From: Eric Anholt <eric@anholt.net>
Date: Tue, 20 Mar 2018 17:42:12 +0000 (-0700)
Subject: gallium/u_vbuf: Protect against overflow with large instance divisors.
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=0356db022da819176d9d0eacab63d4c2c852f876;p=mesa.git

gallium/u_vbuf: Protect against overflow with large instance divisors.

GTF-GLES3.gtf.GL3Tests.instanced_arrays.instanced_arrays_divisor uses -1
as a divisor, so we would overflow to count=0 and upload no data,
triggering the assert below.  We want to upload 1 element in this case,
fixing the test on VC5.

v2: Use some more obvious logic, and explain why we don't use the normal
    round_up().

Reviewed-by: Brian Paul <brianp@vmware.com>
---

diff --git a/src/gallium/auxiliary/util/u_vbuf.c b/src/gallium/auxiliary/util/u_vbuf.c
index 95d7990c6ca..8a680d60a68 100644
--- a/src/gallium/auxiliary/util/u_vbuf.c
+++ b/src/gallium/auxiliary/util/u_vbuf.c
@@ -936,7 +936,16 @@ u_vbuf_upload_buffers(struct u_vbuf *mgr,
          size = mgr->ve->src_format_size[i];
       } else if (instance_div) {
          /* Per-instance attrib. */
-         unsigned count = (num_instances + instance_div - 1) / instance_div;
+
+         /* Figure out how many instances we'll render given instance_div.  We
+          * can't use the typical div_round_up() pattern because the CTS uses
+          * instance_div = ~0 for a test, which overflows div_round_up()'s
+          * addition.
+          */
+         unsigned count = num_instances / instance_div;
+         if (count * instance_div != num_instances)
+            count++;
+
          first += vb->stride * start_instance;
          size = vb->stride * (count - 1) + mgr->ve->src_format_size[i];
       } else {