nir/spirv: fix build_mat_subdet stack smasher

The sub-determinate implementation pattern fixed by
6a7e2904e0a2a6f8efbf739a1b3cad7e1e4ab42d has a second instance in the
same file.

With the previous algorithm, when row and j are both 3, the index
overruns the array.  This only impacts the stack on 32 bit builds.

Reviewed-by: Jason Ekstrand <jason.ekstrand@intel.com>

diff --git a/src/compiler/nir/spirv/vtn_glsl450.c b/src/compiler/nir/spirv/vtn_glsl450.c
index 4fceffa37a60d243db2a2b5b011a8db4af939a45..5fb73df05663f0cbe41f73209bd6f9e47354fefb 100644 (file)
--- a/src/compiler/nir/spirv/vtn_glsl450.c
+++ b/src/compiler/nir/spirv/vtn_glsl450.c
@@ -121,8 +121,11 @@ build_mat_subdet(struct nir_builder *b, struct vtn_ssa_value *src,
    } else {
       /* Swizzle to get all but the specified row */
       unsigned swiz[3];
-      for (unsigned j = 0; j < 4; j++)
-         swiz[j - (j > row)] = j;
+      for (unsigned j = 0, k = 0; j < 3; j++, k++) {
+         if (k == row)
+            k++; /* skip column */
+         swiz[j] = k;
+      }
 
       /* Grab all but the specified column */
       nir_ssa_def *subcol[3];