https://bugs.freedesktop.org/show_bug.cgi?id=44694

Bug #: 44694 Summary: Crash in WebGL Path Tracing demo on Mesa 7.11 / Gallium 0.4 AMD RV710, in src_register called from translate_src Classification: Unclassified Product: Mesa Version: unspecified Platform: x86-64 (AMD64) OS/Version: Linux (All) Status: NEW Severity: normal Priority: medium Component: Drivers/Gallium/r600 AssignedTo: dri-devel@lists.freedesktop.org ReportedBy: bjacob@mozilla.com

My setup: Ubuntu 11.10 x86_64, Mesa 7.11, Gallium 0.4 on AMD RV710.

Steps to reproduce: in Firefox (I'm on Firefox 12 / Nightly but that shouldn't matter), go to this URL:

http://madebyevan.com/webgl-path-tracing/

Result:

Program received signal SIGSEGV, Segmentation fault. 0x00007fffcc851f32 in src_register (t=0x7fffffff88e0, file=PROGRAM_CONSTANT, index=<optimized out>) at state_tracker/st_mesa_to_tgsi.c:243 243 state_tracker/st_mesa_to_tgsi.c: No such file or directory. in state_tracker/st_mesa_to_tgsi.c (gdb) bt #0 0x00007fffcc851f32 in src_register (t=0x7fffffff88e0, file=PROGRAM_CONSTANT, index=<optimized out>) at state_tracker/st_mesa_to_tgsi.c:243 #1 0x00007fffcc8520fc in translate_src (t=0x7fffffff88e0, SrcReg=0x7fffce3ef044) at state_tracker/st_mesa_to_tgsi.c:330 #2 0x00007fffcc855c1d in compile_instruction (inst=0x7fffce3ef040, t=0x7fffffff88e0) at state_tracker/st_mesa_to_tgsi.c:678 #3 st_translate_mesa_program (ctx=0x7fffcfb8600c, procType=<optimized out>, ureg=<optimized out>, program=<optimized out>, numInputs=<optimized out>, inputMapping=<optimized out>, inputSemanticName=0x7fffffff9e00 "", inputSemanticIndex=0x7fffffff9e20 "", interpMode=0x7fffffff9cc0, numOutputs=1, outputMapping=0x7fffffff9dc0, outputSemanticName=0x7fffffff9e40 "\001\313o\321\377\177", outputSemanticIndex=0x7fffffff9e60 "", passthrough_edgeflags=0 '\000') at state_tracker/st_mesa_to_tgsi.c:1230 #4 0x00007fffcc859700 in st_translate_fragment_program (st=0x7fffcf132000, stfp=0x7fffcee25000, key=0x7fffffff9ee0) at state_tracker/st_program.c:609 #5 0x00007fffcc85a54b in st_get_fp_variant (st=<optimized out>, stfp=0x7fffcee25000, key=<optimized out>) at state_tracker/st_program.c:667 #6 0x00007fffcc83c22c in update_fp (st=0x7fffcf132000) at state_tracker/st_atom_shader.c:86 #7 0x00007fffcc839d0f in st_validate_state (st=0x7fffcf132000) at state_tracker/st_atom.c:197 ---Type <return> to continue, or q <return> to quit--- #8 0x00007fffcc84cfb5 in st_draw_vbo (ctx=0x7fffcfb86000, arrays=0x7fffcfba0068, prims=0x7fffffff9fe0, nr_prims=1, ib=0x0, index_bounds_valid=<optimized out>, min_index=0, max_index=3) at state_tracker/st_draw.c:700 #9 0x00007fffccf5f8bb in vbo_draw_arrays (ctx=0x7fffcfb86000, mode=5, start=0, count=<optimized out>, numInstances=1) at vbo/vbo_exec_array.c:640 #10 0x00007ffff29a8fcf in mozilla::gl::GLContext::raw_fDrawArrays (this= 0x7fffcfcc1800, mode=5, first=0, count=4) at ../../../dist/include/GLContext.h:1872 #11 0x00007ffff29a86b2 in mozilla::gl::GLContext::fDrawArrays ( this=0x7fffcfcc1800, mode=5, first=0, count=4) at ../../../dist/include/GLContext.h:1006 #12 0x00007ffff29b31b6 in mozilla::WebGLContext::DrawArrays (this= 0x7fffd26b7800, mode=5, first=0, count=4) at /home/bjacob/mozilla-central/content/canvas/src/WebGLContextGL.cpp:1600

