more skslc hardening

src/sksl/SkSLIRGenerator.cpp

 /*
  * Copyright 2016 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
  
 #include "SkSLIRGenerator.h"
 
 #include "limits.h"
@@ skipping 186 matching lines @@
         auto var = std::unique_ptr<Variable>(new Variable(decl.fPosition, modifiers, varDecl.fName, 
                                                           *type, storage));
         std::unique_ptr<Expression> value;
         if (varDecl.fValue) {
             value = this->convertExpression(*varDecl.fValue);
             if (!value) {
                 return nullptr;
             }
             value = this->coerce(std::move(value), *type);
         }
-        if ("sk_FragColor" == varDecl.fName && (*fSymbolTable)[varDecl.fName]) {
+        if (storage == Variable::kGlobal_Storage && "sk_FragColor" == varDecl.fName && 
+            (*fSymbolTable)[varDecl.fName]) {
             // already defined, ignore
-        } else if ((*fSymbolTable)[varDecl.fName] && 
-                   (*fSymbolTable)[varDecl.fName]->fKind == Symbol::kVariable_Kind && 
+        } else if (storage == Variable::kGlobal_Storage && (*fSymbolTable)[varDecl.fName] &&
+                   (*fSymbolTable)[varDecl.fName]->fKind == Symbol::kVariable_Kind &&
                    ((Variable*) (*fSymbolTable)[varDecl.fName])->fModifiers.fLayout.fBuiltin >= 0) {
             // already defined, just update the modifiers
             Variable* old = (Variable*) (*fSymbolTable)[varDecl.fName];
             old->fModifiers = var->fModifiers;
         } else {
             variables.emplace_back(var.get(), std::move(sizes), std::move(value));
             fSymbolTable->add(varDecl.fName, std::move(var));
         }
     }
     return std::unique_ptr<VarDeclarations>(new VarDeclarations(decl.fPosition, 
@@ skipping 449 matching lines @@
     args.push_back(std::move(expr));
     return std::unique_ptr<Expression>(new Constructor(Position(), type, std::move(args)));
 }
 
