Skip to content

spriv-val: not catching out of bounds array reference #587

@danginsburg

Description

@danginsburg

The attached vertex shader contains the following sequence:

   %2594 = OpConstant %11 8
   %2845 = OpTypeArray %29 %2594
   %2846 = OpTypeArray %29 %2594
   %2847 = OpTypeArray %29 %2594
   %2848 = OpTypeArray %29 %2594
   %2849 = OpTypeArray %29 %2594
    %506 = OpTypeStruct %2845 %2846 %2847 %2848 %2849
  
   %12714 = OpLoad %506 %21402
   %7572 = OpCompositeExtract %29 %12714 0 1363

In the OpCompositeExtract the 1363 is out-of-bounds. However, spirv-val does not catch this error. This shader is crashing on an IHV driver due to the out-of-bounds.

For what it's worth, the bug in the SPIR-V was introduced by a bug in WIP spirv-opt changes, but it took us a long time to hunt down since the shader passed validation. Could this check be added to spirv-val?

The file is located here (I could not figure out how to attach a .spv file to the issue): https://www.dropbox.com/s/m8kz7xcoy4eib11/shader_with_out_of_bounds_error.spv?dl=0

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions