Nouveau - Mar 2018 - [Bug 105629] New: WebGL shader regular update crashes nouveau driver 17.3.3

https://bugs.freedesktop.org/show_bug.cgi?id=105629

            Bug ID: 105629
           Summary: WebGL shader regular update crashes nouveau driver
                    17.3.3
           Product: Mesa
           Version: 17.3
          Hardware: x86-64 (AMD64)
                OS: Linux (All)
            Status: NEW
          Severity: normal
          Priority: medium
         Component: Drivers/DRI/nouveau
          Assignee: nouveau at lists.freedesktop.org
          Reporter: hugues.evrard at graphicsfuzz.com
        QA Contact: nouveau at lists.freedesktop.org

Created attachment 138227
  --> https://bugs.freedesktop.org/attachment.cgi?id=138227&action=edit
Standalone HTML file for reproduction

The repetitive updating + rendering of a fragment shader leads to a crash of
the nouveau driver.

Reproduction steps:
 - OS: Linux 4.13.0-37-generic #42~16.04.1-Ubuntu SMP Wed Mar 7 16:03:28 UTC
2018 x86_64
 - Mesa 17.3.3 (from ppa:ubuntu-x-swat)
 - GPU: NVIDIA Corporation GK107 [GeForce GT 630 OEM] (rev a1)

Using chromium (64.0.3282.167, firefox does not reproduce), visit the html page
attached to that bug report, and wait for approx. 30 times of shader update.
Nouveau crashes with error:

nouveau: kernel rejected pushbuf: No such file or directory
nouveau: ch7: krec 0 pushes 1 bufs 24 relocs 0
nouveau: ch7: buf 00000000 00000004 00000004 00000004 00000000
nouveau: ch7: buf 00000001 00000006 00000004 00000000 00000004
nouveau: ch7: buf 00000002 00000008 00000002 00000002 00000002
...

See attachment for the whole error trace.

Reproduction is non-deterministic as the number of time to render the shader
may vary, but it does crash reliably within the first 50 shader updates
(sometimes less than 20 updates are enough) on my setup.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180320/61824cb0/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105629

--- Comment #1 from Hugues Evrard <hugues.evrard at graphicsfuzz.com> ---
Created attachment 138228
  --> https://bugs.freedesktop.org/attachment.cgi?id=138228&action=edit
Trace of nouveau crash from Chromium output

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180320/8e3453e6/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105629

--- Comment #2 from Ilia Mirkin <imirkin at alum.mit.edu> ---
What's in dmesg when this happens?

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180320/83b5b628/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105629

--- Comment #3 from Hugues Evrard <hugues.evrard at graphicsfuzz.com> ---
This is the two lines of dmesg related to such a crash:

[ 1524.609065] show_signal_msg: 13 callbacks suppressed
[ 1524.609067] chromium-browse[2200]: segfault at 840 ip 00007f66b4a7032c sp
00007ffe7e040960 error 6 in libdrm_nouveau.so.2.0.0[7f66b4a6c000+7000]

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180321/4397dcab/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105629

--- Comment #4 from Ilia Mirkin <imirkin at alum.mit.edu> ---
The long print is a result of an ioctl failure. The kernel will usually print
more information about why the submit ioctl fails in dmesg. What you provided
was the fact that there's a segfault somewhere down the line... ioctl
failures
are very poorly handled by the nouveau 3d driver, so I'm not terribly
surprised.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180321/4edbc983/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105629

--- Comment #5 from Hugues Evrard <hugues.evrard at graphicsfuzz.com> ---
Created attachment 138308
  --> https://bugs.freedesktop.org/attachment.cgi?id=138308&action=edit
Longer dmesg log showing chrome errors

Add a new attachment: longer dmesg trace which shows many duplicate of this
Chrome error just before reporting the segfault in nouveau:

[ 5188.843931] nouveau 0000:01:00.0: chromium-browse[8083]: Unknown handle
0x00000000
[ 5188.843935] nouveau 0000:01:00.0: chromium-browse[8083]: validate_init
[ 5188.843936] nouveau 0000:01:00.0: chromium-browse[8083]: validate: -2
[... the above repeated many times ...]
[ 5195.280913] chromium-browse[8083]: segfault at 4b0 ip 00007f9620a5fd73 sp
00007fffb5af7bc0 error 4 in libdrm_nouveau.so.2.0.0[7f9620a5d000+7000]

Given that I cannot reproduce on Firefox, could it be the case that it is a
Chrome issue?

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20180323/349c8360/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=105629

GitLab Migration User <gitlab-migration at fdo.invalid> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |MOVED

--- Comment #6 from GitLab Migration User <gitlab-migration at
fdo.invalid> ---
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been
closed from further activity.

You can subscribe and participate further through the new bug through this link
to our GitLab instance: https://gitlab.freedesktop.org/mesa/mesa/issues/1153.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20190918/1f9c7773/attachment.html>