[tint][ir] Handle `alignment` of 0 instead of DBZ in `RoundUp`
Recently the checks for alignment and size of elements/members were
removed from the binary decoder, because fundamentally it was a check
that is being duplicated in the validator and thought to be unneeded.
The fuzzer found that these were actually slightly load bearing, since
alignment = 0 will lead to a div by zero in `RoundUp`. When this type
of alignment occurs, either it is a malformed shader that should be
rejected by the validator or an opaque type is being used and there is
special handling for it.
This CL adds a guard to `RoundUp` to just return the initial value if
being asked to round with an alignment of 0.
Fixes: 421228420
Change-Id: I3ff7c542fd4256df3a62e22b58d86d7a3694e031
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/244835
Auto-Submit: Ryan Harrison <rharrison@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: James Price <jrprice@google.com>
Commit-Queue: James Price <jrprice@google.com>
diff --git a/src/tint/utils/math/math.h b/src/tint/utils/math/math.h
index 5a4dc7f..2b8660b 100644
--- a/src/tint/utils/math/math.h
+++ b/src/tint/utils/math/math.h
@@ -37,11 +37,11 @@
/// @param alignment the next multiple to round `value` to
/// @param value the value to round to the next multiple of `alignment`
-/// @return `value` rounded to the next multiple of `alignment`
-/// @note `alignment` must be positive. An alignment of zero will cause a DBZ.
+/// @return `value` rounded to the next multiple of `alignment`, or `value` if `alignment` is 0
+/// @note `alignment` must be positive.
template <typename T>
inline constexpr T RoundUp(T alignment, T value) {
- return ((value + alignment - 1) / alignment) * alignment;
+ return alignment != 0 ? ((value + alignment - 1) / alignment) * alignment : value;
}
/// @param value the value to check whether it is a power-of-two
