Bug 32035

Created attachment 40723 [details]
new test case for piglit 

Bug detailed description:
--------------------------
This is a negative test. The attached shader is expected to fail to compile, but now it gets segfault. This is a recent regression.

GLSL spec 1.20 section 5.7 says:
The equality operators and assignment operator are only allowed if the two operands are same size and type... Both array operands must be explicitly sized.

Reproduce steps:
----------------
glslparsertest glsl-array-compare-unsized.vert fail

Current result:
----------------
Segmentation fault

#0  ast_selection_statement::hir (this=0x968180, instructions=0xe94f70,
    state=<value optimized out>) at ast_to_hir.cpp:2816
#1  0x00007ffff64d17df in ast_compound_statement::hir (this=0x968220,
    instructions=0xe94f70, state=0x9625d0) at ast_to_hir.cpp:1668
#2  0x00007ffff64d1912 in ast_function_definition::hir (this=0x9682c0,
    instructions=<value optimized out>, state=0x9625d0) at ast_to_hir.cpp:2665
#3  0x00007ffff64d2807 in _mesa_ast_to_hir (instructions=0x962b10,
    state=0x9625d0) at ast_to_hir.cpp:85
#4  0x00007ffff64c9bef in _mesa_glsl_compile_shader (ctx=0x6264a0,
    shader=0x9623d0) at program/ir_to_mesa.cpp:2959
#5  0x000000000040353e in test ()
    at /home/gordon/piglit/tests/glslparsertest/glslparsertest.c:108
#6  0x00000000004039cd in main (argc=3, argv=0x7fffffffe2b8)
    at /home/gordon/piglit/tests/glslparsertest/glslparsertest.c:224


Expected result:
----------------
Failed to compile vertex shader glsl-array-compare-unsized.vert: 
0:8(10): error: operands of `==' must have the same type

PIGLIT: {'result': 'pass' }


Rootcause:
----------------
It's caused by below mesa patch. Array size needs checking before comparison.

Branch: master
Commit: ff79633d9f930e396933a0ad9564824ec73ea4dc
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=ff79633d9f930e396933a0ad9564824ec73ea4dc

Author: Eric Anholt <eric@anholt.net>
Date:   Tue Nov 30 11:23:28 2010 -0800

glsl: Fix structure and array comparisions.

We were trying to emit a single ir_expression to compare the whole
thing.  The backends (ir_to_mesa.cpp and brw_fs.cpp so far) expected
ir_binop_any_nequal or ir_binop_all_equal to apply to at most a vector
(with matrices broken down by the lowering pass).  Break them down to
a bunch of ORed or ANDed any_nequals/all_equals.

Fixes:
glsl-array-compare
glsl-array-compare-02
glsl-fs-struct-equal
glsl-fs-struct-notequal
Bug #31909

---

 src/glsl/ast_to_hir.cpp |   72 +++++++++++++++++++++++++++++++++++++++++++++-
 1 files changed, 70 insertions(+), 2 deletions(-)

diff --git a/src/glsl/ast_to_hir.cpp b/src/glsl/ast_to_hir.cpp
index fd9ed55..0978100 100644
--- a/src/glsl/ast_to_hir.cpp
+++ b/src/glsl/ast_to_hir.cpp
@@ -745,6 +745,75 @@ ast_node::hir(exec_list *instructions,
    return NULL;
 }
 
+static ir_rvalue *
+do_comparison(void *mem_ctx, int operation, ir_rvalue *op0, ir_rvalue *op1)
+{
+   int join_op;
+
+   if (operation == ir_binop_all_equal)
+      join_op = ir_binop_logic_and;
+   else
+      join_op = ir_binop_logic_or;
+
+   switch (op0->type->base_type) {
+   case GLSL_TYPE_FLOAT:
+   case GLSL_TYPE_UINT:
+   case GLSL_TYPE_INT:
+   case GLSL_TYPE_BOOL:
+      return new(mem_ctx) ir_expression(operation, op0, op1);
+
+   case GLSL_TYPE_ARRAY: {
+      ir_rvalue *last = NULL;
+
+      for (unsigned int i = 0; i < op0->type->length; i++) {
+	 ir_rvalue *e0, *e1, *result;
+
+	 e0 = new(mem_ctx) ir_dereference_array(op0->clone(mem_ctx, NULL),
+						new(mem_ctx) ir_constant(i));
+	 e1 = new(mem_ctx) ir_dereference_array(op1->clone(mem_ctx, NULL),
+						new(mem_ctx) ir_constant(i));
+	 result = do_comparison(mem_ctx, operation, e0, e1);
+
+	 if (last) {
+	    last = new(mem_ctx) ir_expression(join_op, last, result);
+	 } else {
+	    last = result;
+	 }
+      }
+      return last;
+   }