commit 2a11f365bcb853e20d3a2ad0cc82ac27ee0c008e
author Steven Perron <stevenperron@google.com> Wed Sep 25 17:42:58 2019 -0400
committer GitHub <noreply@github.com> Wed Sep 25 17:42:58 2019 -0400
tree 6ef4fa2f8aae5378b610c332454fd057e87875ee
parent 70097c776125fc311bf39df9fa9729c8dbc6ca8c

Handle id overflow in wrap-opkill (#2916)

New code in wrap-opkill does not handle id overflow correctly.  We fix that up.

Fixes https://crbug.com/1007144

source/opt/wrap_opkill.cpp

diff --git a/source/opt/wrap_opkill.cpp b/source/opt/wrap_opkill.cpp
index fb32178..76714d6 100644
--- a/source/opt/wrap_opkill.cpp
+++ b/source/opt/wrap_opkill.cpp
@@ -60,13 +60,23 @@
     return false;
   }
 
+  Instruction* return_inst = nullptr;
   uint32_t return_type_id = GetOwningFunctionsReturnType(inst);
   if (return_type_id != GetVoidTypeId()) {
     Instruction* undef = ir_builder.AddNullaryOp(return_type_id, SpvOpUndef);
-    ir_builder.AddUnaryOp(0, SpvOpReturnValue, undef->result_id());
+    if (undef == nullptr) {
+      return false;
+    }
+    return_inst =
+        ir_builder.AddUnaryOp(0, SpvOpReturnValue, undef->result_id());
   } else {
-    ir_builder.AddNullaryOp(0, SpvOpReturn);
+    return_inst = ir_builder.AddNullaryOp(0, SpvOpReturn);
   }
+
+  if (return_inst == nullptr) {
+    return false;
+  }
+
   context()->KillInst(inst);
   return true;
 }

test/opt/wrap_opkill_test.cpp

diff --git a/test/opt/wrap_opkill_test.cpp b/test/opt/wrap_opkill_test.cpp
index 7e502be..89022ae 100644
--- a/test/opt/wrap_opkill_test.cpp
+++ b/test/opt/wrap_opkill_test.cpp
@@ -338,6 +338,46 @@
   EXPECT_EQ(Pass::Status::Failure, std::get<1>(result));
 }
 
+TEST_F(WrapOpKillTest, IdBoundOverflow5) {
+  const std::string text = R"(
+               OpCapability Shader
+               OpMemoryModel Logical GLSL450
+               OpEntryPoint Fragment %4 "main"
+               OpExecutionMode %4 OriginUpperLeft
+               OpDecorate %void Location 539091968
+       %void = OpTypeVoid
+          %3 = OpTypeFunction %void
+      %float = OpTypeFloat 32
+  %_struct_7 = OpTypeStruct %float %float
+  %_struct_8 = OpTypeStruct %_struct_7
+%_ptr_Function__struct_8 = OpTypePointer Function %_struct_8
+%_ptr_Output_float = OpTypePointer Output %float
+         %18 = OpTypeFunction %_struct_7 %_ptr_Function__struct_8
+          %4 = OpFunction %void Inline|Pure|Const %3
+     %850212 = OpLabel
+         %10 = OpVariable %_ptr_Function__struct_8 Function
+    %1441807 = OpFunctionCall %_struct_7 %32257 %10
+               OpKill
+               OpFunctionEnd
+      %32257 = OpFunction %_struct_7 None %18
+         %28 = OpLabel
+               OpUnreachable
+               OpFunctionEnd
+      %64821 = OpFunction %_struct_7 Inline %18
+    %4194295 = OpLabel
+               OpKill
+               OpFunctionEnd
+  )";
+
+  SetAssembleOptions(SPV_TEXT_TO_BINARY_OPTION_PRESERVE_NUMERIC_IDS);
+
+  std::vector<Message> messages = {
+      {SPV_MSG_ERROR, "", 0, 0, "ID overflow. Try running compact-ids."}};
+  SetMessageConsumer(GetTestMessageConsumer(messages));
+  auto result = SinglePassRunToBinary<WrapOpKill>(text, true);
+  EXPECT_EQ(Pass::Status::Failure, std::get<1>(result));
+}
+
 }  // namespace
 }  // namespace opt
 }  // namespace spvtools