microsoft / microsoft/DirectXShaderCompiler
Using MSAA UAV store instruction (introduced in SM6.7) with a innocuous write-mask results in an AV in dxc.
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 3.7k
- Forks
- 900
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 44
Description
Description
Using MSAA UAV store instruction (introduced in SM6.7) with a innocuous write-mask results in an AV in dxc.
Steps to Reproduce
Compile shader like:
RWTexture2DMS<float4, 4> uavMsaaTex : register(u0);
[numthreads(1, 1, 1)]
void mainMsaa(uint3 DTid : SV_DispatchThreadID)
{
uavMsaaTex.sample[0][uint2(0,0)].xyzw = float4(0, 0, 0, 0);
}
dxc -T cs_6_7 -E mainMsaa uavMsaa.hlsl
It succeeds if you remove the .xyzw write mask (or use the non-sample suffix operator).
See https://godbolt.org/z/zzndfzd8K (uncomment the failing line)
Actual Behavior
AV with this stack:
0:000> k
# Child-SP RetAddr Call Site
00 00000022`7d98aa00 00007ff8`cdd9736b dxcompiler!llvm::DataLayout::getPointerTypeSizeInBits+0x6
01 00000022`7d98aa30 00007ff8`cdc8749f dxcompiler!llvm::getOrEnforceKnownAlignment+0x37
02 00000022`7d98aac0 00007ff8`cdc3eea7 dxcompiler!llvm::InstCombiner::visitStoreInst+0xa7
03 00000022`7d98ab50 00007ff8`cdc3e0af dxcompiler!llvm::InstCombiner::run+0x2bb
04 00000022`7d98abd0 00007ff8`cdc3f175 dxcompiler!combineInstructionsOverFunction+0x237
05 00000022`7d98af30 00007ff8`ce7379d8 dxcompiler!`anonymous namespace'::InstructionCombiningPass::runOnFunction+0xc5
06 00000022`7d98af90 00007ff8`ce737b40 dxcompiler!llvm::FPPassManager::runOnFunction+0x194
07 00000022`7d98b090 00007ff8`ce737d4b dxcompiler!llvm::FPPassManager::runOnModule+0x90
08 00000022`7d98b0f0 00007ff8`ce737579 dxcompiler!`anonymous namespace'::MPPassManager::runOnModule+0x1d7
09 00000022`7d98b1e0 00007ff8`cddd985c dxcompiler!llvm::legacy::PassManagerImpl::run+0x95
0a 00000022`7d98b220 00007ff8`cddd9bc8 dxcompiler!`anonymous namespace'::EmitAssemblyHelper::EmitAssembly+0x430
0b 00000022`7d98b2b0 00007ff8`cddcf6ad dxcompiler!clang::EmitBackendOutput+0x2fc
0c 00000022`7d98b510 00007ff8`ce461888 dxcompiler!clang::BackendConsumer::HandleTranslationUnit+0x1bd
0d 00000022`7d98b5e0 00007ff8`cdec3c47 dxcompiler!clang::ParseAST+0x1f8
0e 00000022`7d98b690 00007ff8`cddcef71 dxcompiler!clang::ASTFrontendAction::ExecuteAction+0x97
0f 00000022`7d98b6c0 00007ff8`cdec3b95 dxcompiler!clang::CodeGenAction::ExecuteAction+0x481
10 00000022`7d98b920 00007ff8`cda90b5c dxcompiler!clang::FrontendAction::Execute+0x51
11 00000022`7d98b950 00007ff8`cda97e9d dxcompiler!DxcCompiler::Compile+0x331c
12 00000022`7d98e0d0 00007ff8`cda9363e dxcompiler!hlsl::DxcCompilerAdapter::WrapCompile+0x69d
13 00000022`7d98ef50 00007ff8`cda93527 dxcompiler!hlsl::DxcCompilerAdapter::CompileWithDebug+0xfe
14 00000022`7d98efd0 00007ff7`462f5276 dxcompiler!hlsl::DxcCompilerAdapter::Compile+0x97
15 00000022`7d98f050 00007ff7`462fbf43 dxc_full+0x5276
16 00000022`7d98f280 00007ff7`46310de8 dxc_full+0xbf43
17 00000022`7d98fea0 00007ffa`56bbe8d7 dxc_full+0x20de8
18 00000022`7d98fee0 00007ffa`578fc34c KERNEL32!BaseThreadInitThunk+0x17
19 00000022`7d98ff10 00000000`00000000 ntdll!RtlUserThreadStart+0x2c
0:000> r
rax=0000000000000004 rbx=00000134885a4820 rcx=00000134885a4820
rdx=0000001000000000 rsi=00000134885bc030 rdi=0000013489f98e88
rip=00007ff8cdaf12d2 rsp=000000227d98aa00 rbp=000000227d98aa90
r8=00000134885a4820 r9=0000013489f66570 r10=00000134885a4870
r11=00000000ffffffff r12=0000013489f66570 r13=0000000000000004
r14=00000134885a4820 r15=0000013489f6bd68
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
dxcompiler!llvm::DataLayout::getPointerTypeSizeInBits+0x6:
00007ff8`cdaf12d2 807a080e cmp byte ptr [rdx+8],0Eh ds:00000010`00000008=??
Environment
- DXC version: 1.8.2505 +
- Host Operating System: Win11
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the crash with the provided dxc -T cs_6_7 -E mainMsaa command and the shader in the issue. Start from the LLVM InstCombiner::visitStoreInst and DataLayout::getPointerTypeSizeInBits frames shown in the stack. Done means the MSAA UAV store with the .xyzw write mask compiles without an access violation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100