nir/serialize: Alloc constants off the variable
authorJason Ekstrand <jason.ekstrand@intel.com>
Tue, 24 Jul 2018 18:01:20 +0000 (11:01 -0700)
committerJason Ekstrand <jason.ekstrand@intel.com>
Tue, 24 Jul 2018 19:34:07 +0000 (12:34 -0700)
commitf214baf72ff89ba03342067f89c38b4bc84e298b
treef7dce49d0e443d4cda23d6c47b261944b6cf2c12
parent7f95564a22d11ee3f54915ee02f9fa1f78c6adcf
nir/serialize: Alloc constants off the variable

nir_sweep assumes that constants area always allocated off the variable
to which they belong.  Violating this assumption causes them to get
freed early and leads to use-after-free bugs.

Fixes: 120da00975541 "nir: add serialization and deserialization"
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107366
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Tested-by: Mark Janes <mark.a.janes@intel.com>
src/compiler/nir/nir_serialize.c