SPIR-V tools Crash in dEQP tests with ANGLE+SwiftShader test bots

[ianelliottus]

The latest SPIR-V tools causes crashes across multiple-OS's with ANGLE+SwiftShader.

For example, see: https://chromium-swarm.appspot.com/task?id=5eb82a81f5c2a410#dEQP-GLES2.functional.shaders.conditionals.if.input_conditional_assignment_to_matrix,dEQP-GLES2.functional.shaders.conditionals.if.uniform_conditional_assignment_to_matrix,dEQP-GLES2.functional.shaders.conditionals.if.input_conditional_assignment_to_matrix,dEQP-GLES2.functional.shaders.conditionals.if.uniform_conditional_assignment_to_matrix

This is part of the tests running on Linux: https://ci.chromium.org/p/angle/builders/try/linux-test/10005?

Which is part of an AutoRoller change, to take the latest SPIR-V Tools: https://chromium-review.googlesource.com/c/angle/angle/+/4046684?tab=checks

[ShabbyX]

The crash is in the optimizer, in the "CCPPass":

angle::PrintStackBacktrace() at crash_handler_posix.cpp:495
angle::Handler(int) at crash_handler_posix.cpp:655
killpg at ??:?
operator() at const_folding_rules.cpp:147
operator() at function.h:841
spvtools::opt::CCPPass::VisitAssignment(spvtools::opt::Instruction*) at ccp_pass.cpp:166
operator() at function.h:841
operator() at propagator.cpp:193
bool std::Cr::__function::__policy_invoker<bool (spvtools::opt::Instruction*)>::__call_impl<std::Cr::__function::__default_alloc_func<spvtools::opt::BasicBlock::ForEachInst(std::Cr::function<void (spvtools::opt::Instruction*)> const&, bool)::{lambda(spvtools::opt::Instruction*)#1}, bool (spvtools::opt::Instruction*)> >(std::Cr::__function::__policy_storage const*, spvtools::opt::Instruction*) at function.h:710
spvtools::opt::SSAPropagator::Simulate(spvtools::opt::BasicBlock*) at propagator.cpp:?
begin at __split_buffer:95
spvtools::opt::CCPPass::PropagateConstants(spvtools::opt::Function*) at ccp_pass.cpp:341
spvtools::opt::IRContext::ProcessCallTreeFromRoots(std::Cr::function<bool (spvtools::opt::Function*)>&, std::Cr::queue<unsigned int, std::Cr::deque<unsigned int, std::Cr::allocator<unsigned int> > >*) at ir_context.cpp:930
spvtools::opt::IRContext::ProcessReachableCallTree(std::Cr::function<bool (spvtools::opt::Function*)>&) at ir_context.cpp:915
spvtools::opt::CCPPass::Process() at ccp_pass.cpp:372
spvtools::opt::Pass::Run(spvtools::opt::IRContext*) at pass.cpp:37
spvtools::opt::PassManager::Run(spvtools::opt::IRContext*) at pass_manager.cpp:59
spvtools::Optimizer::Run(unsigned int const*, unsigned long, std::Cr::vector<unsigned int, std::Cr::allocator<unsigned int> >*, 

The range must be 54cd5e1..1a7f71a

[alan-baker]

I would guess #4943. @spencer-lunarg can you take a look?

[spencer-lunarg]

operator() at const_folding_rules.cpp:147

That would be the OpSpecConstantOp %_ CompositeInsert logic I added... will fix this

[spencer-lunarg]

@ianelliottus or @ShabbyX is it possible to get me the SPIR-V that ANGLE is producing that is crashing this, other can try getting CTS/ANGLE up to reproduce this

[sugoi1]

We're also impacted by this issue, I've printed out the SPIR-V from this test:

; Version: 1.0
; Generator: Google ANGLE Shader Compiler; 1
; Bound: 124
; Schema: 0
OpCapability Shader
%1 = OpExtInstImport "GLSL.std.450"
OpMemoryModel Logical GLSL450
OpEntryPoint Vertex %91 "main" %5 %7 %9 %35 %74 %75
OpSource GLSL 450
OpName %5 "_udEQP_Position"
OpName %7 "_uin0"
OpName %9 "_uFragVarying"
OpName %15 "ANGLEUniformBlock"
OpMemberName %15 0 "acbBufferOffsets"
OpMemberName %15 1 "depthRange"
OpMemberName %15 2 "renderArea"
OpMemberName %15 3 "flipXY"
OpMemberName %15 4 "dither"
OpMemberName %15 5 "misc"
OpMemberName %15 6 "xfbBufferOffsets"
OpMemberName %15 7 "xfbVerticesPerInstance"
OpMemberName %15 8 "unused"
OpMemberName %15 9 "unused2"
OpName %17 "ANGLEUniforms"
OpMemberName %19 0 "xfbOut"
OpMemberName %22 0 "xfbOut"
OpMemberName %25 0 "xfbOut"
OpMemberName %28 0 "xfbOut"
OpName %33 "gl_PerVertex"
OpMemberName %33 0 "gl_Position"
OpName %35 ""
OpName %38 "position"
OpName %37 "ANGLETransformPosition"
OpName %67 "ANGLECaptureXfb"
OpName %71 "strides"
OpName %70 "ANGLEGetXfbOffsets"
OpName %74 "gl_VertexIndex"
OpName %75 "gl_InstanceIndex"
OpName %91 "main"
OpName %96 "_uprojectionMatrix"
OpDecorate %5 Location 0
OpDecorate %7 Location 1
OpDecorate %9 RelaxedPrecision
OpDecorate %9 Location 0
OpMemberDecorate %15 0 Offset 0
OpMemberDecorate %15 1 Offset 8
OpMemberDecorate %15 2 Offset 16
OpMemberDecorate %15 3 Offset 20
OpMemberDecorate %15 4 Offset 24
OpMemberDecorate %15 5 Offset 28
OpMemberDecorate %15 6 Offset 32
OpMemberDecorate %15 7 Offset 48
OpMemberDecorate %15 8 Offset 52
OpMemberDecorate %15 9 Offset 56
OpDecorate %15 Block
OpDecorate %18 ArrayStride 4
OpMemberDecorate %19 0 Offset 0
OpDecorate %19 BufferBlock
OpMemberDecorate %22 0 Offset 0
OpDecorate %22 BufferBlock
OpMemberDecorate %25 0 Offset 0
OpDecorate %25 BufferBlock
OpMemberDecorate %28 0 Offset 0
OpDecorate %28 BufferBlock
OpMemberDecorate %33 0 BuiltIn Position
OpDecorate %33 Block
OpDecorate %57 RelaxedPrecision
OpDecorate %58 RelaxedPrecision
OpDecorate %74 BuiltIn VertexIndex
OpDecorate %75 BuiltIn InstanceIndex
%2 = OpTypeFloat 32
%3 = OpTypeVector %2 4
%10 = OpTypeInt 32 0
%11 = OpTypeVector %10 2
%12 = OpTypeVector %2 2
%13 = OpTypeInt 32 1
%14 = OpTypeVector %13 4
%15 = OpTypeStruct %11 %12 %10 %10 %10 %10 %14 %13 %10 %11
%18 = OpTypeRuntimeArray %2
%19 = OpTypeStruct %18
%22 = OpTypeStruct %18
%25 = OpTypeStruct %18
%28 = OpTypeStruct %18
%31 = OpConstant %10 8
%32 = OpTypeArray %2 %31
%33 = OpTypeStruct %3
%40 = OpConstant %10 1
%41 = OpConstant %10 5
%46 = OpTypeBool
%48 = OpConstantNull %10
%49 = OpTypeVector %46 2
%54 = OpConstant %10 3
%65 = OpTypeVoid
%77 = OpConstant %10 7
%86 = OpConstant %10 6
%93 = OpTypeMatrix %12 2
%94 = OpConstantNull %93
%97 = OpConstant %2 1
%102 = OpConstant %10 0
%105 = OpConstant %2 0
%114 = OpTypePointer Private %3
%4 = OpTypePointer Input %3
%115 = OpTypePointer Private %2
%6 = OpTypePointer Input %2
%116 = OpTypePointer Private %2
%8 = OpTypePointer Output %2
%16 = OpTypePointer PushConstant %15
