Mesa (9.0): i965: Add texrect scale parameters before pointers to ParameterValues.

[Eric Anholt]

Module: Mesa
Branch: 9.0
Commit: 3d80d54bc948a8ef278fff04110e2b018afaa6da
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=3d80d54bc948a8ef278fff04110e2b018afaa6da

Author: Eric Anholt <eric at anholt.net>
Date:   Wed Nov 21 13:23:36 2012 -0800

i965: Add texrect scale parameters before pointers to ParameterValues.

If adding scale parameters during program compile caused a realloc of
ParameterValues, then the driver uniform storage set up by
_mesa_associate_uniform_storage() would point to potentially freed
memory.

Note that this uses TexturesUsed, which may change at runtime for GLSL
when sampler uniforms change.  This is a flaw in our handling of texrect
in general, and not one I'm fixing currently.

Reviewed-by: Kenneth Graunke <kenneth at whitecape.org>
(cherry picked from commit ffdfafb06cf3ae468ceb3e504365016347f54bee)
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=47169

---

 src/mesa/drivers/dri/i965/brw_program.c  |   21 +++++++++++++++++++++
 src/mesa/drivers/dri/i965/brw_program.h  |    1 +
 src/mesa/drivers/dri/i965/brw_shader.cpp |    2 ++
 3 files changed, 24 insertions(+), 0 deletions(-)

diff --git a/src/mesa/drivers/dri/i965/brw_program.c b/src/mesa/drivers/dri/i965/brw_program.c
index 0bf72d9..c1e3657 100644
--- a/src/mesa/drivers/dri/i965/brw_program.c
+++ b/src/mesa/drivers/dri/i965/brw_program.c
@@ -225,9 +225,30 @@ brwProgramStringNotify(struct gl_context *ctx,
       }
    }
 
+   brw_add_texrect_params(prog);
+
    return true;
 }
 
+void
+brw_add_texrect_params(struct gl_program *prog)
+{
+   for (int texunit = 0; texunit < BRW_MAX_TEX_UNIT; texunit++) {
+      if (!(prog->TexturesUsed[texunit] & (1 << TEXTURE_RECT_INDEX)))
+         continue;
+
+      int tokens[STATE_LENGTH] = {
+         STATE_INTERNAL,
+         STATE_TEXRECT_SCALE,
+         texunit,
+         0,
+         0
+      };
+
+      _mesa_add_state_reference(prog->Parameters, (gl_state_index *)tokens);
+   }
+}
+
 /* Per-thread scratch space is a power-of-two multiple of 1KB. */
 int
 brw_get_scratch_size(int size)
diff --git a/src/mesa/drivers/dri/i965/brw_program.h b/src/mesa/drivers/dri/i965/brw_program.h
index 10022d4..1821775 100644
--- a/src/mesa/drivers/dri/i965/brw_program.h
+++ b/src/mesa/drivers/dri/i965/brw_program.h
@@ -47,5 +47,6 @@ void brw_populate_sampler_prog_key_data(struct gl_context *ctx,
 				        struct brw_sampler_prog_key_data *key);
 bool brw_debug_recompile_sampler_key(const struct brw_sampler_prog_key_data *old_key,
                                      const struct brw_sampler_prog_key_data *key);
+void brw_add_texrect_params(struct gl_program *prog);
 
 #endif
diff --git a/src/mesa/drivers/dri/i965/brw_shader.cpp b/src/mesa/drivers/dri/i965/brw_shader.cpp
index edb4430..1a90bbe 100644
--- a/src/mesa/drivers/dri/i965/brw_shader.cpp
+++ b/src/mesa/drivers/dri/i965/brw_shader.cpp
@@ -204,6 +204,8 @@ brw_link_shader(struct gl_context *ctx, struct gl_shader_program *shProg)
 
       _mesa_reference_program(ctx, &shader->base.Program, prog);
 
+      brw_add_texrect_params(prog);
+
       /* This has to be done last.  Any operation that can cause
        * prog->ParameterValues to get reallocated (e.g., anything that adds a
        * program constant) has to happen before creating this linkage.