[Mesa-dev] [PATCH] i965: Fix segfault in WebGL Conformance on Ivybridge (v2)
Fixes regression of WebGL Conformance test texture-size-limit [1] on
Ivybridge Mobile GT2 0x0166 with Google Chrome R38.
Regression introduced by
commit 6c044231535b93c5d16404528946cad618d96bd9
Author: Kenneth Graunke
Date: Sun Feb 2 02:58:42 2014 -0800
i965: Bump GL_MAX_CUBE_MAP_TEXTURE_SIZE to 8192.
The test regressed because the pointer offset arithmetic in
intel_miptree_map_gtt() overflows for large textures. The pointer
arithmetic is not 64-bit safe.
[1]
https://github.com/KhronosGroup/WebGL/blob/52f0dc240f04dce31b1b8e2b8107fe2b8332dc90/sdk/tests/conformance/textures/texture-size-limit.html
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=78770
Fixes: Intel CHRMOS-1377
Reported-by: Lu Hua
Signed-off-by: Chad Versace
---
v2:
- Simplify diff. Change types of x,y to intptr_t instead of casting
intermediate arithmetic expressions to intptr_t.
- Remove big TODO comment, because my original TODO comment might be the
wrong thing to do :/
src/mesa/drivers/dri/i965/intel_mipmap_tree.c | 7 ---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
index 8fda25d..7081f1d 100644
--- a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
+++ b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
@@ -1745,8 +1745,8 @@ intel_miptree_map_gtt(struct brw_context *brw,
unsigned int bw, bh;
void *base;
unsigned int image_x, image_y;
- int x = map->x;
- int y = map->y;
+ intptr_t x = map->x;
+ intptr_t y = map->y;
/* For compressed formats, the stride is the number of bytes per
* row of blocks. intel_miptree_get_image_offset() already does
@@ -1772,7 +1772,8 @@ intel_miptree_map_gtt(struct brw_context *brw,
map->ptr = base + y * map->stride + x * mt->cpp;
}
- DBG("%s: %d,%d %dx%d from mt %p (%s) %d,%d = %p/%d\n", __FUNCTION__,
+ DBG("%s: %d,%d %dx%d from mt %p (%s) "
+ "%"PRIiPTR",%"PRIiPTR" = %p/%d\n", __FUNCTION__,
map->x, map->y, map->w, map->h,
mt, _mesa_get_format_name(mt->format),
x, y, map->ptr, map->stride);
--
2.1.0-rc0
___
mesa-dev mailing list
mesa-dev@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/mesa-dev
Re: [Mesa-dev] [PATCH] i965: Fix segfault in WebGL Conformance on Ivybridge (v2)
That's much simpler. :)
Reviewed-by: Ian Romanick
On 11/18/2014 04:06 PM, Chad Versace wrote:
> Fixes regression of WebGL Conformance test texture-size-limit [1] on
> Ivybridge Mobile GT2 0x0166 with Google Chrome R38.
>
> Regression introduced by
>
> commit 6c044231535b93c5d16404528946cad618d96bd9
> Author: Kenneth Graunke
> Date: Sun Feb 2 02:58:42 2014 -0800
>
> i965: Bump GL_MAX_CUBE_MAP_TEXTURE_SIZE to 8192.
>
> The test regressed because the pointer offset arithmetic in
> intel_miptree_map_gtt() overflows for large textures. The pointer
> arithmetic is not 64-bit safe.
>
> [1]
> https://github.com/KhronosGroup/WebGL/blob/52f0dc240f04dce31b1b8e2b8107fe2b8332dc90/sdk/tests/conformance/textures/texture-size-limit.html
>
> Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=78770
> Fixes: Intel CHRMOS-1377
> Reported-by: Lu Hua
> Signed-off-by: Chad Versace
> ---
>
> v2:
> - Simplify diff. Change types of x,y to intptr_t instead of casting
> intermediate arithmetic expressions to intptr_t.
> - Remove big TODO comment, because my original TODO comment might be the
> wrong thing to do :/
>
> src/mesa/drivers/dri/i965/intel_mipmap_tree.c | 7 ---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
> b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
> index 8fda25d..7081f1d 100644
> --- a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
> +++ b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c
> @@ -1745,8 +1745,8 @@ intel_miptree_map_gtt(struct brw_context *brw,
> unsigned int bw, bh;
> void *base;
> unsigned int image_x, image_y;
> - int x = map->x;
> - int y = map->y;
> + intptr_t x = map->x;
> + intptr_t y = map->y;
>
> /* For compressed formats, the stride is the number of bytes per
> * row of blocks. intel_miptree_get_image_offset() already does
> @@ -1772,7 +1772,8 @@ intel_miptree_map_gtt(struct brw_context *brw,
>map->ptr = base + y * map->stride + x * mt->cpp;
> }
>
> - DBG("%s: %d,%d %dx%d from mt %p (%s) %d,%d = %p/%d\n", __FUNCTION__,
> + DBG("%s: %d,%d %dx%d from mt %p (%s) "
> + "%"PRIiPTR",%"PRIiPTR" = %p/%d\n", __FUNCTION__,
> map->x, map->y, map->w, map->h,
> mt, _mesa_get_format_name(mt->format),
> x, y, map->ptr, map->stride);
>
___
mesa-dev mailing list
mesa-dev@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/mesa-dev
Re: [Mesa-dev] [PATCH] i965: Fix segfault in WebGL Conformance on Ivybridge (v2)
On 19/11/14 00:06, Chad Versace wrote: > Fixes regression of WebGL Conformance test texture-size-limit [1] on > Ivybridge Mobile GT2 0x0166 with Google Chrome R38. > > Regression introduced by > > commit 6c044231535b93c5d16404528946cad618d96bd9 > Author: Kenneth Graunke > Date: Sun Feb 2 02:58:42 2014 -0800 > > i965: Bump GL_MAX_CUBE_MAP_TEXTURE_SIZE to 8192. > > The test regressed because the pointer offset arithmetic in > intel_miptree_map_gtt() overflows for large textures. The pointer > arithmetic is not 64-bit safe. > > [1] > https://github.com/KhronosGroup/WebGL/blob/52f0dc240f04dce31b1b8e2b8107fe2b8332dc90/sdk/tests/conformance/textures/texture-size-limit.html > Seems like the offending commit got in during the 10.2 devel cycle. Please slap the mesa-stable tag, before committing :) Cc: "10.3 10.4" ___ mesa-dev mailing list mesa-dev@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/mesa-dev
Re: [Mesa-dev] [PATCH] i965: Fix segfault in WebGL Conformance on Ivybridge (v2)
Committed, with Cc stable tags in message. ___ mesa-dev mailing list mesa-dev@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/mesa-dev