%20 = OpTypePointer Uniform %19
%23 = OpTypePointer Uniform %22
%26 = OpTypePointer Uniform %25
%29 = OpTypePointer Uniform %28
%34 = OpTypePointer Output %33
%42 = OpTypePointer PushConstant %10
%117 = OpTypePointer Private %13
%73 = OpTypePointer Input %13
%78 = OpTypePointer PushConstant %13
%87 = OpTypePointer PushConstant %14
%95 = OpTypePointer Function %93
%103 = OpTypePointer Function %2
%118 = OpTypePointer Private %3
%111 = OpTypePointer Output %3
%36 = OpTypeFunction %3 %3
%66 = OpTypeFunction %65
%69 = OpTypeFunction %14 %14
%5 = OpVariable %4 Input
%7 = OpVariable %6 Input
%9 = OpVariable %8 Output
%17 = OpVariable %16 PushConstant
%35 = OpVariable %34 Output
%74 = OpVariable %73 Input
%75 = OpVariable %73 Input
%119 = OpConstant %13 0
%120 = OpConstant %2 0.5
%37 = OpFunction %3 None %36
%38 = OpFunctionParameter %3
%39 = OpLabel
%43 = OpAccessChain %42 %17 %41
%44 = OpLoad %10 %43
%45 = OpBitwiseAnd %10 %44 %40
%47 = OpINotEqual %46 %45 %48
%50 = OpCompositeConstruct %49 %47 %47
%51 = OpVectorShuffle %12 %38 %38 1 0
%52 = OpVectorShuffle %12 %38 %38 0 1
%53 = OpSelect %12 %50 %51 %52
%55 = OpAccessChain %42 %17 %54
%56 = OpLoad %10 %55
%57 = OpExtInst %3 %1 UnpackSnorm4x8 %56
%58 = OpVectorShuffle %12 %57 %57 2 3
%59 = OpFMul %12 %53 %58
%60 = OpCompositeExtract %2 %38 2
%61 = OpCompositeExtract %2 %38 3
%62 = OpCompositeExtract %2 %59 0
%63 = OpCompositeExtract %2 %59 1
%64 = OpCompositeConstruct %3 %62 %63 %60 %61
OpReturnValue %64
OpFunctionEnd
%67 = OpFunction %65 None %66
%68 = OpLabel
OpReturn
OpFunctionEnd
%70 = OpFunction %14 None %69
%71 = OpFunctionParameter %14
%72 = OpLabel
%76 = OpLoad %13 %75
%79 = OpAccessChain %78 %17 %77
%80 = OpLoad %13 %79
%81 = OpIMul %13 %76 %80
%82 = OpLoad %13 %74
%83 = OpIAdd %13 %82 %81
%85 = OpCompositeConstruct %14 %83 %83 %83 %83
%84 = OpIMul %14 %85 %71
%88 = OpAccessChain %87 %17 %86
%89 = OpLoad %14 %88
%90 = OpIAdd %14 %89 %84
OpReturnValue %90
OpFunctionEnd
%91 = OpFunction %65 None %66
%92 = OpLabel
%96 = OpVariable %95 Function %94
%98 = OpLoad %2 %7
%99 = OpFOrdEqual %46 %98 %97
OpSelectionMerge %101 None
OpBranchConditional %99 %100 %101
%100 = OpLabel
%104 = OpAccessChain %103 %96 %102 %102
OpStore %104 %97
OpBranch %101
%101 = OpLabel
OpStore %9 %97
%106 = OpAccessChain %103 %96 %40 %102
%107 = OpLoad %2 %106
%108 = OpCompositeConstruct %3 %107 %105 %105 %105
%109 = OpLoad %3 %5
%110 = OpFAdd %3 %109 %108
%112 = OpAccessChain %111 %35 %102
OpStore %112 %110
%113 = OpFunctionCall %65 %67
%121 = OpAccessChain %111 %35 %119
%122 = OpLoad %3 %121
%123 = OpFunctionCall %3 %37 %122
OpStore %121 %123
OpReturn
OpFunctionEnd

[spencer-lunarg]

Thanks for the shader, I see the issue is one the passes before CCPPass created a OpCompositeInsert with the Composite of OpConstantNull which I didn't know was valid. Will push up a PR to fix and a regression test with it

[sugoi1]

The fix for this issue does fix the crash, but we still have failures, detailed in #5005.