[Bug 111664] [Bisected] Segmentation fault on FS shader compilation (mat4x3 * mat4x3)

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=111664

            Bug ID: 111664
           Summary: [Bisected] Segmentation fault on FS shader compilation
                    (mat4x3 * mat4x3)
           Product: Mesa
           Version: git
          Hardware: Other
                OS: All
            Status: NEW
          Severity: not set
          Priority: not set
         Component: Drivers/DRI/i965
          Assignee: intel-3d-bugs at lists.freedesktop.org
          Reporter: andrey.simiklit.1989 at gmail.com
        QA Contact: intel-3d-bugs at lists.freedesktop.org

This issue is reproducible on latest master.

FS which causes a crash:
#version 430
out vec4 color;
void main()
{
    mat4x3 a;
    a = mat4x3(1.0);
    mat4x3 b;
    b = mat4x3(3.0);
    b *= a;
    color = b[0].xyzz;
}

Just save it as 'test.frag' in piglit folder and execute:
"./bin/glslparsertest test.frag pass 4.30"

You will see an error like:
"ir_swizzle @ 0x5637f74315f0 specifies a channel not present in the value.
 Aborted (core dumped)"

I guess that root cause is because mesa allows such multiplications.
I don't know the reason why mesa allows such multiplication but it should be
wrong because of glsl spec is saying "5.9 Expressions":

"The operator is multiply (*), where both operands are matrices or one operand
is a vector and the
 other a matrix. A right vector operand is treated as a column vector and a
left vector operand as a
 row vector. In all these cases, it is required that the number of columns of
the left operand is equal
 to the number of rows of the right operand"

On shader-playground this shader just fails with an error:
'assign' :  cannot convert from ' temp 4X3 matrix of float' to ' temp 4X3
matrix of float'

Note: radv passes this test without errors and crash that also strange)

I am almost done a mesa fix and the piglit test for that.

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/intel-3d-bugs/attachments/20190911/1e6cf49f/attachment.html>