4 files changed, 19 insertions, 0 deletions
diff --git a/src/mesa/drivers/dri/i965/brw_fs.cpp b/src/mesa/drivers/dri/i965/brw_fs.cpp
index ede2979b915..fcde3dad1b3 100644
--- a/src/mesa/drivers/dri/i965/brw_fs.cpp
+++ b/src/mesa/drivers/dri/i965/brw_fs.cpp
@@ -2454,6 +2454,7 @@ fs_visitor::setup_payload_gen6()
 bool
 fs_visitor::run()
 {
+   sanity_param_count = fp->Base.Parameters->NumParameters;
    uint32_t orig_nr_params = c->prog_data.nr_params;
 
    if (intel->gen >= 6)
@@ -2567,6 +2568,13 @@ fs_visitor::run()
       (void) orig_nr_params;
    }
 
+   /* If any state parameters were appended, then ParameterValues could have
+    * been realloced, in which case the driver uniform storage set up by
+    * _mesa_associate_uniform_storage() would point to freed memory.  Make
+    * sure that didn't happen.
+    */
+   assert(sanity_param_count == fp->Base.Parameters->NumParameters);
+
    return !failed;
 }
 
diff --git a/src/mesa/drivers/dri/i965/brw_fs.h b/src/mesa/drivers/dri/i965/brw_fs.h
index ca242df3d74..75d6cf739b2 100644
--- a/src/mesa/drivers/dri/i965/brw_fs.h
+++ b/src/mesa/drivers/dri/i965/brw_fs.h
@@ -417,6 +417,7 @@ public:
 
    const struct gl_fragment_program *fp;
    struct brw_wm_compile *c;
+   unsigned int sanity_param_count;
 
    /* Delayed setup of c->prog_data.params[] due to realloc of
     * ParamValues[] during compile.
diff --git a/src/mesa/drivers/dri/i965/brw_vec4.cpp b/src/mesa/drivers/dri/i965/brw_vec4.cpp
index 079bbab51ec..d5b7cb76f6f 100644
--- a/src/mesa/drivers/dri/i965/brw_vec4.cpp
+++ b/src/mesa/drivers/dri/i965/brw_vec4.cpp
@@ -1239,6 +1239,8 @@ vec4_visitor::emit_shader_time_write(enum shader_time_shader_type type,
 bool
 vec4_visitor::run()
 {
+   sanity_param_count = vp->Base.Parameters->NumParameters;
+
    if (INTEL_DEBUG & DEBUG_SHADER_TIME)
       emit_shader_time_begin();
 
@@ -1317,6 +1319,13 @@ vec4_visitor::run()
          break;
    }
 
+   /* If any state parameters were appended, then ParameterValues could have
+    * been realloced, in which case the driver uniform storage set up by
+    * _mesa_associate_uniform_storage() would point to freed memory.  Make
+    * sure that didn't happen.
+    */
+   assert(sanity_param_count == vp->Base.Parameters->NumParameters);
+
    return !failed;
 }
 
diff --git a/src/mesa/drivers/dri/i965/brw_vec4.h b/src/mesa/drivers/dri/i965/brw_vec4.h
index 359a5aed041..6aab4c0ffde 100644
--- a/src/mesa/drivers/dri/i965/brw_vec4.h
+++ b/src/mesa/drivers/dri/i965/brw_vec4.h
@@ -227,6 +227,7 @@ public:
    const struct gl_vertex_program *vp;
    struct brw_vs_compile *c;
    struct brw_vs_prog_data *prog_data;
+   unsigned int sanity_param_count;
 
    char *fail_msg;
    bool failed;