KhronosGroup / KhronosGroup/SPIRV-Tools

spirv-fuzz: TransformationDuplicateRegionWithSelection produces invalid output

Open
#4,297 1 comment 0 reactions 0 assignees View on GitHub
component:fuzzer
Dominant language
C++
Stars
1.4k
Forks
709
Avg merge
1d 22h
Merged PRs (30d)
28

Description

You can reproduce this on 91931ffcd22ae774ed932c98c2d0319db9720d93 with the following command
> spirv-fuzz --replay=transformations.binary --replay-validation original.spv -o out.spv

[data.zip](https://github.com/KhronosGroup/SPIRV-Tools/files/6539495/data.zip)

The exact reason why this happens is unknown so far but the behaviour occurs when 2 instances of `TransformationDuplicateRegionWithSelection` are applied to the same region of blocks. For example, if we have the following CFG:
```
[A]
[%id]
[B]
```
where `A` and `B` are some basic blocks and `%id` is some instruction, then we can apply the transformation the first time to produce:
```
[entry 1]
[A] [A1]
[%id] [%id1]
[B] [B1]
[exit 1 - %phi1 = OpPhi %id %id1]
```

We can then apply the transformation the second time to get
```
[entry 1]
[entry 2]
[A] [A2] [A1]
[%id] [%id2] [%id1]
[B] [B2] [B1]
[exit 2 - %phi2 = OpPhi %id %id2]
[exit 1 - %phi1 = OpPhi %id %id1]
```
In the example above, `%phi1` should have `%phi2` instead of `%id` as an operand. The reason why it's not the case might be related to https://github.com/KhronosGroup/SPIRV-Tools/issues/4267.

Contributor guide

Open the contributing guide

Research direction

Start by replaying transformations.binary with spirv-fuzz using the reported commit, data.zip, and the given replay-validation command. Trace two applications of TransformationDuplicateRegionWithSelection to the same region and verify that the generated output validates, including that phi1 uses phi2 instead of the original %id.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.