Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

runtime errors - localintermediate.h:100 #2222

Closed
mgerhardy opened this issue May 16, 2020 · 5 comments · Fixed by #2517
Closed

runtime errors - localintermediate.h:100 #2222

mgerhardy opened this issue May 16, 2020 · 5 comments · Fixed by #2517

Comments

@mgerhardy
Copy link

../../src/tools/glslang/glslang/MachineIndependent/localintermediate.h:100:8: runtime error: load of value 48, which is not a valid value for type 'bool'
../../src/tools/glslang/glslang/MachineIndependent/localintermediate.h:100:8: runtime error: load of value 229, which is not a valid value for type 'bool'
../../src/tools/glslang/glslang/MachineIndependent/localintermediate.h:100:8: runtime error: load of value 182, which is not a valid value for type 'bool'

The error disappears if I initialize those boolean values to false

@RuoyuAMD
Copy link
Contributor

Did you turn on the mandatory check for struct initialization in compile options?

@johnkslang
Copy link
Member

Making any changes there will hide the real defect. We'd want to know what line of code inappropriately used an uninitialized value. Or, switch to a different design.

@glebm
Copy link
Contributor

glebm commented Jan 30, 2021

A stack trace from ppsspp (obtained with UBSAN_OPTIONS=print_stacktrace=1):

