AuroraMiddleware/SPIRV-Tools
1
0
Fork 0
mirror of https://github.com/KhronosGroup/SPIRV-Tools synced 2024-11-25 21:10:04 +00:00
Code Issues Packages Projects Releases Wiki Activity
44936c4a9d
SPIRV-Tools/source/fuzz/fuzzer.cpp

395 lines
19 KiB
C++
Raw Normal View History

Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
// Copyright (c) 2019 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include "source/fuzz/fuzzer.h"
#include <cassert>
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
#include <memory>
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
#include <numeric>
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
#include "source/fuzz/fuzzer_context.h"
spirv-fuzz: Fuzzer pass that adds access chains (#3182) This change adds a fuzzer pass that sprinkles access chain instructions into a module at random. This allows other passes to have a richer set of pointers available to them, in particular the passes that add loads and stores.
2020-02-11 23:10:57 +00:00
#include "source/fuzz/fuzzer_pass_add_access_chains.h"
spirv-fuzz: Add bit instruction synonym transformation (#3775) This PR implements part of the add bit instruction synonym transformation. For now, the implementation covers the OpBitwiseOr, OpBitwiseXor and OpBitwiseAnd cases.
2020-09-15 22:36:23 +00:00
#include "source/fuzz/fuzzer_pass_add_bit_instruction_synonyms.h"
spirv-fuzz: Add FuzzerPassAddCompositeExtract (#3904) Fixes #3806.
2020-10-23 13:49:50 +00:00
#include "source/fuzz/fuzzer_pass_add_composite_extract.h"
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606) Adds FuzzerPassAddCompositeInserts, which randomly adds new OpCompositeInsert instructions. Each OpCompositeInsert instruction yields a copy of an original composite with one subcomponent replaced with an existing or newly added object. Synonym facts are added for the unchanged components in the original and added composite, and for the replaced subcomponent and the object, if possible. Fixes #2859
2020-08-19 12:56:03 +00:00
#include "source/fuzz/fuzzer_pass_add_composite_inserts.h"
spirv-fuzz: Fuzzer pass to add composite types (#3171) Adds a fuzzer pass that randomly adds vector and matrix types not already present in the module, and randomly adds structs with random field types and arrays with random base types and sizes. Other passes will be able to create variables and ids using these types.
2020-02-04 14:00:19 +00:00
#include "source/fuzz/fuzzer_pass_add_composite_types.h"
spirv-fuzz: Add FuzzerPassAddCopyMemoryInstructions (#3391) Fixes #3382.
2020-06-30 20:13:05 +00:00
#include "source/fuzz/fuzzer_pass_add_copy_memory.h"
spirv-fuzz: add dead blocks (#3135) This adds a new kind of fact to the fact manager that knows whether a block is dead - i.e. guaranteed to be statically unreachable - and a new transformation for adding a selection construct to a CFG that conditionally branches to a fresh, dead block, such that the branch will never be dynamically taken. Transformations that may create new blocks ('split block' and 'outline function') are updated to propagate dead block facts to newly-created blocks where appropriate. A fuzzer pass randomly adds dead blocks to the module. Future transformations will be able to exploit the fact that such blocks are known to be dead.
2020-01-13 22:04:01 +00:00
#include "source/fuzz/fuzzer_pass_add_dead_blocks.h"
Add fuzzer pass to add dead breaks. (#2654) This pass randomly add breaks to the merge blocks of selection and loop constructs, such that the breaking edges will not be dynamically reachable.
2019-06-05 07:02:16 +00:00
#include "source/fuzz/fuzzer_pass_add_dead_breaks.h"
Transformation and fuzzer pass to add dead continues (#2758) Similar to the existing 'add dead breaks' pass, this adds a pass to add dead continues to blocks in loops where such a transformation is viable. Various functionality common to this new pass and 'add dead breaks' has been factored into 'fuzzer_util', and some small improvements to 'add dead breaks' that were identified while reviewing that code again have been applied. Fixes #2719.
2019-07-25 12:50:33 +00:00
#include "source/fuzz/fuzzer_pass_add_dead_continues.h"
spirv-fuzz: Fuzzer pass to add equation instructions (#3202) This introduces a new fuzzer pass to add instructions to the module that define equations, and support in the fact manager for recording equation facts and deducing synonym facts from equation facts. Initially the only equations that are supported involve OpIAdd, OpISub, OpSNegate and OpLogicalNot, but there is scope for adding support for equations over various other operators.
2020-03-04 14:54:08 +00:00
#include "source/fuzz/fuzzer_pass_add_equation_instructions.h"
spirv-fuzz: Fuzzer pass to add function calls (#3178) Adds a fuzzer pass that inserts function calls into the module at random. Calls from dead blocks can be arbitrary (so long as they do not introduce recursion), while calls from other blocks can only be to livesafe functions. The change fixes some oversights in transformations to replace constants with uniforms and to obfuscate constants which testing of this fuzzer pass identified.
2020-02-10 23:22:34 +00:00
#include "source/fuzz/fuzzer_pass_add_function_calls.h"
spirv-fuzz: Fuzzer passes to add local and global variables (#3175) Adds two new fuzzer passes to add variables to a module: one that adds Private storage class global variables, another that adds Function storage class local variables.
2020-02-05 21:07:44 +00:00
#include "source/fuzz/fuzzer_pass_add_global_variables.h"
spirv-fuzz: Add image sample unused components transformation (#3439) Fixes #3375.
2020-07-08 16:07:04 +00:00
#include "source/fuzz/fuzzer_pass_add_image_sample_unused_components.h"
spirv-fuzz: Add fuzzer passes to add loads/stores (#3176) This change adds fuzzer passes that sprinkle loads and stores into a module at random, with stores restricted to occur in either dead blocks, or to use pointers for which it is known that the pointee value does not influence the module's overall behaviour. The change also generalises the VariableValueIsArbitrary fact to PointeeValueIsIrrelevant, to allow stores through access chains or object copies of variables whose values are known to be irrelevant. The change includes some other minor refactorings.
