diff options
| author | Roland Scheidegger <[email protected]> | 2018-07-04 04:44:17 +0200 |
|---|---|---|
| committer | Dylan Baker <[email protected]> | 2018-07-09 09:24:30 -0700 |
| commit | d68f2d7edeedebf2db58b28a9ac6befb7757afb7 (patch) | |
| tree | 77a9b3ce9a41b544a64b60ace47639bc20377f15 /src | |
| parent | 3ddbe5d4d7f9ac5ef77fb445242d062c44b9f15d (diff) | |
r600/sb: fix crash in fold_alu_op3
fold_assoc() called from fold_alu_op3() can lower the number of src to 2,
which then leads to an invalid access to n.src[2]->gvalue().
This didn't seem to have caused much harm in the past, but on Fedora 28
it will crash (presumably because -D_GLIBCXX_ASSERTIONS is used, although
with libstdc++ 4.8.5 this didn't do anything, -D_GLIBCXX_DEBUG was
needed to show the issue).
An alternative fix would be to instead call fold_alu_op2() from within
fold_assoc() when the number of src is reduced and return always TRUE
from fold_assoc() in this case, with the only actual difference being
the return value from fold_alu_op3() then. I'm not sure what the return
value actually should be in this case (or whether it even can make a
difference).
https://bugs.freedesktop.org/show_bug.cgi?id=106928
Cc: [email protected]
Reviewed-by: Dave Airlie <[email protected]>
(cherry picked from commit 817efd89685efc6b5866e09cbdad01c4ff21c737)
Diffstat (limited to 'src')
| -rw-r--r-- | src/gallium/drivers/r600/sb/sb_expr.cpp | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/gallium/drivers/r600/sb/sb_expr.cpp b/src/gallium/drivers/r600/sb/sb_expr.cpp index 1df78da6608..ad798453bc1 100644 --- a/src/gallium/drivers/r600/sb/sb_expr.cpp +++ b/src/gallium/drivers/r600/sb/sb_expr.cpp @@ -945,6 +945,8 @@ bool expr_handler::fold_alu_op3(alu_node& n) { if (!sh.safe_math && (n.bc.op_ptr->flags & AF_M_ASSOC)) { if (fold_assoc(&n)) return true; + if (n.src.size() < 3) + return fold_alu_op2(n); } value* v0 = n.src[0]->gvalue(); |