Hi,

I'm executing a test of piglit package: arb_separate_shader_object-mix-and-match-tcs-tes
https://sources.debian.org/src/piglit/0%7Egit20200212-f4710c51b-1/tests/spec/arb_separate_shader_objects/mix-and-match-tcs-tes.c/

this test read and sum a value of an undefined (not allocated) vector and then crash.

Note: I have executed all the tests with packages of Debian Bullseye (testing). When I start to report the bug I see that there is a new version in unstable and experimental. I intalled the new version in unstable and the error reported here is already present. I don't have try the experimental one, because I see it is a lover version.

Note: I have report a bug in libdrm2 package and I'm executing with the patch I have suggested in bug #975658. So if you execute the same following instruction, with my same video board, but without the patch you will see a different resoult (you have to set no the --exit-on-first-error parameter to see the error)

$ valgrind --num-callers=50 --exit-on-first-error=yes --keep-debuginfo=yes bin/arb_separate_shader_object-mix-and-match-tcs-tes

==26309== Invalid read of size 4
==26309==    at 0x6A8381F: ??? (in /usr/lib/x86_64-linux-gnu/dri/r600_dri.so)
==26309==    by 0x6A387CD: ??? (in /usr/lib/x86_64-linux-gnu/dri/r600_dri.so)
==26309==    by 0x645AD57: ??? (in /usr/lib/x86_64-linux-gnu/dri/r600_dri.so)
==26309==    by 0x6699B83: ??? (in /usr/lib/x86_64-linux-gnu/dri/r600_dri.so)
==32743==    by 0x10A30F: piglit_display (mix-and-match-tcs-tes.c:167)
==26309==    by 0x49E0C9A: process_next_event (piglit_x11_framework.c:137)
==26309==    by 0x49E0C9A: enter_event_loop (piglit_x11_framework.c:153)
==26309==    by 0x49E0614: run_test (piglit_winsys_framework.c:88)
==32743==    by 0x49D4751: piglit_gl_test_run (piglit-framework-gl.c:229)
==26309==    by 0x10A1A1: main (mix-and-match-tcs-tes.c:77)
==26309==  Address 0x8 is not stack'd, malloc'd or (recently) free'd

after installing the libgl1-mesa-dri-dbgsym package:

==32743== Invalid read of size 4
==32743==    at 0x6A8381F: r600_need_cs_space (r600_hw_context.c:58)
==32743==    by 0x6A387CD: r600_draw_vbo (r600_state_common.c:2212)
==32743==    by 0x645AD57: st_draw_vbo (st_draw.c:266)
==32743==    by 0x6699B83: UnknownInlinedFun (draw.c:367)
==32743==    by 0x6699B83: _mesa_draw_arrays.constprop.0 (draw.c:348)
==32743==    by 0x10A30F: piglit_display (mix-and-match-tcs-tes.c:167)
==32743==    by 0x49E0AFA: process_next_event (piglit_x11_framework.c:137)
==32743==    by 0x49E0AFA: enter_event_loop (piglit_x11_framework.c:153)
==32743==    by 0x49E0384: run_test (piglit_winsys_framework.c:88)
==32743==    by 0x49D4751: piglit_gl_test_run (piglit-framework-gl.c:229)
==32743==    by 0x10A191: main (mix-and-match-tcs-tes.c:77)
==32743==  Address 0x8 is not stack'd, malloc'd or (recently) free'd


the error is on the line:
num_dw += ctx->atoms[u_bit_scan64(&mask)]->num_dw;

and ctx->atoms[u_bit_scan64(&mask)]->num_dw is unsigned and it has size 4.
So probably here num_dw is summed with a random value.

mask is initialized with the previous instruction:
mask = ctx->dirty_atoms;
and ctx->dirty_atoms contains the values 328273889281

but with that values the u_bit_scan64(&mask) return 0
and ctx->atoms[0] is not defined
I have see that are defined all values between 1 and 39
and are not defined values 0 and between 40 and 55

I don't know how it work and so I don't understand why some values can cause this problem, but I think that the library must manage this problem and not access an undefined values.

This is the content of atoms[] when it crash:

