CVE-2025-14765
Overview
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifsrc/dawn/native/vulkan/PhysicalDeviceVk.cpp |
modified |
Files Changed
src/dawn/native/Toggles.cppsrc/dawn/native/Toggles.hsrc/dawn/native/vulkan/PhysicalDeviceVk.cppsrc/dawn/native/vulkan/PhysicalDeviceVk.hsrc/dawn/native/vulkan/ShaderModuleVk.cppsrc/tint/lang/spirv/writer/common/options.hsrc/tint/lang/spirv/writer/raise/BUILD.bazelsrc/tint/lang/spirv/writer/raise/BUILD.cmakesrc/tint/lang/spirv/writer/raise/BUILD.gn
Patch
From 7369bddb2b510ffd4feb52b8d32e853bfa6695e0 Mon Sep 17 00:00:00 2001 From: Peter McNeeley <[email protected]> Date: Mon, 01 Dec 2025 09:10:36 -0800 Subject: [PATCH] [tint] Polyfill unary negation and abs for amd mesa frontend Bug: 448294721 Change-Id: Ibca22bac11a7289538cefcd70169640d323b297c Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/276774 Reviewed-by: James Price <[email protected]> Commit-Queue: Peter McNeeley <[email protected]> --- diff --git a/src/dawn/native/Toggles.cpp b/src/dawn/native/Toggles.cpp index 8cca76d..f231360 100644 --- a/src/dawn/native/Toggles.cpp +++ b/src/dawn/native/Toggles.cpp @@ -387,6 +387,13 @@ {"metal_polyfill_unpack_2x16_unorm", "Polyfill unpack2x16unorm for MSL due to CTS failures on Mac M3+ devices.", "https://crbug.com/449576833", ToggleStage::Device}}, + {Toggle::VulkanPolyfillF32Negation, + {"spirv_polyfill_f32_negation", + "Polyfill f32 negation with bit manipulation in SPIR-V writer.", + "https://crbug.com/448294721", ToggleStage::Device}}, + {Toggle::VulkanPolyfillF32Abs, + {"spirv_polyfill_f32_abs", "Polyfill f32 abs with bit manipulation in SPIR-V writer.", + "https://crbug.com/448294721", ToggleStage::Device}}, {Toggle::MetalFillEmptyOcclusionQueriesWithZero, {"metal_fill_empty_occlusion_queries_with_zero", "Apple GPUs leave stale results in the visibility result buffer instead of writing zero if " diff --git a/src/dawn/native/Toggles.h b/src/dawn/native/Toggles.h index 13bf92b..423f918 100644 --- a/src/dawn/native/Toggles.h +++ b/src/dawn/native/Toggles.h @@ -104,6 +104,8 @@ MetalKeepMultisubresourceDepthStencilTexturesInitialized, MetalPolyfillUnpack2x16snorm, MetalPolyfillUnpack2x16unorm, + VulkanPolyfillF32Negation, + VulkanPolyfillF32Abs, MetalFillEmptyOcclusionQueriesWithZero, UseBlitForBufferToDepthTextureCopy, UseBlitForBufferToStencilTextureCopy, diff --git a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp index 45271df..64ebd41 100644 --- a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp +++ b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp @@ -998,6 +998,17 @@ deviceToggles->Default(Toggle::VulkanPolyfillSwitchWithIf, true); } + // AMD mesa front end optimizer bug for unary negation and abs. + // Fixed in 25.3 - See crbug.com/448294721 + if (IsAmdMesa()) { + const gpu_info::DriverVersion kGoodMesaDriver = {25, 3, 0, 0}; + const bool badDriver = GetDriverVersion() < kGoodMesaDriver; + if (badDriver) { + deviceToggles->Default(Toggle::VulkanPolyfillF32Abs, true); + deviceToggles->Default(Toggle::VulkanPolyfillF32Negation, true); + } + } + if (IsAndroidARM()) { // dawn:1550: Resolving multiple color targets in a single pass fails on ARM GPUs. To // work around the issue, passes that resolve to multiple color targets will instead be @@ -1285,6 +1296,13 @@ return false; } +bool PhysicalDevice::IsAmdMesa() const { + if (mDeviceInfo.HasExt(DeviceExt::DriverProperties)) { + return