../ext/glslang/glslang/MachineIndependent/localintermediate.h:100:8: runtime error: load of value 160, which is not a valid value for type 'bool'
    #0 0x55a130adc75f in glslang::TCall::TCall(glslang::TCall&&) ../ext/glslang/glslang/MachineIndependent/localintermediate.h:100
    #1 0x55a130adca11 in void __gnu_cxx::new_allocator<std::_List_node<glslang::TCall> >::construct<glslang::TCall, glslang::TCall>(glslang::TCall*, glslang::TCall&&) /usr/include/c++/10/ext/new_allocator.h:150
    #2 0x55a130adae07 in void std::allocator_traits<std::allocator<std::_List_node<glslang::TCall> > >::construct<glslang::TCall, glslang::TCall>(std::allocator<std::_List_node<glslang::TCall> >&, glslang::TCall*, glslang::TCall&&) /usr/include/c++/10/bits/alloc_traits.h:512
    #3 0x55a130ad8c98 in std::_List_node<glslang::TCall>* std::__cxx11::list<glslang::TCall, std::allocator<glslang::TCall> >::_M_create_node<glslang::TCall>(glslang::TCall&&) (/home/gleb/repos/glebm/ppsspp/build/PPSSPPSDL+0x39a3c98)
    #4 0x55a130ad45c6 in void std::__cxx11::list<glslang::TCall, std::allocator<glslang::TCall> >::_M_insert<glslang::TCall>(std::_List_iterator<glslang::TCall>, glslang::TCall&&) /usr/include/c++/10/bits/stl_list.h:1911
    #5 0x55a130ad1db7 in std::__cxx11::list<glslang::TCall, std::allocator<glslang::TCall> >::push_front(glslang::TCall&&) /usr/include/c++/10/bits/stl_list.h:1167
    #6 0x55a130ab29b4 in glslang::TIntermediate::addToCallGraph(TInfoSink&, std::__cxx11::basic_string<char, std::char_traits<char>, glslang::pool_allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, glslang::pool_allocator<char> > const&) ../ext/glslang/glslang/MachineIndependent/Intermediate.cpp:2860
    #7 0x55a130b00604 in glslang::TParseContext::handleFunctionCall(glslang::TSourceLoc const&, glslang::TFunction*, TIntermNode*) ../ext/glslang/glslang/MachineIndependent/ParseHelper.cpp:1229
    #8 0x55a130c58751 in yyparse(glslang::TParseContext*) MachineIndependent/glslang.y:449
    #9 0x55a130ae1bcf in glslang::TParseContext::parseShaderStrings(glslang::TPpContext&, glslang::TInputScanner&, bool) ../ext/glslang/glslang/MachineIndependent/ParseHelper.cpp:204
    #10 0x55a1308fbe36 in operator() ../ext/glslang/glslang/MachineIndependent/ShaderLang.cpp:1213
    #11 0x55a13090b13a in ProcessDeferred<(anonymous namespace)::DoFullParse> ../ext/glslang/glslang/MachineIndependent/ShaderLang.cpp:997
    #12 0x55a1308fc4ac in CompileDeferred ../ext/glslang/glslang/MachineIndependent/ShaderLang.cpp:1299
    #13 0x55a1309016d7 in glslang::TShader::parse(TBuiltInResource const*, int, EProfile, bool, bool, EShMessages, glslang::TShader::Includer&) ../ext/glslang/glslang/MachineIndependent/ShaderLang.cpp:1854
    #14 0x55a1303d59a3 in glslang::TShader::parse(TBuiltInResource const*, int, EProfile, bool, bool, EShMessages) ../ext/glslang/glslang/MachineIndependent/../Include/../Include/../Public/ShaderLang.h:600
    #15 0x55a130446081 in GLSLtoSPV(VkShaderStageFlagBits, char const*, GLSLVariant, std::vector<unsigned int, std::allocator<unsigned int> >&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*) ../Common/GPU/Vulkan/VulkanContext.cpp:1219
    #16 0x55a12fcecebc in VulkanFragmentShader::VulkanFragmentShader(VulkanContext*, FShaderID, char const*) ../GPU/Vulkan/ShaderManagerVulkan.cpp:56
    #17 0x55a12fcf2223 in ShaderManagerVulkan::LoadCache(_IO_FILE*) ../GPU/Vulkan/ShaderManagerVulkan.cpp:420
    #18 0x55a12fcc6b2b in GPU_Vulkan::LoadCache(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) ../GPU/Vulkan/GPU_Vulkan.cpp:137
    #19 0x55a12fcc3f2d in operator() ../GPU/Vulkan/GPU_Vulkan.cpp:110
    #20 0x55a12fcd0c94 in __invoke_impl<void, GPU_Vulkan::GPU_Vulkan(GraphicsContext*, Draw::DrawContext*)::<lambda()> > /usr/include/c++/10/bits/invoke.h:60
    #21 0x55a12fcd0b61 in __invoke<GPU_Vulkan::GPU_Vulkan(GraphicsContext*, Draw::DrawContext*)::<lambda()> > /usr/include/c++/10/bits/invoke.h:95
    #22 0x55a12fcd0a45 in _M_invoke<0> /usr/include/c++/10/thread:264
    #23 0x55a12fcd0988 in operator() /usr/include/c++/10/thread:271
    #24 0x55a12fcd0944 in _M_run /usr/include/c++/10/thread:215
    #25 0x7fb6c9b62d83  (/lib/x86_64-linux-gnu/libstdc++.so.6+0xd6d83)
    #26 0x7fb6c8f9c58f in start_thread nptl/pthread_create.c:463
    #27 0x7fb6c8ec2222 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x119222)

hrydgard/ppsspp#14014

@glebm
Copy link
Contributor

glebm commented Jan 30, 2021

This could be a red herring, because it looks like UBSAN issues this when the object is constructed and not when the field is first accessed.

@glebm
Copy link
Contributor

glebm commented Jan 30, 2021

This happens because inserting a value into the list is a copy, and it copies uninitialized bool which is backed by dword-size uninitialized memory.

glebm added a commit to glebm/glslang that referenced this issue Jan 30, 2021
UBSAN rightly complains on `push_front`:

