wgslfuzz / darthshader

Apache License 2.0
26 stars 7 forks source link

Error: missing entry point definition #6

Open poopypootypants opened 1 month ago

poopypootypants commented 1 month ago

I managed to collect 2 days worth of crashes, and wrote a script to convert all the .ron files to wgsl and then to hlsl, however, when i tried to run them via ./dxc-3.7 <crashes>.hlsl -T ps_6_6 i am encountering the error missing entry point definition. In the wgsl files they were also missing the main function as well:

Example dump:

                struct S1493518634_ {
                    m0_: f32,
                    m1_: f32,
                    m2_: f32,
                }

                fn f2042714845_() {
                    loop {
                        let _e6 = degrees(mat2x2<f32>()[0]);
                        loop {
                            loop {
                                break;
                            }
                            let _e9 = vec2(_e6.y);
                            let _e16 = i32(select(f32(f32(f32())), mat2x2<f32>(_e9, _e9)[1].x, true));
                            continue;
                            continuing {
                                let _e20 = round(exp(mat2x2<f32>()[0])).xyyx;
                                let _e23 = select(_e20, _e20, true);
                                loop {
                                    continue;
                                    continuing {
                                        break if true;
                                    }
                                }
                                let _e28 = i32(_e23.w);
                                switch _e28 {
                                    case 268435456: {
                                    }
                                    case 268435457: {
                                    }
                                    case 268435458: {
                                    }
                                    case 268435459: {
                                    }
                                    default: {
                                    }
                                }
                                loop {
                                    let _e29 = select(false, false, false);
                                    if _e29 {
                                        break;
                                    } else {
                                        continue;
                                    }
                                    continuing {
                                        break if _e29;
                                    }
                                }
                                break if true;
                            }
                        }
                        continuing {
                            let _e5_ = inverseSqrt(1.1009969e18);
                            break if false;
                        }
                    }
                }

Is this an issue related to the dxcompiler as my compilation was successful but did not produce the libdxcompiler.so library

poopypootypants commented 1 month ago

Apologies, I realised I did not set the correct path for LD_LIBRARY_PATH=/.../darthshader/harnesses/dxcompiler/DirectXShaderCompiler/out/build/lib, and it is not that my compilation did not produce the libdxcompiler.so library.

As far as my testing goes, I am getting a bunch of crashes but they all have a recurring pattern of either of the following messages when I analyse them via dxc3.7:

error: condition for short-circuiting ternary operator must be scalar, for non-scalar types use 'select'

warning: code is unreachable
agoodm88 commented 1 month ago

Missing entrypoint definition; you need to specify -E in your dxc command. See issue 1 for a little triage script I hacked together.

I dont think that those crashes are 'interesting' per say. Or at least I am finding crashes like that within a few moments in my run. In my runs I am getting heap buffer overflows and invalid writes in some of the triages. Some of these can be replicated reliably; however the test cases are enormous and I can see no obvious path to minimizing them (eg HLSL files in the 200+MB range). As things stand needle+haystack issue exists for me.

poopypootypants commented 1 month ago

Thank you, that being said the crashes im getting are mainly just warning messages, is that an expected behaviour?

agoodm88 commented 1 month ago

I asked the same question in issue 1, no definitive answer just yet. I cant tell you the answer either but I observe similar behavior - most of the crashes appear to be caught errors.

wgslfuzz commented 1 month ago

Encountering testcases that produce a warning (but no crash) is something I'm observing as well. I never got around to investigate in-depth. In the past, I took all the crashes and attempted to reproduce standalone (one needs to ensure that tint/dxcompiler are built with ASAN as well). A little caveat: finding bugs that crash chrome with a memory safety violation got much harder since chrome ships a custom version of dxc with debug asserts enabled. I found 2 more bugs in fuzzing setup, reliable triggering an ASAN violation in dxc. However, in chrome both findings reach a ud2 instruction, the result of dxc reaching an assertion violation instead of violating memory safety somewhere later.