 static bool is_matrix_multiply(const Type& left, const Type& right) {
     if (left.kind() == Type::kMatrix_Kind) {
         return right.kind() == Type::kMatrix_Kind || right.kind() == Type::kVector_Kind;
     }
     return left.kind() == Type::kVector_Kind && right.kind() == Type::kMatrix_Kind;
 }
+
+static bool is_assignment(Token::Kind op) {
+    switch (op) {
+        case Token::EQ:           // fall through
+        case Token::PLUSEQ:       // fall through
+        case Token::MINUSEQ:      // fall through
+        case Token::STAREQ:       // fall through
+        case Token::SLASHEQ:      // fall through
+        case Token::PERCENTEQ:    // fall through
+        case Token::SHLEQ:        // fall through
+        case Token::SHREQ:        // fall through
+        case Token::BITWISEOREQ:  // fall through
+        case Token::BITWISEXOREQ: // fall through
+        case Token::BITWISEANDEQ: // fall through
+        case Token::LOGICALOREQ:  // fall through
+        case Token::LOGICALXOREQ: // fall through
+        case Token::LOGICALANDEQ: 
+            return true;
+        default:
+            return false;
+    }
+}
+
 /**
  * Determines the operand and result types of a binary expression. Returns true if the expression is
  * legal, false otherwise. If false, the values of the out parameters are undefined.
  */
 static bool determine_binary_type(const Context& context, 
                                   Token::Kind op, 
                                   const Type& left, 
                                   const Type& right, 
                                   const Type** outLeftType,
                                   const Type** outRightType,
                                   const Type** outResultType,
                                   bool tryFlipped) {
     bool isLogical;
+    bool validMatrixOrVectorOp;
     switch (op) {
+        case Token::EQ:
+            *outLeftType = &left;
+            *outRightType = &left;
+            *outResultType = &left;
+            return right.canCoerceTo(left);
         case Token::EQEQ: // fall through
-        case Token::NEQ:  // fall through
+        case Token::NEQ:
+            isLogical = true;
+            validMatrixOrVectorOp = true;
+            break;
         case Token::LT:   // fall through
         case Token::GT:   // fall through
         case Token::LTEQ: // fall through
         case Token::GTEQ:
             isLogical = true;
+            validMatrixOrVectorOp = false;
             break;
         case Token::LOGICALOR: // fall through
         case Token::LOGICALAND: // fall through
         case Token::LOGICALXOR: // fall through
         case Token::LOGICALOREQ: // fall through
         case Token::LOGICALANDEQ: // fall through
         case Token::LOGICALXOREQ:
             *outLeftType = context.fBool_Type.get();
             *outRightType = context.fBool_Type.get();
             *outResultType = context.fBool_Type.get();
@@ skipping 30 matching lines @@
                     } else {
                         // result was a column vector, transpose it back to a row
                         *outResultType = &(*outResultType)->toCompound(context, leftRows,
                                                                        rightColumns);
                     }
                     return leftColumns == rightRows;
                 } else {
                     return false;
                 }
             }
-            // fall through
+            isLogical = false;
+            validMatrixOrVectorOp = true;
+            break;
+        case Token::PLUS:    // fall through
+        case Token::PLUSEQ:  // fall through
+        case Token::MINUS:   // fall through
+        case Token::MINUSEQ: // fall through
+        case Token::SLASH:   // fall through
+        case Token::SLASHEQ:
+            isLogical = false;
+            validMatrixOrVectorOp = true;
+            break;
         default:
             isLogical = false;
+            validMatrixOrVectorOp = false;
     }
-    // FIXME: need to disallow illegal operations like vec3 > vec3. Also do not currently have
-    // full support for numbers other than float.
-    if (left == right) {
+    bool isVectorOrMatrix = left.kind() == Type::kVector_Kind || left.kind() == Type::kMatrix_Kind;
+    // FIXME: incorrect for shift
+    if (right.canCoerceTo(left) && (left.kind() == Type::kScalar_Kind || 
+                                   (isVectorOrMatrix && validMatrixOrVectorOp))) {
         *outLeftType = &left;
         *outRightType = &left;
         if (isLogical) {
             *outResultType = context.fBool_Type.get();
         } else {
             *outResultType = &left;
         }
         return true;
     }
-    // FIXME: incorrect for shift operations
-    if (left.canCoerceTo(right)) {
-        *outLeftType = &right;
-        *outRightType = &right;
-        if (isLogical) {
-            *outResultType = context.fBool_Type.get();
-        } else {
-            *outResultType = &right;
-        }
-        return true;
-    }
     if ((left.kind() == Type::kVector_Kind || left.kind() == Type::kMatrix_Kind) && 
         (right.kind() == Type::kScalar_Kind)) {
         if (determine_binary_type(context, op, left.componentType(), right, outLeftType, 
                                   outRightType, outResultType, false)) {
             *outLeftType = &(*outLeftType)->toCompound(context, left.columns(), left.rows());
             if (!isLogical) {
                 *outResultType = &(*outResultType)->toCompound(context, left.columns(), 
                                                                left.rows());
             }
             return true;
@@ skipping 14 matching lines @@
         return nullptr;
     }
     std::unique_ptr<Expression> right = this->convertExpression(*expression.fRight);
     if (!right) {
         return nullptr;
     }
     const Type* leftType;
     const Type* rightType;
     const Type* resultType;
     if (!determine_binary_type(fContext, expression.fOperator, left->fType, right->fType, &leftType,
-                               &rightType, &resultType, true)) {
+                               &rightType, &resultType, !is_assignment(expression.fOperator))) {
         fErrors.error(expression.fPosition, "type mismatch: '" + 
                                             Token::OperatorName(expression.fOperator) + 
                                             "' cannot operate on '" + left->fType.fName + 
                                             "', '" + right->fType.fName + "'");
         return nullptr;
     }
-    switch (expression.fOperator) {
-        case Token::EQ:           // fall through
-        case Token::PLUSEQ:       // fall through
-        case Token::MINUSEQ:      // fall through
-        case Token::STAREQ:       // fall through
-        case Token::SLASHEQ:      // fall through
-        case Token::PERCENTEQ:    // fall through
-        case Token::SHLEQ:        // fall through
-        case Token::SHREQ:        // fall through
-        case Token::BITWISEOREQ:  // fall through
-        case Token::BITWISEXOREQ: // fall through
-        case Token::BITWISEANDEQ: // fall through
-        case Token::LOGICALOREQ:  // fall through
-        case Token::LOGICALXOREQ: // fall through
-        case Token::LOGICALANDEQ: 
-            this->markWrittenTo(*left);
-        default:
-            break;
+    if (is_assignment(expression.fOperator)) {
+        this->markWrittenTo(*left);
+    }
+    left = this->coerce(std::move(left), *leftType);
+    right = this->coerce(std::move(right), *rightType);
+    if (!left || !right) {
+        return nullptr;
     }
     return std::unique_ptr<Expression>(new BinaryExpression(expression.fPosition, 
-                                                            this->coerce(std::move(left), 
-                                                                         *leftType), 
+                                                            std::move(left), 
                                                             expression.fOperator, 
-                                                            this->coerce(std::move(right), 
-                                                                         *rightType), 
+                                                            std::move(right), 
                                                             *resultType));
 }
 