2020-02-06 16:54:34 +00:00
#include "source/fuzz/fuzzer_pass_add_loads.h"
spirv-fuzz: Fuzzer passes to add local and global variables (#3175) Adds two new fuzzer passes to add variables to a module: one that adds Private storage class global variables, another that adds Function storage class local variables.
2020-02-05 21:07:44 +00:00
#include "source/fuzz/fuzzer_pass_add_local_variables.h"
spirv-fuzz: Fuzzer pass to randomly apply loop preheaders (#3668) This PR introduces FuzzerPassAddLoopPreheaders, which: - Finds existing loop headers - If they have no simple preheader (where simple means that the preheader itself is not a loop header), randomly decides whether to add one. Fixes #3621.
2020-08-14 11:44:28 +00:00
#include "source/fuzz/fuzzer_pass_add_loop_preheaders.h"
spirv-fuzz: Create synonym of int constant using a loop (#3790) This transformation, given a constant integer (scalar or vector) C, constants I and S of compatible type and scalar 32-bit integer constant N, such that C = I - S*N, adds a loop which subtracts S from I, N times, creating a synonym for C. The related fuzzer pass randomly chooses constants to which to add synonyms using this transformation, and the location where they should be added. Fixes #3616.
2020-09-23 13:10:02 +00:00
#include "source/fuzz/fuzzer_pass_add_loops_to_create_int_constant_synonyms.h"
spirv-fuzz: Add fuzzer pass to add NoContraction decorations (#2950) A new pass that allows the fuzzer to add NoContraction decorations to arithmetic instructions. Fixes #2936.
2019-10-11 08:15:47 +00:00
#include "source/fuzz/fuzzer_pass_add_no_contraction_decorations.h"
spirv-fuzz: Create synonym via OpPhi and existing synonyms (#3701) A transformation that adds new OpPhi instructions to blocks with >=1 predecessors, so that its value depends on previously-defined ids of the right type, which are all synonymous. This instruction is also recorded as synonymous to the others. The related fuzzer pass still needs to be implemented. Fixes #3592 .
2020-08-27 14:59:54 +00:00
#include "source/fuzz/fuzzer_pass_add_opphi_synonyms.h"
spirv-fuzz: Implement FuzzerPassAddParameters (#3399) Fixes #3384.
2020-06-23 16:40:44 +00:00
#include "source/fuzz/fuzzer_pass_add_parameters.h"
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606) Adds FuzzerPassAddCompositeInserts, which randomly adds new OpCompositeInsert instructions. Each OpCompositeInsert instruction yields a copy of an original composite with one subcomponent replaced with an existing or newly added object. Synonym facts are added for the unchanged components in the original and added composite, and for the replaced subcomponent and the object, if possible. Fixes #2859
2020-08-19 12:56:03 +00:00
#include "source/fuzz/fuzzer_pass_add_relaxed_decorations.h"
spirv-fuzz: Add fuzzer passes to add loads/stores (#3176) This change adds fuzzer passes that sprinkle loads and stores into a module at random, with stores restricted to occur in either dead blocks, or to use pointers for which it is known that the pointee value does not influence the module's overall behaviour. The change also generalises the VariableValueIsArbitrary fact to PointeeValueIsIrrelevant, to allow stores through access chains or object copies of variables whose values are known to be irrelevant. The change includes some other minor refactorings.
2020-02-06 16:54:34 +00:00
#include "source/fuzz/fuzzer_pass_add_stores.h"
spirv-fuzz: TransformationAddSynonyms (#3447) Part of #3440.
2020-07-12 08:59:08 +00:00
#include "source/fuzz/fuzzer_pass_add_synonyms.h"
spirv-fuzz: Implement vector shuffle fuzzer pass (#3412) Fixes #3108.
2020-06-16 10:21:31 +00:00
#include "source/fuzz/fuzzer_pass_add_vector_shuffle_instructions.h"
Add adjust branch weights transformation (#3336) In this PR, the classes that represent the adjust branch weights transformation and fuzzer pass were implemented. This transformation adjusts the branch weights of a OpBranchConditional instruction.
2020-05-14 10:38:34 +00:00
#include "source/fuzz/fuzzer_pass_adjust_branch_weights.h"
spirv-fuzz: Add fuzzer pass to change function controls (#2951) A new pass that allows the fuzzer to change the 'function control' operand of OpFunction instructions. Fixes #2939.
2019-10-11 06:10:47 +00:00
#include "source/fuzz/fuzzer_pass_adjust_function_controls.h"
spirv-fuzz: Add fuzzer pass to change loop controls (#2949) A new pass that allows the fuzzer to change the 'loop control' operand (and associated literal operands) of OpLoopMerge instructions. Fixes #2938. Fixes #2943.
2019-10-10 12:34:38 +00:00
#include "source/fuzz/fuzzer_pass_adjust_loop_controls.h"
spirv-fuzz: Fuzzer pass to interchange zero-like constants (#3524) This fuzzer pass: For each zero-like constant, either finds the existing definition of the corresponding toggled one (OpConstantNull becomes zero-valued scalar OpConstant or vice versa) or creates a new one if it doesn't exist and records that the two are synonyms For each use of these constants, probabilistically decides whether to change it with the corresponding toggled constant id (as described in #3486 ) Only uses inside blocks of instructions are considered and not, for example, in instructions declaring other constants.
2020-07-15 11:58:29 +00:00
#include "source/fuzz/fuzzer_pass_adjust_memory_operands_masks.h"
spirv-fuzz: Add fuzzer pass to change selection controls (#2944) A new pass that allows the fuzzer to change the 'selection control' operand of OpSelectionControl instructions. Fixes #2937.
