swrast: always do span clipping in _swrast_write_rgba_span()

It's possible for mis-behaving vertex programs to produce vertex data
with very large/NaN values.  This doesn't get handled reliably by the
clipper code so we may try to rasterize triangles that extend beyond
the viewport/window.  Always clip spans to avoid invalid memory accesses
later.

1 files changed, 4 insertions, 14 deletions

diff --git a/src/mesa/swrast/s_span.c b/src/mesa/swrast/s_span.c
index fa8ca1d0e26..0e2793b4740 100644
--- a/src/mesa/swrast/s_span.c
+++ b/src/mesa/swrast/s_span.c
@@ -1297,7 +1297,6 @@ _swrast_write_rgba_span( GLcontext *ctx, SWspan *span)
           span->primitive == GL_LINE ||
 	  span->primitive == GL_POLYGON ||
           span->primitive == GL_BITMAP);
-   ASSERT(span->end <= MAX_WIDTH);
 
    /* Fragment write masks */
    if (span->arrayMask & SPAN_MASK) {
@@ -1310,12 +1309,12 @@ _swrast_write_rgba_span( GLcontext *ctx, SWspan *span)
    }
 
    /* Clip to window/scissor box */
-   if ((swrast->_RasterMask & CLIP_BIT) || (span->primitive != GL_POLYGON)) {
-      if (!clip_span(ctx, span)) {
-	 return;
-      }
+   if (!clip_span(ctx, span)) {
+      return;
    }
 
+   ASSERT(span->end <= MAX_WIDTH);
+
 #ifdef DEBUG
    /* Make sure all fragments are within window bounds */
    if (span->arrayMask & SPAN_XY) {
@@ -1356,15 +1355,6 @@ _swrast_write_rgba_span( GLcontext *ctx, SWspan *span)
    if (ctx->Stencil._Enabled || ctx->Depth.Test) {
       if (!(span->arrayMask & SPAN_Z))
          _swrast_span_interpolate_z(ctx, span);
-
-      if ((span->arrayMask & SPAN_XY) == 0) {
-         if (span->x < fb->_Xmin || span->x + span->end > fb->_Xmax ||
-             span->y < fb->_Ymin || span->y >= fb->_Ymax) {
-            printf("Bad span clipping at %d, %d\n", span->x, span->y);
-            return;
-         }
-      }
-
       if (ctx->Stencil._Enabled) {
          /* Combined Z/stencil tests */
          if (!_swrast_stencil_and_ztest_span(ctx, span)) {