KhronosGroup / KhronosGroup/SPIRV-Tools

spirv-opt: Use of uninitialize value in MergeReturn pass

Open
#4,427 0 comments 0 reactions 1 assignee Claimed by @afd View on GitHub
component:optimization
Dominant language
C++
Stars
1.4k
Forks
709
Avg merge
1d 22h
Merged PRs (30d)
28

Description

From a fuzzing run we get this stack trace:

```
==604314==WARNING: MemorySanitizer: use-of-uninitialized-value
--
  | #0 0x55c56dbdf090 in __constrain_hash buildtools/third_party/libc++/trunk/include/__hash_table:116:10
  | #1 0x55c56dbdf090 in find buildtools/third_party/libc++/trunk/include/__hash_table:2393:26
  | #2 0x55c56dbdf090 in find buildtools/third_party/libc++/trunk/include/unordered_map:1354:69
  | #3 0x55c56dbdf090 in spvtools::opt::IRContext::get_instr_block(spvtools::opt::Instruction*) third_party/vulkan-deps/spirv-tools/src/source/opt/ir_context.h:281:34
  | #4 0x55c56de6c255 in spvtools::opt::MergeReturnPass::AddNewPhiNodes(spvtools::opt::BasicBlock*) third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:743:39
  | #5 0x55c56de4ebcf in spvtools::opt::MergeReturnPass::AddNewPhiNodes() third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:718:5
  | #6 0x55c56de485f8 in spvtools::opt::MergeReturnPass::ProcessStructured(spvtools::opt::Function*, std::__Cr::vector > const&) third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:168:3
  | #7 0x55c56de741f7 in operator() third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:57:12
  | #8 0x55c56de741f7 in __invoke<(lambda at ../../third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:36:25) &, spvtools::opt::Function *> buildtools/third_party/libc++/trunk/include/type_traits:3956:1
  | #9 0x55c56de741f7 in __call<(lambda at ../../third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:36:25) &, spvtools::opt::Function *> buildtools/third_party/libc++/trunk/include/__functional_base:317:16
  | #10 0x55c56de741f7 in operator() buildtools/third_party/libc++/trunk/include/functional:1615:12
  | #11 0x55c56de741f7 in bool std::__Cr::__function::__policy_invoker::__call_impl >(std::__Cr::__function::__policy_storage const*, spvtools::opt::Function*) buildtools/third_party/libc++/trunk/include/functional:2096:16
  | #12 0x55c56dd1cfc0 in operator() buildtools/third_party/libc++/trunk/include/functional:2228:16
  | #13 0x55c56dd1cfc0 in operator() buildtools/third_party/libc++/trunk/include/functional:2567:12
  | #14 0x55c56dd1cfc0 in spvtools::opt::IRContext::ProcessCallTreeFromRoots(std::__Cr::function&, std::__Cr::queue > >*) third_party/vulkan-deps/spirv-tools/src/source/opt/ir_context.cpp:917:18
  | #15 0x55c56dd1ebf5 in spvtools::opt::IRContext::ProcessReachableCallTree(std::__Cr::function&) third_party/vulkan-deps/spirv-tools/src/source/opt/ir_context.cpp:902:10
  | #16 0x55c56de454b4 in spvtools::opt::MergeReturnPass::Process() third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:66:30
  | #17 0x55c56e233896 in spvtools::opt::Pass::Run(spvtools::opt::IRContext*) third_party/vulkan-deps/spirv-tools/src/source/opt/pass.cpp:40:25
  | #18 0x55c56e2394c8 in spvtools::opt::PassManager::Run(spvtools::opt::IRContext*) third_party/vulkan-deps/spirv-tools/src/source/opt/pass_manager.cpp:50:35
  | #19 0x55c56ddf5050 in spvtools::Optimizer::Run(unsigned int const*, unsigned long, std::__Cr::vector >*, spv_optimizer_options_t*) const third_party/vulkan-deps/spirv-tools/src/source/opt/optimizer.cpp:557:37
  | #20 0x55c56ddf45c9 in spvtools::Optimizer::Run(unsigned int const*, unsigned long, std::__Cr::vector >*) const third_party/vulkan-deps/spirv-tools/src/source/opt/optimizer.cpp:519:10
  | #21 0x55c56cf14db5 in tint::fuzzers::spvtools_fuzzer::SpirvOptMutator::Mutate() third_party/dawn/third_party/tint/fuzzers/tint_spirv_tools_fuzzer/spirv_opt_mutator.cc:118:20
  | #22 0x55c56ceeaf05 in LLVMFuzzerCustomMutator third_party/dawn/third_party/tint/fuzzers/tint_spirv_tools_fuzzer/fuzzer.cc:167:26
  | #23 0x55c56cfebe3f in fuzzer::MutationDispatcher::Mutate_Custom(unsigned char*, unsigned long, unsigned long) third_party/libFuzzer/src/FuzzerMutate.cpp:70:10
  | #24 0x55c56cff226f in fuzzer::MutationDispatcher::MutateImpl(unsigned char*, unsigned long, unsigned long, std::__Cr::vector >&) third_party/libFuzzer/src/FuzzerMutate.cpp:516:22
  | #25 0x55c56cff1ebe in fuzzer::MutationDispatcher::Mutate(unsigned char*, unsigned long, unsigned long) third_party/libFuzzer/src/FuzzerMutate.cpp:498:10
  | #26 0x55c56cfadd74 in fuzzer::Fuzzer::MutateAndTestOne() third_party/libFuzzer/src/FuzzerLoop.cpp:691:20
  | #27 0x55c56cfb1a13 in fuzzer::Fuzzer::Loop(std::__Cr::vector >&) third_party/libFuzzer/src/FuzzerLoop.cpp:830:5
  | #28 0x55c56cf687be in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:824:6
  | #29 0x55c56cfc5580 in main third_party/libFuzzer/src/FuzzerMain.cpp:19:10
  | #30 0x7f64a772082f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/libc-start.c:291
  | #31 0x55c56ce673e9 in _start
  |  
  | Uninitialized value was stored to memory at
  | #0 0x55c56de4b64c in spvtools::opt::MergeReturnPass::RecordImmediateDominators(spvtools::opt::Function*) third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:757:32
  | #1 0x55c56de466a5 in spvtools::opt::MergeReturnPass::ProcessStructured(spvtools::opt::Function*, std::__Cr::vector > const&) third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:113:3
  | #2 0x55c56de741f7 in operator() third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:57:12
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.