bb8cf5804c
No-op arithmetic simplification will convert expressions like `x += 0` to `x`. When making this simplification, we will also downgrade the ref- kind of `x` from "write" to "read" since the new expression is no longer an assignment. The fuzzer discovered that the ref-kind downgrade was too aggressive, and would also traverse into nested subexpressions and downgrade them as well. That is, for `x[y=z] += 0` would convert both `x` and `y` into "read" references, which is incorrect; `y` is still being written to. The fuzzer managed to turn this mistake into an assertion by leveraging a separate optimization. It added a leading, side-effect-less comma expression for us to detect as worthless and eliminate. In doing so, we clone the expression with the busted ref-kind, triggering an assertion. Change-Id: I42fc31f6932f679ae875e2b49db2ad2f4e89e2cb Bug: oss-fuzz:37677 Reviewed-on: https://skia-review.googlesource.com/c/skia/+/442536 Auto-Submit: John Stiles <johnstiles@google.com> Commit-Queue: Brian Osman <brianosman@google.com> Reviewed-by: Brian Osman <brianosman@google.com>
74 lines
2.5 KiB
JavaScript
74 lines
2.5 KiB
JavaScript
OpCapability Shader
|
|
%1 = OpExtInstImport "GLSL.std.450"
|
|
OpMemoryModel Logical GLSL450
|
|
OpEntryPoint Fragment %_entrypoint_v "_entrypoint" %sk_FragColor %sk_Clockwise
|
|
OpExecutionMode %_entrypoint_v OriginUpperLeft
|
|
OpName %sk_FragColor "sk_FragColor"
|
|
OpName %sk_Clockwise "sk_Clockwise"
|
|
OpName %_UniformBuffer "_UniformBuffer"
|
|
OpMemberName %_UniformBuffer 0 "colorGreen"
|
|
OpName %_entrypoint_v "_entrypoint_v"
|
|
OpName %main "main"
|
|
OpName %x "x"
|
|
OpName %y "y"
|
|
OpName %z "z"
|
|
OpDecorate %sk_FragColor RelaxedPrecision
|
|
OpDecorate %sk_FragColor Location 0
|
|
OpDecorate %sk_FragColor Index 0
|
|
OpDecorate %sk_Clockwise BuiltIn FrontFacing
|
|
OpMemberDecorate %_UniformBuffer 0 Offset 0
|
|
OpMemberDecorate %_UniformBuffer 0 RelaxedPrecision
|
|
OpDecorate %_UniformBuffer Block
|
|
OpDecorate %10 Binding 0
|
|
OpDecorate %10 DescriptorSet 0
|
|
OpDecorate %_arr_int_int_1 ArrayStride 16
|
|
OpDecorate %40 RelaxedPrecision
|
|
%float = OpTypeFloat 32
|
|
%v4float = OpTypeVector %float 4
|
|
%_ptr_Output_v4float = OpTypePointer Output %v4float
|
|
%sk_FragColor = OpVariable %_ptr_Output_v4float Output
|
|
%bool = OpTypeBool
|
|
%_ptr_Input_bool = OpTypePointer Input %bool
|
|
%sk_Clockwise = OpVariable %_ptr_Input_bool Input
|
|
%_UniformBuffer = OpTypeStruct %v4float
|
|
%_ptr_Uniform__UniformBuffer = OpTypePointer Uniform %_UniformBuffer
|
|
%10 = OpVariable %_ptr_Uniform__UniformBuffer Uniform
|
|
%void = OpTypeVoid
|
|
%15 = OpTypeFunction %void
|
|
%v2float = OpTypeVector %float 2
|
|
%float_0 = OpConstant %float 0
|
|
%19 = OpConstantComposite %v2float %float_0 %float_0
|
|
%_ptr_Function_v2float = OpTypePointer Function %v2float
|
|
%23 = OpTypeFunction %v4float %_ptr_Function_v2float
|
|
%int = OpTypeInt 32 1
|
|
%int_1 = OpConstant %int 1
|
|
%_arr_int_int_1 = OpTypeArray %int %int_1
|
|
%_ptr_Function__arr_int_int_1 = OpTypePointer Function %_arr_int_int_1
|
|
%_ptr_Function_int = OpTypePointer Function %int
|
|
%int_0 = OpConstant %int 0
|
|
%_ptr_Uniform_v4float = OpTypePointer Uniform %v4float
|
|
%_entrypoint_v = OpFunction %void None %15
|
|
%16 = OpLabel
|
|
%20 = OpVariable %_ptr_Function_v2float Function
|
|
OpStore %20 %19
|
|
%22 = OpFunctionCall %v4float %main %20
|
|
OpStore %sk_FragColor %22
|
|
OpReturn
|
|
OpFunctionEnd
|
|
%main = OpFunction %v4float None %23
|
|
%24 = OpFunctionParameter %_ptr_Function_v2float
|
|
%25 = OpLabel
|
|
%x = OpVariable %_ptr_Function__arr_int_int_1 Function
|
|
%y = OpVariable %_ptr_Function_int Function
|
|
%z = OpVariable %_ptr_Function_int Function
|
|
OpStore %y %int_0
|
|
OpStore %z %int_0
|
|
%35 = OpLoad %int %z
|
|
OpStore %y %35
|
|
%36 = OpAccessChain %_ptr_Function_int %x %35
|
|
%37 = OpLoad %int %36
|
|
%38 = OpAccessChain %_ptr_Uniform_v4float %10 %int_0
|
|
%40 = OpLoad %v4float %38
|
|
OpReturnValue %40
|
|
OpFunctionEnd
|