Skip to content

agc_driver_tessellation segfaults on RADV with Mesa 26.2+: nir_opt_varyings corrupts the TCS input offset's use list (Mesa bug) #5444

New issue
New issue
Closed as not planned
Closed as not planned
agc_driver_tessellation segfaults on RADV with Mesa 26.2+: nir_opt_varyings corrupts the TCS input offset's use list (Mesa bug)#5444

Description

@LloydNicholson
LloydNicholson
opened on Oct 13, 2026

What

agc_driver_tessellation segfaults on RADV with Mesa 26.2 and later, 3 of 3 runs. The rest of the suite passes. The crash is a Mesa bug in nir_opt_varyings, not in AnyPS5: the SPIR-V the test builds passes spirv-val --target-env vulkan1.3, and the same pipeline crashes in a standalone Vulkan program without AnyPS5.

Environment

  • Nobara (Fedora 44), kernel 7.2.9, GCC 16.2.1, Release, BUILD_TESTING=ON, ANYPS5_ENABLE_SPIRV_TOOLS=ON, main at dacd78525
  • AMD Radeon RX 9060 XT (RADV GFX1200), Mesa 26.3.0-devel (git ab0ab22, 2026-10-01), subgroup 64
  • ANYPS5_GPU=9060 ANYPS5_REQUIRE_VULKAN=1, ctest -j 8, lds_mixed_width_atomics excluded
  • Result: 1076 of 1077 passed; agc_driver_tessellation SEGFAULT. On llvmpipe it passes. With APS5_NO_GPL=1 it also crashes.

Where it crashes

#0 nir_instr_dce_add_dead_srcs_cb        libvulkan_radeon.so
#1 nir_instr_free_and_dce
#3 nir_shader_lower_instructions
#4 ac_nir_lower_hs_inputs_to_mem
#5 radv_nir_lower_io_to_mem
...
#10 radv_CreateGraphicsPipelines
#11 AgcDriver::Graphics::LinkPipelineFromLibraries

A debug build of Mesa main (eccea0bf, 2026-10-13) stops earlier: nir_validate_shader after nir_opt_varyings fails a list_validate assertion on the use list of the TCS's indirect input offset (ushr %447, 4).

Cause (Mesa)

remove_dead_varyings in src/compiler/nir/nir_opt_varyings.c, when it shrinks an indirectly indexed varying array to one element, replaces the offset source of indirect loads and stores with

*offset_src = nir_src_for_ssa(nir_imm_int(b, 0));

on a source that is still linked into the old def's use list. That leaves zeroed links in the list and a null parent pointer. Replacing both sites with nir_src_rewrite(offset_src, nir_imm_int(b, 0)); fixes it. The code came in with Mesa commit 1559e1477076 ("nir/opt_varyings: shrink pathological varying arrays to 1 element"), which is in mesa-26.2.0 through 26.2.4 and main.

The test's TCS (from the dump) reads its per-vertex input with a dynamic vertex, slot and component index (tess_attributes[umin(n, 2)][(o % 32) >> 4][((o % 32) >> 2) & 3]), which reaches that path.

Checked with the fix

Patched debug Mesa main:

  • the standalone reproducer creates the pipeline
  • agc_driver_tessellation passes
  • agc_*: 491 of 492 pass; agc_driver_vertex_target_range_copied aborts on a debug-only vk_pipeline_cache_destroy assertion (object_cache->entries == 0), which fails the same way on unpatched debug Mesa main, so it is unrelated

For AnyPS5

No change is needed in AnyPS5. Titles whose hull programs index inputs this way will crash in pipeline creation on RADV with Mesa 26.2+ until Mesa is fixed. The Mesa fix is not submitted upstream yet; the patch and the standalone reproducer (C file + the three SPIR-V modules) are available on request.

Not tested: other AMD generations, radeonsi, Windows, any title.

AI-assisted (Claude Code).

Activity

  1. oneandonlydean commented on Oct 13, 2026

    @oneandonlydean
    oneandonlydean
    on Oct 13, 2026
    Collaborator

    Closing: this is a Mesa bug, with nothing to change in AnyPS5. Please file it at https://gitlab.freedesktop.org/mesa/mesa/-/issues with your reproducer and link it here. Comment here if it still fails once Mesa has the fix.

  2. oneandonlydean
    closed this as not plannedon Oct 13, 2026

  3. jackthereaper2006 commented on Oct 15, 2026

    @jackthereaper2006
    jackthereaper2006
    on Oct 15, 2026
    Contributor

    This also reproduces on GCN 5, and @LloydNicholson's two-line fix resolves it there too.

    Setup: CachyOS, Linux 7.2.9, Ryzen 5 PRO 5650U iGPU, AMD Radeon Graphics (RADV RENOIR) 0x1638 (GCN 5), subgroup 64. AnyPS5 main d92a8dad3, GCC 16.2.1, Release, BUILD_TESTING=ON, MESA_SHADER_CACHE_DISABLE=true.

    driver agc_driver_tessellation with APS5_NO_GPL=1
    distro Mesa 26.2.4 (Arch mesa 3:26.2.4-1) SEGFAULT 5/5 SEGFAULT 3/3
    local build of tag mesa-26.2.4 (96cb4312), unpatched SEGFAULT 5/5
    the same build with both nir_src_rewrite changes pass 5/5 pass 3/3

    The local build is release, RADV only, -Dllvm=disabled, loaded through VK_DRIVER_FILES. VK_LOADER_DEBUG=driver confirms which libvulkan_radeon.so each run used.

