Fix for invalid swizzle causing crash (#4690)

* Fix for invalid swizzle causing crash

Fixes #4689

If swizzle code is provided 5+ element swizzle the checkSwizzleExpr code will do an out of bounds array access and crash.

* switch test to check for to ensure no crash

* cleanup swizzle errors to only emit once

---------

Co-authored-by: Yong He <yonghe@outlook.com>

source/slang/slang-check-expr.cpp

@@ -3743,9 +3743,8 @@ namespace Slang
  case 'w': case 'a': elementIndex = 3; break;
  default:
  // An invalid character in the swizzle is an error
- getSink()->diagnose(swizExpr, Diagnostics::invalidSwizzleExpr, swizzleText, baseElementType->toString());
  anyError = true;
- continue;
+ break;
  }
 
  // TODO(tfoley): GLSL requires that all component names
@@ -3754,9 +3753,16 @@ namespace Slang
  // Make sure the index is in range for the source type
  if (elementIndex >= limitElement)
  {
- getSink()->diagnose(swizExpr, Diagnostics::invalidSwizzleExpr, swizzleText, baseElementType->toString());
  anyError = true;
- continue;
+ break;
+ }
+
+ // If elementCount is already at 4 stop trying to assign a swizzle element and send an error,
+ // we cannot have more valid swizzle elements than 4.
+ if (elementCount >= 4)
+ {
+ anyError = true;
+ break;
  }
 
  // Check if we've seen this index before
@@ -3778,6 +3784,7 @@ namespace Slang
 
  if (anyError)
  {
+ getSink()->diagnose(swizExpr, Diagnostics::invalidSwizzleExpr, swizzleText, baseElementType->toString());
  return CreateErrorExpr(memberRefExpr);
  }
  else if (elementCount == 1)

tests/bugs/invalid-swizzle-count.slang

@@ -0,0 +1,11 @@
+//TEST:SIMPLE(filecheck=CHECK): -target spirv -stage compute -entry computeMain -emit-spirv-directly
+// CHECK: error 30052
+// CHECK-NOT: error 30052
+RWStructuredBuffer<float> outputBuffer;
+
+[numthreads(1,1,1)]
+void computeMain( uint2 dispatchThreadID : SV_DispatchThreadID )
+{
+ float4 vecVal = float4(0);
+ outputBuffer[0] = vecVal.xxtyxx;
+}