Bug 30629

Summary:	glDraw[Range]Elements end is out of bounds
Product:	Mesa	Reporter:	Fabio Pedretti <pedretti.fabio>
Component:	Mesa core	Assignee:	mesa-dev
Status:	RESOLVED NOTOURBUG	QA Contact:
Severity:	normal
Priority:	medium
Version:	git
Hardware:	x86 (IA32)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:
Attachments:	backtrace output of call _mesa_print_arrays(ctx)

Description Fabio Pedretti 2010-10-05 08:12:50 UTC

When running sauerbraten with some maps (e.g.: douze map or campaign -> Private Stan Sauer -> Part II after going up the stairs, and advancing through the ogre) and shaders enabled, sometimes walls disappear and I get the following warnings:

Mesa warning: glDraw[Range]Elements(start 1204, end 1331, count 297, type 0x1403, indices=0x118e)
	end is out of bounds (max=90)  Element Buffer 11 (size 62088)
	This should probably be fixed in the application.
Mesa warning: glDraw[Range]Elements(start 1204, end 1331, count 297, type 0x1403, indices=0x118e)
	index=1331 is out of bounds (max=90)  Element Buffer 11 (size 62088)
	Skipping the glDrawRangeElements() call
...

This bug was reported on sauerbraten forum at:
http://cubeengine.com/forum.php4?action=display_thread&thread_id=2242
but one developer think that this could be a mesa bug.

Tested with r300 and r300g.

Comment 1 Fabio Pedretti 2010-10-06 04:58:19 UTC

Created attachment 39221 [details]
backtrace

Backtrace with mesa and sauerbraten debug symbols is attached.

Comment 2 Brian Paul 2010-10-06 08:00:42 UTC

This error is reported when one of the indexes/elements specified by the glDraw[Range]Elements call points to a vertex attribute that's outside the bounds of the containing VBO.  If nothing is done about this, it's possible for this to cause a segfault/crash.

To learn more, set a breakpoint on _mesa_warning().  When it gets hit do this in gdb:
(gdb) call _mesa_print_arrays(ctx)

That will print information about all the enabled vertex arrays.  Please post that info.

Comment 3 Fabio Pedretti 2010-10-06 08:10:27 UTC

Created attachment 39234 [details]
output of call _mesa_print_arrays(ctx)

Comment 4 lsalzman 2010-10-06 11:47:07 UTC

I checked all client *_ARRAY states via glIsEnabled() at the point he alleges this error occurred, and on my end, they are always disabled. (Using NV proprietary drivers)

The texture coordinate array he shows as being enabled in his debug output therefor should not actually be enabled at all, unless he is somehow triggering an odd path in the code that is never reproducing for me, or somehow the bug is in the Mesa drivers themselves not disabling this array. Given my inability to reproduce this issue (again, all queried array states via glIsEnabled() are false except for the vertex array), I can not offer any help in this matter as of yet or point to anything in Sauerbraten's code that could actually be fixed.

Comment 5 lsalzman 2010-10-06 12:08:58 UTC

(In reply to comment #4)
> I checked all client *_ARRAY states via glIsEnabled() at the point he alleges
> this error occurred, and on my end, they are always disabled. (Using NV
> proprietary drivers)
> 
> The texture coordinate array he shows as being enabled in his debug output
> therefor should not actually be enabled at all, unless he is somehow triggering
> an odd path in the code that is never reproducing for me, or somehow the bug is
> in the Mesa drivers themselves not disabling this array. Given my inability to
> reproduce this issue (again, all queried array states via glIsEnabled() are
> false except for the vertex array), I can not offer any help in this matter as
> of yet or point to anything in Sauerbraten's code that could actually be fixed.

Okay, found a potential culprit in my code buried away in a place I still can't force it to trigger the issue, but I will have the user check and see if it fixes it for him.

Comment 6 Fabio Pedretti 2010-10-07 01:51:16 UTC

Yeah, I can confirm the issue is no longer reproducible with the updated sauerbraten.

Comment 7 Fabio Pedretti 2010-11-17 04:52:38 UTC

*** Bug 25706 has been marked as a duplicate of this bug. ***

Comment 8 Fabio Pedretti 2010-11-17 05:05:08 UTC

*** Bug 27755 has been marked as a duplicate of this bug. ***

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.