Bug 92945

Summary: [llvmpipe] [softpipe] piglit fs-ldexp-dvec4 regression
Product: Mesa Reporter: Vinson Lee <vlee>
Component: Mesa coreAssignee: mesa-dev
Status: RESOLVED FIXED QA Contact: mesa-dev
Severity: normal    
Priority: medium CC: brianp, jfonseca, jljusten, krh, sroland
Version: gitKeywords: bisected, regression
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
i915 platform: i915 features:

Description Vinson Lee 2015-11-13 21:31:34 UTC
mesa: 3694d58e6c4a39bd84e8aef0d8e67c3ae9447f33 (master 11.1.0-devel)

$ ./bin/shader_runner tests/spec/arb_gpu_shader_fp64/execution/built-in-functions/fs-ldexp-dvec4.shader_t$
ir_dereference_variable @ 0xfe9b90 specifies undeclared variable `color' @ 0xfee5f0
Aborted (core dumped)

(gdb) bt
#0  0x00007f721d432267 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55
#1  0x00007f721d433eca in __GI_abort () at abort.c:89
#2  0x00007f721baefee1 in (anonymous namespace)::ir_validate::visit (this=0x7ffe25e692b0, ir=0xfe9b90) at$
#3  0x00007f721baebc7e in ir_dereference_variable::accept (this=0xfe9b90, v=0x7ffe25e692b0) at src/glsl/i$
#4  0x00007f721baebeaa in ir_assignment::accept (this=0xfea070, v=0x7ffe25e692b0) at src/glsl/ir_hv_accep$
#5  0x00007f721baeb40a in visit_list_elements (v=0x7ffe25e692b0, l=0xf90548, statement_list=true) at src/$
#6  0x00007f721baeb60f in ir_function_signature::accept (this=0xf90500, v=0x7ffe25e692b0) at src/glsl/ir_$
#7  0x00007f721baeb40a in visit_list_elements (v=0x7ffe25e692b0, l=0xfee3e8, statement_list=false) at src$
#8  0x00007f721baeb6a3 in ir_function::accept (this=0xfee3c0, v=0x7ffe25e692b0) at src/glsl/ir_hv_accept.$
#9  0x00007f721baeb40a in visit_list_elements (v=0x7ffe25e692b0, l=0xfe7d90, statement_list=true) at src/$
#10 0x00007f721baeb2dc in ir_hierarchical_visitor::run (this=0x7ffe25e692b0, instructions=0xfe7d90)
    at src/glsl/ir_hierarchical_visitor.cpp:364
#11 0x00007f721baf3885 in validate_ir_tree (instructions=0xfe7d90) at src/glsl/ir_validate.cpp:939
#12 0x00007f721bafd2e0 in link_shaders (ctx=0x7f721df9c010, prog=0xf87fc0) at src/glsl/linker.cpp:4467
#13 0x00007f721b93405f in _mesa_glsl_link_shader (ctx=0x7f721df9c010, prog=0xf87fc0) at src/mesa/program/$
#14 0x00007f721b887345 in link_program (ctx=0x7f721df9c010, program=3) at src/mesa/main/shaderapi.c:1047
#15 0x00007f721b8884fb in _mesa_LinkProgram (programObj=3) at src/mesa/main/shaderapi.c:1517
#16 0x00007f721da964cc in stub_glLinkProgram (program=3) at piglit/tests/util/piglit-dispatch-gen.c:32599
#17 0x0000000000406f81 in link_and_use_shaders () at piglit/tests/shaders/shader_runner.c:965
#18 0x000000000040d471 in piglit_init (argc=2, argv=0x7ffe25e69748) at piglit/tests/shaders/shader_runner$
#19 0x00007f721db04f84 in run_test (gl_fw=0x7f721dda00e0 <glut_fw>, argc=2, argv=0x7ffe25e69748)
    at piglit/tests/util/piglit-framework-gl/piglit_glut_framework.c:285
#20 0x00007f721daeb014 in piglit_gl_test_run (argc=2, argv=0x7ffe25e69748, config=0x7ffe25e69600)
    at piglit/tests/util/piglit-framework-gl.c:199
#21 0x0000000000405630 in main (argc=2, argv=0x7ffe25e69748) at piglit/tests/shaders/shader_runner.c:54
(gdb) frame 2
#2  0x00007f721baefee1 in (anonymous namespace)::ir_validate::visit (this=0x7ffe25e692b0, ir=0xfe9b90) at$
102           abort();
(gdb) l
98         if (_mesa_set_search(ir_set, ir->var) == NULL) {
99            printf("ir_dereference_variable @ %p specifies undeclared variable "
100                  "`%s' @ %p\n",
101                  (void *) ir, ir->var->name, (void *) ir->var);
102           abort();
103        }
105        this->validate_ir(ir, this->data_enter);

96b22fb080894ba1840af2372f28a46cc0f40c76 is the first bad commit
commit 96b22fb080894ba1840af2372f28a46cc0f40c76
Author: Kristian Høgsberg Kristensen <krh@bitplanet.net>
Date:   Wed Nov 4 14:58:54 2015 -0800

    glsl: Use array deref for access to vector components
    We've assumed that we could lower per-component vector access from
      vec[i] = scalar
      vec = ir_triop_vector_insert(vec, scalar, i)
    but with SSBOs (and compute shader SLM and tesselation outputs) this is
    no longer valid. If a vector is "externally visible", multiple threads
    can write independent components simultaneously. With lowering to
    ir_triop_vector_insert, each thread read the entire vector, changes one
    component, then writes out the entire vector. This is racy.
    Instead of generating a ir_binop_vector_extract when we see v[i], we
    generate ir_dereference_array. We then add a lowering pass to lower the
    ir_dereference_array to ir_binop_vector_extract for rvalues and for to
    vector_insert for lvalues in a separate lowering pass.
    The resulting IR is the same as before, but we now have a window between
    ast->ir conversion and the lowering pass where v[i] appears in the IR as
    an array deref. This lets us run lowering passes that lower the vector
    access to I/O (eg for SSBO load/store) before we lower the per-component
    access to full vector writes.
    Reviewed-by: Jordan Justen <jordan.l.justen@intel.com>
    Signed-off-by: Kristian Høgsberg Kristensen <krh@bitplanet.net>

:040000 040000 e2df93f05e94cac81ae3222837a463d7bcb41cc8 e4f382406684faa0fcafea9e9c293ef0ccffdd96 M	src
bisect run success
Comment 1 Ilia Mirkin 2015-11-26 14:00:40 UTC
Reproduced on nvc0. Note that this issue appears to have little to do with doubles. The shader address an output, color, as color[i] = 1 (i=loop index). However it appears that the color output gets removed for some reason, or is otherwise not look-up-able.
Comment 2 Vinson Lee 2015-12-16 22:42:10 UTC
commit 750393ff7d6162372f368f5ed726b23f4cae49a0
Author: Iago Toral Quiroga <itoral@igalia.com>
Date:   Fri Nov 27 12:46:20 2015 +0100

    glsl/dead_builin_varyings: Fix gl_FragData array lowering
    The current implementation looks for array dereferences on gl_FragData and
    immediately proceeds to lower them, however this is not enough because we
    can have array access on vector variables too, like in this code:
    out vec4 color;
    void main()
       int i;
       for (i = 0; i < 4; i++)
          color[i] = 1.0;
    Fix it by making sure that the actual variable being dereferenced is an array.
    Fixes a crash in:
    Reviewed-by: Tapani Pälli <tapani.palli@intel.com>

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.