mDeviceInfo.driverProperties.driverID == VK_DRIVER_ID_MESA_RADV_KHR; + } + return false; +} + bool PhysicalDevice::IsSwiftshader() const { return gpu_info::IsGoogleSwiftshader(GetVendorId(), GetDeviceId()); } diff --git a/src/dawn/native/vulkan/PhysicalDeviceVk.h b/src/dawn/native/vulkan/PhysicalDeviceVk.h index 622e2b9..1926898 100644 --- a/src/dawn/native/vulkan/PhysicalDeviceVk.h +++ b/src/dawn/native/vulkan/PhysicalDeviceVk.h @@ -67,6 +67,7 @@ bool IsAndroidImgTec() const; bool IsPixel10() const; bool IsIntelMesa() const; + bool IsAmdMesa() const; bool IsAndroidHuawei() const; bool IsSwiftshader() const; diff --git a/src/dawn/native/vulkan/ShaderModuleVk.cpp b/src/dawn/native/vulkan/ShaderModuleVk.cpp index 3fb8c9f..6923bcc 100644 --- a/src/dawn/native/vulkan/ShaderModuleVk.cpp +++ b/src/dawn/native/vulkan/ShaderModuleVk.cpp @@ -212,9 +212,10 @@ req.tintOptions.bindings = std::move(bindings); req.tintOptions.resource_binding = std::move(resourceBindingConfig); - req.tintOptions.disable_robustness = !GetDevice()->IsRobustnessEnabled(); - req.tintOptions.disable_workgroup_init = - GetDevice()->IsToggleEnabled(Toggle::DisableWorkgroupInit); + req.tintOptions.workarounds.polyfill_unary_f32_negation = + GetDevice()->IsToggleEnabled(Toggle::VulkanPolyfillF32Negation); + req.tintOptions.workarounds.polyfill_f32_abs = + GetDevice()->IsToggleEnabled(Toggle::VulkanPolyfillF32Abs); req.tintOptions.disable_polyfill_integer_div_mod = GetDevice()->IsToggleEnabled(Toggle::DisablePolyfillsOnIntegerDivisonAndModulo); diff --git a/src/tint/lang/spirv/writer/common/options.h b/src/tint/lang/spirv/writer/common/options.h index 1701c9e..9177e3a 100644 --- a/src/tint/lang/spirv/writer/common/options.h +++ b/src/tint/lang/spirv/writer/common/options.h @@ -91,6 +91,12 @@ /// Set to `true` to always pass matrices to user functions by pointer instead of by value. bool pass_matrix_by_pointer = false; + /// Set to `true` to generate polyfill for f32 negation. + bool polyfill_unary_f32_negation = false; + + /// Set to `true` to generate polyfill for f32 abs. + bool polyfill_f32_abs = false; + TINT_REFLECT(Workarounds, polyfill_case_switch, scalarize_max_min_clamp, @@ -98,7 +104,9 @@ polyfill_pack_unpack_4x8_norm, subgroup_shuffle_clamped, polyfill_subgroup_broadcast_f16, - pass_matrix_by_pointer); + pass_matrix_by_pointer, + polyfill_unary_f32_negation, + polyfill_f32_abs); }; /// Any options which are controlled by the presence/absence of a vulkan extension. diff --git a/src/tint/lang/spirv/writer/raise/BUILD.bazel b/src/tint/lang/spirv/writer/raise/BUILD.bazel index e261f98..f0b9437 100644 --- a/src/tint/lang/spirv/writer/raise/BUILD.bazel +++ b/src/tint/lang/spirv/writer/raise/BUILD.bazel @@ -52,6 +52,7 @@ "resource_binding.cc", "resource_table.cc", "shader_io.cc", + "unary_polyfill.cc", "var_for_dynamic_index.cc", ], hdrs = [ @@ -68,6 +69,7 @@ "resource_binding.h", "resource_table.h", "shader_io.h", + "unary_polyfill.h", "var_for_dynamic_index.h", ], deps = [ @@ -122,6 +124,7 @@ "pass_matrix_by_pointer_test.cc", "remove_unreachable_in_loop_continuing_test.cc", "shader_io_test.cc", + "unary_polyfill_test.cc", "var_for_dynamic_index_test.cc", ], deps = [ diff --git a/src/tint/lang/spirv/writer/raise/BUILD.cmake b/src/tint/lang/spirv/writer/raise/BUILD.cmake index 0311bd6..8e7e51d 100644 --- a/src/tint/lang/spirv/writer/raise/BUILD.cmake +++ b/src/tint/lang/spirv/writer/raise/BUILD.cmake @@ -67,6 +67,8 @@ lang/spirv/writer/raise/resource_table.h lang/spirv/writer/raise/shader_io.cc lang/spirv/writer/raise/shader_io.h + lang/spirv/writer/raise/unary_polyfill.cc + lang/spirv/writer/raise/unary_polyfill.h lang/spirv/writer/raise/var_for_dynamic_index.cc lang/spirv/writer/raise/var_for_dynamic_index.h ) @@ -130,6 +132,7 @@ lang/spirv/writer/raise/pass_matrix_by_pointer_test.cc lang/spirv/writer/raise/remove_unreachable_in_loop_continuing_test.cc lang/spirv/writer/raise/shader_io_test.cc + lang/spirv/writer/raise/unary_polyfill_test.cc lang/spirv/writer/raise/var_for_dynamic_index_test.cc ) diff --git a/src/tint/lang/spirv/writer/raise/BUILD.gn b/src/tint/lang/spirv/writer/raise/BUILD.gn index 91a8501..cd5756d 100644 --- a/src/tint/lang/spirv/writer/raise/BUILD.gn +++ b/src/tint/lang/spirv/writer/raise/BUILD.gn @@ -71,6 +71,8 @@ "resource_table.h", "shader_io.cc", "shader_io.h", + "unary_polyfill.cc", + "unary_polyfill.h", "var_for_dynamic_index.cc", "var_for_dynamic_index.h", ] @@ -123,6 +125,7 @@
Regression Test / PoC
diff --git a/src/tint/lang/spirv/writer/raise/unary_polyfill_test.cc b/src/tint/lang/spirv/writer/raise/unary_polyfill_test.cc
new file mode 100644
index 0000000..648c5bf
--- /dev/null
+++ b/src/tint/lang/spirv/writer/raise/unary_polyfill_test.cc
@@ -0,0 +1,247 @@
+// Copyright 2025 The Dawn & Tint Authors
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+// list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+// this list of conditions and the following disclaimer in the documentation
+// and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "src/tint/lang/spirv/writer/raise/unary_polyfill.h"
+
+#include "src/tint/lang/core/ir/transform/helper_test.h"
+
+namespace tint::spirv::writer::raise {
+namespace {
+
+using namespace tint::core::fluent_types; // NOLINT
+using namespace tint::core::number_suffixes; // NOLINT
+
+using SpirvWriter_UnaryPolyfillTest = core::ir::transform::TransformTest;
+
+TEST_F(SpirvWriter_UnaryPolyfillTest, Negation_Scalar) {
+ auto* arg = b.FunctionParam("arg", ty.f32());
+ auto* func = b.Function("foo", ty.f32());
+ func->SetParams({arg});
+
+ b.Append(func->Block(), [&] {
+ auto* result = b.Negation(arg);
+ b.Return(func, result);
+ });
+
+ auto* src = R"(
+%foo = func(%arg:f32):f32 {
+ $B1: {
+ %3:f32 = negation %arg
+ ret %3
+ }
+}
+)";
+ EXPECT_EQ(src, str());
+
+ auto* expect = R"(
+%foo = func(%arg:f32):f32 {
+ $B1: {
+ %3:u32 = bitcast %arg
+ %4:u32 = xor %3, 2147483648u
+ %5:f32 = bitcast %4
+ ret %5
+ }
+}
+)";
+
+ UnaryPolyfillConfig config;
+ config.polyfill_f32_negation = true;
+ Run(UnaryPolyfill, config);
+
+ EXPECT_EQ(expect, str());
+}
+
+TEST_F(SpirvWriter_UnaryPolyfillTest, Negation_Vector) {
+ auto* arg = b.FunctionParam("arg", ty.vec4<f32>());
+ auto* func = b.Function("foo", ty.vec4<f32>());
+ func->SetParams({arg});
+
+ b.Append(func->Block(), [&] {
+ auto* result = b.Negation(arg);
+ b.Return(func, result);
+ });
+
+ auto* src = R"(
+%foo = func(%arg:vec4<f32>):vec4<f32> {
+ $B1: {
+ %3:vec4<f32> = negation %arg
+ ret %3
+ }
+}
+)";
+ EXPECT_EQ(src, str());
+
+ auto* expect = R"(
+%foo = func(%arg:vec4<f32>):vec4<f32> {
+ $B1: {
+ %3:vec4<u32> = bitcast %arg
+ %4:vec4<u32> = xor %3, vec4<u32>(2147483648u)
+ %5:vec4<f32> = bitcast %4
+ ret %5
+ }
+}
+)";
+
+ UnaryPolyfillConfig config;
+ config.polyfill_f32_negation = true;