{
  0
  {
    emit =
    num_dw =
    id =
  }
  1
  {
    emit = 0x7ffff5a2f0e0 <r600_emit_framebuffer_state>
    num_dw = 52
    id = 1
  }
  2
  {
    emit = 0x7ffff5a2e530 <r600_emit_vs_constant_buffers>
    num_dw = 0
    id = 2
  }
  3
  {
    emit = 0x7ffff5a2e510 <r600_emit_gs_constant_buffers>
    num_dw = 0
    id = 3
  }
  4
  {
    emit = 0x7ffff5a2e4f0 <r600_emit_ps_constant_buffers>
    num_dw = 19
    id = 4
  }
  5
  {
    emit = 0x7ffff5a2dd00 <r600_emit_vs_sampler_states>
    num_dw = 0
    id = 5
  }
  6
  {
    emit = 0x7ffff5a2dd20 <r600_emit_gs_sampler_states>
    num_dw = 0
    id = 6
  }
  7
  {
    emit = 0x7ffff5a2dd40 <r600_emit_ps_sampler_states>
    num_dw = 0
    id = 7
  }
  8
  {
    emit = 0x7ffff5a2def0 <r600_emit_vs_sampler_views>
    num_dw = 0
    id = 8
  }
  9
  {
    emit = 0x7ffff5a2ded0 <r600_emit_gs_sampler_views>
    num_dw = 0
    id = 9
  }
  10
  {
    emit = 0x7ffff5a2deb0 <r600_emit_ps_sampler_views>
    num_dw = 0
    id = 10
  }
  11
  {
    emit = 0x7ffff5a2d270 <r600_emit_vertex_buffers>
    num_dw = 11
    id = 11
  }
  12
  {
    emit = 0x7ffff5a364b0 <r600_emit_vgt_state>
    num_dw = 10
    id = 12
  }
  13
  {
    emit = 0x7ffff5a2e0d0 <r600_emit_seamless_cube_map>
    num_dw = 3
    id = 13
  }
  14
  {
    emit = 0x7ffff5a2e210 <r600_emit_sample_mask>
    num_dw = 3
    id = 14
  }
  15
  {
    emit = 0x7ffff5a363a0 <r600_emit_alphatest_state>
    num_dw = 6
    id = 15
  }
  16
  {
    emit = 0x7ffff5a36440 <r600_emit_blend_color>
    num_dw = 6
    id = 16
  }
  17
  {
    emit = 0x7ffff5a36360 <r600_emit_cso_state>
    num_dw = 3
    id = 17
  }
  18
  {
    emit = 0x7ffff5a2ed70 <r600_emit_cb_misc_state>
    num_dw = 7
    id = 18
  }
  19
  {
    emit = 0x7ffff5a39dc0 <r600_emit_clip_misc_state>
    num_dw = 6
    id = 19
  }
  20
  {
    emit = 0x7ffff5a2e190 <r600_emit_clip_state>
    num_dw = 26
    id = 20
  }
  21
  {
    emit = 0x7ffff5a2e7d0 <r600_emit_db_misc_state>
    num_dw = 7
    id = 21
  }
  22
  {
    emit = 0x7ffff5a2ec40 <r600_emit_db_state>
    num_dw = 11
    id = 22
  }
  23
  {
    emit = 0x7ffff5a36360 <r600_emit_cso_state>
    num_dw = 3
    id = 23
  }
  24
  {
    emit = 0x7ffff5a2e630 <r600_emit_polygon_offset>
    num_dw = 9
    id = 24
  }
  25
  {
    emit = 0x7ffff5a36360 <r600_emit_cso_state>
    num_dw = 20
    id = 25
  }
  26
  {
    emit = 0x7ffff5a48530 <r600_emit_scissors>
    num_dw = 40
    id = 26
  }
  27
  {
    emit = 0x7ffff5a48150 <r600_emit_viewport_states>
    num_dw = 98
    id = 27
  }
  28
  {
    emit = 0x7ffff5a2e120 <r600_emit_config_state>
    num_dw = 3
    id = 28
  }
  29
  {
    emit = 0x7ffff5a36560 <r600_emit_stencil_ref>
    num_dw = 4
    id = 29
  }
  30
  {
    emit = 0x7ffff5a2e720 <r600_emit_vertex_fetch_shader>
    num_dw = 5
    id = 30
  }
  31
  {
    emit = 0x7ffff5a40460 <r600_emit_query_predication>
    num_dw = 0
    id = 31
  }
  32
  {
    emit = 0x7ffff5a42570 <r600_emit_streamout_begin>
    num_dw = 0
    id = 32
  }
  33
  {
    emit = 0x7ffff5a42420 <r600_emit_streamout_enable>
    num_dw = 6
    id = 33
  }
  34
  {
    emit = 0x7ffff5a3a030 <r600_emit_shader>
    num_dw = 17
    id = 34
  }
  35
  {
    emit = 0x7ffff5a3a030 <r600_emit_shader>
    num_dw = 24
    id = 35
  }
  36
  {
    emit = 0x7ffff5a3a030 <r600_emit_shader>
    num_dw = 0
    id = 36
  }
  37
  {
    emit = 0x7ffff5a3a030 <r600_emit_shader>
    num_dw = 0
    id = 37
  }
  38
  {
    emit = 0x7ffff5a2e550 <r600_emit_shader_stages>
    num_dw = 0
    id = 38
  }
  39
  {
    emit = 0x7ffff5a2e9d0 <r600_emit_gs_rings>
    num_dw = 0
    id = 39
  }
  40
  {
    emit =
    num_dw =
    id =
  }
  41
  {
    emit =
    num_dw =
    id =
  }
  42
  {
    emit =
    num_dw =
    id =
  }
  43
  {
    emit =
    num_dw =
    id =
  }
  44
  {
    emit =
    num_dw =
    id =
  }
  45
  {
    emit =
    num_dw =
    id =
  }
  46
  {
    emit =
    num_dw =
    id =
  }
  47
  {
    emit =
    num_dw =
    id =
  }
  48
  {
    emit =
    num_dw =
    id =
  }
  49
  {
    emit =
    num_dw =
    id =
  }
  50
  {
    emit =
    num_dw =
    id =
  }
  51
  {
    emit =
    num_dw =
    id =
  }
  52
  {
    emit =
    num_dw =
    id =
  }
  53
  {
    emit =
    num_dw =
    id =
  }
  54
  {
    emit =
    num_dw =
    id =
  }
  55
  {
    emit =
    num_dw =
    id =
  }
}

Ciao
Davide