xf86-video-intel: src/sna/sna.h

[Chris Wilson]

 src/sna/sna.h |   18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

New commits:
commit 5b033d638bbf2c0b841088ca75f9eb8de5852cb5
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Sun Feb 8 22:13:35 2015 +0000

    sna: Avoid accessing past the end of the clip boxes for incremental clipping
    
    During incremental clipping of the trapezoids, we can assign the end
    BoxPtr to begin, and so we should be careful not to dereference that
    pointer (as it points passed the end of the clip boxes).
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna.h b/src/sna/sna.h
index 4fdb541..bd5c38b 100644
--- a/src/sna/sna.h
+++ b/src/sna/sna.h
@@ -1194,12 +1194,18 @@ __find_clip_box_for_y(const BoxRec *begin, const BoxRec *end, int16_t y);
 inline static const BoxRec *
 find_clip_box_for_y(const BoxRec *begin, const BoxRec *end, int16_t y)
 {
-    if (begin->y2 > y)
-	    return begin;
-    if (y > end[-1].y2)
-	    return end;
-
-    return __find_clip_box_for_y(begin, end, y);
+	/* Special case for incremental trapezoid clipping */
+	if (begin == end)
+		return end;
+
+	/* Quick test if scanline is within range of clip boxes */
+	if (begin->y2 > y)
+		return begin;
+	if (y > end[-1].y2)
+		return end;
+
+	/* Otherwise bisect to find the first box crossing y */
+	return __find_clip_box_for_y(begin, end, y);
 }
 
 unsigned sna_cpu_detect(void);