2019-10-08 10:25:34 +00:00
#include "source/fuzz/fuzzer_pass_adjust_selection_controls.h"
Add fuzzer pass to replace ids with synonyms (#2857) If the fuzzer's fact manager knows that ids A and B are synonymous, it can replace a use of A with a use of B, so long as various conditions hold (e.g. the definition of B must dominate the use of A, and it is not legal to replace a use of an OpConstant in a struct's access chain with a synonym that is not an OpConstant). This change adds a fuzzer pass to sprinke such synonym replacements through the module.
2019-09-18 19:47:08 +00:00
#include "source/fuzz/fuzzer_pass_apply_id_synonyms.h"
spirv-fuzz: add transformation and pass to construct composites (#2941) Adds a fuzzer pass and transformation to create a composite (array, matrix, struct or vector) from available constituent components, and inform the fact manager that each component of the new composite is synonymous with the id that was used to construct it. This allows the "replace id with synonym" pass to then replace uses of said ids with uses of elements extracted from the composite. Fixes #2858.
2019-10-08 13:04:10 +00:00
#include "source/fuzz/fuzzer_pass_construct_composites.h"
Add fuzzer pass to copy objects (#2853) A new fuzzer pass that randomly introduces OpCopyObject instructions that make copies of ids, and uses the fact manager to record the fact that an id %id is synonymous with an id generated by an OpCopyObject applied to %id. (A future pass will exploit such synonym facts.)
2019-09-11 22:45:20 +00:00
#include "source/fuzz/fuzzer_pass_copy_objects.h"
spirv-fuzz: Add fuzzer pass to perform module donation (#3117) This change adds a fuzzer pass that allows code from other SPIR-V modules to be donated into the module under transformation. It also changes the command-line options of the tools so that, in fuzzing mode, a file must be specified that contains the names of available donor modules.
2020-01-07 08:39:55 +00:00
#include "source/fuzz/fuzzer_pass_donate_modules.h"
spirv-fuzz: Add TransformationDuplicateRegionWithSelection (#3773) Adds a transformation that inserts a conditional statement with a boolean expression of arbitrary value and duplicates a given single-entry, single-exit region, so that it is present in each conditional branch and will be executed regardless of which branch will be taken. Fixes #3614.
2020-09-11 10:48:19 +00:00
#include "source/fuzz/fuzzer_pass_duplicate_regions_with_selections.h"
spirv-fuzz: Add expand vector reduction transformation (#3869) The following implementations are introduced: - Transformation and fuzzer pass for expanding vector reduction. - Unit tests to cover the instructions with different vector sizes. Fixes #3768.
2020-10-23 13:59:08 +00:00
#include "source/fuzz/fuzzer_pass_expand_vector_reductions.h"
spirv-fuzz: Transformation to flatten conditional branch (#3667) This transformation, given the header of a selection construct with branching instruction OpBranchConditional, flattens it. Side-effecting operations such as OpLoad, OpStore and OpFunctionCall are enclosed within smaller conditionals. It is applicable if the construct does not contain inner selection constructs or loops, or atomic or barrier instructions. The corresponding fuzzer pass looks for selection headers and tries to flatten them. Needed for the issue #3544, but it does not fix it completely.
2020-09-15 09:31:01 +00:00
#include "source/fuzz/fuzzer_pass_flatten_conditional_branches.h"
spirv-fuzz: Add inline function transformation (#3517) Fixes #3505.
2020-08-25 16:28:23 +00:00
#include "source/fuzz/fuzzer_pass_inline_functions.h"
spirv-fuzz: Pass to replace int operands with ints of opposite signedness (#3612) This PR introduces a new fuzzer pass, which: - finds all integer vectors or constants - finds or creates the corresponding constants with opposite signedness - records such constants as synonyms of the first ones - replaces the usages of the original constants with the new ones if allowed Fixes #2677.
2020-07-30 18:48:29 +00:00
#include "source/fuzz/fuzzer_pass_interchange_signedness_of_integer_operands.h"
spirv-fuzz: Fuzzer pass to interchange zero-like constants (#3524) This fuzzer pass: For each zero-like constant, either finds the existing definition of the corresponding toggled one (OpConstantNull becomes zero-valued scalar OpConstant or vice versa) or creates a new one if it doesn't exist and records that the two are synonyms For each use of these constants, probabilistically decides whether to change it with the corresponding toggled constant id (as described in #3486 ) Only uses inside blocks of instructions are considered and not, for example, in instructions declaring other constants.
2020-07-15 11:58:29 +00:00
#include "source/fuzz/fuzzer_pass_interchange_zero_like_constants.h"
spirv-fuzz: TransformationInvertComparisonOperator (#3475) Part of #3440.
2020-07-03 16:37:32 +00:00
#include "source/fuzz/fuzzer_pass_invert_comparison_operators.h"
spirv-fuzz: Add TransformationMakeVectorOperationDynamic (#3597) Fixes #3588.
2020-08-06 14:50:18 +00:00
#include "source/fuzz/fuzzer_pass_make_vector_operations_dynamic.h"
spirv-fuzz: Fuzzer pass to merge blocks (#3097) This change adds a transformation and associated fuzzer pass for merging adjacent blocks in a module, re-using block merging code from the optimizer.
2019-12-12 15:27:40 +00:00
#include "source/fuzz/fuzzer_pass_merge_blocks.h"
spirv-fuzz: Merge the return instructions in a function (#3838) This PR introduces TransformationMergeFunctionReturns, which changes a function so that it only has one reachable return statement. Fixes #3655.
2020-10-02 03:45:44 +00:00
#include "source/fuzz/fuzzer_pass_merge_function_returns.h"
spirv-fuzz: TransformationMutatePointer (#3737) Fixes #3624.
2020-09-01 11:45:13 +00:00
#include "source/fuzz/fuzzer_pass_mutate_pointers.h"
Add fuzzer pass to obfuscate constants. (#2671) Adds a new transformation that can replace a constant with a uniform known to have the same value, and adds a fuzzer pass that (a) replaces a boolean with a comparison of literals (e.g. replacing "true" with "42 > 24"), and then (b) obfuscates the literals appearing in this comparison by replacing them with identically-valued uniforms, if available. The fuzzer_replayer test file has also been updated to allow initial facts to be provided, and to do error checking of the status results returned by the fuzzer and replayer components.
