midgard stack smashing

Stack smashing is detected as of 9da3d714b87ce237cf61de4403c5b6af12f1d79d in midgard_ra.c, when running panvk drivers in debug build (I was testing the previous asserts which were firing no longer fire).

System information

System:
  Host: mars Kernel: 5.16.2-2-MANJARO-ARM aarch64 bits: 64 compiler: gcc v: 10.2.0
    Console: pty pts/3 Distro: Manjaro ARM base: Arch Linux
CPU:
  Info: 2x 4-core model: N/A variant-1: cortex-a72 variant-2: cortex-a53 bits: 64 type: MCP AMP
    arch: ARMv8 rev: 4
  Speed (MHz): avg: 408 min/max: 408/1416 cores: 1: 408 2: 408 3: 408 4: 408 5: 408 6: 408
    bogomips: N/A
  Features: Use -f option to see features
Graphics:
  Device-1: display-subsystem driver: rockchip_drm v: N/A bus-ID: N/A
    chip-ID: rockchip:display-subsystem
  Device-2: rk3399-mali driver: panfrost v: kernel bus-ID: N/A chip-ID: rockchip:ff9a0000
  Display: server: No display server data found. Headless machine? tty: 168x34
  Message: Unable to show advanced data. Required tool glxinfo missing.

Describe the issue

Debug build catches stack smashing; looks like issue was introduced in !14885 (merged)

in particular, I think it's somewhere in these lines:

                util_dynarray_foreach(&blk->bundles, midgard_bundle, bundle) {
                        midgard_instruction *instrs[2][3];
                        unsigned instr_count[2] = { 0, 0 };

                        for (unsigned i = 0; i < bundle->instruction_count; i++) {
                                if (bundle->instructions[i]->unit == UNIT_VMUL ||
                                    bundle->instructions[i]->unit == UNIT_SADD)
                                        instrs[0][instr_count[0]++] = bundle->instructions[i];
                                else
                                        instrs[1][instr_count[1]++] = bundle->instructions[i];
                        }

                        for (unsigned i = 0; i < ARRAY_SIZE(instr_count); i++) {
                                for (unsigned j = 0; j < instr_count[i]; j++) {
                                        midgard_instruction *ins_a = instrs[i][j];

                                        if (ins_a->dest >= ctx->temp_count) continue;

                                        for (unsigned k = j + 1; k < instr_count[i]; k++) {
                                                midgard_instruction *ins_b = instrs[i][k];

                                                if (ins_b->dest >= ctx->temp_count) continue;

                                                lcra_add_node_interference(l, ins_b->dest,
                                                                           mir_bytemask(ins_b),
                                                                           ins_a->dest,
                                                                           mir_bytemask(ins_a));
                                        }
                                }
                        }
                }

Here's stack trace:

(gdb) bt                                                                                                                                                                
#0  0x0000ffffb8dfd6c8 in raise () from /usr/lib/libc.so.6                                                                                                              
#1  0x0000ffffb8dea1cc in abort () from /usr/lib/libc.so.6                                                                                                              
#2  0x0000ffffb8e36870 in __libc_message () from /usr/lib/libc.so.6                                                                                                     
#3  0x0000ffffb8ea8bf8 in __fortify_fail () from /usr/lib/libc.so.6
#4  0x0000ffffb8ea8bc4 in __stack_chk_fail () from /usr/lib/libc.so.6
#5  0x0000ffffb8618e08 in mir_compute_interference (ctx=0xaaab0dde3c30, l=0xaaab0dfaae20) at ../src/panfrost/midgard/midgard_ra.c:429
#6  0x0000ffffb861a194 in allocate_registers (ctx=0xaaab0dde3c30, spilled=0xffffd8d073df) at ../src/panfrost/midgard/midgard_ra.c:710
#7  0x0000ffffb861bb84 in mir_ra (ctx=0xaaab0dde3c30) at ../src/panfrost/midgard/midgard_ra.c:1153
#8  0x0000ffffb8608208 in midgard_compile_shader_nir (nir=0xaaab0ddddd50, inputs=0xffffd8d07ac8, binary=0xffffd8d07a88, info=0xffffd8d07b98)
    at ../src/panfrost/midgard/midgard_compile.c:3291
#9  0x0000ffffb85b5020 in pan_shader_compile_v5 (s=0xaaab0ddddd50, inputs=0xffffd8d07ac8, binary=0xffffd8d07a88, info=0xffffd8d07b98)
    at ../src/panfrost/lib/pan_shader.c:199
#10 0x0000ffffb8321650 in panvk_meta_copy_img2img_shader (pdev=0xaaab0df847c0, bin_pool=0xaaab0df89b58, srcfmt=PIPE_FORMAT_R32G32_UINT, 
    dstfmt=PIPE_FORMAT_R32G32_UINT, dstmask=1, texdim=1, texisarray=false, is_ms=false, shader_info=0xffffd8d07b98) at ../src/panfrost/vulkan/panvk_vX_meta_copy.c:546
#11 0x0000ffffb83224bc in panvk_meta_copy_img2img_init (dev=0xaaab0df84480, is_ms=false) at ../src/panfrost/vulkan/panvk_vX_meta_copy.c:822
#12 0x0000ffffb8326ecc in panvk_v5_meta_copy_init (dev=0xaaab0df84480) at ../src/panfrost/vulkan/panvk_vX_meta_copy.c:2142
#13 0x0000ffffb8319eac in panvk_v5_meta_init (dev=0xaaab0df84480) at ../src/panfrost/vulkan/panvk_vX_meta.c:59
#14 0x0000ffffb8301e64 in panvk_physical_device_init (device=0xaaab0df84480, instance=0xaaab0df84240, drm_device=0xaaab0ddd2b80)
    at ../src/panfrost/vulkan/panvk_device.c:323
#15 0x0000ffffb830314c in panvk_enumerate_devices (instance=0xaaab0df84240) at ../src/panfrost/vulkan/panvk_device.c:380
#16 0x0000ffffb8303240 in panvk_EnumeratePhysicalDevices (_instance=0xaaab0df84240, pPhysicalDeviceCount=0xffffd8d084b0, pPhysicalDevices=0x0)
    at ../src/panfrost/vulkan/panvk_device.c:405
#17 0x0000ffffb8aa09c4 in ?? () from /usr/lib/libvulkan.so.1
#18 0x0000ffffb8aa0d20 in ?? () from /usr/lib/libvulkan.so.1
#19 0x0000ffffb8aa0594 in ?? () from /usr/lib/libvulkan.so.1
#20 0x0000ffffb8aa45ac in vkEnumeratePhysicalDevices () from /usr/lib/libvulkan.so.1