KhronosGroup / KhronosGroup/glslang

for (uint x = 0; x < sz.x++ x) caused shaderc to crash

Open
#4,292 0 comments 0 reactions 0 assignees View on GitHub
bug HLSL
Dominant language
C++
Stars
3.6k
Forks
989
Avg merge
1d 2h
Merged PRs (30d)
31

Description

Copy/Paste from BGFX repo: https://github.com/bkaradzic/bgfx/issues/3698

shaderc crashes on the following code, note the is a typo, semicolon is missing between sz.x and ++x.

Snippet of the code.

```
const vec4 mrnLast = imageLoad(mrn, p0);
vec3 normLast = decodeNormalOctahedron(mrnLast.xw);
for (uint x = 0; x < sz.x++ x)
{
ivec2 p = ivec2(x, row);
vec4 mrnCur = imageLoad(mrn, p);
```

The area where it crashed
```
TIntermTyped* TIntermediate::addBinaryMath(TOperator op, TIntermTyped* left, TIntermTyped* right, const TSourceLoc& loc)
{
// No operations work on blocks
if (left->getType().getBasicType() == EbtBlock || right->getType().getBasicType() == EbtBlock ||
left->getType().getBasicType() == EbtString || right->getType().getBasicType() == EbtString)
return nullptr;
```

