0x0) at state_tracker/st_draw.c:290
#22 0x00007fbbe34ec99d in vbo_draw_arrays (ctx=0x7fbbe16eb010, mode=5, start=0, count=4, numInstances=1, baseInstance=0) at vbo/vbo_exec_array.c:661
#23 0x00007fbbe34ed3e8 in vbo_exec_DrawArrays (mode=5, start=0, count=4) at vbo/vbo_exec_array.c:813
#24 0x00007fbbe7ac5c42 in stub_glDrawArrays (mode=5, first=0, count=4) at piglit/tests/util/generated_dispatch.c:6223
#25 0x00007fbbe7ab49d7 in piglit_draw_rect_from_arrays (verts=0x7fff1096b510, tex=0x0) at piglit/tests/util/piglit-util-gl-common.c:632
#26 0x00007fbbe7ab4e13 in piglit_draw_rect_z (z=0.5, x=-0.5, y=-0.5, w=1, h=1) at piglit/tests/util/piglit-util-gl-common.c:769
#27 0x0000000000401638 in do_blit_test (use_es2=true, from_missing_to_complete=true)
    at piglit/tests/spec/arb_es2_compatibility/fbo-missing-attachment-blit.c:147
#28 0x00000000004018fc in piglit_init (argc=3, argv=0x7fff1096b7d8)
    at piglit/tests/spec/arb_es2_compatibility/fbo-missing-attachment-blit.c:214
#29 0x00007fbbe7ab78fa in run_test (gl_fw=0x7fbbe7da5340 <glut_fw>, argc=3, argv=0x7fff1096b7d8)
    at piglit/tests/util/piglit-framework-gl/piglit_glut_framework.c:140
#30 0x00007fbbe7ab56c9 in piglit_gl_test_run (argc=3, argv=0x7fff1096b7d8, config=0x7fff1096b6a0)
    at piglit/tests/util/piglit-framework-gl.c:191
#31 0x000000000040133e in main (argc=3, argv=0x7fff1096b7d8)
    at piglit/tests/spec/arb_es2_compatibility/fbo-missing-attachment-blit.c:67
(gdb) frame 0
#0  0x00007fbbe37acf85 in sp_find_cached_tile (tc=0x15f9040, addr=...) at sp_tile_cache.c:499
499	      assert(pt->resource);
(gdb) print pt
$1 = (struct pipe_transfer *) 0x0


9baa45f78b8ca7d66280e36009b6a685055d7cd6 is the first bad commit
commit 9baa45f78b8ca7d66280e36009b6a685055d7cd6
Author: Marek Olšák <marek.olsak@amd.com>
Date:   Wed Jan 8 01:09:15 2014 +0100

    st/mesa: bind NULL colorbuffers as specified by glDrawBuffers
    
    An example why it is required:
    
        Let's say there's a fragment shader writing to gl_FragData[0..1].
        The user calls: glDrawBuffers(2, {GL_NONE, GL_COLOR_ATTACHMENT0});
    
        That means gl_FragData[0] is unused and gl_FragData[1] is written
        to GL_COLOR_ATTACHMENT0.
    
    st/mesa was skipping the GL_NONE draw buffer, therefore gl_FragData[0]
    was written to GL_COLOR_ATTACHMENT0, which was wrong.
    
    This commit fixes it, but drivers must also be fixed not to crash when
    binding NULL colorbuffers. There is also a new set of piglit tests for this.
    
    The MSAA state also had to be fixed not to crash when reading fb->cbufs[0].
    
    Reviewed-by: Brian Paul <brianp@vmware.com>

:040000 040000 6818bdd84e475c30bd43fc3b5d98af8c6cdd39a7 e73a34aacda41dd8046b425b6d2397a1f8dd6ee8 M	src
bisect run success