[Bug 108999] Calculating the scissors fields when the y is flipped (0 on top) can generate negative numbers that will cause assertion failure later on.

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=108999

Nanley Chery <nanleychery at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #3 from Nanley Chery <nanleychery at gmail.com> ---
This bug has been fixed by:

commit fd37a19ac4c8b2ebff330b2a06a7f311f7d478e3
Author: Eleni Maria Stea <estea at igalia.com>
Date:   Fri Feb 22 23:02:30 2019 +0200

    i965: fixed clamping in set_scissor_bits when the y is flipped

    Calculating the scissor rectangle fields with the y flipped (0 on top)
    can generate negative values that will cause assertion failure later on
    as the scissor fields are all unsigned. We must clamp the bbox values
    again to make sure they don't exceed the fb_height. Also fixed a
    calculation error.

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108999
              https://bugs.freedesktop.org/show_bug.cgi?id=109594

    v2:
       - I initially clamped the values inside the if (Y is flipped) case
       and I made a mistake in the calculation: the clamp of the bbox[2] should
       be a check if (bbox[2] >= fbheight) bbox[2] = fbheight - 1 instead and I
       shouldn't have changed the ScissorRectangleYMax calculation. As the
       fixed code is equivalent with using CLAMP instead of MAX2 at the top of
       the function when bbox[2] and bbox[3] are calculated, and the 2nd is
more
       clear, I replaced it. (Nanley Chery)

    v3:
       - Reversed the CLAMP change in bbox[3] as the API guarantees that the
       viewport height is positive. (Nanley Chery)

    v4:
      - Added nomination for the mesa-stable branch and the link to the second
      bugzilla bug (Nanley Chery)

    CC: <mesa-stable at lists.freedesktop.org>
    Tested-by: Paul Chelombitko <qamonstergl at gmail.com>
    Reviewed-by: Nanley Chery <nanley.g.chery at intel.com>

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/intel-3d-bugs/attachments/20190226/beca1766/attachment.html>