mesa: fix type comparison errors in sub-texture error checking code

patch fixes a crash that happens if glTexSubImage2D is called with a
negative xoffset.

NOTE: This is a candidate for stable branches.

Signed-off-by: Tapani Pälli <tapani.palli@intel.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
(cherry picked from commit 12b0bfa6e92795b4f9c57950ce6c1986618b14b5)
mesa: fix the compressed TexSubImage size checking code

Before, we'd incorrectly generate an error if we we tried to
replace a non-4x4 block near the edge of a NPOT compressed texture.
For example, if the dest image was 15 texels wide and xoffset=12
and width=3 we'd incorrectly generate GL_INVALID_OPERATION.

Verified with new tests added to piglit s3tc-errors test.

Note: This is a candidate for the stable branches.

Reviewed-by: Roland Scheidegger <sroland@vmware.com>
(cherry picked from commit 49dda2d92f7563057601091e084d0fe154d00d25)
vbo: fix possible use-after-free segfault after a VAO is deleted

This like the fifth attempt to fix the issue.

Also with the new "validating" flag, we can set recalculate_inputs to FALSE
earlier in vbo_bind_arrays, because _mesa_update_state won't change it.

NOTE: This is a candidate for the stable branches.

v2: fixed a typo

Reviewed-by: Brian Paul <brianp@vmware.com>
(cherry picked from commit 8eef6ad2e2f90feac231a2e09ed4765f23ed1557)
nv50: initialize kick_notify callback in nv50_create

Fixes infinite loop on startup in Portal and Left 4 Dead 2.

NOTE: This is a candidate for the 9.0 and 9.1 branches.
(cherry picked from commit 14a0bb81fef164949aeb2ec2bcfe14fee4627eeb)
egl/android: Fix error condition for EGL_ANDROID_image_native_buffer

Emit EGL_BAD_CONTEXT if the user passes a context to
eglCreateImageKHR(type=EGL_ANDROID_image_native_buffer).

From the EGL_ANDROID_image_native_buffer spec:
  * If <target> is EGL_NATIVE_BUFFER_ANDROID and <ctx> is not
    EGL_NO_CONTEXT, the error EGL_BAD_CONTEXT is generated.

Note: This is a candidate for the stable branches.
Reviewed-by: Tapani Pälli <tapani.palli@intel.com>
Signed-off-by: Chad Versace <chad.versace@linux.intel.com>
(cherry picked from commit 2878f4685c8a5165937b5f4510b602d1a67af055)
mesa/st: Don't copy propagate from swizzles.

Do not propagate a copy if source and destination are identical.

Otherwise code like

MOV TEMP[0].xyzw, TEMP[0].wzyx
MOV TEMP[1].xyzw, TEMP[0].xyzw

is changed to

MOV TEMP[0].xyzw, TEMP[0].wzyx
MOV TEMP[1].xyzw, TEMP[0].wzyx

This fixes Piglit test shaders/glsl-copy-propagation-self-2 for gallium drivers.

NOTE: This is a candidate for the stable branches.
Signed-off-by: Fabian Bieler <fabianbieler@fastmail.fm>
Reviewed-by: Brian Paul <brianp@vmware.com>
(cherry picked from commit e1ff753d67a355ad20443173b99613a1198331c1)
mesa/program: Don't copy propagate from swizzles.

Do not propagate a copy if source and destination are identical.

Otherwise code like

MOV TEMP[0].xyzw, TEMP[0].wzyx
MOV TEMP[1].xyzw, TEMP[0].xyzw

is changed to

MOV TEMP[0].xyzw, TEMP[0].wzyx
MOV TEMP[1].xyzw, TEMP[0].wzyx

This fixes Piglit test shaders/glsl-copy-propagation-self-2 for drivers that
use Mesa IR.

NOTE: This is a candidate for the stable branches.
Signed-off-by: Fabian Bieler <fabianbieler@fastmail.fm>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
(cherry picked from commit 4e9c7f9c5ac7b2564c1c7299bf688595e1f88372)
st/mesa: generate GL_OUT_OF_MEMORY if we can't create the index buffer

Before, if we failed to allocate the index buffer we'd silently
return from st_draw_vbo() without drawing anything.  We should
raise GL_OUT_OF_MEMORY to give some indication that something went
wrong.

Note: This is a candidate for the stable branches.

Reviewed-by: Marek Olšák <maraeo@gmail.com>
(cherry picked from commit e0144019c08cec64edb78c4f01d78bfbc2aa2edd)
mesa: Make core Mesa allocate the texture renderbuffer wrapper.

Every driver did the same thing.

Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
(cherry picked from commit 749a92786d378ee55cf9ebbbe8596c217fbae0f9)
mesa: Make gl_renderbuffers backed by EGL images use FinishRenderTexture.

