Skip to content

Crash when "uint(-1)" is used for "operator%()" or "operator/()" #4104

@jkwak-work

Description

@jkwak-work

Problem description
It appears that "operator%()" causes a crash when a maximum value of uint is used as a second argument.

Repro
The following test can reproduce the issue when TEST_WHEN_FIX is set to 1,

//TEST:SIMPLE(filecheck=SOURCE): -stage compute -entry computeMain -target hlsl
//TEST:SIMPLE(filecheck=SOURCE): -stage compute -entry computeMain -target glsl
//TEST(compute):COMPARE_COMPUTE_EX(filecheck-buffer=BUF):-dx12 -compute -entry computeMain -profile cs_6_6 -use-dxil -shaderobj -output-using-type
//TEST(compute, vulkan):COMPARE_COMPUTE(filecheck-buffer=BUF):-vk -compute -entry computeMain -output-using-type -emit-spirv-via-glsl
//TEST(compute, vulkan):COMPARE_COMPUTE(filecheck-buffer=BUF):-vk -compute -entry computeMain -output-using-type -emit-spirv-directly

#define TEST_WHEN_FIXED 0

//TEST_INPUT: ubuffer(data=[0], stride=4):out,name outputBuffer
RWStructuredBuffer<int> outputBuffer;

// Note, it appears that -2 works fine.
static const uint32_t u32Const = uint(0xffffffff); // -1 or max
static const int32_t i32Const = 1;

bool Test_CompileTime()
{
    // SOURCE-LABEL: Test_CompileTime
    // SOURCE-NOT: % {{.*}}-
    return true
        && ((1u % u32Const) == 1u)
        && ((1 % u32Const) == 1)
        && ((uint32_t(1) % u32Const) == uint32_t(1))
#if TEST_WHEN_FIXED
        && ((int32_t(1) % u32Const) == uint32_t(1))
        && ((i32Const % u32Const) == i32Const)
#endif
        ;
}

[numthreads(4, 1, 1)]
void computeMain(uint3 dispatchThreadID : SV_DispatchThreadID)
{
    // BUF:1
    // SOURCE-LABEL: Test_CompileTime
    outputBuffer[0] = int(true
        && uint(-1) == u32Const
        && Test_CompileTime()
        );
}

When the issue is reproduced, the following codes were observed,

// HLSL
_S2 = int(1) % int(-1) == int(1);
// GLSL
_S2 = 1 % -1 == 1;

Although the repro code above cannot reproduce the crash, this causes a crash on our customer code.

Metadata

Metadata

Assignees

Labels

GoodFirstBugGreat bug for people getting going in slang codebase

Type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions