Mesa (master): freedreno/ir3: fix potential segfault in RA

[Rob Clark]

Module: Mesa
Branch: master
Commit: a2c22d80d4efc793a29150360f428a76f9c8589d
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=a2c22d80d4efc793a29150360f428a76f9c8589d

Author: Rob Clark <robclark at freedesktop.org>
Date:   Mon Sep  8 13:42:54 2014 -0400

freedreno/ir3: fix potential segfault in RA

Triggered by shaders like:

  FRAG
  PROPERTY FS_COLOR0_WRITES_ALL_CBUFS 1
  DCL OUT[0], COLOR
  DCL CONST[0]
  DCL TEMP[0..2], LOCAL
    0: IF CONST[0].xxxx :0
    1:   MOV TEMP[0], TEMP[1]
    2: ELSE :0
    3:   MOV TEMP[0], TEMP[2]
    4: ENDIF
    5: MOV OUT[0], TEMP[0]
    6: END

not really a sane shader, although driver segfaulting is probably
not the appropriate response.

Signed-off-by: Rob Clark <robclark at freedesktop.org>

---

 src/gallium/drivers/freedreno/ir3/ir3_ra.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/gallium/drivers/freedreno/ir3/ir3_ra.c b/src/gallium/drivers/freedreno/ir3/ir3_ra.c
index b916dd5..3ac626c 100644
--- a/src/gallium/drivers/freedreno/ir3/ir3_ra.c
+++ b/src/gallium/drivers/freedreno/ir3/ir3_ra.c
@@ -253,7 +253,9 @@ static int alloc_block(struct ir3_ra_ctx *ctx,
 				(instr->regs_count == 1)) {
 			unsigned i, base = instr->regs[0]->num & ~0x3;
 			for (i = 0; i < 4; i++) {
-				struct ir3_instruction *in = ctx->block->inputs[base + i];
+				struct ir3_instruction *in = NULL;
+				if ((base + i) < ctx->block->ninputs)
+					in = ctx->block->inputs[base + i];
 				if (in)
 					compute_clobbers(ctx, in->next, in, &liveregs);
 			}
@@ -471,7 +473,9 @@ static void ra_assign_dst_shader_input(struct ir3_visitor *v,
 
 	/* trigger assignment of all our companion input components: */
 	for (i = 0; i < 4; i++) {
-		struct ir3_instruction *in = instr->block->inputs[i+base];
+		struct ir3_instruction *in = NULL;
+		if ((base + i) < instr->block->ninputs)
+			in = instr->block->inputs[base + i];
 		if (in && is_meta(in) && (in->opc == OPC_META_INPUT))
 			ra_assign(a->ctx, in, a->num + off + i);
 	}