From f19bc58594c69bd8ade0c457f28ce1ea0a17a4e8 Mon Sep 17 00:00:00 2001
From: Steven Perron <stevenperron@google.com>
Date: Mon, 9 Sep 2019 14:03:46 -0400
Subject: [PATCH] Handle id overflow in the constant manager.

Fixes crbug.com/997246
---
 source/opt/fold.cpp                |  3 +++
 test/opt/constant_manager_test.cpp | 22 ++++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/source/opt/fold.cpp b/source/opt/fold.cpp
index 276e8358ad..94f5e73fd3 100644
--- a/source/opt/fold.cpp
+++ b/source/opt/fold.cpp
@@ -646,6 +646,9 @@ Instruction* InstructionFolder::FoldInstructionToConstant(
     if (folded_const != nullptr) {
       Instruction* const_inst =
           const_mgr->GetDefiningInstruction(folded_const, inst->type_id());
+      if (const_inst == nullptr) {
+        return nullptr;
+      }
       assert(const_inst->type_id() == inst->type_id());
       // May be a new instruction that needs to be analysed.
       context_->UpdateDefUse(const_inst);
diff --git a/test/opt/constant_manager_test.cpp b/test/opt/constant_manager_test.cpp
index 57dea65120..14e14ec20e 100644
--- a/test/opt/constant_manager_test.cpp
+++ b/test/opt/constant_manager_test.cpp
@@ -82,6 +82,28 @@ TEST_F(ConstantManagerTest, GetDefiningInstruction2) {
   EXPECT_EQ(const_inst_2->result_id(), 4);
 }
 
+TEST_F(ConstantManagerTest, GetDefiningInstructionIdOverflow) {
+  const std::string text = R"(
+%1 = OpTypeInt 32 0
+%3 = OpConstant %1 1
+%4 = OpConstant %1 2
+  )";
+
+  std::unique_ptr<IRContext> context =
+      BuildModule(SPV_ENV_UNIVERSAL_1_2, nullptr, text,
+                  SPV_TEXT_TO_BINARY_OPTION_PRESERVE_NUMERIC_IDS);
+  ASSERT_NE(context, nullptr);
+
+  // Set the id bound to the max, so the new constant cannot be generated.
+  context->module()->SetIdBound(context->max_id_bound());
+
+  Type* int_type = context->get_type_mgr()->GetType(1);
+  IntConstant int_constant(int_type->AsInteger(), {3});
+  Instruction* inst =
+      context->get_constant_mgr()->GetDefiningInstruction(&int_constant, 1);
+  EXPECT_EQ(inst, nullptr);
+}
+
 }  // namespace
 }  // namespace analysis
 }  // namespace opt