KhronosGroup / KhronosGroup/SPIRV-Tools

spirv-fuzz: ReplaceIrrelevantId can introduce undefined behaviour

Open
#3,980 1 comment 0 reactions 0 assignees View on GitHub
component:fuzzer
Dominant language
C++
Stars
1.4k
Forks
709
Avg merge
1d 22h
Merged PRs (30d)
28

Description

An index operand in `OpAccessChain` can be irrelevant. Thus, `TransformationReplaceIrrelevantId` can replace it with some other value. However, the new value may no longer be a valid index into the pointer if the latter points to array, matrix or vector. This causes assertion failures in spirv-opt that look like this:
```
error: line 32: Array access is out of bounds, array size is 8, but access index is 9
%937 = OpCompositeExtract %float %951 9 0
```
Here, `OpAccessChain` was replaced with `OpCompositeExtract` in `convert-local-access-chains` pass.

Contributor guide

Open the contributing guide

Research direction

Start with TransformationReplaceIrrelevantId and the convert-local-access-chains pass mentioned in the report. Reproduce the failing spirv-opt assertion using an OpAccessChain whose index is replaced, then verify that relevant array, matrix, and vector accesses remain valid and no out-of-bounds assertion occurs.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.