    glslang/MachineIndependent/localintermediate.h:100:8: runtime error: load of value 160, which is not a valid value for type 'bool'
    #0 in glslang::TCall::TCall(glslang::TCall&&) glslang/MachineIndependent/localintermediate.h:100
    KhronosGroup#1 in void __gnu_cxx::new_allocator<std::_List_node<glslang::TCall> >::construct<glslang::TCall, glslang::TCall>(glslang::TCall*, glslang::TCall&&) /usr/include/c++/10/ext/new_allocator.h:150
    KhronosGroup#2 in void std::allocator_traits<std::allocator<std::_List_node<glslang::TCall> > >::construct<glslang::TCall, glslang::TCall>(std::allocator<std::_List_node<glslang::TCall> >&, glslang::TCall*, glslang::TCall&&) /usr/include/c++/10/bits/alloc_traits.h:512
    KhronosGroup#3 in std::_List_node<glslang::TCall>* std::__cxx11::list<glslang::TCall, std::allocator<glslang::TCall> >::_M_create_node<glslang::TCall>(glslang::TCall&&) (...)
    KhronosGroup#4 in void std::__cxx11::list<glslang::TCall, std::allocator<glslang::TCall> >::_M_insert<glslang::TCall>(std::_List_iterator<glslang::TCall>, glslang::TCall&&) /usr/include/c++/10/bits/stl_list.h:1911
    KhronosGroup#5 in std::__cxx11::list<glslang::TCall, std::allocator<glslang::TCall> >::push_front(glslang::TCall&&) /usr/include/c++/10/bits/stl_list.h:1167
    KhronosGroup#6 in glslang::TIntermediate::addToCallGraph(TInfoSink&, std::__cxx11::basic_string<char, std::char_traits<char>, glslang::pool_allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, glslang::pool_allocator<char> > const&) glslang/MachineIndependent/Intermediate.cpp:2860

What happens here:

1. TCall's bool fields are not initialized on construction.
2. `push_front` move the `TCall` passed into it.
3. The move constructor copies unitialized bool, which may have an
   out-of-range value.

What this fix does:

Calls `emplace_back` to ensure no copy/move constructor is called.

Fixes KhronosGroup#2222
Refs KhronosGroup#2112
glebm added a commit to glebm/glslang that referenced this issue Jan 30, 2021
UBSAN rightly complains on `push_front` here:

    glslang/MachineIndependent/localintermediate.h:100:8: runtime error: load of value 160, which is not a valid value for type 'bool'
    #0 in glslang::TCall::TCall(glslang::TCall&&) glslang/MachineIndependent/localintermediate.h:100
    KhronosGroup#1 in void __gnu_cxx::new_allocator<std::_List_node<glslang::TCall> >::construct<glslang::TCall, glslang::TCall>(glslang::TCall*, glslang::TCall&&) /usr/include/c++/10/ext/new_allocator.h:150
    KhronosGroup#2 in void std::allocator_traits<std::allocator<std::_List_node<glslang::TCall> > >::construct<glslang::TCall, glslang::TCall>(std::allocator<std::_List_node<glslang::TCall> >&, glslang::TCall*, glslang::TCall&&) /usr/include/c++/10/bits/alloc_traits.h:512
    KhronosGroup#3 in std::_List_node<glslang::TCall>* std::__cxx11::list<glslang::TCall, std::allocator<glslang::TCall> >::_M_create_node<glslang::TCall>(glslang::TCall&&) (...)
    KhronosGroup#4 in void std::__cxx11::list<glslang::TCall, std::allocator<glslang::TCall> >::_M_insert<glslang::TCall>(std::_List_iterator<glslang::TCall>, glslang::TCall&&) /usr/include/c++/10/bits/stl_list.h:1911
    KhronosGroup#5 in std::__cxx11::list<glslang::TCall, std::allocator<glslang::TCall> >::push_front(glslang::TCall&&) /usr/include/c++/10/bits/stl_list.h:1167
    KhronosGroup#6 in glslang::TIntermediate::addToCallGraph(TInfoSink&, std::__cxx11::basic_string<char, std::char_traits<char>, glslang::pool_allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, glslang::pool_allocator<char> > const&) glslang/MachineIndependent/Intermediate.cpp:2860

What happens here:

1. TCall's bool fields are not initialized on construction.
2. `push_front` move the `TCall` passed into it.
3. The move constructor copies unitialized bool, which may have an
   out-of-range value.

What this fix does:

Calls `emplace_back` to ensure no copy/move constructor is called.

Fixes KhronosGroup#2222
Refs KhronosGroup#2112
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants