Skip to content

[SPIR-V] Fixed a crash if encounter constant buffer fields with overlapping register assignments #7636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 21, 2025

Conversation

iOrange
Copy link
Contributor

@iOrange iOrange commented Jul 10, 2025

The issue:
simple vertex shader like so

uniform float4x4 gMVP : register(c0);
uniform float4   gFoo : register(c5);
uniform float4   gBar : register(c5);

float4 main(float4 pos : POSITION) : SV_Position {
    return mul(gMVP, pos * gFoo + gBar);
}

will result in an internal crash

dxc.exe -spirv -T vs_6_2 -E main test.hlsl -Fo test.spirv
Internal compiler error: access violation. Attempted to read from address 0x0000000000000000

Due to LowerTypeVisitor trying to assign offsets to fields without explicit locations.
It'll sort fields first, which will fill the map with the fields first. And since it's using std::map - if there's fields with the same register number - it'll only insert first, other will be left out, resulting nullptrs in the output vector.
We read the content of the vector down the road crashing.

My change fixes the crash and tries to output somewhat useful info about compilation fail.

I hope this helps you in fixing it properly, or you can take it as it is.

Copy link
Contributor

github-actions bot commented Jul 10, 2025

✅ With the latest revision this PR passed the C/C++ code formatter.

@iOrange
Copy link
Contributor Author

iOrange commented Jul 10, 2025

@microsoft-github-policy-service agree

Copy link
Collaborator

@s-perron s-perron left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@s-perron s-perron requested a review from Keenuts July 11, 2025 19:06
@s-perron
Copy link
Collaborator

/AzurePipelines run

Copy link

Azure Pipelines successfully started running 1 pipeline(s).

Copy link
Collaborator

@Keenuts Keenuts left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the fix! LGTM, but will require a test before approval/merging 😊

@iOrange
Copy link
Contributor Author

iOrange commented Jul 16, 2025

Sorry for the delay - fixed formatting and added a test

@Keenuts
Copy link
Collaborator

Keenuts commented Jul 17, 2025

Sorry I forgot to check this during the initial review, but seems like we have a behavior divergence between SPIR-V and DXIL. I think what you implemented is correct but need to double check in case that's a known HLSL weirdness.

@spall : is DXIL allowing an overlap expected or a bug?

// RUN: %dxc -T vs_6_6 -E vs_main %s -O3
// RUN: %dxc -T vs_6_6 -E vs_main %s -O3 -spirv

uniform float4x4 gMVP : register(c0);
uniform float4 gFoo : register(c0);

float4 vs_main(float4 pos : POSITION) : SV_Position {
  return mul(gMVP, pos * gFoo);
}
; cbuffer $Globals
; {
;
;   struct hostlayout.$Globals
;   {
;
;       column_major float4x4 gMVP;                   ; Offset:    0
;       float4 gFoo;                                  ; Offset:    0
;
;   } $Globals;                                       ; Offset:    0 Size:    64
;
; }

@Keenuts
Copy link
Collaborator

Keenuts commented Jul 17, 2025

/AzurePipelines run

Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@iOrange
Copy link
Contributor Author

iOrange commented Jul 17, 2025

Sorry I forgot to check this during the initial review, but seems like we have a behavior divergence between SPIR-V and DXIL. I think what you implemented is correct but need to double check in case that's a known HLSL weirdness.

@spall : is DXIL allowing an overlap expected or a bug?

// RUN: %dxc -T vs_6_6 -E vs_main %s -O3
// RUN: %dxc -T vs_6_6 -E vs_main %s -O3 -spirv

uniform float4x4 gMVP : register(c0);
uniform float4 gFoo : register(c0);

float4 vs_main(float4 pos : POSITION) : SV_Position {
  return mul(gMVP, pos * gFoo);
}
; cbuffer $Globals
; {
;
;   struct hostlayout.$Globals
;   {
;
;       column_major float4x4 gMVP;                   ; Offset:    0
;       float4 gFoo;                                  ; Offset:    0
;
;   } $Globals;                                       ; Offset:    0 Size:    64
;
; }

Hi @Keenuts,

This is the separate DXC issue I've came across - it detects registers overlap, but not if it overlaps with the array. I was going to dive into that one separately.

@tex3d
Copy link
Contributor

tex3d commented Jul 17, 2025

Sorry I forgot to check this during the initial review, but seems like we have a behavior divergence between SPIR-V and DXIL. I think what you implemented is correct but need to double check in case that's a known HLSL weirdness.
@spall : is DXIL allowing an overlap expected or a bug?

// RUN: %dxc -T vs_6_6 -E vs_main %s -O3
// RUN: %dxc -T vs_6_6 -E vs_main %s -O3 -spirv

uniform float4x4 gMVP : register(c0);
uniform float4 gFoo : register(c0);

float4 vs_main(float4 pos : POSITION) : SV_Position {
  return mul(gMVP, pos * gFoo);
}
; cbuffer $Globals
; {
;
;   struct hostlayout.$Globals
;   {
;
;       column_major float4x4 gMVP;                   ; Offset:    0
;       float4 gFoo;                                  ; Offset:    0
;
;   } $Globals;                                       ; Offset:    0 Size:    64
;
; }

Hi @Keenuts,

This is the separate DXC issue I've came across - it detects registers overlap, but not if it overlaps with the array. I was going to dive into that one separately.

Yes, this is a DXC bug. Some of the corner cases for register bindings are broken in DXC, and this is one of them.

Copy link
Collaborator

@Keenuts Keenuts left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, LGTM then!

@s-perron
Copy link
Collaborator

/AzurePipelines run

@s-perron s-perron enabled auto-merge (squash) July 21, 2025 16:17
Copy link

Azure Pipelines successfully started running 1 pipeline(s).

@s-perron s-perron merged commit 020fbdf into microsoft:main Jul 21, 2025
12 checks passed
@github-project-automation github-project-automation bot moved this from New to Done in HLSL Roadmap Jul 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

4 participants