freedreno/ir3: fix potential segfault in RA

Triggered by shaders like:

  FRAG
  PROPERTY FS_COLOR0_WRITES_ALL_CBUFS 1
  DCL OUT[0], COLOR
  DCL CONST[0]
  DCL TEMP[0..2], LOCAL
    0: IF CONST[0].xxxx :0
    1:   MOV TEMP[0], TEMP[1]
    2: ELSE :0
    3:   MOV TEMP[0], TEMP[2]
    4: ENDIF
    5: MOV OUT[0], TEMP[0]
    6: END

not really a sane shader, although driver segfaulting is probably
not the appropriate response.

Signed-off-by: Rob Clark <robclark@freedesktop.org>

diff --git a/src/gallium/drivers/freedreno/ir3/ir3_ra.c b/src/gallium/drivers/freedreno/ir3/ir3_ra.c
index b916dd513936f3b8a9736cd9eae909d3a775e1e7..3ac626ca3b61400446fa29ba444dad2fa377e57e 100644 (file)
--- a/src/gallium/drivers/freedreno/ir3/ir3_ra.c
+++ b/src/gallium/drivers/freedreno/ir3/ir3_ra.c
@@ -253,7 +253,9 @@ static int alloc_block(struct ir3_ra_ctx *ctx,
                                (instr->regs_count == 1)) {
                        unsigned i, base = instr->regs[0]->num & ~0x3;
                        for (i = 0; i < 4; i++) {
-                               struct ir3_instruction *in = ctx->block->inputs[base + i];
+                               struct ir3_instruction *in = NULL;
+                               if ((base + i) < ctx->block->ninputs)
+                                       in = ctx->block->inputs[base + i];
                                if (in)
                                        compute_clobbers(ctx, in->next, in, &liveregs);
                        }
@@ -471,7 +473,9 @@ static void ra_assign_dst_shader_input(struct ir3_visitor *v,
 
        /* trigger assignment of all our companion input components: */
        for (i = 0; i < 4; i++) {
-               struct ir3_instruction *in = instr->block->inputs[i+base];
+               struct ir3_instruction *in = NULL;
+               if ((base + i) < instr->block->ninputs)
+                       in = instr->block->inputs[base + i];
                if (in && is_meta(in) && (in->opc == OPC_META_INPUT))
                        ra_assign(a->ctx, in, a->num + off + i);
        }