KhronosGroup / KhronosGroup/SPIRV-Tools
spirv-fuzz: ReplaceIrrelevantId can introduce undefined behaviour
- Dominant language
- C++
- Stars
- 1.4k
- Forks
- 709
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 28
Description
An index operand in `OpAccessChain` can be irrelevant. Thus, `TransformationReplaceIrrelevantId` can replace it with some other value. However, the new value may no longer be a valid index into the pointer if the latter points to array, matrix or vector. This causes assertion failures in spirv-opt that look like this:
```
error: line 32: Array access is out of bounds, array size is 8, but access index is 9
%937 = OpCompositeExtract %float %951 9 0
```
Here, `OpAccessChain` was replaced with `OpCompositeExtract` in `convert-local-access-chains` pass.
Contributor guide
Research direction
Start with TransformationReplaceIrrelevantId and the convert-local-access-chains pass mentioned in the report. Reproduce the failing spirv-opt assertion using an OpAccessChain whose index is replaced, then verify that relevant array, matrix, and vector accesses remain valid and no out-of-bounds assertion occurs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100