Reading brw->fragment_program is nonsensical in compiler code: it contains the currently active program (if any), not the one currently being compiled. Attempting to access it may either lead to crashes (null pointer dereference if no program is active) or wrong results.
Fixes piglit regressions since 9ef710575b914ddfc8e9a162d98ad554c1c217f7 on pre-Sandybridge hardware. The actual bug was created in commit 7b1fbc688999fd568e65211d79d7678562061594. NOTE: This is a candidate for the 9.0 and 8.0 branches. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=54183 Cc: Rico Tzschichholz <ric...@t-online.de> Signed-off-by: Kenneth Graunke <kenn...@whitecape.org> --- src/mesa/drivers/dri/i965/brw_fs.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) As I suspected: the precompile just exposed a bug that'd been lurking for a while (February 2012 to be precise). diff --git a/src/mesa/drivers/dri/i965/brw_fs.cpp b/src/mesa/drivers/dri/i965/brw_fs.cpp index a8d55ff..167ea08 100644 --- a/src/mesa/drivers/dri/i965/brw_fs.cpp +++ b/src/mesa/drivers/dri/i965/brw_fs.cpp @@ -979,7 +979,7 @@ fs_visitor::calculate_urb_setup() * * See compile_sf_prog() for more info. */ - if (brw->fragment_program->Base.InputsRead & BITFIELD64_BIT(FRAG_ATTRIB_PNTC)) + if (fp->Base.InputsRead & BITFIELD64_BIT(FRAG_ATTRIB_PNTC)) urb_setup[FRAG_ATTRIB_PNTC] = urb_next++; } -- 1.7.11.4 _______________________________________________ mesa-dev mailing list mesa-dev@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/mesa-dev
