i965: fix problem with constant out of bounds access (v3)

[mesa.git] / src / mesa / drivers / dri / i965 / brw_fs.cpp

diff --git a/src/mesa/drivers/dri/i965/brw_fs.cpp b/src/mesa/drivers/dri/i965/brw_fs.cpp
index baaa25c13473171ae963b150c021cd92f908653b..7f8edff57eca24918439ac36a08a746195e49858 100644 (file)
--- a/src/mesa/drivers/dri/i965/brw_fs.cpp
+++ b/src/mesa/drivers/dri/i965/brw_fs.cpp
@@ -818,6 +818,7 @@ fs_visitor::import_uniforms(fs_visitor *v)
                           import_uniforms_callback,
                           variable_ht);
    this->params_remap = v->params_remap;
+   this->nr_params_remap = v->nr_params_remap;
 }
 
 /* Our support for uniforms is piggy-backed on the struct
@@ -1490,6 +1491,7 @@ fs_visitor::remove_dead_constants()
 {
    if (dispatch_width == 8) {
       this->params_remap = ralloc_array(mem_ctx, int, c->prog_data.nr_params);
+      this->nr_params_remap = c->prog_data.nr_params;
 
       for (unsigned int i = 0; i < c->prog_data.nr_params; i++)
         this->params_remap[i] = -1;
@@ -1504,7 +1506,14 @@ fs_visitor::remove_dead_constants()
            if (inst->src[i].file != UNIFORM)
               continue;
 
-           assert(constant_nr < (int)c->prog_data.nr_params);
+           /* Section 5.11 of the OpenGL 4.3 spec says:
+            *
+            *     "Out-of-bounds reads return undefined values, which include
+            *     values from other variables of the active program or zero."
+            */
+           if (constant_nr < 0 || constant_nr >= (int)c->prog_data.nr_params) {
+              constant_nr = 0;
+           }
 
            /* For now, set this to non-negative.  We'll give it the
             * actual new number in a moment, in order to keep the
@@ -1552,6 +1561,10 @@ fs_visitor::remove_dead_constants()
         if (inst->src[i].file != UNIFORM)
            continue;
 
+        /* as above alias to 0 */
+        if (constant_nr < 0 || constant_nr >= (int)this->nr_params_remap) {
+           constant_nr = 0;
+        }
         assert(this->params_remap[constant_nr] != -1);
         inst->src[i].reg = this->params_remap[constant_nr];
         inst->src[i].reg_offset = 0;