commit 481b2ed959fff0497fb12762c8a243a5c5349593
author dan sinclair <dsinclair@chromium.org> Thu Oct 20 14:56:45 2022 +0000
committer Dawn LUCI CQ <dawn-scoped@luci-project-accounts.iam.gserviceaccount.com> Thu Oct 20 14:56:45 2022 +0000
tree dacd9235ddd66267aa46a4f0c0ccffe8b5fc6117
parent 882b38a2f50829e1205c8b7bd955c438a44d78a7

Fix issue resolving address of numeric.

This CL fixes up a clusterfuzz issue where the address of a
numeric was take in a case selector leading to a nullptr.

Bug: chromium:1376865
Change-Id: I3b78a17e1c47263e18d2d272ff28c2cc8be79a0e
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/106540
Auto-Submit: Dan Sinclair <dsinclair@chromium.org>
Reviewed-by: Antonio Maiorano <amaiorano@google.com>
Commit-Queue: Dan Sinclair <dsinclair@chromium.org>
Kokoro: Kokoro <noreply+kokoro@google.com>

src/tint/resolver/resolver.cc

diff --git a/src/tint/resolver/resolver.cc b/src/tint/resolver/resolver.cc
index 0f558b8..bbabef7 100644
--- a/src/tint/resolver/resolver.cc
+++ b/src/tint/resolver/resolver.cc
@@ -3113,6 +3113,9 @@
                     continue;
                 }
                 auto* sem_expr = Expression(sel->expr);
+                if (!sem_expr) {
+                    return false;
+                }
                 types.Push(sem_expr->Type()->UnwrapRef());
             }
         }

src/tint/resolver/resolver_test.cc

diff --git a/src/tint/resolver/resolver_test.cc b/src/tint/resolver/resolver_test.cc
index 97f5020..5495356 100644
--- a/src/tint/resolver/resolver_test.cc
+++ b/src/tint/resolver/resolver_test.cc
@@ -135,6 +135,14 @@
     EXPECT_EQ(sem->Cases()[1]->Selectors().size(), 1u);
 }
 
+TEST_F(ResolverTest, Stmt_Case_AddressOf_Invalid) {
+    auto* cond_var = Var("i", ty.i32());
+    WrapInFunction(cond_var, Switch("i", Case(CaseSelector(AddressOf(1_a)), Block())));
+
+    EXPECT_FALSE(r()->Resolve());
+    EXPECT_EQ(r()->error(), "error: cannot take the address of expression");
+}
+
 TEST_F(ResolverTest, Stmt_Block) {
     auto* v = Var("v", ty.f32());
     auto* lhs = Expr("v");