nir/opt_load_store_vectorize: check_for_robustness() crashes on derefs
Found on Turnip with GTA V trace. But likely is true for anyone using this opt.
unsigned addition_bits = low->intrin->src[low->info->base_src].ssa->bit_size;
low->info->base_src
is -1
for derefs resulting in out-of-bounds access.
Probably it should be:
unsigned addition_bits = low->info->base_src != -1 ?
low->intrin->src[low->info->base_src].ssa->bit_size :
64;
But I'm rather unsure, hence this issue.
NIR right before the crash (click me)
shader: MESA_SHADER_FRAGMENT
inputs: 0
outputs: 0
uniforms: 0
ubos: 1
shared: 0
decl_var ubo INTERP_MODE_NONE cb0_t cb0 (~0, 0, 0)
decl_var uniform INTERP_MODE_NONE restrict sampler2DArray t1 (~0, 0, 1)
decl_var uniform INTERP_MODE_NONE restrict usampler2DArray t11 (~0, 0, 2)
decl_var shader_out INTERP_MODE_NONE float oDepth (FRAG_RESULT_DEPTH.x, 0, 0)
decl_function main (0 params)
impl main {
decl_var INTERP_MODE_NONE vec4[2] shader_in
decl_var INTERP_MODE_NONE vec4 r0
decl_var INTERP_MODE_NONE vec4 r1
block block_0:
/* preds: */
vec4 32 ssa_182 = intrinsic load_frag_coord () ()
vec1 32 ssa_183 = intrinsic load_sample_id () ()
vec1 32 ssa_20 = load_const (0x00000000 /* 0.000000 */)
vec1 1 ssa_21 = load_const (true)
vec1 32 ssa_25 = load_const (0xffffffff /* -nan */)
vec1 32 ssa_32 = load_const (0x000003e8 /* 0.000000 */)
vec3 32 ssa_34 = intrinsic vulkan_resource_index (ssa_20) (0, 0, 6) /* desc_set=0 */ /* binding=0 */ /* desc_type=UBO */
vec3 32 ssa_35 = intrinsic load_vulkan_descriptor (ssa_34) (6) /* desc_type=UBO */
vec3 32 ssa_36 = deref_cast (cb0_t *)ssa_35 (ubo cb0_t) /* ptr_stride=0, align_mul=0, align_offset=0 */
vec3 32 ssa_37 = deref_struct &ssa_36->field0 (ubo vec4[1]) /* &((cb0_t *)ssa_35)->field0 */
vec3 32 ssa_39 = deref_array &(*ssa_37)[0] (ubo vec4) /* &((cb0_t *)ssa_35)->field0[0] */
vec1 32 ssa_40 = load_const (0x00000003 /* 0.000000 */)
vec3 32 ssa_41 = deref_array &(*ssa_39)[3] (ubo float) /* &((cb0_t *)ssa_35)->field0[0][3] */
vec1 32 ssa_42 = intrinsic load_deref (ssa_41) (0) /* access=0 */
vec3 32 ssa_52 = deref_array &(*ssa_39)[0] (ubo float) /* &((cb0_t *)ssa_35)->field0[0][0] */
vec1 32 ssa_53 = intrinsic load_deref (ssa_52) (0) /* access=0 */
vec1 32 ssa_61 = imul ssa_42, ssa_53
vec1 32 ssa_62 = iadd ssa_61, ssa_183
vec1 32 ssa_209 = f2u32 ssa_182.x
vec1 32 ssa_210 = f2u32 ssa_182.y
vec1 32 ssa_88 = load_const (0x00000001 /* 0.000000 */)
vec3 32 ssa_89 = deref_array &(*ssa_39)[1] (ubo float) /* &((cb0_t *)ssa_35)->field0[0][1] */
vec1 32 ssa_90 = intrinsic load_deref (ssa_89) (0) /* access=0 */
vec1 1 ssa_92 = ult ssa_90, ssa_32
vec1 32 ssa_245 = b2i32 ssa_92
vec1 32 ssa_246 = ineg ssa_245
vec1 1 ssa_247 = load_const (true)
vec1 1 ssa_248 = load_const (false)
vec1 1 ssa_244 = bcsel ssa_92, ssa_247, ssa_248
/* succs: block_1 block_5 */
if ssa_244 {
block block_1:
/* preds: block_0 */
vec3 32 ssa_117 = vec3 ssa_209, ssa_210, ssa_62
vec1 32 ssa_118 = deref_var &t11 (uniform usampler2DArray)
vec4 32 ssa_120 = (uint32)txf ssa_118 (texture_deref), ssa_117 (coord), ssa_20 (lod), 0 (sampler)
vec1 32 ssa_241 = mov ssa_120.y
vec1 1 ssa_143 = ine ssa_241, ssa_90
vec1 32 ssa_239 = b2i32 ssa_143
vec1 32 ssa_240 = ineg ssa_239
vec1 1 ssa_249 = load_const (true)
vec1 1 ssa_250 = load_const (false)
vec1 1 ssa_238 = bcsel ssa_143, ssa_249, ssa_250
/* succs: block_2 block_3 */
if ssa_238 {
block block_2:
/* preds: block_1 */
intrinsic demote () ()
/* succs: block_4 */
} else {
block block_3:
/* preds: block_1 */
/* succs: block_4 */
}
block block_4:
/* preds: block_2 block_3 */
/* succs: block_6 */
} else {
block block_5:
/* preds: block_0 */
/* succs: block_6 */
}
block block_6:
/* preds: block_4 block_5 */
vec1 32 ssa_224 = phi block_4: ssa_209, block_5: ssa_209
vec1 32 ssa_227 = phi block_4: ssa_210, block_5: ssa_210
vec1 32 ssa_230 = phi block_4: ssa_62, block_5: ssa_62
vec3 32 ssa_168 = vec3 ssa_224, ssa_227, ssa_230
vec1 32 ssa_169 = deref_var &t1 (uniform sampler2DArray)
vec4 32 ssa_171 = (float32)txf ssa_169 (texture_deref), ssa_168 (coord), ssa_20 (lod), 0 (sampler)
vec1 32 ssa_235 = mov ssa_171.x
vec1 32 ssa_181 = deref_var &oDepth (shader_out float)
intrinsic store_deref (ssa_181, ssa_235) (1, 0) /* wrmask=x */ /* access=0 */
/* succs: block_7 */
block block_7:
}
CC: @pendingchaos