SPIRV-Tools/source/fuzz/transformation_copy_object.cpp

118 lines
4.5 KiB
C++
Raw Normal View History

// Copyright (c) 2019 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include "source/fuzz/transformation_copy_object.h"
#include "source/fuzz/data_descriptor.h"
#include "source/fuzz/fuzzer_util.h"
#include "source/fuzz/instruction_descriptor.h"
#include "source/opt/instruction.h"
#include "source/util/make_unique.h"
namespace spvtools {
namespace fuzz {
TransformationCopyObject::TransformationCopyObject(
const protobufs::TransformationCopyObject& message)
: message_(message) {}
TransformationCopyObject::TransformationCopyObject(
uint32_t object,
const protobufs::InstructionDescriptor& instruction_to_insert_before,
uint32_t fresh_id) {
message_.set_object(object);
*message_.mutable_instruction_to_insert_before() =
instruction_to_insert_before;
message_.set_fresh_id(fresh_id);
}
bool TransformationCopyObject::IsApplicable(
opt::IRContext* context, const FactManager& /*fact_manager*/) const {
if (!fuzzerutil::IsFreshId(context, message_.fresh_id())) {
// We require the id for the object copy to be unused.
return false;
}
// The id of the object to be copied must exist
auto object_inst = context->get_def_use_mgr()->GetDef(message_.object());
if (!object_inst) {
return false;
}
if (!fuzzerutil::CanMakeSynonymOf(context, object_inst)) {
return false;
}
auto insert_before =
FindInstruction(message_.instruction_to_insert_before(), context);
if (!insert_before) {
// The instruction before which the copy should be inserted was not found.
return false;
}
if (!fuzzerutil::CanInsertOpcodeBeforeInstruction(SpvOpCopyObject,
insert_before)) {
return false;
}
// |message_object| must be available at the point where we want to add the
// copy. It is available if it is at global scope (in which case it has no
// block), or if it dominates the point of insertion but is different from the
// point of insertion.
//
// The reason why the object needs to be different from the insertion point is
// that the copy will be added *before* this point, and we do not want to
// insert it before the object's defining instruction.
return !context->get_instr_block(object_inst) ||
(object_inst != &*insert_before &&
context
->GetDominatorAnalysis(
context->get_instr_block(insert_before)->GetParent())
->Dominates(object_inst, &*insert_before));
}
void TransformationCopyObject::Apply(opt::IRContext* context,
FactManager* fact_manager) const {
auto object_inst = context->get_def_use_mgr()->GetDef(message_.object());
assert(object_inst && "The object to be copied must exist.");
auto insert_before_inst =
FindInstruction(message_.instruction_to_insert_before(), context);
auto destination_block = context->get_instr_block(insert_before_inst);
assert(destination_block && "The base instruction must be in a block.");
auto insert_before = fuzzerutil::GetIteratorForInstruction(
destination_block, insert_before_inst);
assert(insert_before != destination_block->end() &&
"There must be an instruction before which the copy can be inserted.");
opt::Instruction::OperandList operands = {
{SPV_OPERAND_TYPE_ID, {message_.object()}}};
insert_before->InsertBefore(MakeUnique<opt::Instruction>(
context, SpvOp::SpvOpCopyObject, object_inst->type_id(),
message_.fresh_id(), operands));
fuzzerutil::UpdateModuleIdBound(context, message_.fresh_id());
context->InvalidateAnalysesExceptFor(opt::IRContext::Analysis::kAnalysisNone);
fact_manager->AddFactDataSynonym(MakeDataDescriptor(message_.object(), {}),
MakeDataDescriptor(message_.fresh_id(), {}),
context);
}
protobufs::Transformation TransformationCopyObject::ToMessage() const {
protobufs::Transformation result;
*result.mutable_copy_object() = message_;
return result;
}
} // namespace fuzz
} // namespace spvtools