#13 0x00007ffff324a44f in nsIDOMWebGLRenderingContext_DrawArrays (cx= 0x7fffd90f2660, argc=3, vp=0x7fffde5fe340) at /home/bjacob/mozilla-central/obj-firefox-debug/js/xpconnect/src/dom_quickstubs.cpp:24893 #14 0x00007ffff3e967fd in js::CallJSNative (cx=0x7fffd90f2660, native=0x7ffff324a2d2 <nsIDOMWebGLRenderingContext_DrawArrays(JSContext*, uintN, jsval*)>, args=...) at /home/bjacob/mozilla-central/js/src/jscntxtinlines.h:311 ---Type <return> to continue, or q <return> to quit--- #15 0x00007ffff3e7b528 in js::InvokeKernel (cx=0x7fffd90f2660, args=..., construct=js::NO_CONSTRUCT) at /home/bjacob/mozilla-central/js/src/jsinterp.cpp:520 #16 0x00007ffff3e88e90 in js::Interpret (cx=0x7fffd90f2660, entryFrame=0x7fffde5fe0b0, interpMode=js::JSINTERP_NORMAL) at /home/bjacob/mozilla-central/js/src/jsinterp.cpp:3013 #17 0x00007ffff3e7b2dc in js::RunScript (cx=0x7fffd90f2660, script=0x7fffd21f6f18, fp=0x7fffde5fe0b0) at /home/bjacob/mozilla-central/js/src/jsinterp.cpp:475 #18 0x00007ffff3e7b619 in js::InvokeKernel (cx=0x7fffd90f2660, args=..., construct=js::NO_CONSTRUCT) at /home/bjacob/mozilla-central/js/src/jsinterp.cpp:538 #19 0x00007ffff3de1a41 in js::Invoke (cx=0x7fffd90f2660, args=..., construct=js::NO_CONSTRUCT) at /home/bjacob/mozilla-central/js/src/jsinterp.h:157 #20 0x00007ffff3e7b802 in js::Invoke (cx=0x7fffd90f2660, thisv=..., fval=..., argc=1, argv=0x7fffd144b788, rval=0x7fffffffb400) at /home/bjacob/mozilla-central/js/src/jsinterp.cpp:570 #21 0x00007ffff3dc0276 in JS_CallFunctionValue (cx=0x7fffd90f2660, obj=0x7fffd21ca060, fval=..., argc=1, argv=0x7fffd144b788, rval=0x7fffffffb400) at /home/bjacob/mozilla-central/js/src/jsapi.cpp:5468 #22 0x00007ffff2c3e013 in nsJSContext::CallEventHandler (this=0x7fffd9c7eef0, aTarget=0x7fffce77b400, aScope=0x7fffd21ca060, aHandler=0x7fffd195fd60, ---Type <return> to continue, or q <return> to quit--- aargv=0x7fffce3aafc8, arv=0x7fffffffb6d0) at /home/bjacob/mozilla-central/dom/base/nsJSEnvironment.cpp:1962 #23 0x00007ffff2c7c03a in nsGlobalWindow::RunTimeout (this=0x7fffce77b400, aTimeout=0x7fffce278160) at /home/bjacob/mozilla-central/dom/base/nsGlobalWindow.cpp:9292 #24 0x00007ffff2c7cfc6 in nsGlobalWindow::TimerCallback (aTimer= 0x7fffce3a5aa0, aClosure=0x7fffce278160) at /home/bjacob/mozilla-central/dom/base/nsGlobalWindow.cpp:9680 #25 0x00007ffff394eb15 in nsTimerImpl::Fire (this=0x7fffce3a5aa0) at /home/bjacob/mozilla-central/xpcom/threads/nsTimerImpl.cpp:428 #26 0x00007ffff394ef19 in nsTimerEvent::Run (this=0x7fffcfb6c3a0) at /home/bjacob/mozilla-central/xpcom/threads/nsTimerImpl.cpp:524 #27 0x00007ffff39471df in nsThread::ProcessNextEvent (this=0x7ffff6d5dc60, mayWait=false, result=0x7fffffffba0f) at /home/bjacob/mozilla-central/xpcom/threads/nsThread.cpp:660 #28 0x00007ffff38da1e5 in NS_ProcessNextEvent_P (thread=0x7ffff6d5dc60, mayWait=false) at /home/bjacob/mozilla-central/obj-firefox-debug/xpcom/build/nsThreadUtils.cpp:245 #29 0x00007ffff37b8492 in mozilla::ipc::MessagePump::Run (this=0x7fffe874f240, aDelegate=0x7ffff6dd6a80) at /home/bjacob/mozilla-central/ipc/glue/MessagePump.cpp:110 #30 0x00007ffff39986bf in MessageLoop::RunInternal (this=0x7ffff6dd6a80) ---Type <return> to continue, or q <return> to quit--- at /home/bjacob/mozilla-central/ipc/chromium/src/base/message_loop.cc:208 #31 0x00007ffff3998650 in MessageLoop::RunHandler (this=0x7ffff6dd6a80) at /home/bjacob/mozilla-central/ipc/chromium/src/base/message_loop.cc:201 #32 0x00007ffff3998629 in MessageLoop::Run (this=0x7ffff6dd6a80) at /home/bjacob/mozilla-central/ipc/chromium/src/base/message_loop.cc:175 #33 0x00007ffff3654a0e in nsBaseAppShell::Run (this=0x7fffe3d84cf0) at /home/bjacob/mozilla-central/widget/xpwidgets/nsBaseAppShell.cpp:189 #34 0x00007ffff339a966 in nsAppStartup::Run (this=0x7fffe3de47e0) at /home/bjacob/mozilla-central/toolkit/components/startup/nsAppStartup.cpp:220 #35 0x00007ffff21d443f in XRE_main (argc=4, argv=0x7fffffffe6b8, aAppData=0x623c60) at /home/bjacob/mozilla-central/toolkit/xre/nsAppRunner.cpp:3537 #36 0x00000000004023f9 in do_main ( exePath=0x7fffffffd5b0 "/home/bjacob/mozilla-central/obj-firefox-debug/dist/bin/", argc=4, argv=0x7fffffffe6b8) at /home/bjacob/mozilla-central/browser/app/nsBrowserApp.cpp:205 #37 0x0000000000402660 in main (argc=4, argv=0x7fffffffe6b8) at /home/bjacob/mozilla-central/browser/app/nsBrowserApp.cpp:295