Fix invalid subtype for subgroup matrix.
When decoding an IR protobuf guard against an invalid subtype in a
subgroup matrix type.
Fixed: 447615953
Change-Id: Ic57b76b586c662774579ae355852d0ec0c22cc60
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/263855
Auto-Submit: dan sinclair <dsinclair@chromium.org>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
diff --git a/src/tint/lang/core/ir/binary/decode.cc b/src/tint/lang/core/ir/binary/decode.cc
index e5e8fa5..ef9e4f9 100644
--- a/src/tint/lang/core/ir/binary/decode.cc
+++ b/src/tint/lang/core/ir/binary/decode.cc
@@ -1011,11 +1011,15 @@
return mod_out_.Types().input_attachment(sub_type);
}
- const type::SubgroupMatrix* CreateTypeSubgroupMatrix(
- SubgroupMatrixKind kind,
- const pb::TypeSubgroupMatrix& subgroup_matrix) {
- return mod_out_.Types().subgroup_matrix(kind, Type(subgroup_matrix.sub_type()),
- subgroup_matrix.columns(), subgroup_matrix.rows());
+ const type::Type* CreateTypeSubgroupMatrix(SubgroupMatrixKind kind,
+ const pb::TypeSubgroupMatrix& subgroup_matrix) {
+ const auto el_ty = Type(subgroup_matrix.sub_type());
+ if (el_ty == nullptr) {
+ err_ << "invalid subtype for subgroup matrix\n";
+ return mod_out_.Types().invalid();
+ }
+ return mod_out_.Types().subgroup_matrix(kind, el_ty, subgroup_matrix.columns(),
+ subgroup_matrix.rows());
}
const type::Type* CreateTypeBuiltinStruct(pb::TypeBuiltinStruct builtin_struct_in) {
