KhronosGroup / KhronosGroup/SPIRV-Tools
spirv-opt: Use of uninitialize value in MergeReturn pass
- Dominant language
- C++
- Stars
- 1.4k
- Forks
- 709
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 28
Description
From a fuzzing run we get this stack trace:
```
==604314==WARNING: MemorySanitizer: use-of-uninitialized-value
--
| #0 0x55c56dbdf090 in __constrain_hash buildtools/third_party/libc++/trunk/include/__hash_table:116:10
| #1 0x55c56dbdf090 in find buildtools/third_party/libc++/trunk/include/__hash_table:2393:26
| #2 0x55c56dbdf090 in find buildtools/third_party/libc++/trunk/include/unordered_map:1354:69
| #3 0x55c56dbdf090 in spvtools::opt::IRContext::get_instr_block(spvtools::opt::Instruction*) third_party/vulkan-deps/spirv-tools/src/source/opt/ir_context.h:281:34
| #4 0x55c56de6c255 in spvtools::opt::MergeReturnPass::AddNewPhiNodes(spvtools::opt::BasicBlock*) third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:743:39
| #5 0x55c56de4ebcf in spvtools::opt::MergeReturnPass::AddNewPhiNodes() third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:718:5
| #6 0x55c56de485f8 in spvtools::opt::MergeReturnPass::ProcessStructured(spvtools::opt::Function*, std::__Cr::vector > const&) third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:168:3
| #7 0x55c56de741f7 in operator() third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:57:12
| #8 0x55c56de741f7 in __invoke<(lambda at ../../third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:36:25) &, spvtools::opt::Function *> buildtools/third_party/libc++/trunk/include/type_traits:3956:1
| #9 0x55c56de741f7 in __call<(lambda at ../../third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:36:25) &, spvtools::opt::Function *> buildtools/third_party/libc++/trunk/include/__functional_base:317:16
| #10 0x55c56de741f7 in operator() buildtools/third_party/libc++/trunk/include/functional:1615:12
| #11 0x55c56de741f7 in bool std::__Cr::__function::__policy_invoker::__call_impl >(std::__Cr::__function::__policy_storage const*, spvtools::opt::Function*) buildtools/third_party/libc++/trunk/include/functional:2096:16
| #12 0x55c56dd1cfc0 in operator() buildtools/third_party/libc++/trunk/include/functional:2228:16
| #13 0x55c56dd1cfc0 in operator() buildtools/third_party/libc++/trunk/include/functional:2567:12
| #14 0x55c56dd1cfc0 in spvtools::opt::IRContext::ProcessCallTreeFromRoots(std::__Cr::function&, std::__Cr::queue > >*) third_party/vulkan-deps/spirv-tools/src/source/opt/ir_context.cpp:917:18
| #15 0x55c56dd1ebf5 in spvtools::opt::IRContext::ProcessReachableCallTree(std::__Cr::function&) third_party/vulkan-deps/spirv-tools/src/source/opt/ir_context.cpp:902:10
| #16 0x55c56de454b4 in spvtools::opt::MergeReturnPass::Process() third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:66:30
| #17 0x55c56e233896 in spvtools::opt::Pass::Run(spvtools::opt::IRContext*) third_party/vulkan-deps/spirv-tools/src/source/opt/pass.cpp:40:25
| #18 0x55c56e2394c8 in spvtools::opt::PassManager::Run(spvtools::opt::IRContext*) third_party/vulkan-deps/spirv-tools/src/source/opt/pass_manager.cpp:50:35
| #19 0x55c56ddf5050 in spvtools::Optimizer::Run(unsigned int const*, unsigned long, std::__Cr::vector >*, spv_optimizer_options_t*) const third_party/vulkan-deps/spirv-tools/src/source/opt/optimizer.cpp:557:37
| #20 0x55c56ddf45c9 in spvtools::Optimizer::Run(unsigned int const*, unsigned long, std::__Cr::vector >*) const third_party/vulkan-deps/spirv-tools/src/source/opt/optimizer.cpp:519:10
| #21 0x55c56cf14db5 in tint::fuzzers::spvtools_fuzzer::SpirvOptMutator::Mutate() third_party/dawn/third_party/tint/fuzzers/tint_spirv_tools_fuzzer/spirv_opt_mutator.cc:118:20
| #22 0x55c56ceeaf05 in LLVMFuzzerCustomMutator third_party/dawn/third_party/tint/fuzzers/tint_spirv_tools_fuzzer/fuzzer.cc:167:26
| #23 0x55c56cfebe3f in fuzzer::MutationDispatcher::Mutate_Custom(unsigned char*, unsigned long, unsigned long) third_party/libFuzzer/src/FuzzerMutate.cpp:70:10
| #24 0x55c56cff226f in fuzzer::MutationDispatcher::MutateImpl(unsigned char*, unsigned long, unsigned long, std::__Cr::vector >&) third_party/libFuzzer/src/FuzzerMutate.cpp:516:22
| #25 0x55c56cff1ebe in fuzzer::MutationDispatcher::Mutate(unsigned char*, unsigned long, unsigned long) third_party/libFuzzer/src/FuzzerMutate.cpp:498:10
| #26 0x55c56cfadd74 in fuzzer::Fuzzer::MutateAndTestOne() third_party/libFuzzer/src/FuzzerLoop.cpp:691:20
| #27 0x55c56cfb1a13 in fuzzer::Fuzzer::Loop(std::__Cr::vector >&) third_party/libFuzzer/src/FuzzerLoop.cpp:830:5
| #28 0x55c56cf687be in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:824:6
| #29 0x55c56cfc5580 in main third_party/libFuzzer/src/FuzzerMain.cpp:19:10
| #30 0x7f64a772082f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/libc-start.c:291
| #31 0x55c56ce673e9 in _start
|
| Uninitialized value was stored to memory at
| #0 0x55c56de4b64c in spvtools::opt::MergeReturnPass::RecordImmediateDominators(spvtools::opt::Function*) third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:757:32
| #1 0x55c56de466a5 in spvtools::opt::MergeReturnPass::ProcessStructured(spvtools::opt::Function*, std::__Cr::vector > const&) third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:113:3
| #2 0x55c56de741f7 in operator() third_party/vulkan-deps/spirv-tools/src/source/opt/merge_return_pass.cpp:57:12
```
Contributor guide
Assessment
This issue has not been assessed yet.