AuroraMiddleware/skia2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
6a1a98c313
skia2/tests/sksl/shared
History
John Stiles 6a1a98c313 Fix for fuzzer-discovered use-after-free. 
The inliner discovered that when a binary expression is inlined, its
type is not cloned into the destination's SymbolTable. This meant that
when the inlined-from function was later dead-stripped, the type pointer
would become dangling. Did a quick pass over inlineExpression and
inlineStatement and ensured that types are always copied.

Also found that `copy_if_needed` was making a copy of eligible types
each time one was encountered, instead of making one copy and reusing
it. This is fixed as well.

Change-Id: Iee3259ab038dfb04034bf0110af1909ccffec3de
Bug: oss-fuzz:29444
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/354219
Auto-Submit: John Stiles <johnstiles@google.com>
Reviewed-by: Brian Osman <brianosman@google.com>
Commit-Queue: John Stiles <johnstiles@google.com>
2021-01-15 15:11:00 +00:00
..
golden Fix for fuzzer-discovered use-after-free. 2021-01-15 15:11:00 +00:00
ArrayConstructors.sksl Enforce (valid) array sizes in many more places 2021-01-14 22:14:59 +00:00
ArrayIndexTypes.sksl
ArrayTypes.sksl
Assignment.sksl Add unit tests for assignment and invalid field access. 2020-09-25 21:42:22 +00:00
Caps.sksl
CastsRoundTowardZero.sksl
Clockwise.sksl
ComplexDelete.sksl Disallow identifier names that overlap existing types. 2020-12-04 16:52:01 +00:00
ConstantIf.sksl Update tests which mix int and float types without casts. 2021-01-13 19:47:13 +00:00
ConstArray.sksl Enforce (valid) array sizes in many more places 2021-01-14 22:14:59 +00:00
ConstVariableComparison.sksl
Control.sksl Fix codegen errors with Metal return statements. 2020-12-01 21:28:05 +00:00
DeadDoWhileLoop.sksl
DeadIfStatement.sksl Create test case for oss-fuzz:26942. 2020-11-03 17:19:22 +00:00
DeadLoopVariable.sksl
DeadStripFunctions.sksl Add unit test for function dead-stripping. 2020-11-30 15:16:44 +00:00
DependentInitializers.sksl
Derivatives.sksl
DerivativesFlipY.sksl
DerivativesUnused.sksl
Discard.sksl
Enum.sksl Add support for enums in Metal code generator. 2020-11-30 15:14:34 +00:00
FragCoordsFlipY.sksl
FragCoordsNew.sksl
FragCoordsOld.sksl
FunctionArgumentMatch.sksl
FunctionPrototype.sksl Add test cases to function-prototype golden outputs. 2020-11-02 17:17:23 +00:00
Functions.sksl Disallow multi-dimensional arrays in SkSL. 2020-12-03 16:28:19 +00:00
GaussianBlur.sksl Add unit test demonstrating output from Gaussian blur. 2020-11-23 20:46:54 +00:00
GeometricIntrinsics.sksl SkSL: Add test for scalar versions of geometric intrinsics 2020-11-24 20:38:20 +00:00
Geometry.geom
GeometryExtension.geom
GeometryGSInvocations.geom
GeometryNoGSInvocations.geom
GeometryNoGSInvocationsReorder.geom Add geometry shader test demonstrating max_vertices/invocations bug 2020-10-12 21:19:33 +00:00
Height.sksl
HelloWorld.sksl
Hex.sksl
InstanceID.vert Enforce layout(location=...) on Metal out variables. 2020-12-01 20:41:15 +00:00
InterfaceBlockAnonymous.sksl Enforce that layout(binding=...) is set on interface blocks in Metal. 2020-12-04 19:30:35 +00:00
InterfaceBlockArray.sksl Enforce that layout(binding=...) is set on interface blocks in Metal. 2020-12-04 19:30:35 +00:00
InterfaceBlockNamed.sksl Enforce that layout(binding=...) is set on interface blocks in Metal. 2020-12-04 19:30:35 +00:00
MatricesFloat.sksl Prevent half type from being emitted in Metal matrixConstructHelpers. 2020-12-29 21:01:27 +00:00
MatricesHalf.sksl Prevent half type from being emitted in Metal matrixConstructHelpers. 2020-12-29 21:01:27 +00:00
MixedTypeCommaOperator.sksl Replace SPIR-V assertion with mixed-types error message. 2020-11-25 15:13:27 +00:00
