From: Ian Romanick <ian.d.roman...@intel.com> If the source is not a GRF, it could have a register >= virtual_grf_count. Accessing virtual_grf_end with such a register would lead to out-of-bounds access. Make sure the source is a GRF before accessing virtual_grf_end.
Fixes gles3conform failure in: ES3-CTS.shaders.struct.uniform.sampler_array_vertex. Signed-off-by: Ian Romanick <ian.d.roman...@intel.com> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=83215 --- src/mesa/drivers/dri/i965/brw_vec4_cse.cpp | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/src/mesa/drivers/dri/i965/brw_vec4_cse.cpp b/src/mesa/drivers/dri/i965/brw_vec4_cse.cpp index a0f6e77..da3e65a 100644 --- a/src/mesa/drivers/dri/i965/brw_vec4_cse.cpp +++ b/src/mesa/drivers/dri/i965/brw_vec4_cse.cpp @@ -224,14 +224,21 @@ vec4_visitor::opt_cse_local(bblock_t *block) /* Kill any AEB entries using registers that don't get reused any * more -- a sure sign they'll fail operands_match(). */ - int last_reg_use = MAX2(MAX2(virtual_grf_end[src->reg * 4 + 0], - virtual_grf_end[src->reg * 4 + 1]), - MAX2(virtual_grf_end[src->reg * 4 + 2], - virtual_grf_end[src->reg * 4 + 3])); - if (src->file == GRF && last_reg_use < ip) { - entry->remove(); - ralloc_free(entry); - break; + if (src->file == GRF) { + assert((src->reg * 4 + 0) < (virtual_grf_count * 4)); + assert((src->reg * 4 + 1) < (virtual_grf_count * 4)); + assert((src->reg * 4 + 2) < (virtual_grf_count * 4)); + assert((src->reg * 4 + 3) < (virtual_grf_count * 4)); + + int last_reg_use = MAX2(MAX2(virtual_grf_end[src->reg * 4 + 0], + virtual_grf_end[src->reg * 4 + 1]), + MAX2(virtual_grf_end[src->reg * 4 + 2], + virtual_grf_end[src->reg * 4 + 3])); + if (last_reg_use < ip) { + entry->remove(); + ralloc_free(entry); + break; + } } } } -- 1.8.1.4 _______________________________________________ mesa-dev mailing list mesa-dev@lists.freedesktop.org http://lists.freedesktop.org/mailman/listinfo/mesa-dev
