[SPIR-V] Silent compiler crash when using GetAttributeAtVertex

[Dredhog]

Title

Silent compiler crash when using GetAttributeAtVertex

Functional impact

Compiler crashes, no result gets printed to stdout.

Minimal repro steps

1. Compile repro_shader.txt with dxc.exe -E frag -T ps_6_1 repro_shader.txt -spirv

struct PSInput
{
	float4 position : SV_POSITION;
	nointerpolation float3 color : COLOR;
};

cbuffer constants : register(b0)
{
	float4 g_constants;
}

float4 frag(PSInput input) : SV_TARGET
{
	uint cmp = (uint)(g_constants[0]);

	float colorAtV0 = GetAttributeAtVertex(input.color, 0)[cmp];
	float colorAtV1 = GetAttributeAtVertex(input.color, 1)[cmp];
	float colorAtV2 = GetAttributeAtVertex(input.color, 2)[cmp];

	return float4(colorAtV0, colorAtV1, colorAtV2, 0);
}

Expected result

The compiler outputs valid SPIR-V

Actual result

DXC crashes on null pointer dereference (see call_stack.txt)

Further technical details

DXC built from changeset 5ebc67c

[kuhar]

Thanks for the detailed bug report, @Dredhog! Looping in spir-v folks: @ehsannas @jaebaek.

[sudonatalie]

Closing this issue as the crash is resolved, and opened #3930 to track an actual implementation of the intrinsic in future.

[Keenuts]

Seems like this issue is now present again.
Started https://github.com/microsoft/DirectXShaderCompiler/pull/6018/files but unsure about the result.

Also, tried to figure out the actual usages, and turns out the SPIR-V backend generated invalid code in a few cases instead of showing an error, or generating valid code.

@ShchchowAMD could you take a look? Seems like you implemented those features IIRC?

Another example which yields a validation error:

struct S {
  float4 a : COLOR;
};

float compute(float4 a) {
  return GetAttributeAtVertex(a, 0)[0];
}

float4 main(nointerpolation S s) : SV_TARGET
{
  return float4(0, 0, 0, compute(s.a));
}

dxc -E main -T ps_6_0 repro.hlsl -fcgl -spirv

fatal error: generated SPIR-V is invalid: Expected Constituent type to be equal to the corresponding member type of Result Type struct
  %22 = OpCompositeConstruct %S %21

note: please file a bug report on https://github.com/Microsoft/DirectXShaderCompiler/issues with source code if possible

[ShchchowAMD]

Just to double check I understand correct as I'm not familiar with this case:

a[0] is accessing first float channel of a, which means a[0] is eqaul to a.x.

I'll try to make a fix for this case if above explanation is expected.

Seems like previous implementation missed such case that using array-like bracket indexing to access a channel in vector.

[s-perron]

Just to double check I understand correct as I'm not familiar with this case:

a[0] is accessing first float channel of a, which means a[0] is eqaul to a.x.

I'll try to make a fix for this case if above explanation is expected.

Seems like previous implementation missed such case that using array-like bracket indexing to access a channel in vector.

I believe that is correct. You can see compare v.x and v[0] at https://godbolt.org/z/no8nvnaPz. They both have essentially the same access chain.

[s-perron]

@ShchchowAMD Thanks for looking into this.