Mesa (master): freedreno/a3xx/compiler: overflow in trans_endif

[Rob Clark]

Module: Mesa
Branch: master
Commit: ecb71cfa66f4257661579a0afa5f9c56c7dbfce2
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=ecb71cfa66f4257661579a0afa5f9c56c7dbfce2

Author: Rob Clark <robclark at freedesktop.org>
Date:   Sun Mar  2 08:48:08 2014 -0500

freedreno/a3xx/compiler: overflow in trans_endif

The logic to count number of block outputs was out of sync with the
actual array construction.  But to simplify / make things less fragile,
we can just allocate the arrays for worst case size.

Signed-off-by: Rob Clark <robclark at freedesktop.org>

---

 src/gallium/drivers/freedreno/a3xx/fd3_compiler.c |   18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/src/gallium/drivers/freedreno/a3xx/fd3_compiler.c b/src/gallium/drivers/freedreno/a3xx/fd3_compiler.c
index 7450fac..9b64474 100644
--- a/src/gallium/drivers/freedreno/a3xx/fd3_compiler.c
+++ b/src/gallium/drivers/freedreno/a3xx/fd3_compiler.c
@@ -1427,19 +1427,9 @@ trans_endif(const struct instr_translater *t,
 	if (!elseb)
 		elseb = ifb->parent;
 
-	/* count up number of outputs for each block: */
-	for (i = 0; i < ifb->ntemporaries; i++) {
-		if (ifb->temporaries[i])
-			ifnout++;
-		if (elseb->temporaries[i])
-			elsenout++;
-	}
-	for (i = 0; i < ifb->noutputs; i++) {
-		if (ifb->outputs[i])
-			ifnout++;
-		if (elseb->outputs[i])
-			elsenout++;
-	}
+	/* worst case sizes: */
+	ifnout = ifb->ntemporaries + ifb->noutputs;
+	elsenout = elseb->ntemporaries + elseb->noutputs;
 
 	ifout = ir3_alloc(ctx->ir, sizeof(ifb->outputs[0]) * ifnout);
 	if (elseb != ifb->parent)
@@ -1480,6 +1470,8 @@ trans_endif(const struct instr_translater *t,
 		}
 	}
 
+	compile_assert(ctx, ifb->noutputs == elseb->noutputs);
+
 	/* .. and any outputs written: */
 	for (i = 0; i < ifb->noutputs; i++) {
 		struct ir3_instruction *a = ifb->outputs[i];