spirv-val: Untyped pointer shader crashes

[ziga-lunarg]

This is from the CTS test dEQP-VK.spirv_assembly.instruction.compute.untyped_pointers.vulkan_memory_model.physical_storage.op_bitcast.to_untyped.uint8

OpCapability Shader
OpCapability UntypedPointersKHR
OpCapability VulkanMemoryModel
OpCapability VulkanMemoryModelDeviceScopeKHR
OpCapability Int8
OpCapability PhysicalStorageBufferAddresses

OpExtension "SPV_KHR_storage_buffer_storage_class"
OpExtension "SPV_KHR_untyped_pointers"
OpExtension "SPV_KHR_vulkan_memory_model"
OpExtension "SPV_KHR_physical_storage_buffer"

OpMemoryModel PhysicalStorageBuffer64 Vulkan
OpEntryPoint GLCompute %main "main" %id
OpExecutionMode %main LocalSize 1 1 1
OpDecorate %id BuiltIn GlobalInvocationId
OpDecorate       %untyped_phys_ptr ArrayStride 1
OpDecorate       %data_buffer      Block
OpMemberDecorate %data_buffer      0 Offset 0
OpDecorate       %phys_ptrs_struct Block
OpMemberDecorate %phys_ptrs_struct 0 Offset 0
OpMemberDecorate %phys_ptrs_struct 1 Offset 8
OpDecorate       %all_data_var     DescriptorSet 0
OpDecorate       %all_data_var     Binding       0
%uint32     = OpTypeInt  32      0
%void         = OpTypeVoid
%bool         = OpTypeBool
%uint8  = OpTypeInt    8 0

%vec3_uint32  = OpTypeVector %uint32 3
%void_func   = OpTypeFunction %void
%c_uint32_0   = OpConstant %uint32 0
%c_uint32_1   = OpConstant %uint32 1
%c_uint32_2   = OpConstant %uint32 2
%c_uint32_4   = OpConstant %uint32 4
%c_uint32_8   = OpConstant %uint32 8
%c_uint32_16  = OpConstant %uint32 16
%c_uint32_32  = OpConstant %uint32 32
%c_uint32_64  = OpConstant %uint32 64
%c_uint32_264 = OpConstant %uint32 264

%uint32_input_ptr      = OpTypePointer Input %uint32
%vec3_uint32_input_ptr = OpTypePointer Input %vec3_uint32
%data_buffer   = OpTypeStruct %uint8
%untyped_phys_ptr                 = OpTypeUntypedPointerKHR PhysicalStorageBuffer
%uint8_phys_ptr             = OpTypePointer           PhysicalStorageBuffer %uint8
%data_buffer_phys_ptr             = OpTypePointer           PhysicalStorageBuffer %data_buffer
%data_buffer_phys_ptr_ptr         = OpTypePointer           StorageBuffer         %data_buffer_phys_ptr
%phys_ptrs_struct = OpTypeStruct %data_buffer_phys_ptr %data_buffer_phys_ptr
%phys_ptrs_struct_ptr = OpTypePointer StorageBuffer %phys_ptrs_struct
%all_data_var = OpVariable %phys_ptrs_struct_ptr  StorageBuffer
%id              = OpVariable           %vec3_uint32_input_ptr                            Input
%main       = OpFunction %void None %void_func
%label_main = OpLabel
%input_ptr  = OpAccessChain           %data_buffer_phys_ptr_ptr  %all_data_var %c_uint32_0
%input      = OpLoad                  %data_buffer_phys_ptr      %input_ptr
%input_loc  = OpAccessChain           %uint8_phys_ptr      %input        %c_uint32_0
%output_ptr = OpAccessChain            %data_buffer_phys_ptr_ptr %all_data_var %c_uint32_1
%output     = OpLoad                   %data_buffer_phys_ptr     %output_ptr
%output_loc = OpUntypedAccessChainKHR  %untyped_phys_ptr         %data_buffer  %output     %c_uint32_0
%bitcasted     = OpBitcast %untyped_phys_ptr     %input_loc
%bitcasted_val = OpLoad    %uint8          %bitcasted      Aligned 1
                 OpStore   %output_loc           %bitcasted_val  Aligned 1
                OpReturn
                OpFunctionEnd

If run with validation layers it will crash in:

