-
Notifications
You must be signed in to change notification settings - Fork 664
spirv-fuzz: The fact manager doesn't handle invalid ids #3741
Copy link
Copy link
Closed
Labels
component:fuzzerRelates to the spirv-fuzz toolRelates to the spirv-fuzz tool
Description
The following test crashes
TEST(FactManagerTest, HandlesCorollariesWithInvalidIds) {
std::string shader = R"(
OpCapability Shader
%1 = OpExtInstImport "GLSL.std.450"
OpMemoryModel Logical GLSL450
OpEntryPoint Fragment %12 "main"
OpExecutionMode %12 OriginUpperLeft
OpSource ESSL 310
%2 = OpTypeVoid
%3 = OpTypeFunction %2
%6 = OpTypeFloat 32
%8 = OpTypeInt 32 1
%9 = OpConstant %8 3
%12 = OpFunction %2 None %3
%13 = OpLabel
%14 = OpConvertSToF %6 %9
%15 = OpConvertSToF %6 %9
OpReturn
OpFunctionEnd
)";
const auto env = SPV_ENV_UNIVERSAL_1_3;
const auto consumer = nullptr;
const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption);
ASSERT_TRUE(IsValid(env, context.get()));
FactManager fact_manager;
// Register %9 in the equivalence relation.
fact_manager.AddFactDataSynonym(MakeDataDescriptor(9, {}),
MakeDataDescriptor(9, {}), context.get());
// Add an equation fact.
fact_manager.AddFactIdEquation(14, SpvOpConvertSToF, {9}, context.get());
// Remove the equation instruction from the module.
ASSERT_TRUE(context->KillDef(14));
// Add another equation.
fact_manager.AddFactIdEquation(15, SpvOpConvertSToF, {9}, context.get());
// The removed equation id (%14) and the new equation id (%15) should be
// synonymous.
ASSERT_TRUE(fact_manager.IsSynonymous(MakeDataDescriptor(14, {}),
MakeDataDescriptor(15, {})));
}The reason is that ComputeConversionDataSynonymFacts doesn't handle the case when data descriptors do not exist in the module.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
component:fuzzerRelates to the spirv-fuzz toolRelates to the spirv-fuzz tool