Bug 1580019

Summary: Google maps 3D view not avaiable on mesa 18.0.2 ([AMD/ATI] Cypress XT [Radeon HD 5870])
Product: [Fedora] Fedora Reporter: Uros Bizjak <ubizjak>
Component: mesaAssignee: Adam Jackson <ajax>
Status: CLOSED EOL QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 28CC: ajax, alexl, bskeggs, caillon+fedoraproject, fschwarz, igor.raits, jglisse, john.j5live, michal.spondr, rclark, rhughes, rstrode, thatslyude
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-05-28 22:00:29 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Uros Bizjak 2018-05-19 07:37:18 UTC
Description of problem:

There is no 3D view in google maps with mesa 18.0.2 ([AMD/ATI] Cypress XT [Radeon HD 5870]). It is a regression from Fedora 27, where 3D view worked without problems. Firefox doesn't report anything, but Chrome reports "Rats! WebGL hit a snag." (which can be ignored, but still no 3D view).

Version-Release number of selected component (if applicable):

OpenGL vendor string: X.Org
OpenGL renderer string: AMD CYPRESS (DRM 2.50.0 / 4.16.8-300.fc28.x86_64, LLVM 6.0.0)
OpenGL core profile version string: 4.3 (Core Profile) Mesa 18.0.2
OpenGL core profile shading language version string: 4.30

03:00.0 VGA compatible controller: Advanced Micro Devices, Inc. [AMD/ATI] Cypress XT [Radeon HD 5870] (prog-if 00 [VGA controller])
        Subsystem: Gigabyte Technology Co., Ltd Device 21e5
        Flags: bus master, fast devsel, latency 0, IRQ 42
        Memory at d0000000 (64-bit, prefetchable) [size=256M]
        Memory at e0300000 (64-bit, non-prefetchable) [size=128K]
        I/O ports at 4000 [size=256]
        Expansion ROM at 000c0000 [disabled] [size=128K]
        Capabilities: [50] Power Management version 3
        Capabilities: [58] Express Legacy Endpoint, MSI 00
        Capabilities: [a0] MSI: Enable+ Count=1/1 Maskable- 64bit+
        Capabilities: [100] Vendor Specific Information: ID=0001 Rev=1 Len=010 <?>
        Capabilities: [150] Advanced Error Reporting
        Kernel driver in use: radeon
        Kernel modules: radeon

How reproducible:

Always.

Steps to Reproduce:
1. Start Firefox or Google Chrome
2. Go to maps.google.com (Notice error report with Chrome (nothing with Firefox))
3. Click satellite view

Actual results:

In the bottom status line, Google maps on Firefox says "3D Earth view is not available" and there is no 3D functionality.

Expected results:

3D works as it worked in Fedora 27 with Mesa 17.3.6.

Additional info:

A regression from Fedora 27.

Comment 1 Michal Špondr 2018-05-31 09:24:34 UTC
I think I have similar issue. WebGL stopped working for me recently. http://webglreport.com returns "× This browser supports WebGL 1, but it is disabled or unavailable."

Running latest Fedora 28, upgraded from Fedora 27.

Comment 2 Uros Bizjak 2018-06-26 15:34:34 UTC
Some more info: when running firefox from command line, I get:

/usr/include/c++/8/bits/stl_vector.h:932: std::vector<_Tp, _Alloc>::reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) [with _Tp = r600_sb::value*; _Alloc = std::allocator<r600_sb::value*>; std::vector<_Tp, _Alloc>::reference = r600_sb::value*&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.
Redirecting call to abort() to mozalloc_abort

[Parent 4324, Gecko_IOThread] WARNING: pipe error (58): Connection reset by peer: file /builddir/build/BUILD/firefox-60.0.2/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 353

###!!! [Parent][MessageChannel] Error: (msgtype=0x15007F,name=PBrowser::Msg_Destroy) Channel error: cannot send/recv

Comment 3 Uros Bizjak 2018-06-26 15:38:05 UTC
Calling firefox with R600_DEBUG=nosb works OK.

