[Mesa-dev] [PATCH] i965/vs: Fix invalid array access in copy propagation.

[Kenneth Graunke]

Accessing virtual_grf_reg_map[inst->dst.reg] is invalid if
inst->dst.file != GRF.  Since is_direct_copy already implies a GRF
destination, we can just move the check earlier.

Fixes a regression in commit 07ee9f374f2946f852896e9264c7fa83eafc3f16.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44302
Signed-off-by: Kenneth Graunke <kenneth at whitecape.org>
---
 .../drivers/dri/i965/brw_vec4_copy_propagation.cpp |   29 ++++++++++---------
 1 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/src/mesa/drivers/dri/i965/brw_vec4_copy_propagation.cpp b/src/mesa/drivers/dri/i965/brw_vec4_copy_propagation.cpp
index 08d8f5b..4d27c53 100644
--- a/src/mesa/drivers/dri/i965/brw_vec4_copy_propagation.cpp
+++ b/src/mesa/drivers/dri/i965/brw_vec4_copy_propagation.cpp
@@ -297,23 +297,24 @@ vec4_visitor::opt_copy_propagation()
       }
 
       /* Track available source registers. */
-      const int reg = virtual_grf_reg_map[inst->dst.reg] + inst->dst.reg_offset;
+      if (inst->dst.file == GRF) {
+	 const int reg =
+	    virtual_grf_reg_map[inst->dst.reg] + inst->dst.reg_offset;
 
-      /* Update our destination's current channel values.  For a direct copy,
-       * the value is the newly propagated source.  Otherwise, we don't know
-       * the new value, so clear it.
-       */
-      bool direct_copy = is_direct_copy(inst);
-      for (int i = 0; i < 4; i++) {
-	 if (inst->dst.writemask & (1 << i)) {
-	    cur_value[reg][i] = direct_copy ? &inst->src[0] : NULL;
+	 /* Update our destination's current channel values.  For a direct copy,
+	  * the value is the newly propagated source.  Otherwise, we don't know
+	  * the new value, so clear it.
+	  */
+	 bool direct_copy = is_direct_copy(inst);
+	 for (int i = 0; i < 4; i++) {
+	    if (inst->dst.writemask & (1 << i)) {
+	       cur_value[reg][i] = direct_copy ? &inst->src[0] : NULL;
+	    }
 	 }
-      }
 
-      /* Clear the records for any registers whose current value came from
-       * our destination's updated channels, as the two are no longer equal.
-       */
-      if (inst->dst.file == GRF) {
+	 /* Clear the records for any registers whose current value came from
+	  * our destination's updated channels, as the two are no longer equal.
+	  */
 	 if (inst->dst.reladdr)
 	    memset(cur_value, 0, sizeof(cur_value));
 	 else {
-- 
1.7.8.1