Bug 107366 - NIR verification crashes on piglit tests
Summary: NIR verification crashes on piglit tests
Alias: None
Product: Mesa
Classification: Unclassified
Component: Drivers/DRI/i965 (show other bugs)
Version: git
Hardware: Other All
: medium normal
Assignee: Danylo
QA Contact: Intel 3D Bugs Mailing List
Keywords: bisected, regression
Depends on:
Reported: 2018-07-24 17:24 UTC by Mark Janes
Modified: 2018-07-24 19:35 UTC (History)
2 users (show)

See Also:
i915 platform:
i915 features:


Description Mark Janes 2018-07-24 17:24:44 UTC
Running piglit tests with NIR_TEST_CLONE=true NIR_TEST_SERIALIZE=true, thousands of piglit tests crash:

NIR_TEST_CLONE=true NIR_TEST_SERIALIZE=true /tmp/build_root/m64/lib/piglit/bin/shader_runner /tmp/build_root/m64/lib/piglit/generated_tests/spec/arb_tessellation_shader/execution/built-in-functions/tcs-op-mult-float-mat4.shader_test -auto -fbo
piglit: debug: Requested an OpenGL 3.2 Core Context, and received a matching 4.5 context

Segmentation fault

Bisected to:
d219521379626ebf2bff63e4a9c2f92725b3926a is the first bad commit
commit d219521379626ebf2bff63e4a9c2f92725b3926a
Author: Danylo Piliaiev <danylo.piliaiev@gmail.com>
Date:   Wed Jul 11 15:29:00 2018 +0300
    i965: Sweep NIR after linking phase to free held memory
    After optimization passes and many trasfromations most of memory
    NIR holds is a garbage which was being freed only after shader deletion.
    Freeing it at the end of linking will save memory which would be useful
    in case there are a lot of complex shaders being compiled.
    The common case for this issue is 32bit game running under Wine.
    The cost of the optimization is around ~3-5% of compilation speed
    with complex shaders.
    V2: by Jason Ekstrand
        - Move nir_sweep up, right after the last change of NIR
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=103274
    Signed-off-by: Danylo Piliaiev <danylo.piliaiev@globallogic.com>
    Reviewed-by: Jason Ekstrand <jason@jlekstrand.net>
    Cc: mesa-stable@lists.freedesktop.org
Comment 1 Jason Ekstrand 2018-07-24 19:35:48 UTC
Fixed by the following commit in master:

commit f214baf72ff89ba03342067f89c38b4bc84e298b (public/master)
Author: Jason Ekstrand <jason.ekstrand@intel.com>
Date:   Tue Jul 24 11:01:20 2018 -0700

    nir/serialize: Alloc constants off the variable
    nir_sweep assumes that constants area always allocated off the variable
    to which they belong.  Violating this assumption causes them to get
    freed early and leads to use-after-free bugs.
    Fixes: 120da00975541 "nir: add serialization and deserialization"
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107366
    Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
    Tested-by: Mark Janes <mark.a.janes@intel.com>

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.