Comment 4 Uros Bizjak 2018-06-26 15:53:23 UTC
The assert is the same as in upstream report [1].

[1] https://bugs.freedesktop.org/show_bug.cgi?id=106928

Comment 5 Uros Bizjak 2018-06-26 16:04:40 UTC
The backtrace from the gdb, attached to firefox:

(gdb) bt
#0  0x000055ddca6584b2 in mozalloc_abort(char const*) ()
#1  0x000055ddca64c7b6 in mozilla::detail::ConditionVariableImpl::ConditionVariableImpl() [clone .cold.16] ()
#2  0x00007fdf27c23965 in r600_sb::expr_handler::fold_alu_op3(r600_sb::alu_node&) () at /usr/lib64/dri/r600_dri.so
#3  0x00007fdf27c200cd in r600_sb::expr_handler::try_fold(r600_sb::value*) () at /usr/lib64/dri/r600_dri.so
#4  0x00007fdf27c423fc in r600_sb::value_table::add_value(r600_sb::value*) () at /usr/lib64/dri/r600_dri.so
#5  0x00007fdf27c27381 in r600_sb::gvn::process_op(r600_sb::node&, bool) () at /usr/lib64/dri/r600_dri.so
#6  0x00007fdf27c2756e in r600_sb::gvn::visit(r600_sb::alu_node&, bool) () at /usr/lib64/dri/r600_dri.so
#7  0x00007fdf27c2b570 in r600_sb::vpass::run_on(r600_sb::container_node&) () at /usr/lib64/dri/r600_dri.so
#8  0x00007fdf27c2b651 in r600_sb::vpass::run() () at /usr/lib64/dri/r600_dri.so
#9  0x00007fdf27c1b0ba in r600_sb_bytecode_process () at /usr/lib64/dri/r600_dri.so
#10 0x00007fdf27be7bcd in r600_pipe_shader_create () at /usr/lib64/dri/r600_dri.so
#11 0x00007fdf27bf1e64 in r600_shader_select () at /usr/lib64/dri/r600_dri.so
#12 0x00007fdf27bf3077 in r600_draw_vbo () at /usr/lib64/dri/r600_dri.so
#13 0x00007fdf279d2710 in u_vbuf_draw_vbo () at /usr/lib64/dri/r600_dri.so
#14 0x00007fdf277bda2f in st_draw_vbo () at /usr/lib64/dri/r600_dri.so
#15 0x00007fdf2778270b in vbo_draw_arrays () at /usr/lib64/dri/r600_dri.so
#16 0x00007fdf2778279a in vbo_exec_DrawArraysInstanced () at /usr/lib64/dri/r600_dri.so
#17 0x00007fe109092855 in mozilla::WebGLContext::DrawArraysInstanced(unsigned int, int, int, int, char const*) () at /usr/lib64/firefox/libxul.so
#18 0x00007fe108d2f967 in mozilla::dom::WebGLRenderingContextBinding::drawArrays(JSContext*, JS::Handle<JSObject*>, mozilla::WebGLContext*, JSJitMethodCallArgs const&) () at /usr/lib64/firefox/libxul.so
#19 0x00007fe10900e1c9 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) () at /usr/lib64/firefox/libxul.so

Comment 6 Uros Bizjak 2018-06-26 16:14:31 UTC
Following is the backtrace with full debug info:

