skia2/resources/sksl/errors/Ossfuzz32587.sksl

const float x=1, _=x1;
half x=x*8;
Fix fuzzer-discovered error with variable declarations. As soon as a single VarDeclaration is successfully created, its Variable is added to the current symbol table. However, if a variable-declaration line declared several variables in a row, we would stop if ANY of the declarations contained an error and discard the entire statement, but would continue processing the rest of the program. This left us in a position where some Variables existed in the SymbolTable with valid, reachable names, but their corresponding VarDeclaration statement had been thrown away as erroneous. Since Variables point back to VarDeclarations for their initialValues, this gave us a stale pointer. Any future reference to that variable name which could trigger an access to its initialValue would read from this dead pointer. This CL fixes the conversion of VarDeclarations so that we no longer throw away any VarDeclarations associated with a successfully-parsed Variable. Change-Id: If8ec3c160933e48a0e1f36414234b3a849d8978c Bug: oss-fuzz:32587 Reviewed-on: https://skia-review.googlesource.com/c/skia/+/389636 Commit-Queue: John Stiles <johnstiles@google.com> Commit-Queue: Brian Osman <brianosman@google.com> Auto-Submit: John Stiles <johnstiles@google.com> Reviewed-by: Brian Osman <brianosman@google.com> 2021-03-29 13:38:59 +00:00			`const float x=1, _=x1;`
			`half x=x*8;`