fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-05 05:18:08 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

nir/search: Use larger type to hold linearized index

Browse source 
"index" is an offset into a linearized 3-dimensional array.  Starting
with fbd5359a0a, the 3-dimensional array can have 43 elements in each
dimension.  43**3 = 79507, and that will overflow the uint16_t.

See also the discussion in MR !3765.

Fixes: fbd5359a0a ("nir/algebraic: Rearrange bcsel sequences generated by nir_opt_peephole_select")
Suggested-by: Connor Abbott <cwabbott0@gmail.com>
Reviewed-by: Connor Abbott <cwabbott0@gmail.com>
Tested-by: Marge Bot <https://gitlab.freedesktop.org/mesa/mesa/merge_requests/3871>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/merge_requests/3871>
(cherry picked from commit 58bdc1c748)
This commit is contained in:
Ian Romanick 2020-02-18 15:31:37 -08:00 • committed by Dylan Baker
parent 5376a79962
commit 760b8cfd1c
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.pick_status.json
View file

@ -157,7 +157,7 @@
"description": "nir/search: Use larger type to hold linearized index",
"nominated": true,
"nomination_type": 1,
"resolution": 0,
"resolution": 1,
"master_sha": null,
"because_sha": "fbd5359a0a6f4b6d220c4cea9020ec4665ed4955"
},

2
src/compiler/nir/nir_search.c
View file

@ -789,7 +789,7 @@ nir_algebraic_automaton(nir_instr *instr, struct util_dynarray *states,
* itertools.product(), which was used to emit the transition
* table.
*/
uint16_t index = 0;
unsigned index = 0;
for (unsigned i = 0; i < nir_op_infos[op].num_inputs; i++) {
index *= tbl->num_filtered_states;
index += tbl->filter[*util_dynarray_element(states, uint16_t,