2019-06-18 17:41:08 +00:00
#include "source/fuzz/fuzzer_pass_obfuscate_constants.h"
spirv-fuzz: function outlining fuzzer pass (#3078) A new transformation and associated fuzzer pass in spirv-fuzz that selects single-entry single-exit control flow graph regions and for each selected region outlines the region into a new function and replaces the original region with a call to this function.
2019-12-10 14:47:42 +00:00
#include "source/fuzz/fuzzer_pass_outline_functions.h"
Add spirv-fuzz pass to permute blocks. (#2642) The blocks within each function in the module will be permuted in a randomized manner that respects dominance.
2019-05-31 08:59:06 +00:00
#include "source/fuzz/fuzzer_pass_permute_blocks.h"
spirv-fuzz: Add fuzzer pass to permute function parameters (#3212) Fixes #3194.
2020-03-08 14:27:05 +00:00
#include "source/fuzz/fuzzer_pass_permute_function_parameters.h"
spirv-fuzz: Permute the order of variables at function scope issue (#4248) Fixes #4194.
2021-04-26 15:53:55 +00:00
#include "source/fuzz/fuzzer_pass_permute_function_variables.h"
spirv-fuzz: TransformationMoveInstructionDown (#3477) Swaps an instruction with the next instruction in the block. Fixes #3457.
2020-08-03 15:45:24 +00:00
#include "source/fuzz/fuzzer_pass_permute_instructions.h"
spirv-fuzz: Permute OpPhi instruction operands (#3421) Fixes #3415.
2020-06-23 14:00:28 +00:00
#include "source/fuzz/fuzzer_pass_permute_phi_operands.h"
spirv-fuzz: TransformationPropagateInstructionDown (#3692) Fixes #3691.
2020-10-06 12:38:19 +00:00
#include "source/fuzz/fuzzer_pass_propagate_instructions_down.h"
spirv-fuzz: FuzzerPassPropagateInstructionsUp (#3478) Given an instruction (that may use an OpPhi result from the same block as an input operand), try to clone the instruction into each predecessor block, replacing the input operand with the corresponding OpPhi input operand in each case, if necessary. Fixes #3458.
2020-08-11 09:24:32 +00:00
#include "source/fuzz/fuzzer_pass_propagate_instructions_up.h"
spirv-fuzz: Add push id through variable transformation (#3359) Makes an id synonym by storing an id to a new variable and then loading it back from that variable. Fixes #3192.
2020-05-29 15:43:38 +00:00
#include "source/fuzz/fuzzer_pass_push_ids_through_variables.h"
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606) Adds FuzzerPassAddCompositeInserts, which randomly adds new OpCompositeInsert instructions. Each OpCompositeInsert instruction yields a copy of an original composite with one subcomponent replaced with an existing or newly added object. Synonym facts are added for the unchanged components in the original and added composite, and for the replaced subcomponent and the object, if possible. Fixes #2859
2020-08-19 12:56:03 +00:00
#include "source/fuzz/fuzzer_pass_replace_adds_subs_muls_with_carrying_extended.h"
spirv-fuzz: Replace dead-block terminators with OpKill etc. (#3882) Fixes #3615.
2020-10-06 14:59:05 +00:00
#include "source/fuzz/fuzzer_pass_replace_branches_from_dead_blocks_with_exits.h"
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606) Adds FuzzerPassAddCompositeInserts, which randomly adds new OpCompositeInsert instructions. Each OpCompositeInsert instruction yields a copy of an original composite with one subcomponent replaced with an existing or newly added object. Synonym facts are added for the unchanged components in the original and added composite, and for the replaced subcomponent and the object, if possible. Fixes #2859
2020-08-19 12:56:03 +00:00
#include "source/fuzz/fuzzer_pass_replace_copy_memories_with_loads_stores.h"
#include "source/fuzz/fuzzer_pass_replace_copy_objects_with_stores_loads.h"
spirv-fuzz: Transformation to replace the use of an irrelevant id (#3697) A transformation that replaces the use of an irrelevant id with another id of the same type. The related fuzzer pass, for every use of an irrelevant id, checks whether the id can be replaced in that use by another id of the same type and randomly decides whether to replace it. Fixes #3503.
2020-09-01 15:28:04 +00:00
#include "source/fuzz/fuzzer_pass_replace_irrelevant_ids.h"
spirv-fuzz: Add replace linear algebra instruction transformation (#3402) This PR implements a transformation that replaces a linear algebra instruction with its mathematical definition.
2020-06-16 10:20:51 +00:00
#include "source/fuzz/fuzzer_pass_replace_linear_algebra_instructions.h"
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606) Adds FuzzerPassAddCompositeInserts, which randomly adds new OpCompositeInsert instructions. Each OpCompositeInsert instruction yields a copy of an original composite with one subcomponent replaced with an existing or newly added object. Synonym facts are added for the unchanged components in the original and added composite, and for the replaced subcomponent and the object, if possible. Fixes #2859
2020-08-19 12:56:03 +00:00
#include "source/fuzz/fuzzer_pass_replace_loads_stores_with_copy_memories.h"
spirv-fuzz: Replace id in OpPhi coming from a dead predecessor (#3744) This transformation takes the id of an OpPhi instruction, of a dead predecessor of the block containing it and a replacement id of available to use and of the same type as the OpPhi, and changes the id in the OpPhi corresponding to the given predecessor. For example, %id = OpPhi %type %v1 %p1 %v2 %p2 becomes %id = OpPhi %type %v3 %p1 %v2 %p2 if the transformation is given %id, %p1 and %v3, %p1 is a dead block, %v3 is type type and it is available to use at the end of %p1. The fuzzer pass randomly decides to apply the transformation to OpPhi instructions for which at least one of the predecessors is dead Fixes #3726.
