i965/blorp_clear: Use memcpy instead of assignment to copy clear value

Similar to the problem described in 2c50212b14da27de4e3, if we copy the clear
value through a regular assignment via a floating point value, then if an
integer clear value is being used that happens to contain a signalling NaN
value then it would get converted to a quiet NaN when stored via the x87
floating-point registers. This would corrupt the integer value. Instead we
should use a memcpy to ensure the exact bit representation is preserved.

This bug can be triggered on 32-bit builds with optimisations by using an
integer clear color with a value like 0x7f817f81.

Reviewed-by: Matt Turner <[email protected]>

1 files changed, 2 insertions, 7 deletions

diff --git a/src/mesa/drivers/dri/i965/brw_blorp_clear.cpp b/src/mesa/drivers/dri/i965/brw_blorp_clear.cpp
index ffbcd1a81b9..8db083736ca 100644
--- a/src/mesa/drivers/dri/i965/brw_blorp_clear.cpp
+++ b/src/mesa/drivers/dri/i965/brw_blorp_clear.cpp
@@ -202,12 +202,7 @@ brw_blorp_clear_params::brw_blorp_clear_params(struct brw_context *brw,
       y1 = rb->Height - fb->_Ymin;
    }
 
-   float *push_consts = (float *)&wm_push_consts;
-
-   push_consts[0] = ctx->Color.ClearColor.f[0];
-   push_consts[1] = ctx->Color.ClearColor.f[1];
-   push_consts[2] = ctx->Color.ClearColor.f[2];
-   push_consts[3] = ctx->Color.ClearColor.f[3];
+   memcpy(&wm_push_consts.dst_x0, ctx->Color.ClearColor.f, sizeof(float) * 4);
 
    use_wm_prog = true;
 
@@ -250,7 +245,7 @@ brw_blorp_clear_params::brw_blorp_clear_params(struct brw_context *brw,
    if (irb->mt->fast_clear_state != INTEL_FAST_CLEAR_STATE_NO_MCS &&
        !partial_clear && wm_prog_key.use_simd16_replicated_data &&
        is_color_fast_clear_compatible(brw, format, &ctx->Color.ClearColor)) {
-      memset(push_consts, 0xff, 4*sizeof(float));
+      memset(&wm_push_consts, 0xff, 4*sizeof(float));
       fast_clear_op = GEN7_FAST_CLEAR_OP_FAST_CLEAR;
 
       /* Figure out what the clear rectangle needs to be aligned to, and how