Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Crash during Vulkan replay in push descriptor replay #1182

Closed
zeux opened this issue Nov 20, 2018 · 1 comment
Closed

Crash during Vulkan replay in push descriptor replay #1182

zeux opened this issue Nov 20, 2018 · 1 comment
Labels
Bug A crash, misbehaviour, or other problem Unresolved Waiting for a fix or implementation

Comments

@zeux
Copy link
Contributor

zeux commented Nov 20, 2018

RenderDoc nightly (11/19) crashes during replay of the capture below, taken from https://github.com/zeux/niagara master on RTX 2080 with drawCount = 1000:

rdoccrash.rdc.zip

The crash can be reproduced as follows:

  1. Open the capture
  2. Click on the "Colour pass 2" without expanding any commands

The crash happens with the following callstack:

>	renderdoc.dll!VulkanRenderState::BindDescriptorSet(const DescSetLayout & descLayout, VkCommandBuffer_T * cmd, VkPipelineLayout_T * layout, VkPipelineBindPoint bindPoint, unsigned int setIndex, unsigned int * dynamicOffsets) Line 447	C++
 	renderdoc.dll!VulkanRenderState::BindPipeline(VkCommandBuffer_T * cmd, VulkanRenderState::PipelineBinding binding, bool subpass0) Line 367	C++
 	renderdoc.dll!WrappedVulkan::ReplayLog(unsigned int startEventID, unsigned int endEventID, ReplayLogType replayType) Line 2931	C++
 	renderdoc.dll!VulkanReplay::ReplayLog(unsigned int endEventID, ReplayLogType replayType) Line 99	C++
 	renderdoc.dll!ReplayController::SetFrameEvent(unsigned int eventId, bool force) Line 223	C++
 	qrenderdoc.exe!CaptureContext::SetEventID::__l2::<lambda>(IReplayController * r) Line 1370	C++

descLayout.bindings.size() has 6 elements, but setInfo.currentBindings only has 3; therefore the following line:

      DescriptorSetSlot *slots = setInfo.currentBindings[b];

Performs an out-of-bounds read, slots ends up as nullptr and the following access to slots crashes:

          dst[a] = slots[a].bufferInfo;

It looks like setInfo.currentBindings corresponds to the push descriptor setup for the indirect draw call (3 input buffers), and descLayout.bindings corresponds to the push descriptor setup for the preceding compute dispatch (5 input buffers and 1 input sampler).

@baldurk baldurk added Bug A crash, misbehaviour, or other problem Unresolved Waiting for a fix or implementation labels Nov 20, 2018
@baldurk
Copy link
Owner

baldurk commented Nov 20, 2018

Fixed - I should have been tracking push descriptors separately for compute/graphics but I wasn't. This lead to the graphics bind trampling the compute bind but getting confused because the layouts were still separate.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug A crash, misbehaviour, or other problem Unresolved Waiting for a fix or implementation
Projects
None yet
Development

No branches or pull requests

2 participants