commit cdf75d78ae2e5860799f85477f174416a90613d4
author Ryan Harrison <rharrison@chromium.org> Tue Jun 04 22:23:41 2024 +0000
committer Dawn LUCI CQ <dawn-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Jun 04 22:23:41 2024 +0000
tree b13acf064f564ae5b610993fc3a6f3d84f904d1c
parent d3c95f5a9d7f893d8e2cb47e087144891a2dae42

Reject OOB index access that are being washed through a ref

Fixes: 343762297
Change-Id: I67bf958e91cddf99ceb4d84d925562ca76ad7d41
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/191423
Commit-Queue: dan sinclair <dsinclair@chromium.org>
Auto-Submit: Ryan Harrison <rharrison@chromium.org>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: dan sinclair <dsinclair@chromium.org>

src/tint/lang/core/constant/eval.cc

diff --git a/src/tint/lang/core/constant/eval.cc b/src/tint/lang/core/constant/eval.cc
index a8e1f84..58beeca 100644
--- a/src/tint/lang/core/constant/eval.cc
+++ b/src/tint/lang/core/constant/eval.cc
@@ -1394,7 +1394,7 @@
                          const core::type::Type* obj_ty,
                          const Value* idx_val,
                          const Source& idx_source) {
-    auto el = obj_ty->UnwrapRef()->Elements();
+    auto el = obj_ty->UnwrapPtrOrRef()->Elements();
 
     AInt idx = idx_val->ValueAs<AInt>();
     if (idx < 0 || (el.count > 0 && idx >= el.count)) {

src/tint/lang/core/constant/eval_indexing_test.cc

diff --git a/src/tint/lang/core/constant/eval_indexing_test.cc b/src/tint/lang/core/constant/eval_indexing_test.cc
index b27a053..f764e24 100644
--- a/src/tint/lang/core/constant/eval_indexing_test.cc
+++ b/src/tint/lang/core/constant/eval_indexing_test.cc
@@ -64,6 +64,26 @@
     EXPECT_EQ(r()->error(), "12:34 error: index -3 out of bounds [0..2]");
 }
 
+TEST_F(ConstEvalTest, Vec3_Index_Via_Ptr_OOB_High) {
+    auto* a = Var("a", ty.vec3(ty.i32()));
+    auto* p = Let("p", ty.ptr(function, ty.vec3(ty.i32())), AddressOf(a));
+    auto* expr = IndexAccessor("p", Expr(Source{{12, 34}}, 12_i));
+    WrapInFunction(a, p, expr);
+
+    EXPECT_FALSE(r()->Resolve()) << r()->error();
+    EXPECT_EQ(r()->error(), "12:34 error: index 12 out of bounds [0..2]");
+}
+
+TEST_F(ConstEvalTest, Vec3_Index_Via_Ptr_OOB_Low) {
+    auto* a = Var("a", ty.vec3(ty.i32()));
+    auto* p = Let("p", ty.ptr(function, ty.vec3(ty.i32())), AddressOf(a));
+    auto* expr = IndexAccessor("p", Expr(Source{{12, 34}}, -3_i));
+    WrapInFunction(a, p, expr);
+
+    EXPECT_FALSE(r()->Resolve()) << r()->error();
+    EXPECT_EQ(r()->error(), "12:34 error: index -3 out of bounds [0..2]");
+}
+
 namespace Swizzle {
 struct Case {
     Value input;