[Bf-blender-cvs] [802d253] blender-v2.78-release: Fix T49251: moving smoke domain with additional resolution causes crash.

[Alexander Gavrilov]

Commit: 802d253a46f62ac2073a8f5b6cbfb93c2cabc645
Author: Alexander Gavrilov
Date:   Mon Sep 5 15:50:12 2016 +0300
Branches: blender-v2.78-release
https://developer.blender.org/rB802d253a46f62ac2073a8f5b6cbfb93c2cabc645

Fix T49251: moving smoke domain with additional resolution causes crash.

This is a bug in the multithreaded task manager in negative value range.

The problem here is that if previter is unsigned, the comparison in the
return statement is unsigned, and works incorrectly if stop < 0 &&
iter >= 0. This in turn can happen if stop is close to 0, because this
code is designed to overrun the stop by chunk_size*num_threads as
the threads terminate.

This probably should go into 2.78 as it prevents a crash.

===================================================================

M	source/blender/blenlib/intern/task.c

===================================================================

diff --git a/source/blender/blenlib/intern/task.c b/source/blender/blenlib/intern/task.c
index bd7b7f9..9d4d40e 100644
--- a/source/blender/blenlib/intern/task.c
+++ b/source/blender/blenlib/intern/task.c
@@ -780,9 +780,10 @@ BLI_INLINE bool parallel_range_next_iter_get(
         ParallelRangeState * __restrict state,
         int * __restrict iter, int * __restrict count)
 {
-	uint32_t previter = atomic_fetch_and_add_uint32((uint32_t *)(&state->iter), state->chunk_size);
+	uint32_t uval = atomic_fetch_and_add_uint32((uint32_t *)(&state->iter), state->chunk_size);
+	int previter = *(int32_t*)&uval;
 
-	*iter = (int)previter;
+	*iter = previter;
 	*count = max_ii(0, min_ii(state->chunk_size, state->stop - previter));
 
 	return (previter < state->stop);