2020-09-02 00:06:38 +00:00
#include "source/fuzz/fuzzer_pass_replace_opphi_ids_from_dead_predecessors.h"
spirv-fuzz: Transformation to convert OpSelect to conditional branch (#3681) This transformation takes an OpSelect instruction and replaces it with a conditional branch, selecting the correct value using an OpPhi instruction. Fixes part of the issue #3544.
2020-09-03 09:19:02 +00:00
#include "source/fuzz/fuzzer_pass_replace_opselects_with_conditional_branches.h"
spirv-fuzz: TransformationReplaceParameterWithGlobal (#3434) Fixes #3432.
2020-07-09 10:03:49 +00:00
#include "source/fuzz/fuzzer_pass_replace_parameter_with_global.h"
spirv-fuzz: TransformationReplaceParamsWithStruct (#3455) Fixes #3453.
2020-07-21 20:02:32 +00:00
#include "source/fuzz/fuzzer_pass_replace_params_with_struct.h"
Add "split block" transformation. (#2633) With this pass, the fuzzer can split blocks in the input module. This is mainly useful in order to give other (future) transformations more opportunities to apply.
2019-05-29 15:42:46 +00:00
#include "source/fuzz/fuzzer_pass_split_blocks.h"
spirv-fuzz: Add swap commutable operands transformation (#3205) In this PR, the classes that represent the swap commutable operands transformation and the fuzzer pass were implemented. Fixes #3205.
2020-03-05 08:18:39 +00:00
#include "source/fuzz/fuzzer_pass_swap_commutable_operands.h"
spirv-fuzz: Swap operands in OpBranchConditional (#3423) Fixes #3415.
2020-06-19 15:38:52 +00:00
#include "source/fuzz/fuzzer_pass_swap_conditional_branch_operands.h"
spirv-fuzz: Swap positions of two functions in a module (#4236) Adds a new transformation class that swaps the syntactic position of two functions in the module, and a fuzzer pass to apply it. Fixes #4026.
2021-04-27 11:33:08 +00:00
#include "source/fuzz/fuzzer_pass_swap_functions.h"
spirv-fuzz: Add toggle access chain instruction transformation (#3211) In this PR, the classes that represent the toggle access chain instruction transformation and fuzzer pass were implemented. This transformation toggles the instructions OpAccessChain and OpInBoundsAccessChain between them. Fixes #3193.
2020-03-08 22:33:24 +00:00
#include "source/fuzz/fuzzer_pass_toggle_access_chain_instruction.h"
spirv-fuzz: TransformationWrapRegionInSelection (#3674) Fixes #3675.
2020-10-01 08:54:10 +00:00
#include "source/fuzz/fuzzer_pass_wrap_regions_in_selections.h"
spirv-fuzz: TransformationWrapVectorSynonym that rewrites scalar operations using vectors (#4376) Adds a new transformation that rewrites a scalar operation (like OpFAdd, opISub) as an equivalent vector operation, adding a synonym between the scalar result and an appropriate component of the vector result. Fixes #4195.
2021-07-20 10:01:20 +00:00
#include "source/fuzz/fuzzer_pass_wrap_vector_synonym.h"
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
#include "source/fuzz/pass_management/repeated_pass_manager.h"
#include "source/fuzz/pass_management/repeated_pass_recommender_standard.h"
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
#include "source/fuzz/protobufs/spirvfuzz_protobufs.h"
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
#include "source/fuzz/transformation_context.h"
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
#include "source/opt/build_module.h"
#include "source/spirv_fuzzer_options.h"
#include "source/util/make_unique.h"
namespace spvtools {
namespace fuzz {
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
Fuzzer::Fuzzer(std::unique_ptr<opt::IRContext> ir_context,
std::unique_ptr<TransformationContext> transformation_context,
std::unique_ptr<FuzzerContext> fuzzer_context,
MessageConsumer consumer,
spirv-fuzz: Refactor fuzzer, replayer and shrinker (#3818) In preparation for some upcoming work on the shrinker, this PR changes the interfaces of Fuzzer, Replayer and Shrinker so that all data relevant to each class is provided on construction, meaning that the "Run" method can become a zero-argument method that returns a status, transformed binary and sequence of applied transformations via a struct. This makes greater use of fields, so that -- especially in Fuzzer -- there is a lot less parameter passing.
2020-09-22 09:07:58 +00:00
const std::vector<fuzzerutil::ModuleSupplier>& donor_suppliers,
bool enable_all_passes,
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
RepeatedPassStrategy repeated_pass_strategy,
spirv-fuzz: Add validator options (#3254) Allows several validator options to be passed to the fuzzer, to be used when validation is invoked during fuzzing.
2020-04-02 13:37:59 +00:00
bool validate_after_each_fuzzer_pass,
spirv-fuzz: Allow inapplicable transformations to be ignored (#4407) spirv-fuzz features transformations that should be applicable by construction. Assertions are used to detect when such transformations turn out to be inapplicable. Failures of such assertions indicate bugs in the fuzzer. However, when using the fuzzer at scale (e.g. in ClusterFuzz) reports of these assertion failures create noise, and cause the fuzzer to exit early. This change adds an option whereby inapplicable transformations can be ignored. This reduces noise and allows fuzzing to continue even when a transformation that should be applicable but is not has been erroneously created.
2021-07-28 21:59:37 +00:00
spv_validator_options validator_options,
Fuzzer: Default the new constructor parameter (#4438) Introducing a new mandatory parameter makes it very difficult to roll Chromium to a new version of SPIRV-Tools, as this project is used by several third-party projects, and an atomic update of all projects is very hard to coordinate.