#0 std::__throw_out_of_range_fmt (__fmt=0x7fffe2d64dd8 "vector::M_range_check: __n (which is %zu) >= this->size() (which is %zu)")
at ../../../../../src/libstdc++-v3/src/c++11/functexcept.cc:90
#1 0x00007fffe1fe9d5f in std::vector<spv_parsed_operand_t, std::allocator<spv_parsed_operand_t> >::M_range_check (this=0x555583734ee8, __n=2)
at /usr/include/c++/13/bits/stl_vector.h:1158
#2 0x00007fffe1fe8261 in std::vector<spv_parsed_operand_t, std::allocator<spv_parsed_operand_t> >::at (this=0x555583734ee8, __n=2) at /usr/include/c++/13/bits/stl_vector.h:1199
#3 0x00007fffe1fe6acf in spvtools::val::Instruction::GetOperandAs (this=0x555583734ed0, index=2)
at /home/nnn/Projects/Vulkan-ValidationLayers/external/Debug/64/SPIRV-Tools/source/val/instruction.h:103
#4 0x00007fffe20ce3ab in spvtools::val::(anonymous namespace)::CheckMemoryAccess (=..., inst=0x5555837357d8, index=3)
at /home/nnn/Projects/Vulkan-ValidationLayers/external/Debug/64/SPIRV-Tools/source/val/validate_memory.cpp:403
#5 0x00007fffe20d2152 in spvtools::val::(anonymous namespace)::ValidateLoad (=..., inst=0x5555837357d8)
at /home/nnn/Projects/Vulkan-ValidationLayers/external/Debug/64/SPIRV-Tools/source/val/validate_memory.cpp:1074
#6 0x00007fffe20de10d in spvtools::val::MemoryPass (_=..., inst=0x5555837357d8)
at /home/nnn/Projects/Vulkan-ValidationLayers/external/Debug/64/SPIRV-Tools/source/val/validate_memory.cpp:3018
#7 0x00007fffe1fe4e16 in spvtools::val::(anonymous namespace)::ValidateBinaryUsingContextAndValidationState (context=..., words=0x55556b0829a0, num_words=255,
pDiagnostic=0x7fffffffca58, vstate=0x7fffffffc290) at /home/nnn/Projects/Vulkan-ValidationLayers/external/Debug/64/SPIRV-Tools/source/val/validate.cpp:380
#8 0x00007fffe1fe5903 in spvValidateWithOptions (context=0x55558381b670, options=0x5555837225f0, binary=0x7fffffffcba0, pDiagnostic=0x7fffffffca58)
at /home/nnn/Projects/Vulkan-ValidationLayers/external/Debug/64/SPIRV-Tools/source/val/validate.cpp:506
#9 0x00007fffe0eb52b2 in CoreChecks::RunSpirvValidation (this=0x55558380a840, binary=..., loc=..., cache=0x55558383f440)
at /home/nnn/Projects/Vulkan-ValidationLayers/layers/core_checks/cc_spirv.cpp:2186
#10 0x00007fffe0eb5a4e in CoreChecks::ValidateShaderModuleCreateInfo (this=0x55558380a840, create_info=..., create_info_loc=...)
at /home/nnn/Projects/Vulkan-ValidationLayers/layers/core_checks/cc_spirv.cpp:2277
#11 0x00007fffe0eb5b50 in CoreChecks::PreCallValidateCreateShaderModule (this=0x55558380a840, device=0x55558382bd00, pCreateInfo=0x7fffffffcfd0, pAllocator=0x0,
pShaderModule=0x7fffffffcf68, error_obj=...) at /home/nnn/Projects/Vulkan-ValidationLayers/layers/core_checks/cc_spirv.cpp:2286
#12 0x00007fffe0b6227b in vulkan_layer_chassis::CreateShaderModule (device=0x55558382bd00, pCreateInfo=0x7fffffffcfd0, pAllocator=0x0, pShaderModule=0x7fffffffcf68)
at /home/nnn/Projects/Vulkan-ValidationLayers/layers/chassis/chassis_manual.cpp:876

[alan-baker]

@spencer-lunarg here's the case I was originally worried about in the wild. The problem is:

%36 = OpLoad %uchar %35 Aligned 1

This grabs the load pointer type which is:

%_ptr_PhysicalStorageBuffer = OpTypeUntypedPointerKHR PhysicalStorageBuffer

Then it attempts to get the largest scalar, but it cannot. Might need refactored a bit. The load and store cases can use the load result type and store object type respectively. Copy memory is more complicated.

[spencer-lunarg]

@ziga-lunarg thanks as always for giving me work, @alan-baker ok sounds good

Copy memory is more complicated.

Ya, OpCopyMemory worries me have the src and dst and made the code a bit more tangled

[alan-baker]

For OpCopyMemory, one of the operands must be typed so you can use that type. For OpCopyMemorySized there might be no real type info.