MultipleAssignments.sksl Update tests which mix int and float types without casts. 2021-01-13 19:47:13 +00:00
NegatedVectorLiteral.sksl Allow constant propagation for negated constant-vectors and ints. 2020-11-05 17:39:48 +00:00
NoFragCoordsPos.vert
NoFragCoordsPosRT.vert Add golden outputs for the Metal backend. 2020-09-25 17:46:43 +00:00
NormalizationGeo.geom
NormalizationVert.vert Add golden outputs for the Metal backend. 2020-09-25 17:46:43 +00:00
NumberCasts.sksl Add unit test for casting between float, int and bool. 2021-01-05 16:30:11 +00:00
NumberConversions.sksl Update tests which mix int and float types without casts. 2021-01-13 19:47:13 +00:00
Offset.sksl
Operators.sksl Update tests which mix int and float types without casts. 2021-01-13 19:47:13 +00:00
Ossfuzz26167.sksl Fix use-after-free discovered by fuzzer. 2020-10-23 16:10:15 +00:00
Ossfuzz27614.sksl Add fix for fuzzer-discovered crash at oss-fuzz:27614. 2020-11-18 21:01:15 +00:00
Ossfuzz28050.sksl Enforce (valid) array sizes in many more places 2021-01-14 22:14:59 +00:00
Ossfuzz28794.sksl Update tests which mix int and float types without casts. 2021-01-13 19:47:13 +00:00
Ossfuzz28904.sksl Fix fuzzer-discovered crash with negated swizzles. 2020-12-23 18:52:47 +00:00
Ossfuzz29444.sksl Fix for fuzzer-discovered use-after-free. 2021-01-15 15:11:00 +00:00
OutParams.sksl Update tests which mix int and float types without casts. 2021-01-13 19:47:13 +00:00
OutParamsTricky.sksl Add 'tricky' OutParams golden output. 2020-09-28 18:52:13 +00:00
RectangleTexture.sksl Add golden outputs for the Metal backend. 2020-09-25 17:46:43 +00:00
ResizeMatrix.sksl
SampleLocations.vert Update tests which mix int and float types without casts. 2021-01-13 19:47:13 +00:00
SampleMask.sksl
ScalarConversionConstructors.sksl Add unit test for scalar conversion constructors. 2021-01-14 15:53:03 +00:00
ScopedSymbol.sksl
StackingVectorCasts.sksl
StaticIf.sksl
StaticSwitch.sksl
StaticSwitchWithBreak.sksl
StaticSwitchWithBreakInsideBlock.sksl
StaticSwitchWithConditionalBreak.sksl
StaticSwitchWithConditionalBreakInsideBlock.sksl
StaticSwitchWithFallthroughA.sksl
StaticSwitchWithFallthroughB.sksl
StaticSwitchWithStaticConditionalBreak.sksl
StaticSwitchWithStaticConditionalBreakInsideBlock.sksl
StructMaxDepth.sksl Disallow multi-dimensional arrays in SkSL. 2020-12-03 16:28:19 +00:00
Structs.sksl Update tests which mix int and float types without casts. 2021-01-13 19:47:13 +00:00
Switch.sksl
SwitchContainingDeadCode.sksl
SwitchWithFallthrough.sksl
SwizzleBoolConstants.sksl Add golden outputs for the Metal backend. 2020-09-25 17:46:43 +00:00
SwizzleByIndex.sksl Replace array indexing on vector types with swizzles. 2020-12-07 21:16:40 +00:00
SwizzleConstants.sksl
SwizzleLTRB.sksl
SwizzleOpt.sksl Optimize swizzled multiple-argument constructors. 2020-11-19 17:10:11 +00:00
SwizzleScalar.sksl
TernaryAsLValueEntirelyFoldable.sksl Update tests which mix int and float types without casts. 2021-01-13 19:47:13 +00:00
TernaryAsLValueFoldableTest.sksl Update tests which mix int and float types without casts. 2021-01-13 19:47:13 +00:00
Texture1D.sksl Split Texture test into separate 1D and 2D tests. 2020-11-02 14:39:31 +00:00
Texture2D.sksl Split Texture test into separate 1D and 2D tests. 2020-11-02 14:39:31 +00:00
TextureSharpen.sksl Detect non-2D textures in MetalCodeGenerator and fail cleanly 2020-10-02 20:36:04 +00:00
UnaryPositiveNegative.sksl
UniformArray.sksl Disallow multi-dimensional arrays in SkSL. 2020-12-03 16:28:19 +00:00
UnusedVariables.sksl
VectorConstructors.sksl Update VectorConstructor unit test with mixed-type ctors. 2021-01-13 19:09:16 +00:00
VertexEarlyReturn.vert Fix codegen errors with Metal return statements. 2020-12-01 21:28:05 +00:00
VertexID.vert Enforce layout(location=...) on Metal out variables. 2020-12-01 20:41:15 +00:00
Width.sksl