Incorrect spirv generated

[kobli]

Issue Description

The code below produces probably incorrect spirv. Vulkan pipeline creation fails, spirv-val produces following output:

error: line 100: Indexes passed to OpAccessChain must be of type integer.
  %321 = OpAccessChain %_ptr_Function_uint %320 %316

Reproducer Code

static const uint MAX_NESTED_VOLUMES = 4;
static const int MATERIAL_LAYERS_MAX = 10;

struct MaterialFlags
{
    static const uint32_t HAS_SCATTERING_VOLUME = 1 << 20;
};

struct Material
{
    uint32_t flags = 0;
    uint32_t layerCount = 0;
    uint32_t layers[MATERIAL_LAYERS_MAX];

    bool HasFlag(uint32_t mask)
    {
        return (flags & mask) != 0;
    }

    IVolume GetVolume()
    {
        if (HasFlag(MaterialFlags::HAS_SCATTERING_VOLUME)) {
            return ScatteringVolume(PhaseFunction());
        }
        else {
            return EmptyVolume();
        }
    }
};

[[vk::binding(1, 3)]]
StructuredBuffer<Material> materials;

struct PhaseFunction
{
    void GenerateSample(uint channelIndex, float2 rnd, inout float3 sampleDirection, out float pdf)
    {
        sampleDirection = {};
        pdf = {};
    }
}

interface IVolume
{
    void Integrate(float3 rayOrigin, float3 intersection, float4 rnd, inout float3 rayDirection, inout float tHit,
                   inout float3 throughput);
}

struct EmptyVolume : IVolume
{
    float3 dummy1 = 0;

    void Integrate(float3 rayOrigin, float3 intersection, float4 rnd, inout float3 rayDirection, inout float tHit,
                   inout float3 throughput)
    {
    }
}

struct ScatteringVolume : IVolume
{
    PhaseFunction phase;

    __init(PhaseFunction phase)
    {
        this.phase = phase;
    }

    void Integrate(float3 rayOrigin, float3 intersection, float4 rnd, inout float3 rayDirection, inout float tHit,
                   inout float3 throughput)
    {
        let rayDirectionBeforeScatter = rayDirection;
        float phasePdf;
        phase.GenerateSample(0, rnd.zw, rayDirection, phasePdf);
        tHit = 0;
    }
}

struct Payload
{
    float2 _padding;
    float tHit;
    int volumeStackIndex;

    uint volumeStack[MAX_NESTED_VOLUMES];

    IVolume GetVolume()
    {
        if (volumeStackIndex == -1)
            return EmptyVolume();
        uint mid = volumeStack[volumeStackIndex];
        return materials[mid].GetVolume();
    }
}

[shader("closesthit")]
void main(inout Payload payload, in BuiltInTriangleIntersectionAttributes attr)
{
    float3 throughput = 1;
    IVolume volume = payload.GetVolume();
    float3 o = {};
    volume.Integrate(WorldRayOrigin(), {}, {}, o, payload.tHit, throughput);
}

compiled with
slangc.exe -entry main test.slang -o test.spv

Expected Behavior

The code should compile and pass spirv-val.

Environment

• Slang Version 2025.18 up to 2025.22.1 (2025.17.3 and older worked fine)

[skiminki-nv]

Confirmed. This indeed triggers a spirv validation error.

$ export SLANG_RUN_SPIRV_VALIDATION=1
$ slangc -target spirv test.slang
error: line 157: Indexes passed to OpAccessChain must be of type integer.
  %51 = OpAccessChain %_ptr_Function_uint %49 %41

%Payload_GetVolume = OpFunction %Tuple None %30
       %this = OpFunctionParameter %_ptr_Function_Payload
         %32 = OpLabel
         %36 = OpVariable %_ptr_Function_EmptyVolume Function
         %41 = OpAccessChain %_ptr_Function_int %this %int_2
         %42 = OpLoad %int %41
         %44 = OpIEqual %bool %42 %int_n1
               OpSelectionMerge %37 None
               OpBranchConditional %44 %38 %37
         %37 = OpLabel
         %49 = OpAccessChain %_ptr_Function__arr_uint_int_4 %this %int_3
         %51 = OpAccessChain %_ptr_Function_uint %49 %41
         %52 = OpLoad %uint %51
         %53 = OpFunctionCall %Tuple %Material_GetVolume %52
               OpReturnValue %53
         %38 = OpLabel
        %155 = OpConvertSToF %v3float %156
        %157 = OpFunctionCall %EmptyVolume %EmptyVolume__init %155
               OpStore %36 %157
        %159 = OpFunctionCall %_struct_27 %packAnyValue12_1 %36
        %183 = OpCompositeConstruct %Tuple %131 %182 %159
               OpReturnValue %183
               OpFunctionEnd

Looking at %51 = OpAccessChain %_ptr_Function_uint %49 %41, parameter %41 type is indeed %_ptr_Function_int. Possibly, the parameter should be %42, instead.