+ Run(UnaryPolyfill, config);
+
+ EXPECT_EQ(expect, str());
+}
+
+TEST_F(SpirvWriter_UnaryPolyfillTest, Abs_Scalar) {
+ auto* arg = b.FunctionParam("arg", ty.f32());
+ auto* func = b.Function("foo", ty.f32());
+ func->SetParams({arg});
+
+ b.Append(func->Block(), [&] {
+ auto* result = b.Call(ty.f32(), core::BuiltinFn::kAbs, arg);
+ b.Return(func, result);
+ });
+
+ auto* src = R"(
+%foo = func(%arg:f32):f32 {
+ $B1: {
+ %3:f32 = abs %arg
+ ret %3
+ }
+}
+)";
+ EXPECT_EQ(src, str());
+
+ auto* expect = R"(
+%foo = func(%arg:f32):f32 {
+ $B1: {
+ %3:u32 = bitcast %arg
+ %4:u32 = and %3, 2147483647u
+ %5:f32 = bitcast %4
+ ret %5
+ }
+}
+)";
+
+ UnaryPolyfillConfig config;
+ config.polyfill_f32_abs = true;
+ Run(UnaryPolyfill, config);
+
+ EXPECT_EQ(expect, str());
+}
+
+TEST_F(SpirvWriter_UnaryPolyfillTest, Abs_Vector) {
+ auto* arg = b.FunctionParam("arg", ty.vec4<f32>());
+ auto* func = b.Function("foo", ty.vec4<f32>());
+ func->SetParams({arg});
+
+ b.Append(func->Block(), [&] {
+ auto* result = b.Call(ty.vec4<f32>(), core::BuiltinFn::kAbs, arg);
+ b.Return(func, result);
+ });
+
+ auto* src = R"(
+%foo = func(%arg:vec4<f32>):vec4<f32> {
+ $B1: {
+ %3:vec4<f32> = abs %arg
+ ret %3
+ }
+}
+)";
+ EXPECT_EQ(src, str());
+
+ auto* expect = R"(
+%foo = func(%arg:vec4<f32>):vec4<f32> {
+ $B1: {
+ %3:vec4<u32> = bitcast %arg
+ %4:vec4<u32> = and %3, vec4<u32>(2147483647u)
+ %5:vec4<f32> = bitcast %4
+ ret %5
+ }
+}
+)";
+
+ UnaryPolyfillConfig config;
+ config.polyfill_f32_abs = true;
+ Run(UnaryPolyfill, config);
+
+ EXPECT_EQ(expect, str());
+}
+
+TEST_F(SpirvWriter_UnaryPolyfillTest, Negation_NoPolyfill) {
+ auto* arg = b.FunctionParam("arg", ty.f32());
+ auto* func = b.Function("foo", ty.f32());
+ func->SetParams({arg});
+
+ b.Append(func->Block(), [&] {
+ auto* result = b.Negation(arg);
+ b.Return(func, result);
+ });
+
+ auto* src = R"(
+%foo = func(%arg:f32):f32 {
+ $B1: {
+ %3:f32 = negation %arg
+ ret %3
+ }
+}
+)";
+ EXPECT_EQ(src, str());
+
+ UnaryPolyfillConfig config;
+ config.polyfill_f32_negation = false;
+ Run(UnaryPolyfill, config);
+
+ EXPECT_EQ(src, str());
+}
+
+TEST_F(SpirvWriter_UnaryPolyfillTest, Abs_NoPolyfill) {
+ auto* arg = b.FunctionParam("arg", ty.f32());
+ auto* func = b.Function("foo", ty.f32());
+ func->SetParams({arg});
+
+ b.Append(func->Block(), [&] {
+ auto* result = b.Call(ty.f32(), core::BuiltinFn::kAbs, arg);
+ b.Return(func, result);
+ });
+
+ auto* src = R"(
+%foo = func(%arg:f32):f32 {
+ $B1: {
+ %3:f32 = abs %arg
+ ret %3
+ }
+}
+)";
+ EXPECT_EQ(src, str());
+
+ UnaryPolyfillConfig config;
+ config.polyfill_f32_abs = false;
+ Run(UnaryPolyfill, config);
+
+ EXPECT_EQ(src, str());
+}
+
+} // namespace
+} // namespace tint::spirv::writer::raise
Original Bug Report
[bugSWAT] GPU process crash via WebGPU shader - wild-deref in Mesa aco::combine_instruction
VULNERABILITY DETAILS
This report is about a heap-use-after-free in the Mesa shader compiler, reachable via WebGPU shaders emitted by dawn/tint. The offending shader looks as follows:
enable subgroups;
@group(0) @binding(0)
var<storage, read_write> g: f32;
@fragment
fn frag_main() -> @location(0) vec4<f32> {
g = tanh(subgroupMin(-g));
return vec4<f32>();
}
The standalone reproducer crashs in the vendor-specific file amd/compiler/aco_optimizer.cpp + I never found a similar-looking crash on Intel devices so its probably only affecting AMD.
