commit e93979ba599355c42df01a89073362b970489a3a
author Danylo Piliaiev <danylo.piliaiev@globallogic.com> Mon Aug 17 18:13:24 2020 +0300
committer Marge Bot <eric+marge@anholt.net> Fri Aug 21 15:00:51 2020 +0000
tree cf86e58ede170a4e337bc9e80340ee5592a808f5
parent b243a74768ed86410b27617f81880b24a84eda89

ir_constant: Return zero on out-of-bounds vector accesses

Several optimization paths, including constant folding, can lead to
accessing an ir_constant vector with an out of bounds index.

Return 0 since GL_ARB_robustness and GL_KHR_robustness encourage
us to do so.

Fixes piglit tests:
spec@glsl-1.20@execution@vector-out-of-bounds-access@fs-vec4-out-of-bounds-2
spec@glsl-1.20@execution@vector-out-of-bounds-access@fs-vec4-out-of-bounds-4
spec@glsl-1.20@execution@vector-out-of-bounds-access@fs-vec4-out-of-bounds-5

Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/2604
CC: <mesa-stable@lists.freedesktop.org>
Signed-off-by: Danylo Piliaiev <danylo.piliaiev@globallogic.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Marcin Ślusarz <marcin.slusarz@intel.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/6363>

.gitlab-ci/piglit/quick_shader.txt

diff --git a/.gitlab-ci/piglit/quick_shader.txt b/.gitlab-ci/piglit/quick_shader.txt
index 1f1c83e..ff29f61 100644
--- a/.gitlab-ci/piglit/quick_shader.txt
+++ b/.gitlab-ci/piglit/quick_shader.txt
@@ -370,9 +370,6 @@
 spec/glsl-1.10/preprocessor/extension-defined-test: skip
 spec/glsl-1.10/preprocessor/extension-if-1: skip
 spec/glsl-1.20/execution/vector-out-of-bounds-access/fs-vec4-out-of-bounds-1: crash
-spec/glsl-1.20/execution/vector-out-of-bounds-access/fs-vec4-out-of-bounds-2: crash
-spec/glsl-1.20/execution/vector-out-of-bounds-access/fs-vec4-out-of-bounds-4: crash
-spec/glsl-1.20/execution/vector-out-of-bounds-access/fs-vec4-out-of-bounds-5: crash
 spec/glsl-1.20/execution/vector-out-of-bounds-access/fs-vec4-out-of-bounds-6: crash
 spec/glsl-1.30/execution/fs-texturegrad-miplevels: fail
 spec/glsl-1.30/execution/fs-texturelod-miplevels: fail
@@ -595,9 +592,9 @@
 summary:
        name:  results
        ----  --------
-       pass:    15781
+       pass:    15784
        fail:      104
-      crash:      175
+      crash:      172
        skip:      315
     timeout:        0
        warn:        0

src/compiler/glsl/ir.cpp

diff --git a/src/compiler/glsl/ir.cpp b/src/compiler/glsl/ir.cpp
index 607cb3e..71be1e1 100644
--- a/src/compiler/glsl/ir.cpp
+++ b/src/compiler/glsl/ir.cpp
@@ -857,6 +857,20 @@
    this->const_elements = NULL;
    this->type = c->type->get_base_type();
 
+   /* Section 5.11 (Out-of-Bounds Accesses) of the GLSL 4.60 spec says:
+    *
+    *    In the subsections described above for array, vector, matrix and
+    *    structure accesses, any out-of-bounds access produced undefined
+    *    behavior....Out-of-bounds reads return undefined values, which
+    *    include values from other variables of the active program or zero.
+    *
+    * GL_KHR_robustness and GL_ARB_robustness encourage us to return zero.
+    */
+   if (i >= c->type->vector_elements) {
+      this->value = { { 0 } };
+      return;
+   }
+
    switch (this->type->base_type) {
    case GLSL_TYPE_UINT16:  this->value.u16[0] = c->value.u16[i]; break;
    case GLSL_TYPE_INT16:  this->value.i16[0] = c->value.i16[i]; break;