f89a8122a4
We had a logic bug when attempting to optimize the following code:
const vecN x = vecN(a, b, c);
-x;
The goal was to replace `-x` with `vecN(-a, -b, -c)` but we accidentally
tried to cast the `x` VariableReference to a Constructor. We
unfortunately didn't cover this in any of our test cases, but the fuzzer
managed to synthesize it by mixing and matching elements from its new
corpus.
This affected several different constructor types: splat, diagonal-
matrix, compound and array.
Change-Id: I10dd2460ab26ba3e820b0cff5db091368fb7e648
Bug: oss-fuzz:37764, oss-fuzz:37861
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/443407
Commit-Queue: John Stiles <johnstiles@google.com>
Commit-Queue: Ethan Nicholas <ethannicholas@google.com>
Auto-Submit: John Stiles <johnstiles@google.com>
Reviewed-by: Ethan Nicholas <ethannicholas@google.com>
35 lines
1003 B
Metal
35 lines
1003 B
Metal
#include <metal_stdlib>
|
|
#include <simd/simd.h>
|
|
using namespace metal;
|
|
struct Uniforms {
|
|
float4 colorGreen;
|
|
float4 colorRed;
|
|
};
|
|
struct Inputs {
|
|
};
|
|
struct Outputs {
|
|
float4 sk_FragColor [[color(0)]];
|
|
};
|
|
bool test_ivec_b() {
|
|
int one = 1;
|
|
const int two = 2;
|
|
bool ok = true;
|
|
ok = ok && all(-int2(-one, one + one) == -int2(one - two, 2));
|
|
return ok;
|
|
}
|
|
bool test_mat_b() {
|
|
bool ok = true;
|
|
return ok;
|
|
}
|
|
fragment Outputs fragmentMain(Inputs _in [[stage_in]], constant Uniforms& _uniforms [[buffer(0)]], bool _frontFacing [[front_facing]], float4 _fragCoord [[position]]) {
|
|
Outputs _out;
|
|
(void)_out;
|
|
const float _0_one = 1.0;
|
|
float _1_two = 2.0;
|
|
bool _4_ok = true;
|
|
_4_ok = _4_ok && all(-float4(_1_two) == float4(-_1_two, float3(-_1_two)));
|
|
_4_ok = _4_ok && all(float2(1.0, -2.0) == -float2(_0_one - _1_two, _1_two));
|
|
_out.sk_FragColor = (_4_ok && test_ivec_b()) && test_mat_b() ? _uniforms.colorGreen : _uniforms.colorRed;
|
|
return _out;
|
|
}
|