VERSION
Chrome Version: Version 141.0.7353.0 (Developer Build) (64-bit) (ASAN build)
Operating System: Ubuntu 25.04
Mesa: mesa-25.2.3 commit 62f9be9
REPRODUCTION
There are two means of reproduction, standalone and via Chrome. The instructions below use an ASAN build of Chrome and an ASAN build of Mesa. Precise build instructions for Mesa depend on the distro, a complete example for Ubuntu is part of the Dockerfile file of the standalone reproducer.
Standalone
- Place the Dockerfile and the .gfxr in a new directory
- Inside this directory:
docker build -t mesarepo . - Once built, switch into the container:
docker run -it mesarepo /bin/bash - Inside the container, run:
LD_PRELOAD="/usr/lib/llvm-20/lib/clang/20/lib/linux/libclang_rt.asan-x86_64.so /mesa/buildASAN/src/amd/drm-shim/libamdgpu_noop_drm_shim.so" VK_DRIVER_FILES=/mesa/buildASAN/src/amd/vulkan/radeon_icd.x86_64.json /gfxreconstruct/build/tools/replay/gfxrecon-replay /gfxrecon.gfxr
This should produce the following ASAN report:
AddressSanitizer:DEADLYSIGNAL
=================================================================
==18==ERROR: AddressSanitizer: SEGV on unknown address 0x6f731bde2ba0 (pc 0x6ef31762a73b bp 0x7ffc932e4a90 sp 0x7ffc932e4940 T0)
==18==The signal is caused by a READ memory access.
#0 0x6ef31762a73b in aco::(anonymous namespace)::combine_instruction(aco::(anonymous namespace)::opt_ctx&, std::unique_ptr<aco::Instruction, aco::instr_deleter_functor>&) /mesa/buildASAN/../src/amd/compiler/aco_optimizer.cpp:3800:46
#1 0x6ef3176091ca in aco::optimize(aco::Program*) /mesa/buildASAN/../src/amd/compiler/aco_optimizer.cpp:5086:10
#2 0x6ef3174cc63c in (anonymous namespace)::aco_postprocess_shader[abi:cxx11](aco_compiler_options const*, std::unique_ptr<aco::Program, std::default_delete<aco::Program>>&) /mesa/buildASAN/../src/amd/compiler/aco_interface.cpp:89:10
#3 0x6ef3174cbc32 in aco_compile_shader /mesa/buildASAN/../src/amd/compiler/aco_interface.cpp:245:26
#4 0x6ef316a88131 in shader_compile /mesa/buildASAN/../src/amd/vulkan/radv_shader.c:3120:7
#5 0x6ef316a88131 in radv_shader_nir_to_asm /mesa/buildASAN/../src/amd/vulkan/radv_shader.c:3151:7
#6 0x6ef316a2df53 in radv_graphics_shaders_nir_to_asm /mesa/buildASAN/../src/amd/vulkan/radv_pipeline_graphics.c:2380:21
#7 0x6ef316a2df53 in radv_graphics_shaders_compile /mesa/buildASAN/../src/amd/vulkan/radv_pipeline_graphics.c:2808:4
#8 0x6ef316a3f8a9 in radv_graphics_pipeline_compile /mesa/buildASAN/../src/amd/vulkan/radv_pipeline_graphics.c:3057:4
#9 0x6ef316a35f03 in radv_graphics_pipeline_init /mesa/buildASAN/../src/amd/vulkan/radv_pipeline_graphics.c:3453:13
#10 0x6ef316a35f03 in radv_graphics_pipeline_create /mesa/buildASAN/../src/amd/vulkan/radv_pipeline_graphics.c:3514:13
#11 0x6ef316a35f03 in radv_CreateGraphicsPipelines /mesa/buildASAN/../src/amd/vulkan/radv_pipeline_graphics.c:3669:14
