Fix crash when viewport Y position is negative
More specifically, crash occurs when viewport.Y is negative, and
scissoring isn't explicitly set by user. Problem was a combination
of computing invalid scissor bounds, and after clamping to these
bounds, proceeding to index buffers when yMin >= yMax. Fixed
both computation of scissor bounds, and making sure to early out
when yMin >= yMax to avoid OOB buffer indexing.
Bug: chromium:904276
Change-Id: I14580d7c4f0d9888c19e037b47113624a247ede1
Reviewed-on: https://swiftshader-review.googlesource.com/c/SwiftShader/+/29971
Tested-by: Antonio Maiorano <amaiorano@google.com>
Presubmit-Ready: Antonio Maiorano <amaiorano@google.com>
Kokoro-Presubmit: kokoro <noreply+kokoro@google.com>
Reviewed-by: Nicolas Capens <nicolascapens@google.com>
Reviewed-by: Alexis Hétu <sugoi@google.com>
diff --git a/src/Shader/SetupRoutine.cpp b/src/Shader/SetupRoutine.cpp
index e5bd7fd..7ecfa3d 100644
--- a/src/Shader/SetupRoutine.cpp
+++ b/src/Shader/SetupRoutine.cpp
@@ -189,14 +189,17 @@
yMax = (yMax + 0x0F) >> 4;
}
- If(yMin == yMax)
+ yMin = Max(yMin, *Pointer<Int>(data + OFFSET(DrawData,scissorY0)));
+ yMax = Min(yMax, *Pointer<Int>(data + OFFSET(DrawData,scissorY1)));
+
+ // If yMin and yMax are initially negative, the scissor clamping above will typically result
+ // in yMin == 0 and yMax unchanged. We bail as we don't need to rasterize this primitive, and
+ // code below assumes yMin < yMax.
+ If(yMin >= yMax)
{
Return(false);
}
- yMin = Max(yMin, *Pointer<Int>(data + OFFSET(DrawData,scissorY0)));
- yMax = Min(yMax, *Pointer<Int>(data + OFFSET(DrawData,scissorY1)));
-
For(Int q = 0, q < state.multiSample, q++)
{
Array<Int> Xq(16);
