Fix fuzzer-discovered issue with inlining.
When inlining a function, every cloned statement and expression is
intended to have its Position replaced with the position of the
function call that is being inlined. This allows errors detected
during inlining to be reported at the call site. e.g., if we call
`divide_int(x, 0)` we would prefer to diagnose the division-by-zero
at the call site instead of inside of the function body, because
diagnosing at the function body would be very confusing.
This position-substitution was not occurring for scratch variables.
The fuzzer managed to construct a case that would turn this
oversight into an assertion inside Position, because
`Position::rangeThrough` treats it as an error if the right-side
expression's endpoint comes before the left-side expression's
endpoint.
This does not solve our fuzzer issue but it is a good start.
Bug: oss-fuzz:65111
Change-Id: I73284efac6708ec32130bd4923eaaa9e9149d1db
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/789918
Commit-Queue: Brian Osman <brianosman@google.com>
Auto-Submit: John Stiles <johnstiles@google.com>
Reviewed-by: Brian Osman <brianosman@google.com>
diff --git a/src/sksl/SkSLInliner.cpp b/src/sksl/SkSLInliner.cpp
index c47a084..9685f6b 100644
--- a/src/sksl/SkSLInliner.cpp
+++ b/src/sksl/SkSLInliner.cpp
@@ -98,8 +98,9 @@
}
std::unique_ptr<Expression> clone_with_ref_kind(const Expression& expr,
- VariableReference::RefKind refKind) {
- std::unique_ptr<Expression> clone = expr.clone();
+ VariableReference::RefKind refKind,
+ Position pos) {
+ std::unique_ptr<Expression> clone = expr.clone(pos);
Analysis::UpdateVariableRefKind(clone.get(), refKind);
return clone;
}
@@ -301,7 +302,7 @@
const VariableReference& v = expression.as<VariableReference>();
std::unique_ptr<Expression>* remap = varMap->find(v.variable());
if (remap) {
- return clone_with_ref_kind(**remap, v.refKind());
+ return clone_with_ref_kind(**remap, v.refKind(), pos);
}
return expression.clone(pos);
}
@@ -420,7 +421,7 @@
BinaryExpression::Make(
*fContext,
pos,
- clone_with_ref_kind(**resultExpr, VariableRefKind::kWrite),
+ clone_with_ref_kind(**resultExpr, VariableRefKind::kWrite, pos),
Operator::Kind::EQ,
expr(r.expression())));
}
diff --git a/tests/sksl/errors/ArrayInlinedIndexOutOfRange.glsl b/tests/sksl/errors/ArrayInlinedIndexOutOfRange.glsl
index 74a07ca..786feae 100644
--- a/tests/sksl/errors/ArrayInlinedIndexOutOfRange.glsl
+++ b/tests/sksl/errors/ArrayInlinedIndexOutOfRange.glsl
@@ -2,8 +2,8 @@
error: 11: index -1 out of range for 'int[3]'
int undefined = indexArray(-1) + indexArray(3);
- ^^
+ ^^^^^^^^^^^^^^
error: 11: index 3 out of range for 'int[3]'
int undefined = indexArray(-1) + indexArray(3);
- ^
+ ^^^^^^^^^^^^^
2 errors
diff --git a/tests/sksl/errors/MatrixInlinedIndexOutOfRange.glsl b/tests/sksl/errors/MatrixInlinedIndexOutOfRange.glsl
index 6925424..d261890 100644
--- a/tests/sksl/errors/MatrixInlinedIndexOutOfRange.glsl
+++ b/tests/sksl/errors/MatrixInlinedIndexOutOfRange.glsl
@@ -2,8 +2,8 @@
error: 11: index -1 out of range for 'float3x3'
float3 undefined = indexMatrix(-1) + indexMatrix(3);
- ^^
+ ^^^^^^^^^^^^^^^
error: 11: index 3 out of range for 'float3x3'
float3 undefined = indexMatrix(-1) + indexMatrix(3);
- ^
+ ^^^^^^^^^^^^^^
2 errors
diff --git a/tests/sksl/errors/VectorInlinedIndexOutOfRange.glsl b/tests/sksl/errors/VectorInlinedIndexOutOfRange.glsl
index 73013e1..b2af8f4 100644
--- a/tests/sksl/errors/VectorInlinedIndexOutOfRange.glsl
+++ b/tests/sksl/errors/VectorInlinedIndexOutOfRange.glsl
@@ -2,8 +2,8 @@
error: 11: index -1 out of range for 'int3'
int undefined = indexVector(-1) + indexVector(3);
- ^^
+ ^^^^^^^^^^^^^^^
error: 11: index 3 out of range for 'int3'
int undefined = indexVector(-1) + indexVector(3);
- ^
+ ^^^^^^^^^^^^^^
2 errors
