KhronosGroup / KhronosGroup/glslang
for (uint x = 0; x < sz.x++ x) caused shaderc to crash
- Dominant language
- C++
- Stars
- 3.6k
- Forks
- 989
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 31
Description
Copy/Paste from BGFX repo: https://github.com/bkaradzic/bgfx/issues/3698
shaderc crashes on the following code, note the is a typo, semicolon is missing between sz.x and ++x.
Snippet of the code.
```
const vec4 mrnLast = imageLoad(mrn, p0);
vec3 normLast = decodeNormalOctahedron(mrnLast.xw);
for (uint x = 0; x < sz.x++ x)
{
ivec2 p = ivec2(x, row);
vec4 mrnCur = imageLoad(mrn, p);
```
The area where it crashed
```
TIntermTyped* TIntermediate::addBinaryMath(TOperator op, TIntermTyped* left, TIntermTyped* right, const TSourceLoc& loc)
{
// No operations work on blocks
if (left->getType().getBasicType() == EbtBlock || right->getType().getBasicType() == EbtBlock ||
left->getType().getBasicType() == EbtString || right->getType().getBasicType() == EbtString)
return nullptr;
```
Backtrace
```
#0 0x00005555557c840c in glslang::TIntermediate::addBinaryMath (this=0x5555565aaf00, op=glslang::EOpLessThan, left=0x555556aaa788, right=0x0, loc=...) at ../../../3rdparty/glslang/glslang/MachineIndependent/Intermediate.cpp:121
#1 0x0000555555878b27 in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlRelational) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3277
#2 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlEquality) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#3 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlBitwiseAnd) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#4 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlBitwiseXor) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#5 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlBitwiseOr) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#6 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlLogicalAnd) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#7 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlLogicalXor) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#8 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlLogicalOr) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#9 0x0000555555874c56 in glslang::HlslGrammar::acceptConditionalExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3204
#10 0x00005555558706c8 in glslang::HlslGrammar::acceptAssignmentExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3158
#11 0x0000555555870aec in glslang::HlslGrammar::acceptExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3052
#12 0x000055555587a585 in glslang::HlslGrammar::acceptIterationStatement (this=0x7ffffffefca0, statement=@0x7ffffffef8b8: 0x0, attributes=...) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:4112
#13 0x0000555555879c41 in glslang::HlslGrammar::acceptStatement (this=0x7ffffffefca0, statement=@0x7ffffffef8b8: 0x0) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3784
#14 0x00005555558787b0 in glslang::HlslGrammar::acceptCompoundStatement (this=0x7ffffffefca0, retStatement=@0x7ffffffef8f8: 0x0) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3710
#15 0x0000555555877cf1 in glslang::HlslGrammar::acceptFunctionBody (this=0x7ffffffefca0, declarator=..., nodeList=@0x7ffffffefe00: 0x55555661e678) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:2988
#16 0x00005555558704fd in glslang::HlslGrammar::acceptFunctionDefinition (this=0x7ffffffefca0, declarator=..., nodeList=@0x7ffffffefe00: 0x55555661e678, deferredTokens=0x0) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:2974
#17 0x000055555586e76c in glslang::HlslGrammar::acceptDeclaration (this=0x7ffffffefca0, nodeList=@0x7ffffffefe00: 0x55555661e678) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:434
#18 0x000055555586e1cc in glslang::HlslGrammar::acceptDeclarationList (this=0x7ffffffefca0, nodeList=@0x7ffffffefe00: 0x55555661e678) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:165
#19 0x000055555586dac3 in glslang::HlslGrammar::acceptCompilationUnit (this=0x7ffffffefca0) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:130
#20 0x000055555586da92 in glslang::HlslGrammar::parse (this=0x7ffffffefca0) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:66
#21 0x000055555574dd70 in glslang::HlslParseContext::parseShaderStrings (this=0x5555565f31f0, ppContext=..., input=..., versionWillBeError=true) at ../../../3rdparty/glslang/glslang/HLSL/hlslParseHelper.cpp:132