#12 0x56db1d817769 in gfxrecon::decode::VulkanReplayConsumerBase::OverrideCreateGraphicsPipelines(VkResult (*)(VkDevice_T*, VkPipelineCache_T*, unsigned int, VkGraphicsPipelineCreateInfo const*, VkAllocationCallbacks const*, VkPipeline_T**), VkResult, gfxrecon::decode::VulkanDeviceInfo const*, gfxrecon::decode::VulkanPipelineCacheInfo const*, unsigned int, gfxrecon::decode::StructPointerDecoder<gfxrecon::decode::Decoded_VkGraphicsPipelineCreateInfo> const*, gfxrecon::decode::StructPointerDecoder<gfxrecon::decode::Decoded_VkAllocationCallbacks> const*, gfxrecon::decode::HandlePointerDecoder<VkPipeline_T*>*) /gfxreconstruct/framework/decode/vulkan_replay_consumer_base.cpp:11229:34
#13 0x56db1de1d702 in gfxrecon::decode::VulkanReplayConsumer::Process_vkCreateGraphicsPipelines(gfxrecon::decode::ApiCallInfo const&, VkResult, unsigned long, unsigned long, unsigned int, gfxrecon::decode::StructPointerDecoder<gfxrecon::decode::Decoded_VkGraphicsPipelineCreateInfo>*, gfxrecon::decode::StructPointerDecoder<gfxrecon::decode::Decoded_VkAllocationCallbacks>*, gfxrecon::decode::HandlePointerDecoder<VkPipeline_T*>*) /gfxreconstruct/framework/generated/generated_vulkan_replay_consumer.cpp:995:61
#14 0x56db1dceb1df in gfxrecon::decode::VulkanDecoder::Decode_vkCreateGraphicsPipelines(gfxrecon::decode::ApiCallInfo const&, unsigned char const*, unsigned long) /gfxreconstruct/framework/generated/generated_vulkan_decoder.cpp:1375:52
#15 0x56db1dd3f6e6 in gfxrecon::decode::VulkanDecoder::DecodeFunctionCall(gfxrecon::format::ApiCallId, gfxrecon::decode::ApiCallInfo const&, unsigned char const*, unsigned long) /gfxreconstruct/framework/generated/generated_vulkan_decoder.cpp:14766:41
#16 0x56db1d6709d4 in gfxrecon::decode::FileProcessor::ProcessFunctionCall(gfxrecon::format::BlockHeader const&, gfxrecon::format::ApiCallId, bool&) /gfxreconstruct/framework/decode/file_processor.cpp:689:48
#17 0x56db1d66f6b7 in gfxrecon::decode::FileProcessor::ProcessBlocks() /gfxreconstruct/framework/decode/file_processor.cpp:307:64
#18 0x56db1d66ef2a in gfxrecon::decode::FileProcessor::ProcessBlocksOneFrame() /gfxreconstruct/framework/decode/file_processor.cpp:122:25
#19 0x56db1d66edc6 in gfxrecon::decode::FileProcessor::ProcessNextFrame()::'lambda'()::operator()() const /gfxreconstruct/framework/decode/file_processor.cpp:112:73
#20 0x56db1d67923d in bool std::__invoke_impl<bool, gfxrecon::decode::FileProcessor::ProcessNextFrame()::'lambda'()&>(std::__invoke_other, gfxrecon::decode::FileProcessor::ProcessNextFrame()::'lambda'()&) /usr/include/c++/14/bits/invoke.h:61:36
#21 0x56db1d679133 in std::enable_if<is_invocable_r_v<bool, gfxrecon::decode::FileProcessor::ProcessNextFrame()::'lambda'()&>, bool>::type std::__invoke_r<bool, gfxrecon::decode::FileProcessor::ProcessNextFrame()::'lambda'()&>(gfxrecon::decode::FileProcessor::ProcessNextFrame()::'lambda'()&) /usr/include/c++/14/bits/invoke.h:114:35
#22 0x56db1d679006 in std::_Function_handler<bool (), gfxrecon::decode::FileProcessor::ProcessNextFrame()::'lambda'()>::_M_invoke(std::_Any_data const&) /usr/include/c++/14/bits/std_function.h:290:30
#23 0x56db1d67a8db in std::function<bool ()>::operator()() const /usr/include/c++/14/bits/std_function.h:591:9
#24 0x56db1d66ef76 in gfxrecon::decode::FileProcessor::DoProcessNextFrame(std::function<bool ()> const&) /gfxreconstruct/framework/decode/file_processor.cpp:132:34
#25 0x56db1d66ee17 in gfxrecon::decode::FileProcessor::ProcessNextFrame() /gfxreconstruct/framework/decode/file_processor.cpp:113:30
