commit 5b68c1266eb91bd29c26751a820919f1afa31260
author Tint team <no-reply@google.com> Wed Jun 05 13:25:44 2024 +0000
committer Tint LUCI CQ <tint-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed Jun 05 13:25:44 2024 +0000
tree e44b2933b511fb4a1e6c36e42f612e2afb955bb1
parent c3ebebf6ffaea00e7f2f877b3dcde84d4f43347e

Import Tint changes from Dawn

Changes:
  - cdf75d78ae2e5860799f85477f174416a90613d4 Reject OOB index access that are being washed through a ref by Ryan Harrison <rharrison@chromium.org>
GitOrigin-RevId: cdf75d78ae2e5860799f85477f174416a90613d4
Change-Id: If931e87e9c942bbad547fa84cfbd130706f73004
Reviewed-on: https://dawn-review.googlesource.com/c/tint/+/191764
Kokoro: Kokoro <noreply+kokoro@google.com>
Reviewed-by: James Price <jrprice@google.com>
Commit-Queue: James Price <jrprice@google.com>

src/tint/lang/core/constant/eval.cc

diff --git a/src/tint/lang/core/constant/eval.cc b/src/tint/lang/core/constant/eval.cc
index a8e1f84..58beeca 100644
--- a/src/tint/lang/core/constant/eval.cc
+++ b/src/tint/lang/core/constant/eval.cc
@@ -1394,7 +1394,7 @@
                          const core::type::Type* obj_ty,
                          const Value* idx_val,
                          const Source& idx_source) {
-    auto el = obj_ty->UnwrapRef()->Elements();
+    auto el = obj_ty->UnwrapPtrOrRef()->Elements();
 
     AInt idx = idx_val->ValueAs<AInt>();
     if (idx < 0 || (el.count > 0 && idx >= el.count)) {

src/tint/lang/core/constant/eval_indexing_test.cc

diff --git a/src/tint/lang/core/constant/eval_indexing_test.cc b/src/tint/lang/core/constant/eval_indexing_test.cc
index b27a053..f764e24 100644
--- a/src/tint/lang/core/constant/eval_indexing_test.cc
+++ b/src/tint/lang/core/constant/eval_indexing_test.cc
@@ -64,6 +64,26 @@
     EXPECT_EQ(r()->error(), "12:34 error: index -3 out of bounds [0..2]");
 }
 
+TEST_F(ConstEvalTest, Vec3_Index_Via_Ptr_OOB_High) {
+    auto* a = Var("a", ty.vec3(ty.i32()));
+    auto* p = Let("p", ty.ptr(function, ty.vec3(ty.i32())), AddressOf(a));
+    auto* expr = IndexAccessor("p", Expr(Source{{12, 34}}, 12_i));
+    WrapInFunction(a, p, expr);
+
+    EXPECT_FALSE(r()->Resolve()) << r()->error();
+    EXPECT_EQ(r()->error(), "12:34 error: index 12 out of bounds [0..2]");
+}
+
+TEST_F(ConstEvalTest, Vec3_Index_Via_Ptr_OOB_Low) {
+    auto* a = Var("a", ty.vec3(ty.i32()));
+    auto* p = Let("p", ty.ptr(function, ty.vec3(ty.i32())), AddressOf(a));
+    auto* expr = IndexAccessor("p", Expr(Source{{12, 34}}, -3_i));
+    WrapInFunction(a, p, expr);
+
+    EXPECT_FALSE(r()->Resolve()) << r()->error();
+    EXPECT_EQ(r()->error(), "12:34 error: index -3 out of bounds [0..2]");
+}
+
 namespace Swizzle {
 struct Case {
     Value input;