skia2/tests/sksl/shared/Ossfuzz37677.glsl


out vec4 sk_FragColor;
uniform vec4 colorGreen;
vec4 main() {
    int x[1];
    int y = 0;
    int z = 0;
    (0, x[y = z]);
    return colorGreen;
}
Fix invalid variable ref-kind discovered by fuzzer. No-op arithmetic simplification will convert expressions like `x += 0` to `x`. When making this simplification, we will also downgrade the ref- kind of `x` from "write" to "read" since the new expression is no longer an assignment. The fuzzer discovered that the ref-kind downgrade was too aggressive, and would also traverse into nested subexpressions and downgrade them as well. That is, for `x[y=z] += 0` would convert both `x` and `y` into "read" references, which is incorrect; `y` is still being written to. The fuzzer managed to turn this mistake into an assertion by leveraging a separate optimization. It added a leading, side-effect-less comma expression for us to detect as worthless and eliminate. In doing so, we clone the expression with the busted ref-kind, triggering an assertion. Change-Id: I42fc31f6932f679ae875e2b49db2ad2f4e89e2cb Bug: oss-fuzz:37677 Reviewed-on: https://skia-review.googlesource.com/c/skia/+/442536 Auto-Submit: John Stiles <johnstiles@google.com> Commit-Queue: Brian Osman <brianosman@google.com> Reviewed-by: Brian Osman <brianosman@google.com> 2021-08-27 03:34:59 +00:00
			`out vec4 sk_FragColor;`
			`uniform vec4 colorGreen;`
			`vec4 main() {`
			`int x[1];`
			`int y = 0;`
			`int z = 0;`
Prevent comma operator constant-folding or constant-expression-usage. OpenGL docs specifically insist that the sequence (comma) operator should not be treated as a constant-expression so that attempts to declare multidimensional arrays with a comma will fail: http://screen/vJEpAe9yNmbzZTm (See "12.43 Sequence operator and constant expressions" in the OpenGL ES3 documentation or read skia:13311 for details.) In practice, we don't get much benefit from optimizing away unused comma-expressions; it improves some synthetic tests, but realistically this will not help Skia in any real-world scenario. The constant folder no longer attempts this optimization, and comma-expressions are now rejected in a constant-expression context. Change-Id: Ic5dea6ff90e36614b548c1ce89a444e81da944ae Bug: skia:13311 Reviewed-on: https://skia-review.googlesource.com/c/skia/+/539565 Auto-Submit: John Stiles <johnstiles@google.com> Reviewed-by: Arman Uguray <armansito@google.com> Commit-Queue: John Stiles <johnstiles@google.com> 2022-05-11 22:14:13 +00:00			`(0, x[y = z]);`
Fix invalid variable ref-kind discovered by fuzzer. No-op arithmetic simplification will convert expressions like `x += 0` to `x`. When making this simplification, we will also downgrade the ref- kind of `x` from "write" to "read" since the new expression is no longer an assignment. The fuzzer discovered that the ref-kind downgrade was too aggressive, and would also traverse into nested subexpressions and downgrade them as well. That is, for `x[y=z] += 0` would convert both `x` and `y` into "read" references, which is incorrect; `y` is still being written to. The fuzzer managed to turn this mistake into an assertion by leveraging a separate optimization. It added a leading, side-effect-less comma expression for us to detect as worthless and eliminate. In doing so, we clone the expression with the busted ref-kind, triggering an assertion. Change-Id: I42fc31f6932f679ae875e2b49db2ad2f4e89e2cb Bug: oss-fuzz:37677 Reviewed-on: https://skia-review.googlesource.com/c/skia/+/442536 Auto-Submit: John Stiles <johnstiles@google.com> Commit-Queue: Brian Osman <brianosman@google.com> Reviewed-by: Brian Osman <brianosman@google.com> 2021-08-27 03:34:59 +00:00			`return colorGreen;`
			`}`