[Mesa-dev] [PATCH] i965: Fix segfault in WebGL Conformance on Ivybridge (v2)
Fixes regression of WebGL Conformance test texture-size-limit [1] on Ivybridge Mobile GT2 0x0166 with Google Chrome R38. Regression introduced by commit 6c044231535b93c5d16404528946cad618d96bd9 Author: Kenneth Graunke Date: Sun Feb 2 02:58:42 2014 -0800 i965: Bump GL_MAX_CUBE_MAP_TEXTURE_SIZE to 8192. The test regressed because the pointer offset arithmetic in intel_miptree_map_gtt() overflows for large textures. The pointer arithmetic is not 64-bit safe. [1] https://github.com/KhronosGroup/WebGL/blob/52f0dc240f04dce31b1b8e2b8107fe2b8332dc90/sdk/tests/conformance/textures/texture-size-limit.html Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=78770 Fixes: Intel CHRMOS-1377 Reported-by: Lu Hua Signed-off-by: Chad Versace --- v2: - Simplify diff. Change types of x,y to intptr_t instead of casting intermediate arithmetic expressions to intptr_t. - Remove big TODO comment, because my original TODO comment might be the wrong thing to do :/ src/mesa/drivers/dri/i965/intel_mipmap_tree.c | 7 --- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c index 8fda25d..7081f1d 100644 --- a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c +++ b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c @@ -1745,8 +1745,8 @@ intel_miptree_map_gtt(struct brw_context *brw, unsigned int bw, bh; void *base; unsigned int image_x, image_y; - int x = map->x; - int y = map->y; + intptr_t x = map->x; + intptr_t y = map->y; /* For compressed formats, the stride is the number of bytes per * row of blocks. intel_miptree_get_image_offset() already does @@ -1772,7 +1772,8 @@ intel_miptree_map_gtt(struct brw_context *brw, map->ptr = base + y * map->stride + x * mt->cpp; } - DBG("%s: %d,%d %dx%d from mt %p (%s) %d,%d = %p/%d\n", __FUNCTION__, + DBG("%s: %d,%d %dx%d from mt %p (%s) " + "%"PRIiPTR",%"PRIiPTR" = %p/%d\n", __FUNCTION__, map->x, map->y, map->w, map->h, mt, _mesa_get_format_name(mt->format), x, y, map->ptr, map->stride); -- 2.1.0-rc0 ___ mesa-dev mailing list mesa-dev@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/mesa-dev
Re: [Mesa-dev] [PATCH] i965: Fix segfault in WebGL Conformance on Ivybridge (v2)
That's much simpler. :) Reviewed-by: Ian Romanick On 11/18/2014 04:06 PM, Chad Versace wrote: > Fixes regression of WebGL Conformance test texture-size-limit [1] on > Ivybridge Mobile GT2 0x0166 with Google Chrome R38. > > Regression introduced by > > commit 6c044231535b93c5d16404528946cad618d96bd9 > Author: Kenneth Graunke > Date: Sun Feb 2 02:58:42 2014 -0800 > > i965: Bump GL_MAX_CUBE_MAP_TEXTURE_SIZE to 8192. > > The test regressed because the pointer offset arithmetic in > intel_miptree_map_gtt() overflows for large textures. The pointer > arithmetic is not 64-bit safe. > > [1] > https://github.com/KhronosGroup/WebGL/blob/52f0dc240f04dce31b1b8e2b8107fe2b8332dc90/sdk/tests/conformance/textures/texture-size-limit.html > > Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=78770 > Fixes: Intel CHRMOS-1377 > Reported-by: Lu Hua > Signed-off-by: Chad Versace > --- > > v2: > - Simplify diff. Change types of x,y to intptr_t instead of casting > intermediate arithmetic expressions to intptr_t. > - Remove big TODO comment, because my original TODO comment might be the > wrong thing to do :/ > > src/mesa/drivers/dri/i965/intel_mipmap_tree.c | 7 --- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c > b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c > index 8fda25d..7081f1d 100644 > --- a/src/mesa/drivers/dri/i965/intel_mipmap_tree.c > +++ b/src/mesa/drivers/dri/i965/intel_mipmap_tree.c > @@ -1745,8 +1745,8 @@ intel_miptree_map_gtt(struct brw_context *brw, > unsigned int bw, bh; > void *base; > unsigned int image_x, image_y; > - int x = map->x; > - int y = map->y; > + intptr_t x = map->x; > + intptr_t y = map->y; > > /* For compressed formats, the stride is the number of bytes per > * row of blocks. intel_miptree_get_image_offset() already does > @@ -1772,7 +1772,8 @@ intel_miptree_map_gtt(struct brw_context *brw, >map->ptr = base + y * map->stride + x * mt->cpp; > } > > - DBG("%s: %d,%d %dx%d from mt %p (%s) %d,%d = %p/%d\n", __FUNCTION__, > + DBG("%s: %d,%d %dx%d from mt %p (%s) " > + "%"PRIiPTR",%"PRIiPTR" = %p/%d\n", __FUNCTION__, > map->x, map->y, map->w, map->h, > mt, _mesa_get_format_name(mt->format), > x, y, map->ptr, map->stride); > ___ mesa-dev mailing list mesa-dev@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/mesa-dev
Re: [Mesa-dev] [PATCH] i965: Fix segfault in WebGL Conformance on Ivybridge (v2)
On 19/11/14 00:06, Chad Versace wrote: > Fixes regression of WebGL Conformance test texture-size-limit [1] on > Ivybridge Mobile GT2 0x0166 with Google Chrome R38. > > Regression introduced by > > commit 6c044231535b93c5d16404528946cad618d96bd9 > Author: Kenneth Graunke > Date: Sun Feb 2 02:58:42 2014 -0800 > > i965: Bump GL_MAX_CUBE_MAP_TEXTURE_SIZE to 8192. > > The test regressed because the pointer offset arithmetic in > intel_miptree_map_gtt() overflows for large textures. The pointer > arithmetic is not 64-bit safe. > > [1] > https://github.com/KhronosGroup/WebGL/blob/52f0dc240f04dce31b1b8e2b8107fe2b8332dc90/sdk/tests/conformance/textures/texture-size-limit.html > Seems like the offending commit got in during the 10.2 devel cycle. Please slap the mesa-stable tag, before committing :) Cc: "10.3 10.4" ___ mesa-dev mailing list mesa-dev@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/mesa-dev
Re: [Mesa-dev] [PATCH] i965: Fix segfault in WebGL Conformance on Ivybridge (v2)
Committed, with Cc stable tags in message. ___ mesa-dev mailing list mesa-dev@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/mesa-dev