Thread 1 "firefox" received signal SIGSEGV, Segmentation fault.
0x000055649a0f04b2 in mozalloc_abort(char const*) ()
(gdb) bt
#0  0x000055649a0f04b2 in mozalloc_abort(char const*) ()
#1  0x000055649a0e47b6 in mozilla::detail::ConditionVariableImpl::ConditionVariableImpl() [clone .cold.16] ()
#2  0x00007f9da3761965 in std::__replacement_assert(char const*, int, char const*, char const*) (__condition=0x7f9da3978638 "__builtin_expect(__n < this->size(), true)", __function=<synthetic pointer>, __line=932, __file=0x7f9da397a4a0 "/usr/include/c++/8/bits/stl_vector.h")
    at /usr/include/c++/8/x86_64-redhat-linux/bits/c++config.h:2389
#3  0x00007f9da3761965 in std::vector<r600_sb::value*, std::allocator<r600_sb::value*> >::operator[](unsigned long) (__n=2, this=0x7f9dab123820)
    at /usr/include/c++/8/bits/stl_vector.h:932
#4  0x00007f9da3761965 in r600_sb::expr_handler::fold_alu_op3(r600_sb::alu_node&) (this=0x7f9ddbbedea8, n=...) at sb/sb_expr.cpp:951
#5  0x00007f9da375e0cd in r600_sb::expr_handler::try_fold(r600_sb::node*) (n=<optimized out>, this=<optimized out>) at sb/sb_expr.cpp:145
#6  0x00007f9da375e0cd in r600_sb::expr_handler::try_fold(r600_sb::value*) (this=<optimized out>, v=0x7f9dab1386f0) at sb/sb_expr.cpp:136
#7  0x00007f9da37803fc in r600_sb::value_table::add_value(r600_sb::value*) (this=0x7f9ddbbede70, v=<optimized out>, v@entry=0x7f9dab1386f0)
    at sb/sb_valtable.cpp:149
#8  0x00007f9da3765381 in r600_sb::gvn::process_op(r600_sb::node&, bool) (this=0x7fff9da76b30, n=..., rewrite=rewrite@entry=true) at sb/sb_gvn.cpp:222
#9  0x00007f9da376556e in r600_sb::gvn::visit(r600_sb::alu_node&, bool) (this=<optimized out>, n=..., enter=<optimized out>) at sb/sb_gvn.cpp:97
#10 0x00007f9da3769570 in r600_sb::vpass::run_on(r600_sb::container_node&) (this=0x7fff9da76b30, n=...) at sb/sb_ir.h:888
#11 0x00007f9da3769651 in r600_sb::vpass::run() (this=0x7fff9da76b30) at sb/sb_pass.cpp:44
#12 0x00007f9da37590ba in r600_sb_bytecode_process () at sb/sb_core.cpp:205
#13 0x00007f9da3725bcd in r600_pipe_shader_create (ctx=ctx@entry=0x7f9dcbae7000, shader=shader@entry=0x7f9dab112000, key=...) at r600_shader.c:215
#14 0x00007f9da372fe64 in r600_shader_select (ctx=ctx@entry=0x7f9dcbae7000, sel=0x7f9dab10f000, dirty=dirty@entry=0x7fff9da77885) at r600_state_common.c:869
#15 0x00007f9da3731077 in r600_update_derived_state (rctx=0x7f9dcbae7000) at r600_state_common.c:1687
#16 0x00007f9da3731077 in r600_draw_vbo (ctx=0x7f9dcbae7000, info=0x7fff9da77ba0) at r600_state_common.c:1968
#17 0x00007f9da3510710 in u_vbuf_draw_vbo (mgr=0x7f9dcc11a000, info=<optimized out>) at util/u_vbuf.c:1150
#18 0x00007f9da32fba2f in st_draw_vbo (ctx=<optimized out>, prims=0x7fff9da77c60, nr_prims=<optimized out>, ib=0x0, index_bounds_valid=<optimized out>, min_index=<optimized out>, max_index=<optimized out>, tfb_vertcount=0x0, stream=0, indirect=0x0) at state_tracker/st_draw.c:227
#19 0x00007f9da32c070b in vbo_draw_arrays (ctx=ctx@entry=0x7f9dbfac2000, mode=mode@entry=4, start=start@entry=1320, count=count@entry=87, numInstances=numInstances@entry=1, baseInstance=baseInstance@entry=0, drawID=0) at vbo/vbo_exec_array.c:486
#20 0x00007f9da32c079a in vbo_exec_DrawArraysInstanced (mode=4, start=1320, count=87, numInstances=1) at vbo/vbo_exec_array.c:677
#21 0x00007f9f8e192855 in mozilla::WebGLContext::DrawArraysInstanced(unsigned int, int, int, int, char const*) () at /usr/lib64/firefox/libxul.so
#22 0x00007f9f8de2f967 in mozilla::dom::WebGLRenderingContextBinding::drawArrays(JSContext*, JS::Handle<JSObject*>, mozilla::WebGLContext*, JSJitMethodCallArgs const&) () at /usr/lib64/firefox/libxul.so
#23 0x00007f9f8e10e1c9 in mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*) () at /usr/lib64/firefox/libxul.so
#24 0x00003baead6934b6 in  ()
#25 0x00007f9dd7944580 in  ()
#26 0x00007fff9da77ed0 in  ()
#27 0x0000000000000000 in  ()

