From ff61e9b54d9133cd7ac2f2d4b4761a43383834a3 Mon Sep 17 00:00:00 2001
From: Rob Clark <robdclark@chromium.org>
Date: Tue, 2 Feb 2021 12:12:14 -0800
Subject: [PATCH] freedreno/decode: Fix overflow

CP_SET_DRAW_STATE state-groups count as a 4th level of IB.  Fixes a
crash seen on 32b/arm builds of crashdec.

Signed-off-by: Rob Clark <robdclark@chromium.org>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/8842>
---
 src/freedreno/decode/cffdec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/freedreno/decode/cffdec.c b/src/freedreno/decode/cffdec.c
index 10b27b0a236..95411671f59 100644
--- a/src/freedreno/decode/cffdec.c
+++ b/src/freedreno/decode/cffdec.c
@@ -71,7 +71,7 @@ static int is_64b(void)
 }
 
 
-static int draws[3];
+static int draws[4];
 static struct {
 	uint64_t base;
 	uint32_t size;   /* in dwords */
@@ -2656,6 +2656,7 @@ dump_commands(uint32_t *dwords, uint32_t sizedwords, int level)
 		return;
 	}
 
+	assert(ib < ARRAY_SIZE(draws));
 	draws[ib] = 0;
 
 	while (dwords_left > 0) {