KhronosGroup / KhronosGroup/SPIRV-Tools

spirv-fuzz: Potential edge-case missed for TransformationDuplicateRegionWithSelection

Open
#3,870 1 comment 0 reactions 0 assignees View on GitHub
component:fuzzer
Dominant language
C++
Stars
1.4k
Forks
709
Avg merge
1d 22h
Merged PRs (30d)
28

Description

A comment says:

We know that |entry_block| has only one predecessor, since the region is single-entry, single-exit and its constructs and their merge blocks must be either wholly within or wholly outside of the region.

And then asserts that the entry block only has one predecessor. I am not sure if this is right because control flow can converge early, so the single-entry, single-exit region could be within a selection construct and the entry block could be a "convergence block" within that selection construct (but not the header nor the merge block).

Contributor guide

Open the contributing guide

Research direction

Start by locating the implementation of TransformationDuplicateRegionWithSelection and the assertion that the entry block has one predecessor. Review how convergence blocks and single-entry, single-exit regions are represented, then determine whether the reported control-flow case is valid. Done means the assertion is correct for the case or a regression test and appropriate fix cover it.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.