r600g : fix incorrect size computation in r600_query_result

query->num_results already has the size in dwords of the query
buffer.  There no need to multiply again.  We were reading past
the end of the buffer, resulting in reading garbage.

Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=37028

agd5f: clarify the comment.

Signed-off-by: Alex Deucher <alexdeucher@gmail.com>

diff --git a/src/gallium/winsys/r600/drm/r600_hw_context.c b/src/gallium/winsys/r600/drm/r600_hw_context.c
index 2159d41..6b62d16 100644 (file)
--- a/src/gallium/winsys/r600/drm/r600_hw_context.c
+++ b/src/gallium/winsys/r600/drm/r600_hw_context.c
@@ -1629,7 +1629,8 @@ static boolean r600_query_result(struct r600_context *ctx, struct r600_query *qu
        if (!results)
                return FALSE;
 
-       size = query->num_results * (query->type == PIPE_QUERY_OCCLUSION_COUNTER ? ctx->max_db : 1);
+       /* query->num_results contains how many dwords were used for the query */
+       size = query->num_results;
        for (i = 0; i < size; i += 4) {
                start = (u64)results[i] | (u64)results[i + 1] << 32;
                end = (u64)results[i + 2] | (u64)results[i + 3] << 32;