Backtrace
```
#0 0x00005555557c840c in glslang::TIntermediate::addBinaryMath (this=0x5555565aaf00, op=glslang::EOpLessThan, left=0x555556aaa788, right=0x0, loc=...) at ../../../3rdparty/glslang/glslang/MachineIndependent/Intermediate.cpp:121
#1 0x0000555555878b27 in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlRelational) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3277
#2 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlEquality) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#3 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlBitwiseAnd) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#4 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlBitwiseXor) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#5 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlBitwiseOr) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#6 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlLogicalAnd) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#7 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlLogicalXor) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#8 0x0000555555878a5f in glslang::HlslGrammar::acceptBinaryExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788, precedenceLevel=glslang::PlLogicalOr) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3257
#9 0x0000555555874c56 in glslang::HlslGrammar::acceptConditionalExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3204
#10 0x00005555558706c8 in glslang::HlslGrammar::acceptAssignmentExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3158
#11 0x0000555555870aec in glslang::HlslGrammar::acceptExpression (this=0x7ffffffefca0, node=@0x7ffffffef7d0: 0x555556aaa788) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3052
#12 0x000055555587a585 in glslang::HlslGrammar::acceptIterationStatement (this=0x7ffffffefca0, statement=@0x7ffffffef8b8: 0x0, attributes=...) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:4112
#13 0x0000555555879c41 in glslang::HlslGrammar::acceptStatement (this=0x7ffffffefca0, statement=@0x7ffffffef8b8: 0x0) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3784
#14 0x00005555558787b0 in glslang::HlslGrammar::acceptCompoundStatement (this=0x7ffffffefca0, retStatement=@0x7ffffffef8f8: 0x0) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:3710
#15 0x0000555555877cf1 in glslang::HlslGrammar::acceptFunctionBody (this=0x7ffffffefca0, declarator=..., nodeList=@0x7ffffffefe00: 0x55555661e678) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:2988
#16 0x00005555558704fd in glslang::HlslGrammar::acceptFunctionDefinition (this=0x7ffffffefca0, declarator=..., nodeList=@0x7ffffffefe00: 0x55555661e678, deferredTokens=0x0) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:2974
#17 0x000055555586e76c in glslang::HlslGrammar::acceptDeclaration (this=0x7ffffffefca0, nodeList=@0x7ffffffefe00: 0x55555661e678) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:434
#18 0x000055555586e1cc in glslang::HlslGrammar::acceptDeclarationList (this=0x7ffffffefca0, nodeList=@0x7ffffffefe00: 0x55555661e678) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:165
#19 0x000055555586dac3 in glslang::HlslGrammar::acceptCompilationUnit (this=0x7ffffffefca0) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:130
#20 0x000055555586da92 in glslang::HlslGrammar::parse (this=0x7ffffffefca0) at ../../../3rdparty/glslang/glslang/HLSL/hlslGrammar.cpp:66
#21 0x000055555574dd70 in glslang::HlslParseContext::parseShaderStrings (this=0x5555565f31f0, ppContext=..., input=..., versionWillBeError=true) at ../../../3rdparty/glslang/glslang/HLSL/hlslParseHelper.cpp:132
#22 0x00005555556abc82 in (anonymous namespace)::DoFullParse::operator() (this=0x7fffffff0800, parseContext=..., ppContext=..., fullInput=..., versionWillBeError=true, intermediate=..., optLevel=EShOptNone, messages=1112) at ../../../3rdparty/glslang/glslang/MachineIndependent/ShaderLang.cpp:1233
#23 0x00005555556a9f6a in (anonymous namespace)::ProcessDeferred<(anonymous namespace)::DoFullParse> (compiler=0x5555565f4cb0, shaderStrings=0x7fffffff54a8, numStrings=1, inputLengths=0x0, stringNames=0x0, customPreamble=0x5555560b5898 "", optLevel=EShOptNone, resources=0x5555560afc78 , defaultVersion=110, defaultProfile=ENoProfile, forceDefaultVersionAndProfile=false, overrideVersion=0, forwardCompatible=false, messages=1112, intermediate=..., processingContext=..., requireNonempty=true, includer=..., sourceEntryPointName="", environment=0x5555565e5a0c, compileOnly=false) at ../../../3rdparty/glslang/glslang/MachineIndependent/ShaderLang.cpp:1008
#24 0x00005555556a6305 in (anonymous namespace)::CompileDeferred (compiler=0x5555565f4cb0, shaderStrings=0x7fffffff54a8, numStrings=1, inputLengths=0x0, stringNames=0x0, preamble=0x5555560b5898 "", optLevel=EShOptNone, resources=0x5555560afc78 , defaultVersion=110, defaultProfile=ENoProfile, forceDefaultVersionAndProfile=false, overrideVersion=0, forwardCompatible=false, messages=1112, intermediate=..., includer=..., sourceEntryPointName=..., environment=0x5555565e5a0c, compileOnly=false) at ../../../3rdparty/glslang/glslang/MachineIndependent/ShaderLang.cpp:1321
#25 0x00005555556a7560 in glslang::TShader::parse (this=0x5555565e5990, builtInResources=0x5555560afc78 , defaultVersion=110, defaultProfile=ENoProfile, forceDefaultVersionAndProfile=false, forwardCompatible=false, messages=1112, includer=...) at ../../../3rdparty/glslang/glslang/MachineIndependent/ShaderLang.cpp:1893
#26 0x00005555555ec04a in glslang::TShader::parse (this=0x5555565e5990, res=0x5555560afc78 , defaultVersion=110, defaultProfile=ENoProfile, forceDefaultVersionAndProfile=false, forwardCompatible=false, messages=1112) at ../../../3rdparty/glslang/glslang/Public/ShaderLang.h:679
#27 0x00005555555eb278 in glslang::TShader::parse (this=0x5555565e5990, builtInResources=0x5555560afc78 , defaultVersion=110, forwardCompatible=false, messages=1112) at ../../../3rdparty/glslang/glslang/Public/ShaderLang.h:685
#28 0x00005555555f9ca6 in bgfx::spirv::compile (_options=..., _version=1010, _code="// shaderc command line:\n// /home/mika/prj/game025/bgfx/bgfx/.build/linux64_clang/bin/shadercDebug -i bgfx/bgfx/src -f blur-h-cs.sc -o data/blur-h-cs.spv --type compute --platform linux --profile spir"..., _shaderWriter=0x555556599ef0, _messageWriter=0x5555565876f0 , _firstPass=true) at ../../../tools/shaderc/shaderc_spirv.cpp:494
#29 0x00005555555f9a59 in bgfx::compileSPIRVShader (_options=..., _version=1010, _code="// shaderc command line:\n// /home/mika/prj/game025/bgfx/bgfx/.build/linux64_clang/bin/shadercDebug -i bgfx/bgfx/src -f blur-h-cs.sc -o data/blur-h-cs.spv --type compute --platform linux --profile spir"..., _shaderWriter=0x555556599ef0, _messageWriter=0x5555565876f0 ) at ../../../tools/shaderc/shaderc_spirv.cpp:899
#30 0x00005555555d7297 in bgfx::compileShader (_varying=0x0, _comment=0x5555565aa790 "// shaderc command line:\n// /home/mika/prj/game025/bgfx/bgfx/.build/linux64_clang/bin/shadercDebug -i bgfx/bgfx/src -f blur-h-cs.sc -o data/blur-h-cs.spv --type compute --platform linux --profile spir"..., _shader=0x5555565ab960 "\315\315\315\315\315\315\315͈", _shaderLen=1221, _options=..., _shaderWriter=0x555556599ef0, _messageWriter=0x5555565876f0 ) at ../../../tools/shaderc/shaderc.cpp:1714
#31 0x00005555555db57d in bgfx::compileShader (_argc=15, _argv=0x7fffffffe1b8) at ../../../tools/shaderc/shaderc.cpp:2898
#32 0x00005555555db702 in main (_argc=15, _argv=0x7fffffffe1b8) at ../../../tools/shaderc/shaderc.cpp:2931
```

The BGFX was build from the git hash: 80370936d Cleanup.

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash with the malformed loop condition, then start in glslang/HLSL/hlslGrammar.cpp at acceptBinaryExpression and follow the call into glslang/MachineIndependent/Intermediate.cpp at addBinaryMath. Verify that shaderc handles the missing operand without crashing and reports an appropriate parse or validation error.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.