[Mesa-dev] [PATCH 2/2] i965: Assert array index on access to vec4_visitor's arrays.

[Kenneth Graunke]

On 11/22/2013 12:09 AM, Petri Latvala wrote:
> Signed-off-by: Petri Latvala <petri.latvala at intel.com>
> ---
>  src/mesa/drivers/dri/i965/brw_vec4_visitor.cpp | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/src/mesa/drivers/dri/i965/brw_vec4_visitor.cpp b/src/mesa/drivers/dri/i965/brw_vec4_visitor.cpp
> index df38dab..511b080 100644
> --- a/src/mesa/drivers/dri/i965/brw_vec4_visitor.cpp
> +++ b/src/mesa/drivers/dri/i965/brw_vec4_visitor.cpp
> @@ -662,6 +662,7 @@ vec4_visitor::setup_uniform_values(ir_variable *ir)
>                                 storage->type->matrix_columns);
>  
>        for (unsigned s = 0; s < vector_count; s++) {
> +         assert(uniforms < uniform_param_count);
>           uniform_vector_size[uniforms] = storage->type->vector_elements;
>  
>           int i;
> @@ -685,6 +686,7 @@ vec4_visitor::setup_uniform_clipplane_values()
>     gl_clip_plane *clip_planes = brw_select_clip_planes(ctx);
>  
>     for (int i = 0; i < key->nr_userclip_plane_consts; ++i) {
> +      assert(this->uniforms < uniform_param_count);
>        this->uniform_vector_size[this->uniforms] = 4;
>        this->userplane[i] = dst_reg(UNIFORM, this->uniforms);
>        this->userplane[i].type = BRW_REGISTER_TYPE_F;
> @@ -715,6 +717,7 @@ vec4_visitor::setup_builtin_uniform_values(ir_variable *ir)
>  					    (gl_state_index *)slots[i].tokens);
>        float *values = &this->prog->Parameters->ParameterValues[index][0].f;
>  
> +      assert(this->uniforms < uniform_param_count);
>        this->uniform_vector_size[this->uniforms] = 0;
>        /* Add each of the unique swizzled channels of the element.
>         * This will end up matching the size of the glsl_type of this field.
> @@ -725,6 +728,7 @@ vec4_visitor::setup_builtin_uniform_values(ir_variable *ir)
>  	 last_swiz = swiz;
>  
>  	 prog_data->param[this->uniforms * 4 + j] = &values[swiz];
> +	 assert(this->uniforms < uniform_param_count);
>  	 if (swiz <= last_swiz)
>  	    this->uniform_vector_size[this->uniforms]++;
>        }
> @@ -983,6 +987,7 @@ vec4_visitor::visit(ir_variable *ir)
>        /* Track how big the whole uniform variable is, in case we need to put a
>         * copy of its data into pull constants for array access.
>         */
> +      assert(this->uniforms < uniform_param_count);
>        this->uniform_size[this->uniforms] = type_size(ir->type);
>  
>        if (!strncmp(ir->name, "gl_", 3)) {
> @@ -3197,6 +3202,7 @@ vec4_visitor::move_uniform_array_access_to_pull_constants()
>  
>  	    pull_constant_loc[uniform] = prog_data->nr_pull_params / 4;
>  
> +	    assert(uniform < uniform_param_count);
>  	    for (int j = 0; j < uniform_size[uniform] * 4; j++) {
>  	       prog_data->pull_param[prog_data->nr_pull_params++]
>                    = values[j];
> 

This patch looks good to me (assuming
s/uniform_param_count/uniform_array_size/g).  So, patch 2 is:

Reviewed-by: Kenneth Graunke <kenneth at whitecape.org>