 std::unique_ptr<Expression> IRGenerator::convertTernaryExpression(  
                                                            const ASTTernaryExpression& expression) {
     std::unique_ptr<Expression> test = this->coerce(this->convertExpression(*expression.fTest), 
                                                     *fContext.fBool_Type);
     if (!test) {
         return nullptr;
     }
@@ skipping 33 matching lines @@
                                  " argument";
         if (function.fParameters.size() != 1) {
             msg += "s";
         }
         msg += ", but found " + to_string((uint64_t) arguments.size());
         fErrors.error(position, msg);
         return nullptr;
     }
     for (size_t i = 0; i < arguments.size(); i++) {
         arguments[i] = this->coerce(std::move(arguments[i]), function.fParameters[i]->fType);
+        if (!arguments[i]) {
+            return nullptr;
+        }
         if (arguments[i] && (function.fParameters[i]->fModifiers.fFlags & Modifiers::kOut_Flag)) {
             this->markWrittenTo(*arguments[i]);
         }
     }
     return std::unique_ptr<FunctionCall>(new FunctionCall(position, function,
                                                           std::move(arguments)));
 }
 
 /**
  * Determines the cost of coercing the arguments of a function to the required types. Returns true 
@@ skipping 77 matching lines @@
     }
     if (args.size() == 1 && args[0]->fType == type) {
         // argument is already the right type, just return it
         return std::move(args[0]);
     }
     if (type.isNumber()) {
         if (args.size() != 1) {
             fErrors.error(position, "invalid arguments to '" + type.description() + 
                                     "' constructor, (expected exactly 1 argument, but found " +
                                     to_string((uint64_t) args.size()) + ")");
+            return nullptr;
         }
         if (args[0]->fType == *fContext.fBool_Type) {
             std::unique_ptr<IntLiteral> zero(new IntLiteral(fContext, position, 0));
             std::unique_ptr<IntLiteral> one(new IntLiteral(fContext, position, 1));
             return std::unique_ptr<Expression>(
                                          new TernaryExpression(position, std::move(args[0]),
                                                                this->coerce(std::move(one), type),
                                                                this->coerce(std::move(zero), 
                                                                             type)));
         } else if (!args[0]->fType.isNumber()) {
             fErrors.error(position, "invalid argument to '" + type.description() + 
                                     "' constructor (expected a number or bool, but found '" +
                                     args[0]->fType.description() + "')");
         }
         if (args[0]->fKind == Expression::kIntLiteral_Kind && (type == *fContext.fInt_Type || 
             type == *fContext.fUInt_Type)) {
             return std::unique_ptr<Expression>(new IntLiteral(fContext, 
                                                               position, 
                                                               ((IntLiteral&) *args[0]).fValue,
                                                               &type));
         }
     } else if (kind == Type::kArray_Kind) {
         const Type& base = type.componentType();
         for (size_t i = 0; i < args.size(); i++) {
             args[i] = this->coerce(std::move(args[i]), base);
+            if (!args[i]) {
+                return nullptr;
+            }
         }
     } else {
         ASSERT(kind == Type::kVector_Kind || kind == Type::kMatrix_Kind);
         int actual = 0;
         for (size_t i = 0; i < args.size(); i++) {
             if (args[i]->fType.kind() == Type::kVector_Kind || 
                 args[i]->fType.kind() == Type::kMatrix_Kind) {
                 int columns = args[i]->fType.columns();
                 int rows = args[i]->fType.rows();
                 args[i] = this->coerce(std::move(args[i]), 
@@ skipping 263 matching lines @@
 
 void IRGenerator::checkValid(const Expression& expr) {
     switch (expr.fKind) {
         case Expression::kFunctionReference_Kind:
             fErrors.error(expr.fPosition, "expected '(' to begin function call");
             break;
         case Expression::kTypeReference_Kind:
             fErrors.error(expr.fPosition, "expected '(' to begin constructor invocation");
             break;
         default:
-            ASSERT(expr.fType != *fContext.fInvalid_Type);
-            break;
+            if (expr.fType == *fContext.fInvalid_Type) {
+                fErrors.error(expr.fPosition, "invalid expression");
+            }
     }
 }
 
 void IRGenerator::markReadFrom(const Variable& var) {
     var.fIsReadFrom = true;
 }
 
 static bool has_duplicates(const Swizzle& swizzle) {
     int bits = 0;
     for (int idx : swizzle.fComponents) {
@@ skipping 31 matching lines @@
         case Expression::kIndex_Kind:
             this->markWrittenTo(*((IndexExpression&) expr).fBase);
             break;
         default:
             fErrors.error(expr.fPosition, "cannot assign to '" + expr.description() + "'");
             break;
     }
 }
 
 }