From f6ac6c94a9d574d1d4a10af65eaae3aa4ed2bc19 Mon Sep 17 00:00:00 2001 From: Kenneth Graunke Date: Mon, 8 Jan 2024 20:58:20 -0800 Subject: [PATCH] intel/brw: Handle SHADER_OPCODE_SEND without src[3] in copy prop We construct some SENDs with only 3 sources (such as FB writes). This code could read out of bounds. Reviewed-by: Ian Romanick Part-of: --- src/intel/compiler/brw_fs_copy_propagation.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/intel/compiler/brw_fs_copy_propagation.cpp b/src/intel/compiler/brw_fs_copy_propagation.cpp index fd2317a2866..c923b7dd936 100644 --- a/src/intel/compiler/brw_fs_copy_propagation.cpp +++ b/src/intel/compiler/brw_fs_copy_propagation.cpp @@ -698,7 +698,8 @@ try_copy_propagate(const brw_compiler *compiler, fs_inst *inst, * We need to pin both split SEND sources in g112-g126/127, so only * allow this if the registers aren't too large. */ - if (inst->opcode == SHADER_OPCODE_SEND && entry->src.file == VGRF) { + if (inst->opcode == SHADER_OPCODE_SEND && inst->sources >= 4 && + entry->src.file == VGRF) { int other_src = arg == 2 ? 3 : 2; unsigned other_size = inst->src[other_src].file == VGRF ? alloc.sizes[inst->src[other_src].nr] :