#26 0x56db1d59ae82 in gfxrecon::application::Application::PlaySingleFrame() /gfxreconstruct/framework/application/application.cpp:207:52
#27 0x56db1d59acee in gfxrecon::application::Application::Run() /gfxreconstruct/framework/application/application.cpp:168:28
#28 0x56db1d4ee8fd in main /gfxreconstruct/tools/replay/desktop_main.cpp:324:29
#29 0x72f31bcfa337 (/lib/x86_64-linux-gnu/libc.so.6+0x2a337) (BuildId: 467f544f15035abef911999cbc14489edd0555ab)
#30 0x72f31bcfa3fa in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a3fa) (BuildId: 467f544f15035abef911999cbc14489edd0555ab)
#31 0x56db1d4d6aa4 in _start (/gfxreconstruct/build/tools/replay/gfxrecon-replay+0xccaa4) (BuildId: 46d2949d464fa1eacdc6c00f89eb8e9661551eba)
==18==Register values:
rax = 0x000070831ae1d6a8 rbx = 0x00007ffc932e4940 rcx = 0x00006f731bde2ba0 rdx = 0x0000000000000000
rdi = 0x000072031ae30d50 rsi = 0x000070131ade1d50 rbp = 0x00007ffc932e4a90 rsp = 0x00007ffc932e4940
r8 = 0x00007ffc932e4ce0 r9 = 0x00000e02635bc3aa r10 = 0x000070831ae1d480 r11 = 0x00006f731ade2ba0
r12 = 0x00000e40635c61a7 r13 = 0x0000000021000017 r14 = 0x000072031ae30d38 r15 = 0x000072031ae30d2c
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /mesa/buildASAN/../src/amd/compiler/aco_optimizer.cpp:3800:46 in aco::(anonymous namespace)::combine_instruction(aco::(anonymous namespace)::opt_ctx&, std::unique_ptr<aco::Instruction, aco::instr_deleter_functor>&)
==18==ABORTING
Chrome
Reproducing the issue requires an AMD GPU with the subgroups feature, I’ve been using a RX 7600. Opening the attached html file should trigger a crash in the Chrome GPU process. Start chrome and run it with the ASAN version of mesa (adapt paths as needed): ASAN_OPTIONS=external_symbolizer_path=/usr/lib/llvm-20/bin/llvm-symbolizer VK_DRIVER_FILES=/path/to/src/amd/vulkan/radeon_icd.x86_64.json ./chrome --user-data-dir=/tmp/deleteme --use-angle=vulkan --enable-features=Vulkan --disable-gpu-watchdog --no-sandbox --enable-unsafe-webgpu and open the attached html:
ASAN_OPTIONS=external_symbolizer_path=/usr/lib/llvm-20/bin/llvm-symbolizer VK_DRIVER_FILES=/home/user/mesa/radeon_icd.x86_64.json ./chrome --user-data-dir=/tmp/deleteme --use-angle=vulkan --enable-features=Vulkan --disable-gpu-watchdog --no-sandbox --enable-unsafe-webgpu
[10519:10519:0929/172016.461885:ERROR:ui/ozone/platform/wayland/gpu/wayland_surface_factory.cc:250] '--ozone-platform=wayland' is not compatible with Vulkan. Consider switching to '--ozone-platform=x11' or disabling Vulkan
Received signal 11 SEGV_ACCERR 78baa6b691a0
#0 0x5d12bd92b8a6 (/home/user/Downloads/linux-1499953/chrome+0xff578a5)
#1 0x5d12d3920e48 (/home/user/Downloads/linux-1499953/chrome+0x25f4ce47)
#2 0x5d12d38e1317 (/home/user/Downloads/linux-1499953/chrome+0x25f0d316)
#3 0x5d12d3920272 (/home/user/Downloads/linux-1499953/chrome+0x25f4c271)
#4 0x7c3aa74458d0 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x458cf)
#5 0x783a86467b72 <unknown>
#6 0x783a8645e2fb <unknown>
#7 0x783a863f5987 <unknown>
#8 0x783a863f5499 <unknown>
#9 0x783a8614be78 <unknown>
#10 0x783a8613079f <unknown>
#11 0x783a861355c5 <unknown>
#12 0x783a86132e23 <unknown>
#13 0x5d12c07a4027 (/home/user/Downloads/linux-1499953/chrome+0x12dd0026)
