fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2025-12-24 13:10:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

i965: Fix segfault in WebGL Conformance on Ivybridge

Browse source 
Fixes regression of WebGL Conformance test texture-size-limit [1] on
Ivybridge Mobile GT2 0x0166 with Google Chrome R38.

Regression introduced by

    commit 6c04423153
    Author: Kenneth Graunke <kenneth@whitecape.org>
    Date:   Sun Feb 2 02:58:42 2014 -0800

        i965: Bump GL_MAX_CUBE_MAP_TEXTURE_SIZE to 8192.

The test regressed because the pointer offset arithmetic in
intel_miptree_map_gtt() overflows for large textures. The pointer
arithmetic is not 64-bit safe.

[1] 52f0dc240f/sdk/tests/conformance/textures/texture-size-limit.html

Cc: "10.3 10.4" <mesa-stable@lists.freedesktop.org>
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=78770
Fixes: Intel CHRMOS-1377
Reported-by: Lu Hua <huax.lu@intel.com>
Reviewed-by: Ian Romanic <ian.d.romanick@intel.com>
Signed-off-by: Chad Versace <chad.versace@linux.intel.com>
This commit is contained in:
Chad Versace 2014-11-18 15:41:35 -08:00
parent 80bffde0a2
commit b69c7c5dac
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/mesa/drivers/dri/i965/intel_mipmap_tree.c
View file

@ -1745,8 +1745,8 @@ intel_miptree_map_gtt(struct brw_context *brw,
unsigned int bw, bh;
void *base;
unsigned int image_x, image_y;
int x = map->x;
int y = map->y;
intptr_t x = map->x;
intptr_t y = map->y;
/* For compressed formats, the stride is the number of bytes per
* row of blocks. intel_miptree_get_image_offset() already does
@ -1772,7 +1772,8 @@ intel_miptree_map_gtt(struct brw_context *brw,
map->ptr = base + y * map->stride + x * mt->cpp;
}
DBG("%s: %d,%d %dx%d from mt %p (%s) %d,%d = %p/%d\n", __FUNCTION__,
DBG("%s: %d,%d %dx%d from mt %p (%s) "
"%"PRIiPTR",%"PRIiPTR" = %p/%d\n", __FUNCTION__,
map->x, map->y, map->w, map->h,
mt, _mesa_get_format_name(mt->format),
x, y, map->ptr, map->stride);