commit f13cadd8bd5fa1f4f4ab78b594812117c26a4b95
author Olli Etuaho <oetuaho@nvidia.com> Tue Nov 28 10:53:09 2017 +0200
committer Commit Bot <commit-bot@chromium.org> Wed Nov 29 10:23:05 2017 +0000
tree c3095eec0a75672714339f1e63e5024aa588b11b
parent 57ea533f79a7a30224ea641785cbd7a9485d33ed

Fix checking negative index when indexing matrix/vector

It's important that the test against the maximum of the valid range
is only done if the index is positive, so the sanitized index value
is guaranteed to end up in the valid range.

This fixes a regression from commit "Add GLSL support for
runtime-sized arrays in SSBOs".

BUG=chromium:789029
TEST=angle_unittests

Change-Id: Ic7125e383a64e46994b072df6d7e642432c521af
Reviewed-on: https://chromium-review.googlesource.com/792935
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Commit-Queue: Olli Etuaho <oetuaho@nvidia.com>

src/compiler/translator/ParseContext.cpp

diff --git a/src/compiler/translator/ParseContext.cpp b/src/compiler/translator/ParseContext.cpp
index c97f91d..5b92ace 100644
--- a/src/compiler/translator/ParseContext.cpp
+++ b/src/compiler/translator/ParseContext.cpp
@@ -4038,25 +4038,29 @@
                         safeIndex = 0;
                     }
                 }
-                // Only do generic out-of-range check if similar error hasn't already been reported.
-                if (safeIndex < 0)
+            }
+            // Only do generic out-of-range check if similar error hasn't already been reported.
+            if (safeIndex < 0)
+            {
+                if (baseExpression->isArray())
                 {
                     safeIndex = checkIndexLessThan(outOfRangeIndexIsError, location, index,
                                                    baseExpression->getOutermostArraySize(),
                                                    "array index out of range");
                 }
-            }
-            else if (baseExpression->isMatrix())
-            {
-                safeIndex = checkIndexLessThan(outOfRangeIndexIsError, location, index,
-                                               baseExpression->getType().getCols(),
-                                               "matrix field selection out of range");
-            }
-            else if (baseExpression->isVector())
-            {
-                safeIndex = checkIndexLessThan(outOfRangeIndexIsError, location, index,
-                                               baseExpression->getType().getNominalSize(),
-                                               "vector field selection out of range");
+                else if (baseExpression->isMatrix())
+                {
+                    safeIndex = checkIndexLessThan(outOfRangeIndexIsError, location, index,
+                                                   baseExpression->getType().getCols(),
+                                                   "matrix field selection out of range");
+                }
+                else
+                {
+                    ASSERT(baseExpression->isVector());
+                    safeIndex = checkIndexLessThan(outOfRangeIndexIsError, location, index,
+                                                   baseExpression->getType().getNominalSize(),
+                                                   "vector field selection out of range");
+                }
             }
 
             ASSERT(safeIndex >= 0);
@@ -4092,6 +4096,8 @@
 {
     // Should not reach here with an unsized / runtime-sized array.
     ASSERT(arraySize > 0);
+    // A negative index should already have been checked.
+    ASSERT(index >= 0);
     if (index >= arraySize)
     {
         std::stringstream reasonStream;