KhronosGroup / KhronosGroup/SPIRV-Tools
Invalid SPIR-V code generated by instrument pass on Validation-Layer test's VkLayerTest.GpuValidationArrayOOB
- Dominant language
- C++
- Stars
- 1.4k
- Forks
- 709
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 28
Description
Validation-Layer test called ```VkLayerTest.GpuValidationArrayOOB``` is failing on the open-source ANV driver in Mesa because of invalid SPIR-V.
The original Vertex shader is:
```glsl
#version 450
layout(std140, set = 0, binding = 0) uniform foo { uint tex_index[1]; } uniform_index_buffer;
layout(set = 0, binding = 1) uniform sampler2D tex[6];
vec2 vertices[3];
void main(){
vertices[0] = vec2(-1.0, -1.0);
vertices[1] = vec2( 1.0, -1.0);
vertices[2] = vec2( 0.0, 1.0);
gl_Position = vec4(vertices[gl_VertexIndex % 3], 0.0, 1.0);
gl_Position += 1e-30 * texture(tex[uniform_index_buffer.tex_index[0]], vec2(0, 0));
}
```
Then glslang translated it to the following SPIR-V code:
[vert.spv.txt](https://github.com/KhronosGroup/SPIRV-Tools/files/2918885/vert.spv.txt)
Notice that ```%gl_VertexIndex``` is defined as:
```%gl_VertexIndex = OpVariable %_ptr_Input_int Input```
Then, the test adds instrumentation code into the shader, so the final shader is:
[vert-final.spv.txt](https://github.com/KhronosGroup/SPIRV-Tools/files/2918886/vert-final.spv.txt)
Notice that it adds the following OpLoad, which is invalid as ```%gl_VertexIndex``` is defined as a pointer to signed integer.
```%107 = OpLoad %uint %gl_VertexIndex```
When parsing the SPIR-V module, ANV driver checks that the operand of OpLoad has the same type than the result type and it aborts:
```
SPIR-V parsing FAILED:
In file ../../../../devel/jh-source/mesa/src/compiler/spirv/vtn_variables.c:2234
Source and destination types of SpvOpLoad do not match: uint vs. int
```
The culprit seems to be instrument pass that assumes that ```%gl_VertexIndex``` is unsigned.
Contributor guide
Research direction
Start with the VkLayerTest.GpuValidationArrayOOB failure and compare the attached vert.spv.txt and vert-final.spv.txt modules. Trace the instrument pass handling of %gl_VertexIndex, then run the validation-layer test or SPIR-V parsing checks; done means the generated OpLoad uses a type compatible with the signed input variable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100