2021-08-02 12:37:37 +00:00
bool ignore_inapplicable_transformations /* = true */)
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
: consumer_(std::move(consumer)),
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
enable_all_passes_(enable_all_passes),
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
validate_after_each_fuzzer_pass_(validate_after_each_fuzzer_pass),
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
validator_options_(validator_options),
spirv-fuzz: Refactor fuzzer, replayer and shrinker (#3818) In preparation for some upcoming work on the shrinker, this PR changes the interfaces of Fuzzer, Replayer and Shrinker so that all data relevant to each class is provided on construction, meaning that the "Run" method can become a zero-argument method that returns a status, transformed binary and sequence of applied transformations via a struct. This makes greater use of fields, so that -- especially in Fuzzer -- there is a lot less parameter passing.
2020-09-22 09:07:58 +00:00
num_repeated_passes_applied_(0),
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
is_valid_(true),
ir_context_(std::move(ir_context)),
transformation_context_(std::move(transformation_context)),
fuzzer_context_(std::move(fuzzer_context)),
transformation_sequence_out_(),
pass_instances_(),
repeated_pass_recommender_(nullptr),
repeated_pass_manager_(nullptr),
spirv-fuzz: Allow inapplicable transformations to be ignored (#4407) spirv-fuzz features transformations that should be applicable by construction. Assertions are used to detect when such transformations turn out to be inapplicable. Failures of such assertions indicate bugs in the fuzzer. However, when using the fuzzer at scale (e.g. in ClusterFuzz) reports of these assertion failures create noise, and cause the fuzzer to exit early. This change adds an option whereby inapplicable transformations can be ignored. This reduces noise and allows fuzzing to continue even when a transformation that should be applicable but is not has been erroneously created.
2021-07-28 21:59:37 +00:00
final_passes_(),
ignore_inapplicable_transformations_(
ignore_inapplicable_transformations) {
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
assert(ir_context_ && "IRContext is not initialized");
assert(fuzzer_context_ && "FuzzerContext is not initialized");
assert(transformation_context_ && "TransformationContext is not initialized");
assert(fuzzerutil::IsValidAndWellFormed(ir_context_.get(), validator_options_,
consumer_) &&
"IRContext is invalid");
// The following passes are likely to be very useful: many other passes
// introduce synonyms, irrelevant ids and constants that these passes can work
// with. We thus enable them with high probability.
MaybeAddRepeatedPass<FuzzerPassObfuscateConstants>(90, &pass_instances_);
MaybeAddRepeatedPass<FuzzerPassApplyIdSynonyms>(90, &pass_instances_);
MaybeAddRepeatedPass<FuzzerPassReplaceIrrelevantIds>(90, &pass_instances_);
do {
// Each call to MaybeAddRepeatedPass randomly decides whether the given pass
// should be enabled, and adds an instance of the pass to |pass_instances|
// if it is enabled.
MaybeAddRepeatedPass<FuzzerPassAddAccessChains>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddBitInstructionSynonyms>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddCompositeExtract>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddCompositeInserts>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddCompositeTypes>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddCopyMemory>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddDeadBlocks>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddDeadBreaks>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddDeadContinues>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddEquationInstructions>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddFunctionCalls>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddGlobalVariables>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddImageSampleUnusedComponents>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddLoads>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddLocalVariables>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddLoopPreheaders>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddLoopsToCreateIntConstantSynonyms>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddOpPhiSynonyms>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddParameters>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddRelaxedDecorations>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddStores>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddSynonyms>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassAddVectorShuffleInstructions>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassConstructComposites>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassCopyObjects>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassDonateModules>(&pass_instances_,
donor_suppliers);
MaybeAddRepeatedPass<FuzzerPassDuplicateRegionsWithSelections>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassExpandVectorReductions>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassFlattenConditionalBranches>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassInlineFunctions>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassInvertComparisonOperators>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassMakeVectorOperationsDynamic>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassMergeBlocks>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassMergeFunctionReturns>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassMutatePointers>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassOutlineFunctions>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassPermuteBlocks>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassPermuteFunctionParameters>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassPermuteInstructions>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassPropagateInstructionsDown>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassPropagateInstructionsUp>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassPushIdsThroughVariables>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassReplaceAddsSubsMulsWithCarryingExtended>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassReplaceBranchesFromDeadBlocksWithExits>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassReplaceCopyMemoriesWithLoadsStores>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassReplaceCopyObjectsWithStoresLoads>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassReplaceLoadsStoresWithCopyMemories>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassReplaceParameterWithGlobal>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassReplaceLinearAlgebraInstructions>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassReplaceOpPhiIdsFromDeadPredecessors>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassReplaceOpSelectsWithConditionalBranches>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassReplaceParamsWithStruct>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassSplitBlocks>(&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassSwapBranchConditionalOperands>(
&pass_instances_);
MaybeAddRepeatedPass<FuzzerPassWrapRegionsInSelections>(&pass_instances_);
spirv-fuzz: TransformationWrapVectorSynonym that rewrites scalar operations using vectors (#4376) Adds a new transformation that rewrites a scalar operation (like OpFAdd, opISub) as an equivalent vector operation, adding a synonym between the scalar result and an appropriate component of the vector result. Fixes #4195.
2021-07-20 10:01:20 +00:00
MaybeAddRepeatedPass<FuzzerPassWrapVectorSynonym>(&pass_instances_);
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
// There is a theoretical possibility that no pass instances were created
// until now; loop again if so.
} while (pass_instances_.GetPasses().empty());
repeated_pass_recommender_ = MakeUnique<RepeatedPassRecommenderStandard>(
&pass_instances_, fuzzer_context_.get());
repeated_pass_manager_ = RepeatedPassManager::Create(
repeated_pass_strategy, fuzzer_context_.get(), &pass_instances_,
repeated_pass_recommender_.get());
MaybeAddFinalPass<FuzzerPassAdjustBranchWeights>(&final_passes_);
MaybeAddFinalPass<FuzzerPassAdjustFunctionControls>(&final_passes_);
MaybeAddFinalPass<FuzzerPassAdjustLoopControls>(&final_passes_);
MaybeAddFinalPass<FuzzerPassAdjustMemoryOperandsMasks>(&final_passes_);
MaybeAddFinalPass<FuzzerPassAdjustSelectionControls>(&final_passes_);
MaybeAddFinalPass<FuzzerPassAddNoContractionDecorations>(&final_passes_);
spirv-fuzz: Add WGSL compatibility flag to context (#4193) The new flags allows transformations and fuzzer passes to be enabled and applied in a WGSL-compatible fashion.
2021-03-21 09:10:15 +00:00
if (!fuzzer_context_->IsWgslCompatible()) {
spirv-fuzz: Fix comments #4215 Related to #4214.
2021-03-25 17:20:45 +00:00
// TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/4214):
// this is disabled temporarily due to some issues in the Tint compiler.
// Enable it back when the issues are resolved.
spirv-fuzz: Add WGSL compatibility flag to context (#4193) The new flags allows transformations and fuzzer passes to be enabled and applied in a WGSL-compatible fashion.
2021-03-21 09:10:15 +00:00
MaybeAddFinalPass<FuzzerPassInterchangeSignednessOfIntegerOperands>(
&final_passes_);
}
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
MaybeAddFinalPass<FuzzerPassInterchangeZeroLikeConstants>(&final_passes_);
spirv-fuzz: Permute the order of variables at function scope issue (#4248) Fixes #4194.
2021-04-26 15:53:55 +00:00
MaybeAddFinalPass<FuzzerPassPermuteFunctionVariables>(&final_passes_);
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
MaybeAddFinalPass<FuzzerPassPermutePhiOperands>(&final_passes_);
MaybeAddFinalPass<FuzzerPassSwapCommutableOperands>(&final_passes_);
spirv-fuzz: Swap positions of two functions in a module (#4236) Adds a new transformation class that swaps the syntactic position of two functions in the module, and a fuzzer pass to apply it. Fixes #4026.
2021-04-27 11:33:08 +00:00
MaybeAddFinalPass<FuzzerPassSwapFunctions>(&final_passes_);
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
MaybeAddFinalPass<FuzzerPassToggleAccessChainInstruction>(&final_passes_);
}
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
Fuzzer::~Fuzzer() = default;
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
template <typename FuzzerPassT, typename... Args>
spirv-fuzz: Enable some passes with high probability (#3860) Fixes #3764.
2020-10-01 08:07:06 +00:00
void Fuzzer::MaybeAddRepeatedPass(uint32_t percentage_chance_of_adding_pass,
RepeatedPassInstances* pass_instances,
spirv-fuzz: Refactor fuzzer, replayer and shrinker (#3818) In preparation for some upcoming work on the shrinker, this PR changes the interfaces of Fuzzer, Replayer and Shrinker so that all data relevant to each class is provided on construction, meaning that the "Run" method can become a zero-argument method that returns a status, transformed binary and sequence of applied transformations via a struct. This makes greater use of fields, so that -- especially in Fuzzer -- there is a lot less parameter passing.
2020-09-22 09:07:58 +00:00
Args&&... extra_args) {
spirv-fuzz: Enable some passes with high probability (#3860) Fixes #3764.
2020-10-01 08:07:06 +00:00
if (enable_all_passes_ ||
fuzzer_context_->ChoosePercentage(percentage_chance_of_adding_pass)) {
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
pass_instances->SetPass(MakeUnique<FuzzerPassT>(
spirv-fuzz: Refactor fuzzer, replayer and shrinker (#3818) In preparation for some upcoming work on the shrinker, this PR changes the interfaces of Fuzzer, Replayer and Shrinker so that all data relevant to each class is provided on construction, meaning that the "Run" method can become a zero-argument method that returns a status, transformed binary and sequence of applied transformations via a struct. This makes greater use of fields, so that -- especially in Fuzzer -- there is a lot less parameter passing.
2020-09-22 09:07:58 +00:00
ir_context_.get(), transformation_context_.get(), fuzzer_context_.get(),
spirv-fuzz: Allow inapplicable transformations to be ignored (#4407) spirv-fuzz features transformations that should be applicable by construction. Assertions are used to detect when such transformations turn out to be inapplicable. Failures of such assertions indicate bugs in the fuzzer. However, when using the fuzzer at scale (e.g. in ClusterFuzz) reports of these assertion failures create noise, and cause the fuzzer to exit early. This change adds an option whereby inapplicable transformations can be ignored. This reduces noise and allows fuzzing to continue even when a transformation that should be applicable but is not has been erroneously created.
2021-07-28 21:59:37 +00:00
&transformation_sequence_out_, ignore_inapplicable_transformations_,
std::forward<Args>(extra_args)...));
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
}
}
template <typename FuzzerPassT, typename... Args>
spirv-fuzz: Refactor fuzzer, replayer and shrinker (#3818) In preparation for some upcoming work on the shrinker, this PR changes the interfaces of Fuzzer, Replayer and Shrinker so that all data relevant to each class is provided on construction, meaning that the "Run" method can become a zero-argument method that returns a status, transformed binary and sequence of applied transformations via a struct. This makes greater use of fields, so that -- especially in Fuzzer -- there is a lot less parameter passing.
2020-09-22 09:07:58 +00:00
void Fuzzer::MaybeAddFinalPass(std::vector<std::unique_ptr<FuzzerPass>>* passes,
Args&&... extra_args) {
if (enable_all_passes_ || fuzzer_context_->ChooseEven()) {
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
passes->push_back(MakeUnique<FuzzerPassT>(
spirv-fuzz: Refactor fuzzer, replayer and shrinker (#3818) In preparation for some upcoming work on the shrinker, this PR changes the interfaces of Fuzzer, Replayer and Shrinker so that all data relevant to each class is provided on construction, meaning that the "Run" method can become a zero-argument method that returns a status, transformed binary and sequence of applied transformations via a struct. This makes greater use of fields, so that -- especially in Fuzzer -- there is a lot less parameter passing.