This is the opportunity that radeon and intel drivers rely on for flushing
render targets that may get reused as textures.  Before EGL, that only
happened for GL_TEXTURE attachments.

Fixes piglits:
KHR_gl_renderbuffer_image/renderbuffer-texture
OES_EGL_image/renderbuffer-texture

NOTE: This is a candidate for the 9.1 branch.
Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
(cherry picked from commit c810e67c55a8a2965b730317873fbdcc186a7514)
glsl: Fix error checking on "flat" keyword to match GLSL ES 3.00, GLSL 1.50.

All of the GLSL specs from GLSL 1.30 (and GLSL ES 3.00) onward contain
language requiring certain integer variables to be declared with the
"flat" keyword, but they differ in exactly *when* the rule is
enforced:

(a) GLSL 1.30 and 1.40 say that vertex shader outputs having integral
type must be declared as "flat".  There is no restriction on fragment
shader inputs.

(b) GLSL 1.50 through 4.30 say that fragment shader inputs having
integral type must be declared as "flat".  There is no restriction on
vertex shader outputs.

(c) GLSL ES 3.00 says that both vertex shader outputs and fragment
shader inputs having integral type must be declared as "flat".

Previously, Mesa's behaviour was consistent with (a).  This patch
makes it consistent with (b) when compiling desktop shaders, and (c)
when compiling ES shaders.

Rationale for desktop shaders: once we add geometry shaders, (b) really
seems like the right choice, because it requires "flat" in just the
situations where it matters.  Since we may want to extend geometry
shader support back before GLSL 1.50 (via ARB_geometry_shader4), it
seems sensible to apply this rule to all GLSL versions.  Also, this
matches the behaviour of the nVidia proprietary driver for Linux, and
the expectations of Intel's oglconform test suite.

Rationale for ES shaders: since the behaviour specified in GLSL ES
3.00 matches neither pre-GLSL-1.50 nor post-GLSL-1.50 behaviour, it
seems likely that this was a deliberate choice on the part of the GLES
folks to be more restrictive.  Also, the argument in favor of (b)
doesn't apply to GLES, since it doesn't support geometry shaders at
all.

Some discussion about this has already happened on the Mesa-dev list.
See:

http://lists.freedesktop.org/archives/mesa-dev/2013-February/034199.html

Fixes piglit tests:
- glsl-1.30/compiler/interpolation-qualifiers/nonflat-*.frag
- glsl-1.30/compiler/interpolation-qualifiers/vs-flat-int-0{2,3,4,5}.vert
- glsl-es-3.00/compiler/interpolation-qualifiers/varying-struct-nonflat-{int,uint}.frag

Fixes oglconform tests:
- glsl-q-inperpol negative.fragin.{int,uint,ivec,uvec}

Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
Reviewed-by: Anuj Phogat <anuj.phogat@gmail.com>
(cherry picked from commit dfb57e7d1b005e208684316a6939939f4fb73352)
mesa: Add i965 varying index patches to .cherry-ignore.

Ian and I have tried to backport them a few times now and have hit
regressions every time.  They're also performance fixes, not
bug/stability fixes, so we'll skip them for now.

Acked-by: Eric Anholt <eric@anholt.net>
i965/fs: Bake regs_written into the IR instead of recomputing it later.

For sampler messages, it depends on the target gen, and on gen4
SIMD16-sampler-on-SIMD8-execution we were returning 4 instead of 8 like we
should.

Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
(cherry picked from commit 3cf69b228404791cf15231321b6a18b5701be0a6)

Conflicts:
(We didn't pick over the varying-index changes, so
 FS_OPCODE_VARYING_PULL_CONSTANT_LOAD_GEN7 returns 1 reg, not 4.)
	src/mesa/drivers/dri/i965/brw_fs.cpp
Fix build of swrast only without libdrm

Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Daniel Martin <consume.noise@gmail.com>
(cherry picked from commit 998d975e38db7478781130b42a4fb68d6b181055)
integer overflow in XF86DRIOpenConnection() [CVE-2013-1993 1/2]

busIdStringLength is a CARD32 and needs to be bounds checked before adding
one to it to come up with the total size to allocate, to avoid integer
overflow leading to underallocation and writing data from the network past
the end of the allocated buffer.

NOTE: This is a candidate for stable release branches.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
(cherry picked from commit 2e5a268f18be30df15aed0b44b01a18a37fb5df4)
integer overflow in XF86DRIGetClientDriverName() [CVE-2013-1993 2/2]

clientDriverNameLength is a CARD32 and needs to be bounds checked before
adding one to it to come up with the total size to allocate, to avoid
integer overflow leading to underallocation and writing data from the
network past the end of the allocated buffer.

NOTE: This is a candidate for stable release branches.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
(cherry picked from commit 306f630e676eb901789dd09a0f30d7e7fa941ebe)