nir: Use VARYING_SLOT_TESS_MAX to size indirect bitmasks

MAX_VARYINGS_INCL_PATCH subtracts VARYING_SLOT_VAR0 giving us a size
that's too small, so BITSET_SET writes words out of bounds, corrupting
the stack and causing all kinds of chaos.  VARYING_SLOT_TESS_MAX is
the right value to use here, as it's the largest location.

Closes: 2002
Fixes: ee2050b1111 ("nir: Use BITSET for tracking varyings in lower_io_arrays")
Reviewed-by: Kristian H. Kristensen <hoegsberg@google.com>

diff --git a/src/compiler/nir/nir_lower_io_arrays_to_elements.c b/src/compiler/nir/nir_lower_io_arrays_to_elements.c
index a0d0eb740db1c953096d892cb926244e16956432..ca9eb700f945e690485bc6b7a14fefc265d949c0 100644 (file)
--- a/src/compiler/nir/nir_lower_io_arrays_to_elements.c
+++ b/src/compiler/nir/nir_lower_io_arrays_to_elements.c
@@ -349,7 +349,7 @@ nir_lower_io_arrays_to_elements_no_indirects(nir_shader *shader,
    struct hash_table *split_inputs = _mesa_pointer_hash_table_create(NULL);
    struct hash_table *split_outputs = _mesa_pointer_hash_table_create(NULL);
 
-   BITSET_DECLARE(indirects, 4 * MAX_VARYINGS_INCL_PATCH) = {};
+   BITSET_DECLARE(indirects, 4 * VARYING_SLOT_TESS_MAX) = {};
 
    lower_io_arrays_to_elements(shader, nir_var_shader_out,
                                indirects, split_outputs, true);
@@ -387,7 +387,7 @@ nir_lower_io_arrays_to_elements(nir_shader *producer, nir_shader *consumer)
    struct hash_table *split_inputs = _mesa_pointer_hash_table_create(NULL);
    struct hash_table *split_outputs = _mesa_pointer_hash_table_create(NULL);
 
-   BITSET_DECLARE(indirects, 4 * MAX_VARYINGS_INCL_PATCH) = {};
+   BITSET_DECLARE(indirects, 4 * VARYING_SLOT_TESS_MAX) = {};
 
    create_indirects_mask(producer, indirects, nir_var_shader_out);
    create_indirects_mask(consumer, indirects, nir_var_shader_in);