Comment 7 Uros Bizjak 2018-06-26 16:24:37 UTC
This is alu_node&n in frame #4, where things go downhill:

(gdb) f 4
#4  r600_sb::expr_handler::fold_alu_op3 (this=0x7f94f3deeea8, n=...) at sb/sb_expr.cpp:951
951             value* v2 = n.src[2]->gvalue();
(gdb) list
946                             return true;
947             }
948
949             value* v0 = n.src[0]->gvalue();
950             value* v1 = n.src[1]->gvalue();
951             value* v2 = n.src[2]->gvalue();
952
953             /* LDS instructions look like op3 with no dst - don't fold. */
954             if (!n.dst[0])
955                     return false;
(gdb) p n
$1 = (r600_sb::alu_node &) @0x7f94d904c7d0: {<r600_sb::node> = {_vptr.node = 0x7f94d0b692f8 <vtable for r600_sb::alu_node+16>, prev = 0x7f94d904c738, 
    next = 0x7f94d904c938, parent = 0x7f94d904c000, type = r600_sb::NT_OP, subtype = r600_sb::NST_ALU_INST, flags = r600_sb::NF_EMPTY, pred = 0x0, 
    dst = std::vector of length 1, capacity 1 = {0x7f94d90616f0}, src = std::vector of length 2, capacity 3 = {0x7f94d905d110, 0x7f94d905cf70}}, bc = {
    op_ptr = 0x7f94d0b628a0 <r600_alu_op_table>, op = 0, src = {{sel = 252, chan = 2, neg = 0, abs = 0, rel = 0, value = {{i = 0, u = 0, f = 0}}}, {sel = 0, 
        chan = 0, neg = 0, abs = 0, rel = 0, value = {{i = 0, u = 0, f = 0}}}, {sel = 252, chan = 2, neg = 0, abs = 0, rel = 0, value = {{i = 0, u = 0, 
            f = 0}}}}, dst_gpr = 6, dst_chan = 2, dst_rel = 0, clamp = 0, omod = 0, bank_swizzle = 0, index_mode = 0, last = 1, pred_sel = 0, fog_merge = 0, 
    write_mask = 0, update_exec_mask = 0, update_pred = 0, slot = 2, lds_idx_offset = 0, slot_flags = AF_VS}}

Comment 9 Ben Cotton 2019-05-02 21:13:42 UTC
This message is a reminder that Fedora 28 is nearing its end of life.
On 2019-May-28 Fedora will stop maintaining and issuing updates for
Fedora 28. It is Fedora's policy to close all bug reports from releases
that are no longer maintained. At that time this bug will be closed as
EOL if it remains open with a Fedora 'version' of '28'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 28 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 10 Ben Cotton 2019-05-28 22:00:29 UTC
Fedora 28 changed to end-of-life (EOL) status on 2019-05-28. Fedora 28 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.