#14 0x5d12c05093a8 (/home/user/Downloads/linux-1499953/chrome+0x12b353a7)
#15 0x5d12c03d8fea (/home/user/Downloads/linux-1499953/chrome+0x12a04fe9)
#16 0x5d12c03d8a55 (/home/user/Downloads/linux-1499953/chrome+0x12a04a54)
#17 0x5d12dd0b76f0 (/home/user/Downloads/linux-1499953/chrome+0x2f6e36ef)
#18 0x5d12dd0aa26d (/home/user/Downloads/linux-1499953/chrome+0x2f6d626c)
#19 0x5d12dd0b1304 (/home/user/Downloads/linux-1499953/chrome+0x2f6dd303)
#20 0x5d12dd06bd11 (/home/user/Downloads/linux-1499953/chrome+0x2f697d10)
#21 0x5d12dd06c1a4 (/home/user/Downloads/linux-1499953/chrome+0x2f6981a3)
#22 0x5d12dd060202 (/home/user/Downloads/linux-1499953/chrome+0x2f68c201)
#23 0x5d12c786d868 (/home/user/Downloads/linux-1499953/chrome+0x19e99867)
#24 0x5d12dc89d7f8 (/home/user/Downloads/linux-1499953/chrome+0x2eec97f7)
#25 0x5d12dc89ca44 (/home/user/Downloads/linux-1499953/chrome+0x2eec8a43)
#26 0x5d12dc8bed3e (/home/user/Downloads/linux-1499953/chrome+0x2eeead3d)
#27 0x5d12dc8cc8f8 (/home/user/Downloads/linux-1499953/chrome+0x2eef88f7)
#28 0x5d12dc8cc6e0 (/home/user/Downloads/linux-1499953/chrome+0x2eef86df)
#29 0x5d12c78af736 (/home/user/Downloads/linux-1499953/chrome+0x19edb735)
#30 0x5d12c78829cd (/home/user/Downloads/linux-1499953/chrome+0x19eae9cc)
#31 0x5d12c788062d (/home/user/Downloads/linux-1499953/chrome+0x19eac62c)
#32 0x5d12c7886d04 (/home/user/Downloads/linux-1499953/chrome+0x19eb2d03)
#33 0x5d12d37700a7 (/home/user/Downloads/linux-1499953/chrome+0x25d9c0a6)
#34 0x5d12d37e2d68 (/home/user/Downloads/linux-1499953/chrome+0x25e0ed67)
#35 0x5d12d37e1c4d (/home/user/Downloads/linux-1499953/chrome+0x25e0dc4c)
#36 0x5d12d37e385b (/home/user/Downloads/linux-1499953/chrome+0x25e0f85a)
#37 0x5d12d3635cd7 (/home/user/Downloads/linux-1499953/chrome+0x25c61cd6)
#38 0x5d12d37e4425 (/home/user/Downloads/linux-1499953/chrome+0x25e10424)
#39 0x5d12d36eeea0 (/home/user/Downloads/linux-1499953/chrome+0x25d1ae9f)
#40 0x5d12de76d57b (/home/user/Downloads/linux-1499953/chrome+0x30d9957a)
#41 0x5d12cfca75c1 (/home/user/Downloads/linux-1499953/chrome+0x222d35c0)
#42 0x5d12cfca864e (/home/user/Downloads/linux-1499953/chrome+0x222d464d)
#43 0x5d12cfcaafb4 (/home/user/Downloads/linux-1499953/chrome+0x222d6fb3)
#44 0x5d12cfca52df (/home/user/Downloads/linux-1499953/chrome+0x222d12de)
#45 0x5d12cfca580c (/home/user/Downloads/linux-1499953/chrome+0x222d180b)
#46 0x5d12bd9c0278 (/home/user/Downloads/linux-1499953/chrome+0xffec277)
#47 0x7c3aa742a578 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a577)
#48 0x7c3aa742a63b (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a63a)
#49 0x5d12bd8e402a (/home/user/Downloads/linux-1499953/chrome+0xff10029)
r8: 0000795aa5c3f2c8 r9: 00007ffe4fd509d0 r10: 0000000000000000 r11: 000000000000020f
r12: 00007b4aae298cf0 r13: 0000000021000017 r14: 000078baa5b691a0 r15: 0000000000000045
di: 00007ffe4fd509d0 si: 0000000000800000 bp: 000079caa5eaef80 bx: 000079caa5eaef80
dx: 00007ffe4fd50a30 ax: 0000000000000018 cx: 0000000000000045 sp: 00007ffe4fd508a0
ip: 0000783a86467b72 efl: 0000000000010206 cgf: 002b000000000033 erf: 0000000000000004
trp: 000000000000000e msk: 0000000000000000 cr2: 000078baa6b691a0
[end of stack trace]