(Ref: https://registry.khronos.org/SPIR-V/specs/unified1/SPIRV.html#OpAccessChain)

[skiminki-nv]

Minimal repro is as follows:

struct Payload
{
    uint volumeStackIndex;
    int volumeStack[2];

    int GetVolume()
    {
        return volumeStack[volumeStackIndex];
    }
}

RWStructuredBuffer<int> outputBuffer;

[shader("closesthit")]
void main(inout Payload payload)
{
// POSITIVE-NOT: {{(error|warning).*}}:
// POSITIVE: result code = 0
// POSITIVE-NOT: {{(error|warning).*}}:

    outputBuffer[0] = payload.GetVolume();
}

Compiler invocation: slangc -g0 -target spirv tests/bugs/gh-9073-spirv-pointer-double-dereference.slang

Now, looking at the generated SPIR-V for Payload::GetVolume():

                     %Payload = OpTypeStruct %uint %_arr_int_int_2
       %_ptr_Function_Payload = OpTypePointer Function %Payload
          %_ptr_Function_uint = OpTypePointer Function %uint
%_ptr_Function__arr_int_int_2 = OpTypePointer Function %_arr_int_int_2
           %_ptr_Function_int = OpTypePointer Function %int


               ; Function Payload_GetVolume
%Payload_GetVolume = OpFunction %int None %25
       %this = OpFunctionParameter %_ptr_Function_Payload
         %27 = OpLabel
         %29 = OpAccessChain %_ptr_Function_uint %this %int_0
         %32 = OpAccessChain %_ptr_Function__arr_int_int_2 %this %int_1
         %34 = OpAccessChain %_ptr_Function_int %32 %29     <<<<<<<<< validation error here
         %35 = OpLoad %int %34
               OpReturnValue %35
               OpFunctionEnd

What happens here is as follows:

• %29 = pointer to volumeStackIndex (this + 0)
• %32 = pointer to volumeStack array (this + 1)
• %34 = should be pointer to volumeStack[dereference(%29)] but it is volumeStack[%29]
  where dereference = OpLoad %uint %29

Now, tracing back to slang ir:

### LOWER-TO-IR:
func %Payloadx5FGetVolume       : Func(Int, %Payload)
{
block %3(
                [nameHint("this")]
                param %this     : %Payload):
        let  %4 : UInt  = get_field(%this, %volumeStackIndex)
        let  %5 : Array(Int, 2 : Int)   = get_field(%this, %volumeStack)
        let  %6 : Int   = getElement(%5, %4)
        return_val(%6)
}

...

### AFTER-VECTOR-LEGALIZATION:
func %Payloadx5FGetVolume       : Func(Int, %Payload)
{
block %29(
                [nameHint("this")]
                param %this     : %Payload):
        let  %30        : UInt  = get_field(%this, %volumeStackIndex)
        let  %31        : Array(Int, 2 : Int)   = get_field(%this, %volumeStack)
        let  %32        : Int   = getElement(%31, %30)
        return_val(%32)
}

### POST LINK AND OPTIMIZE:
func %Payloadx5FGetVolume       : Func(Int, BorrowInParam(%Payload, 1 : UInt64, 2147483647 : UInt64))
{
block %29(
                [nameHint("this")]
                param %this     : BorrowInParam(%Payload, 1 : UInt64, 2147483647 : UInt64)):
        let  %30        : Ptr(UInt, 1 : UInt64, 2147483647 : UInt64)    = get_field_addr(%this, %volumeStackIndex)
        let  %31        : Ptr(Array(Int, 2 : Int), 1 : UInt64, 2147483647 : UInt64)     = get_field_addr(%this, %volumeStack)
        let  %32        : Ptr(Int, 1 : UInt64, 2147483647 : UInt64)     = getElementPtr(%31, %30)
        let  %33        : Int   = load(%32)
        return_val(%33)
}

Here I'd need to double-check the semantics of get_field(). That is, whether it returns a pointer/address to the field or the field itself. I'd suppose it's the pointer/address. If this is the case, there's getElement() missing already in the first stage of IR, i.e., let %6 : Int = getElement(%5, %4) tries to index pointer to array by another pointer. That is, do the equivalent of volumeStack[&volumeStackIndex].

[skiminki-nv]

Brief update. (Note: get_field() returns the lvalue of the field.)

This turned out to be an issue with the pass that changes the function parameters to pointers of parameters for optimization purposes. The function failed to add the necessary IRLoad in case the index of translated getElement → getElementPtr was also a translated IR op.

PR #9113 should address this issue.

[skiminki-nv]

Verified that the reproduce code now compiles cleanly with Slangc ToT, and fails if I revert commit 9536d2f.

We now also have the simplified regression test as part of the slang tests: https://github.com/shader-slang/slang/blob/9536d2f94df2f396a1a3f25314e3b1610a3f1e64/tests/bugs/gh-9073-spirv-pointer-double-dereference.slang

Closing this issue.

@kobli : Please reopen if needed.