Fix invalid variable ref-kind discovered by fuzzer.
No-op arithmetic simplification will convert expressions like `x += 0`
to `x`. When making this simplification, we will also downgrade the ref-
kind of `x` from "write" to "read" since the new expression is no longer
an assignment.
The fuzzer discovered that the ref-kind downgrade was too aggressive,
and would also traverse into nested subexpressions and downgrade them
as well. That is, for `x[y=z] += 0` would convert both `x` and `y`
into "read" references, which is incorrect; `y` is still being written
to.
The fuzzer managed to turn this mistake into an assertion by leveraging
a separate optimization. It added a leading, side-effect-less comma
expression for us to detect as worthless and eliminate. In doing so, we
clone the expression with the busted ref-kind, triggering an assertion.
Change-Id: I42fc31f6932f679ae875e2b49db2ad2f4e89e2cb
Bug: oss-fuzz:37677
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/442536
Auto-Submit: John Stiles <johnstiles@google.com>
Commit-Queue: Brian Osman <brianosman@google.com>
Reviewed-by: Brian Osman <brianosman@google.com>
diff --git a/src/sksl/SkSLConstantFolder.cpp b/src/sksl/SkSLConstantFolder.cpp
index 3de16af..3f7c8c3 100644
--- a/src/sksl/SkSLConstantFolder.cpp
+++ b/src/sksl/SkSLConstantFolder.cpp
@@ -293,7 +293,7 @@
case Token::Kind::TK_MINUSEQ:
if (is_constant_value(right, 0.0)) { // x += 0, x -= 0
std::unique_ptr<Expression> result = cast_expression(context, left, resultType);
- Analysis::UpdateRefKind(result.get(), VariableRefKind::kRead);
+ Analysis::UpdateVariableRefKind(result.get(), VariableRefKind::kRead);
return result;
}
break;
@@ -302,7 +302,7 @@
case Token::Kind::TK_SLASHEQ:
if (is_constant_value(right, 1.0)) { // x *= 1, x /= 1
std::unique_ptr<Expression> result = cast_expression(context, left, resultType);
- Analysis::UpdateRefKind(result.get(), VariableRefKind::kRead);
+ Analysis::UpdateVariableRefKind(result.get(), VariableRefKind::kRead);
return result;
}
break;