    With the patched driver, the whole ctest gives 1222/1222. The baseline on the distro driver is 1221/1222, with only agc_driver_tessellation failing. My build has no Wayland WSI, so 5 video_out tests that need a Wayland surface skipped in that run. They pass with SDL_VIDEODRIVER=x11. The other 17 skips are the same as on the distro driver.

    Patch applied to mesa-26.2.4 
    --- a/src/compiler/nir/nir_opt_varyings.c
+++ b/src/compiler/nir/nir_opt_varyings.c
@@ -2389,7 +2389,7 @@
                            assert(elem == 0);
 
                            b->cursor = nir_before_instr(&load->instr);
-                           *offset_src = nir_src_for_ssa(nir_imm_int(b, 0));
+                           nir_src_rewrite(offset_src, nir_imm_int(b, 0));
 
                            /* Reduce the number of slots to 1. */
                            nir_io_semantics sem =
@@ -2490,7 +2490,7 @@
                         nir_if *if_eq =
                            nir_push_if(b, nir_ieq_imm(b, offset.def,
                                                       direct_index));
-                        *offset_src = nir_src_for_ssa(nir_imm_int(b, 0));
+                        nir_src_rewrite(offset_src, nir_imm_int(b, 0));
                         nir_instr_move(b->cursor, &store->instr);
                         b->cursor = nir_after_instr(&store->instr);
                         nir_pop_if(b, if_eq);

    As of today, Mesa main still has both lines (2393 and 2494), and I found no Mesa issue or merge request for this. @LloydNicholson, are you filing it upstream? You're welcome to reference this GCN 5 result there.

    AI-assisted: yes (Claude Code).

  4. blawesom commented on Oct 17, 2026

    @blawesom
    blawesom
    on Oct 17, 2026
    Contributor

    An independent standalone reproducer, and a sharper trigger boundary — I built this from the AnyPS5 side before finding this issue (my #4727 bisect data is upthread-adjacent), and it agrees with and extends the diagnosis here:

    • ~200 lines of C + four trivial shaders (the hull reads gl_in at a data-computed index — but see the next point): creates a pre-raster GPL library (vert + TCS + TES) and a fragment library, then links them. Segfaults inside vkCreateGraphicsPipelines on RADV (Mesa 26.2.4, RX 9070 XT / GFX1201), in the same remove_dead_varyings→nir_instr_free_and_dce area.
    • The trigger is broader than the hull shader's index arithmetic: replacing the data-computed index with plain gl_InvocationID (the pattern that predates the AnyPS5 commit) still crashes — the crash is in any tessellation pipeline linked from libraries, not in the new lowering's output. The direct (non-library) vkCreateGraphicsPipelines with the same four shaders succeeds, which matches the standalone repro already noted here.
    • The crash instruction is a null-list insertion (mov %rdx,0x8(%rcx) with rcx == 0), consistent with the corrupted use list described above.
    • Mesa 26.2.5 does not contain the fix — I checked its release notes and change list; there is no nir_opt_varyings entry. So 26.2.4 and 26.2.5 both carry it, and the earliest stable pickup would be 26.2.6 (scheduled Oct 28) if the two-line fix lands in it.

    The reproducer is at blawesom/AnyPS5 branch mesa-gpl-tess-repro (build: cc repro.c -lvulkan with the four shaders compiled by glslangValidator -V; run plain for the crash, DIRECT=1 for the passing control).

    On the ask to file it at Mesa's GitLab: I don't see a link to a filed issue or MR in this thread — has anyone filed it? If not, this repro plus the description above is ready to go (I can't file on freedesktop GitLab without an account there; if someone files it, my GFX1201 result adds a third hardware data point to @jackthereaper2006's GCN 5 one).

  5. StarMrGamer commented on Nov 1, 2026

    @StarMrGamer
    StarMrGamer
    on Nov 1, 2026
    Contributor

    The Mesa fix is upstream and released: mesa!45358 ("nir/opt_varyings: use nir_src_rewrite when shrinking varying arrays", merged 2026-10-21, the two nir_src_rewrite changes described above). It is backported to the 26.2 branch (cdbaf5f9) and listed in the Mesa 26.2.6 release notes (2026-10-28).

    Checked on an AMD Radeon 780M (RADV PHOENIX), Arch Linux, kernel 7.2.11, main 6fe120d, same build, only the driver changed:

    driver agc_driver_tessellation with APS5_NO_GPL=1
    Arch vulkan-radeon 1:26.2.5-1 SEGFAULT 5/5 (in LinkPipelineFromLibraries → libvulkan_radeon.so) SEGFAULT 3/3
    Arch vulkan-radeon 1:26.2.6-1 pass 5/5 pass 3/3

    On 26.2.6 the full ANYPS5_REQUIRE_VULKAN=1 ctest -j6 gives 3117/3118. The remaining failure is agc_idle_publish_wait, already tracked in #11889.

    So anyone still hitting this on RADV needs Mesa 26.2.6 or later. Nothing to change in AnyPS5.

    AI-assisted: yes (Claude Code)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions