fdo-mirrors/mesa
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/mesa/mesa.git synced 2026-05-07 07:08:04 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

r600/sb: fix crash in fold_alu_op3

Browse source 
fold_assoc() called from fold_alu_op3() can lower the number of src to 2,
which then leads to an invalid access to n.src[2]->gvalue().
This didn't seem to have caused much harm in the past, but on Fedora 28
it will crash (presumably because -D_GLIBCXX_ASSERTIONS is used, although
with libstdc++ 4.8.5 this didn't do anything, -D_GLIBCXX_DEBUG was
needed to show the issue).

An alternative fix would be to instead call fold_alu_op2() from within
fold_assoc() when the number of src is reduced and return always TRUE
from fold_assoc() in this case, with the only actual difference being
the return value from fold_alu_op3() then. I'm not sure what the return
value actually should be in this case (or whether it even can make a
difference).

https://bugs.freedesktop.org/show_bug.cgi?id=106928
Cc: mesa-stable@lists.freedesktop.org
Reviewed-by: Dave Airlie <airlied@redhat.com>
(cherry picked from commit 817efd8968)
This commit is contained in:
Roland Scheidegger 2018-07-04 04:44:17 +02:00 • committed by Dylan Baker
parent 3ddbe5d4d7
commit d68f2d7ede
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/gallium/drivers/r600/sb/sb_expr.cpp
View file

@ -945,6 +945,8 @@ bool expr_handler::fold_alu_op3(alu_node& n) {
if (!sh.safe_math && (n.bc.op_ptr->flags & AF_M_ASSOC)) {
if (fold_assoc(&n))
return true;
if (n.src.size() < 3)
return fold_alu_op2(n);
}
value* v0 = n.src[0]->gvalue();