commit 43ac7e631561c0f530442743d14eafbf37241248
author John Stiles <johnstiles@google.com> Wed Aug 25 12:43:22 2021 -0400
committer SkCQ <skcq-be@skia-corp.google.com.iam.gserviceaccount.com> Wed Aug 25 17:52:50 2021 +0000
tree 4d16f2ef39ca01c2f9e5e021662e27de80764cae
parent b61014d31064cec1bc1e5d1cf6b05ec4c9a77fd4

Fix parsing error with SPIR-V negating a uint.

Our SPIR-V code generator did not implement support for negating a uint.
However, this is something that GLSL allows (as does the rest of SkSL).
I checked glslang and it uses OpSNegate here. The SPIR-V docs indicate
that OpSNegate allows any type of integer, and the validator lets it
pass, so we now use OpSNegate here as well.

http://screen/33mkq92uxAT5Xu8
http://screen/4YBTh3gCWz8eZx7
http://screen/388HtXyytcN5vLZ

Change-Id: I8c142018fd5e162dcd051abe1bc5d69a6e034794
Bug: oss-fuzz:37627
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/441880
Reviewed-by: Brian Osman <brianosman@google.com>
Commit-Queue: Brian Osman <brianosman@google.com>
Commit-Queue: John Stiles <johnstiles@google.com>
Auto-Submit: John Stiles <johnstiles@google.com>

gn/sksl_tests.gni

diff --git a/gn/sksl_tests.gni b/gn/sksl_tests.gni
index 6338d74..5d5ad22 100644
--- a/gn/sksl_tests.gni
+++ b/gn/sksl_tests.gni
@@ -187,6 +187,7 @@
   "/sksl/spirv/LayoutOutOfOrder.sksl",
   "/sksl/spirv/OpaqueTypeInArray.sksl",
   "/sksl/spirv/Ossfuzz35916.sksl",
+  "/sksl/spirv/Ossfuzz37627.sksl",
   "/sksl/workarounds/RewriteMatrixVectorMultiply.sksl",
   "/sksl/errors/Ossfuzz36850.sksl",
   "/sksl/errors/Ossfuzz37469.sksl",

resources/sksl/spirv/Ossfuzz37627.sksl

diff --git a/resources/sksl/spirv/Ossfuzz37627.sksl b/resources/sksl/spirv/Ossfuzz37627.sksl
new file mode 100644
index 0000000..c4cad2d
--- /dev/null
+++ b/resources/sksl/spirv/Ossfuzz37627.sksl
@@ -0,0 +1 @@
+void main(){uint x;-++x;}
\ No newline at end of file

src/sksl/codegen/SkSLSPIRVCodeGenerator.cpp

diff --git a/src/sksl/codegen/SkSLSPIRVCodeGenerator.cpp b/src/sksl/codegen/SkSLSPIRVCodeGenerator.cpp
index 194ced7..b30d250 100644
--- a/src/sksl/codegen/SkSLSPIRVCodeGenerator.cpp
+++ b/src/sksl/codegen/SkSLSPIRVCodeGenerator.cpp
@@ -2796,7 +2796,7 @@
         SpvId expr = this->writeExpression(*p.operand(), out);
         if (is_float(fContext, type)) {
             this->writeInstruction(SpvOpFNegate, typeId, result, expr, out);
-        } else if (is_signed(fContext, type)) {
+        } else if (is_signed(fContext, type) || is_unsigned(fContext, type)) {
             this->writeInstruction(SpvOpSNegate, typeId, result, expr, out);
         } else {
             SkDEBUGFAILF("unsupported prefix expression %s", p.description().c_str());

tests/sksl/spirv/Ossfuzz37627.asm.frag

diff --git a/tests/sksl/spirv/Ossfuzz37627.asm.frag b/tests/sksl/spirv/Ossfuzz37627.asm.frag
new file mode 100644
index 0000000..0e3aad5
--- /dev/null
+++ b/tests/sksl/spirv/Ossfuzz37627.asm.frag
@@ -0,0 +1,26 @@
+OpCapability Shader
+%1 = OpExtInstImport "GLSL.std.450"
+OpMemoryModel Logical GLSL450
+OpEntryPoint Fragment %main "main" %sk_Clockwise
+OpExecutionMode %main OriginUpperLeft
+OpName %sk_Clockwise "sk_Clockwise"
+OpName %main "main"
+OpName %x "x"
+OpDecorate %sk_Clockwise BuiltIn FrontFacing
+%bool = OpTypeBool
+%_ptr_Input_bool = OpTypePointer Input %bool
+%sk_Clockwise = OpVariable %_ptr_Input_bool Input
+%void = OpTypeVoid
+%7 = OpTypeFunction %void
+%uint = OpTypeInt 32 0
+%_ptr_Function_uint = OpTypePointer Function %uint
+%uint_1 = OpConstant %uint 1
+%main = OpFunction %void None %7
+%8 = OpLabel
+%x = OpVariable %_ptr_Function_uint Function
+%14 = OpLoad %uint %x
+%15 = OpIAdd %uint %14 %uint_1
+OpStore %x %15
+%12 = OpSNegate %uint %15
+OpReturn
+OpFunctionEnd