#22 0x00005555556abc82 in (anonymous namespace)::DoFullParse::operator() (this=0x7fffffff0800, parseContext=..., ppContext=..., fullInput=..., versionWillBeError=true, intermediate=..., optLevel=EShOptNone, messages=1112) at ../../../3rdparty/glslang/glslang/MachineIndependent/ShaderLang.cpp:1233
#23 0x00005555556a9f6a in (anonymous namespace)::ProcessDeferred<(anonymous namespace)::DoFullParse> (compiler=0x5555565f4cb0, shaderStrings=0x7fffffff54a8, numStrings=1, inputLengths=0x0, stringNames=0x0, customPreamble=0x5555560b5898 "", optLevel=EShOptNone, resources=0x5555560afc78 , defaultVersion=110, defaultProfile=ENoProfile, forceDefaultVersionAndProfile=false, overrideVersion=0, forwardCompatible=false, messages=1112, intermediate=..., processingContext=..., requireNonempty=true, includer=..., sourceEntryPointName="", environment=0x5555565e5a0c, compileOnly=false) at ../../../3rdparty/glslang/glslang/MachineIndependent/ShaderLang.cpp:1008
#24 0x00005555556a6305 in (anonymous namespace)::CompileDeferred (compiler=0x5555565f4cb0, shaderStrings=0x7fffffff54a8, numStrings=1, inputLengths=0x0, stringNames=0x0, preamble=0x5555560b5898 "", optLevel=EShOptNone, resources=0x5555560afc78 , defaultVersion=110, defaultProfile=ENoProfile, forceDefaultVersionAndProfile=false, overrideVersion=0, forwardCompatible=false, messages=1112, intermediate=..., includer=..., sourceEntryPointName=..., environment=0x5555565e5a0c, compileOnly=false) at ../../../3rdparty/glslang/glslang/MachineIndependent/ShaderLang.cpp:1321
#25 0x00005555556a7560 in glslang::TShader::parse (this=0x5555565e5990, builtInResources=0x5555560afc78 , defaultVersion=110, defaultProfile=ENoProfile, forceDefaultVersionAndProfile=false, forwardCompatible=false, messages=1112, includer=...) at ../../../3rdparty/glslang/glslang/MachineIndependent/ShaderLang.cpp:1893
#26 0x00005555555ec04a in glslang::TShader::parse (this=0x5555565e5990, res=0x5555560afc78 , defaultVersion=110, defaultProfile=ENoProfile, forceDefaultVersionAndProfile=false, forwardCompatible=false, messages=1112) at ../../../3rdparty/glslang/glslang/Public/ShaderLang.h:679
#27 0x00005555555eb278 in glslang::TShader::parse (this=0x5555565e5990, builtInResources=0x5555560afc78 , defaultVersion=110, forwardCompatible=false, messages=1112) at ../../../3rdparty/glslang/glslang/Public/ShaderLang.h:685
#28 0x00005555555f9ca6 in bgfx::spirv::compile (_options=..., _version=1010, _code="// shaderc command line:\n// /home/mika/prj/game025/bgfx/bgfx/.build/linux64_clang/bin/shadercDebug -i bgfx/bgfx/src -f blur-h-cs.sc -o data/blur-h-cs.spv --type compute --platform linux --profile spir"..., _shaderWriter=0x555556599ef0, _messageWriter=0x5555565876f0 , _firstPass=true) at ../../../tools/shaderc/shaderc_spirv.cpp:494
#29 0x00005555555f9a59 in bgfx::compileSPIRVShader (_options=..., _version=1010, _code="// shaderc command line:\n// /home/mika/prj/game025/bgfx/bgfx/.build/linux64_clang/bin/shadercDebug -i bgfx/bgfx/src -f blur-h-cs.sc -o data/blur-h-cs.spv --type compute --platform linux --profile spir"..., _shaderWriter=0x555556599ef0, _messageWriter=0x5555565876f0 ) at ../../../tools/shaderc/shaderc_spirv.cpp:899
#30 0x00005555555d7297 in bgfx::compileShader (_varying=0x0, _comment=0x5555565aa790 "// shaderc command line:\n// /home/mika/prj/game025/bgfx/bgfx/.build/linux64_clang/bin/shadercDebug -i bgfx/bgfx/src -f blur-h-cs.sc -o data/blur-h-cs.spv --type compute --platform linux --profile spir"..., _shader=0x5555565ab960 "\315\315\315\315\315\315\315͈", _shaderLen=1221, _options=..., _shaderWriter=0x555556599ef0, _messageWriter=0x5555565876f0 ) at ../../../tools/shaderc/shaderc.cpp:1714
#31 0x00005555555db57d in bgfx::compileShader (_argc=15, _argv=0x7fffffffe1b8) at ../../../tools/shaderc/shaderc.cpp:2898
#32 0x00005555555db702 in main (_argc=15, _argv=0x7fffffffe1b8) at ../../../tools/shaderc/shaderc.cpp:2931
```
The BGFX was build from the git hash: 80370936d Cleanup.
Contributor guide
Research direction
Reproduce the crash with the malformed loop condition, then start in glslang/HLSL/hlslGrammar.cpp at acceptBinaryExpression and follow the call into glslang/MachineIndependent/Intermediate.cpp at addBinaryMath. Verify that shaderc handles the missing operand without crashing and reports an appropriate parse or validation error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 65/100