From 9a1b2615295fc002479b8ca77ca51a385d66424e Mon Sep 17 00:00:00 2001 From: Rhys Perry Date: Fri, 25 Jul 2025 10:28:55 +0100 Subject: [PATCH] nir/uub: fix 8/16-bit overflow Signed-off-by: Rhys Perry Reviewed-by: Georg Lehmann Backport-to: 25.1 Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/13552 Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/13553 Tested-by: @LingMan Part-of: (cherry picked from commit a9a1da0264b9c7080464daed7f4baf506e0b60da) --- .pick_status.json | 2 +- src/compiler/nir/nir_range_analysis.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.pick_status.json b/.pick_status.json index 7dbe8056581..7f1de7a781e 100644 --- a/.pick_status.json +++ b/.pick_status.json @@ -1354,7 +1354,7 @@ "description": "nir/uub: fix 8/16-bit overflow", "nominated": true, "nomination_type": 4, - "resolution": 0, + "resolution": 1, "main_sha": null, "because_sha": null, "notes": null diff --git a/src/compiler/nir/nir_range_analysis.c b/src/compiler/nir/nir_range_analysis.c index 4761e493b02..d2f894a818e 100644 --- a/src/compiler/nir/nir_range_analysis.c +++ b/src/compiler/nir/nir_range_analysis.c @@ -1840,11 +1840,13 @@ get_alu_uub(struct analysis_state *state, struct uub_query q, uint32_t *result, uint32_t src1 = MIN2(src[1], q.scalar.def->bit_size - 1u); if (util_last_bit64(src[0]) + src1 <= q.scalar.def->bit_size) /* check overflow */ *result = src[0] << src1; + *result = MIN2(*result, max); break; } case nir_op_imul: if (src[0] == 0 || (src[0] * src[1]) / src[0] == src[1]) /* check overflow */ *result = src[0] * src[1]; + *result = MIN2(*result, max); break; case nir_op_ushr: { nir_scalar src1_scalar = nir_scalar_chase_alu_src(q.scalar, 1); @@ -1867,6 +1869,7 @@ get_alu_uub(struct analysis_state *state, struct uub_query q, uint32_t *result, case nir_op_iadd: if (src[0] + src[1] >= src[0]) /* check overflow */ *result = src[0] + src[1]; + *result = MIN2(*result, max); break; case nir_op_umod: *result = src[1] ? src[1] - 1 : 0;