KhronosGroup / KhronosGroup/SPIRV-Tools
spirv-fuzz: TransformationDuplicateRegionWithSelection produces invalid output
- Dominant language
- C++
- Stars
- 1.4k
- Forks
- 709
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 28
Description
You can reproduce this on 91931ffcd22ae774ed932c98c2d0319db9720d93 with the following command
> spirv-fuzz --replay=transformations.binary --replay-validation original.spv -o out.spv
[data.zip](https://github.com/KhronosGroup/SPIRV-Tools/files/6539495/data.zip)
The exact reason why this happens is unknown so far but the behaviour occurs when 2 instances of `TransformationDuplicateRegionWithSelection` are applied to the same region of blocks. For example, if we have the following CFG:
```
[A]
[%id]
[B]
```
where `A` and `B` are some basic blocks and `%id` is some instruction, then we can apply the transformation the first time to produce:
```
[entry 1]
[A] [A1]
[%id] [%id1]
[B] [B1]
[exit 1 - %phi1 = OpPhi %id %id1]
```
We can then apply the transformation the second time to get
```
[entry 1]
[entry 2]
[A] [A2] [A1]
[%id] [%id2] [%id1]
[B] [B2] [B1]
[exit 2 - %phi2 = OpPhi %id %id2]
[exit 1 - %phi1 = OpPhi %id %id1]
```
In the example above, `%phi1` should have `%phi2` instead of `%id` as an operand. The reason why it's not the case might be related to https://github.com/KhronosGroup/SPIRV-Tools/issues/4267.
Contributor guide
Research direction
Start by replaying transformations.binary with spirv-fuzz using the reported commit, data.zip, and the given replay-validation command. Trace two applications of TransformationDuplicateRegionWithSelection to the same region and verify that the generated output validates, including that phi1 uses phi2 instead of the original %id.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100