i965: Add texrect scale parameters before pointers to ParameterValues.

If adding scale parameters during program compile caused a realloc of
ParameterValues, then the driver uniform storage set up by
_mesa_associate_uniform_storage() would point to potentially freed
memory.

Note that this uses TexturesUsed, which may change at runtime for GLSL
when sampler uniforms change.  This is a flaw in our handling of texrect
in general, and not one I'm fixing currently.

Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>

3 files changed, 24 insertions, 0 deletions

diff --git a/src/mesa/drivers/dri/i965/brw_program.c b/src/mesa/drivers/dri/i965/brw_program.c
index d7b240a8b9..5bfdcca216 100644
--- a/src/mesa/drivers/dri/i965/brw_program.c
+++ b/src/mesa/drivers/dri/i965/brw_program.c
@@ -143,9 +143,30 @@ brwProgramStringNotify(struct gl_context *ctx,
       _tnl_program_string(ctx, target, prog);
    }
 
+   brw_add_texrect_params(prog);
+
    return true;
 }
 
+void
+brw_add_texrect_params(struct gl_program *prog)
+{
+   for (int texunit = 0; texunit < BRW_MAX_TEX_UNIT; texunit++) {
+      if (!(prog->TexturesUsed[texunit] & (1 << TEXTURE_RECT_INDEX)))
+         continue;
+
+      int tokens[STATE_LENGTH] = {
+         STATE_INTERNAL,
+         STATE_TEXRECT_SCALE,
+         texunit,
+         0,
+         0
+      };
+
+      _mesa_add_state_reference(prog->Parameters, (gl_state_index *)tokens);
+   }
+}
+
 /* Per-thread scratch space is a power-of-two multiple of 1KB. */
 int
 brw_get_scratch_size(int size)
diff --git a/src/mesa/drivers/dri/i965/brw_program.h b/src/mesa/drivers/dri/i965/brw_program.h
index 10022d48cb..182177527d 100644
--- a/src/mesa/drivers/dri/i965/brw_program.h
+++ b/src/mesa/drivers/dri/i965/brw_program.h
@@ -47,5 +47,6 @@ void brw_populate_sampler_prog_key_data(struct gl_context *ctx,
 				        struct brw_sampler_prog_key_data *key);
 bool brw_debug_recompile_sampler_key(const struct brw_sampler_prog_key_data *old_key,
                                      const struct brw_sampler_prog_key_data *key);
+void brw_add_texrect_params(struct gl_program *prog);
 
 #endif
diff --git a/src/mesa/drivers/dri/i965/brw_shader.cpp b/src/mesa/drivers/dri/i965/brw_shader.cpp
index bbde12c380..951b5f4fed 100644
--- a/src/mesa/drivers/dri/i965/brw_shader.cpp
+++ b/src/mesa/drivers/dri/i965/brw_shader.cpp
@@ -208,6 +208,8 @@ brw_link_shader(struct gl_context *ctx, struct gl_shader_program *shProg)
 
       _mesa_reference_program(ctx, &shader->base.Program, prog);
 
+      brw_add_texrect_params(prog);
+
       /* This has to be done last.  Any operation that can cause
        * prog->ParameterValues to get reallocated (e.g., anything that adds a
        * program constant) has to happen before creating this linkage.