https://bugs.freedesktop.org/show_bug.cgi?id=84327
Priority: medium Bug ID: 84327 Assignee: dri-devel@lists.freedesktop.org Summary: crash in gnome-shell when typing in the app view Severity: normal Classification: Unclassified OS: All Reporter: rstrode@redhat.com Hardware: Other Status: NEW Version: unspecified Component: Drivers/Gallium/r300 Product: Mesa
in gnome-shell 3.14.0 (with mutter 3.14.0) any time i type in the overview it crashes. valgrind reports this:
==6970== Thread 1: ==6970== Invalid read of size 4 ==6970== at 0x228163E9: UnknownInlinedFun (register_allocate.c:524) ==6970== by 0x228163E9: ra_allocate (register_allocate.c:555) ==6970== by 0x22AF000F: do_advanced_regalloc (radeon_pair_regalloc.c:620) ==6970== by 0x22AF000F: rc_pair_regalloc (radeon_pair_regalloc.c:776) ==6970== by 0x22AE417B: rc_run_compiler_passes (radeon_compiler.c:465) ==6970== by 0x22AE4224: rc_run_compiler (radeon_compiler.c:491) ==6970== by 0x22AF69B3: r3xx_compile_fragment_program (r3xx_fragprog.c:153) ==6970== by 0x22AD03AF: r300_translate_fragment_shader (r300_fs.c:519) ==6970== by 0x22AD1439: r300_pick_fragment_shader (r300_fs.c:597) ==6970== by 0x22ADC5F2: r300_validate_fragment_shader (r300_state_derived.c:1048) ==6970== by 0x22ADC5F2: r300_update_derived_state (r300_state_derived.c:1075) ==6970== by 0x22AD3476: r300_draw_vbo (r300_render.c:794) ==6970== by 0x22926B74: u_vbuf_draw_vbo (u_vbuf.c:1148) ==6970== by 0x227DCD5E: st_draw_vbo (st_draw.c:285) ==6970== by 0x227AF16D: vbo_draw_arrays (vbo_exec_array.c:667) ==6970== Address 0x45864d64 is 18,532 bytes inside an unallocated block of size 20,144 in arena "client" ==6970== gnome-shell: compiler/radeon_variable.c:61: rc_variable_change_dst: Assertion `new_writemask & 8' failed.
COGL_DEBUG=show-source writes this to the console just before the crash:
Cogl-Message: fragment shader: #version 120
#ifdef GL_ES precision highp float; #endif #define COGL_VERSION 100
uniform mat4 cogl_modelview_matrix; uniform mat4 cogl_modelview_projection_matrix; uniform mat4 cogl_projection_matrix;
varying vec4 _cogl_color;
#define cogl_color_in _cogl_color #define cogl_tex_coord_in _cogl_tex_coord
#define cogl_color_out gl_FragColor #define cogl_depth_out gl_FragDepth
#define cogl_front_facing gl_FrontFacing
#define cogl_point_coord gl_PointCoord varying vec4 _cogl_tex_coord[1]; #define cogl_tex_coord0_in _cogl_tex_coord[0] /* * st-scroll-view-fade.glsl: Edge fade effect for StScrollView * * Copyright 2010 Intel Corporation. * Copyright 2011 Adel Gadllah * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU Lesser General Public License, * version 2.1, as published by the Free Software Foundation. * * This program is distributed in the hope it will be useful, but WITHOUT ANY * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for * more details. * * You should have received a copy of the GNU Lesser General Public License * along with this program. If not, see http://www.gnu.org/licenses/. */
uniform sampler2D tex; uniform float height; uniform float width; uniform float vfade_offset; uniform float hfade_offset; uniform bool fade_edges_top; uniform bool fade_edges_right; uniform bool fade_edges_bottom; uniform bool fade_edges_left;
uniform vec2 fade_area_topleft; uniform vec2 fade_area_bottomright;
void main () { cogl_color_out = cogl_color_in * texture2D (tex, vec2 (cogl_tex_coord_in[0].xy));
float y = height * cogl_tex_coord_in[0].y; float x = width * cogl_tex_coord_in[0].x;
/* * We cannot just return here due to a bug in llvmpipe see: * https://bugzilla.freedesktop.org/show_bug.cgi?id=62357 */ if (x > fade_area_topleft[0] && x < fade_area_bottomright[0] && y > fade_area_topleft[1] && y < fade_area_bottomright[1]) { float ratio = 1.0; float fade_bottom_start = fade_area_bottomright[1] - vfade_offset; float fade_right_start = fade_area_bottomright[0] - hfade_offset; bool fade_top = y < vfade_offset && fade_edges_top; bool fade_bottom = y > fade_bottom_start && fade_edges_bottom; bool fade_left = x < hfade_offset && fade_edges_left; bool fade_right = x > fade_right_start && fade_edges_right;
float vfade_scale = height / vfade_offset; if (fade_top) { ratio *= y / vfade_offset; }
if (fade_bottom) { ratio *= (fade_area_bottomright[1] - y) / (fade_area_bottomright[1] - fade_bottom_start); }
float hfade_scale = width / hfade_offset; if (fade_left) { ratio *= x / hfade_offset; }
if (fade_right) { ratio *= (fade_area_bottomright[0] - x) / (fade_area_bottomright[0] - fade_right_start); }
cogl_color_out *= ratio; } }
Segmentation fault (core dumped)