Mesa (staging/20.1): glsl: Eliminate assigments to out-of-bounds elements of vector

[GitLab Mirror]

Module: Mesa
Branch: staging/20.1
Commit: 4779d55a78d3cb5ca85d59acc16c55f3ffa35e3d
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=4779d55a78d3cb5ca85d59acc16c55f3ffa35e3d

Author: Danylo Piliaiev <danylo.piliaiev at globallogic.com>
Date:   Mon Aug 17 18:22:47 2020 +0300

glsl: Eliminate assigments to out-of-bounds elements of vector

Several optimization paths, including constant folding, can lead to
indexing vector with an out of bounds index.

Out-of-bounds writes could be eliminated per spec:

Section 5.11 (Out-of-Bounds Accesses) of the GLSL 4.60 spec says:

"In the subsections described above for array, vector, matrix and
 structure accesses, any out-of-bounds access produced undefined
 behavior.... Out-of-bounds writes may be discarded or overwrite
 other variables of the active program."

Fixes piglit tests:
spec at glsl-1.20@execution at vector-out-of-bounds-access@fs-vec4-out-of-bounds-1
spec at glsl-1.20@execution at vector-out-of-bounds-access@fs-vec4-out-of-bounds-6

CC: <mesa-stable at lists.freedesktop.org>
Signed-off-by: Danylo Piliaiev <danylo.piliaiev at globallogic.com>
Reviewed-by: Eric Anholt <eric at anholt.net>
Reviewed-by: Marcin Ślusarz <marcin.slusarz at intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6363>
(cherry picked from commit 5922d57a184fcb27955d959e949e1ef68873bd19)

---

 .pick_status.json                         |  2 +-
 src/compiler/glsl/lower_vector_derefs.cpp | 32 +++++++++++++++++++++++--------
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/.pick_status.json b/.pick_status.json
index 8928a5efde6..d77a19ed66f 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -1768,7 +1768,7 @@
         "description": "glsl: Eliminate assigments to out-of-bounds elements of vector",
         "nominated": true,
         "nomination_type": 0,
-        "resolution": 0,
+        "resolution": 1,
         "master_sha": null,
         "because_sha": null
     },
diff --git a/src/compiler/glsl/lower_vector_derefs.cpp b/src/compiler/glsl/lower_vector_derefs.cpp
index 0c09630fa03..8a37e35b606 100644
--- a/src/compiler/glsl/lower_vector_derefs.cpp
+++ b/src/compiler/glsl/lower_vector_derefs.cpp
@@ -136,15 +136,31 @@ vector_deref_visitor::visit_enter(ir_assignment *ir)
          ir->write_mask = (1 << new_lhs->type->vector_elements) - 1;
          ir->set_lhs(new_lhs);
       }
-   } else if (new_lhs->ir_type != ir_type_swizzle) {
-      ir->set_lhs(new_lhs);
-      ir->write_mask = 1 << old_index_constant->get_uint_component(0);
    } else {
-      /* If the "new" LHS is a swizzle, use the set_lhs helper to instead
-       * swizzle the RHS.
-       */
-      unsigned component[1] = { old_index_constant->get_uint_component(0) };
-      ir->set_lhs(new(mem_ctx) ir_swizzle(new_lhs, component, 1));
+      unsigned index = old_index_constant->get_uint_component(0);
+
+      if (index >= new_lhs->type->vector_elements) {
+         /* Section 5.11 (Out-of-Bounds Accesses) of the GLSL 4.60 spec says:
+          *
+          *  In the subsections described above for array, vector, matrix and
+          *  structure accesses, any out-of-bounds access produced undefined
+          *  behavior.... Out-of-bounds writes may be discarded or overwrite
+          *  other variables of the active program.
+          */
+         ir->remove();
+         return visit_continue;
+      }
+
+      if (new_lhs->ir_type != ir_type_swizzle) {
+         ir->set_lhs(new_lhs);
+         ir->write_mask = 1 << index;
+      } else {
+         /* If the "new" LHS is a swizzle, use the set_lhs helper to instead
+          * swizzle the RHS.
+          */
+         unsigned component[1] = { index };
+         ir->set_lhs(new(mem_ctx) ir_swizzle(new_lhs, component, 1));
+      }
    }
 
    return ir_rvalue_enter_visitor::visit_enter(ir);