2020-09-22 09:07:58 +00:00
ir_context_.get(), transformation_context_.get(), fuzzer_context_.get(),
spirv-fuzz: Allow inapplicable transformations to be ignored (#4407) spirv-fuzz features transformations that should be applicable by construction. Assertions are used to detect when such transformations turn out to be inapplicable. Failures of such assertions indicate bugs in the fuzzer. However, when using the fuzzer at scale (e.g. in ClusterFuzz) reports of these assertion failures create noise, and cause the fuzzer to exit early. This change adds an option whereby inapplicable transformations can be ignored. This reduces noise and allows fuzzing to continue even when a transformation that should be applicable but is not has been erroneously created.
2021-07-28 21:59:37 +00:00
&transformation_sequence_out_, ignore_inapplicable_transformations_,
std::forward<Args>(extra_args)...));
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
}
}
spirv-fuzz: Fix to TransformationInlineFunction (#3913) This fixes a problem where TransformationInlineFunction could lead to distinct instructions having identical unique ids. It adds a validity check to detect this problem in general. Fixes #3911.
2020-10-16 21:58:09 +00:00
bool Fuzzer::ApplyPassAndCheckValidity(FuzzerPass* pass) const {
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
pass->Apply();
spirv-fuzz: Fix to TransformationInlineFunction (#3913) This fixes a problem where TransformationInlineFunction could lead to distinct instructions having identical unique ids. It adds a validity check to detect this problem in general. Fixes #3911.
2020-10-16 21:58:09 +00:00
return !validate_after_each_fuzzer_pass_ ||
fuzzerutil::IsValidAndWellFormed(ir_context_.get(), validator_options_,
consumer_);
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
}
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
opt::IRContext* Fuzzer::GetIRContext() { return ir_context_.get(); }
spirv-fuzz: Refactor fuzzer, replayer and shrinker (#3818) In preparation for some upcoming work on the shrinker, this PR changes the interfaces of Fuzzer, Replayer and Shrinker so that all data relevant to each class is provided on construction, meaning that the "Run" method can become a zero-argument method that returns a status, transformed binary and sequence of applied transformations via a struct. This makes greater use of fields, so that -- especially in Fuzzer -- there is a lot less parameter passing.
2020-09-22 09:07:58 +00:00
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
const protobufs::TransformationSequence& Fuzzer::GetTransformationSequence()
const {
return transformation_sequence_out_;
}
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
Fuzzer::Result Fuzzer::Run(uint32_t num_of_transformations_to_apply) {
assert(is_valid_ && "The module was invalidated during the previous fuzzing");
spirv-fuzz: Enable some passes with high probability (#3860) Fixes #3764.
2020-10-01 08:07:06 +00:00
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
const auto initial_num_of_transformations =
static_cast<uint32_t>(transformation_sequence_out_.transformation_size());
spirv-fuzz: Enable some passes with high probability (#3860) Fixes #3764.
2020-10-01 08:07:06 +00:00
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
auto status = Status::kComplete;
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
do {
spirv-fuzz: Apply fuzzer pass before checking exit conditions (#4199) Fixes #4198.
2021-03-19 05:32:54 +00:00
if (!ApplyPassAndCheckValidity(
repeated_pass_manager_->ChoosePass(transformation_sequence_out_))) {
status = Status::kFuzzerPassLedToInvalidModule;
break;
}
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
// Check that the module is small enough.
if (ir_context_->module()->id_bound() >=
fuzzer_context_->GetIdBoundLimit()) {
status = Status::kModuleTooBig;
break;
}
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
auto transformations_applied_so_far = static_cast<uint32_t>(
transformation_sequence_out_.transformation_size());
assert(transformations_applied_so_far >= initial_num_of_transformations &&
"Number of transformations cannot decrease");
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
// Check if we've already applied the maximum number of transformations.
if (transformations_applied_so_far >=
fuzzer_context_->GetTransformationLimit()) {
status = Status::kTransformationLimitReached;
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
break;
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
}
spirv-fuzz: Apply fuzzer pass before checking exit conditions (#4199) Fixes #4198.
2021-03-19 05:32:54 +00:00
// Check that we've not got stuck (this can happen if the only available
// fuzzer passes are not able to apply any transformations, or can only
// apply very few transformations).
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
if (num_repeated_passes_applied_ >=
fuzzer_context_->GetTransformationLimit()) {
status = Status::kFuzzerStuck;
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
break;
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
}
// Check whether we've exceeded the number of transformations we can apply
// in a single call to this method.
if (num_of_transformations_to_apply != 0 &&
transformations_applied_so_far - initial_num_of_transformations >=
num_of_transformations_to_apply) {
status = Status::kComplete;
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
break;
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
}
Add spirv-fuzz pass to permute blocks. (#2642) The blocks within each function in the module will be permuted in a randomized manner that respects dominance.
2019-05-31 08:59:06 +00:00
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
} while (ShouldContinueRepeatedPasses(num_of_transformations_to_apply == 0));
Add spirv-fuzz pass to permute blocks. (#2642) The blocks within each function in the module will be permuted in a randomized manner that respects dominance.
2019-05-31 08:59:06 +00:00
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
if (status != Status::kFuzzerPassLedToInvalidModule) {
// We apply this transformations despite the fact that we might exceed
// |num_of_transformations_to_apply|. This is not a problem for us since
// these fuzzer passes are relatively simple yet might trigger some bugs.
for (auto& pass : final_passes_) {
if (!ApplyPassAndCheckValidity(pass.get())) {
status = Status::kFuzzerPassLedToInvalidModule;
break;
}
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
}
spirv-fuzz: Add fuzzer pass to add NoContraction decorations (#2950) A new pass that allows the fuzzer to add NoContraction decorations to arithmetic instructions. Fixes #2936.
2019-10-11 08:15:47 +00:00
}
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
is_valid_ = status != Status::kFuzzerPassLedToInvalidModule;
return {status, static_cast<uint32_t>(
transformation_sequence_out_.transformation_size()) !=
initial_num_of_transformations};
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
}
spirv-fuzz: Add persistent state to the fuzzer (#4137) Adds persistent state to the fuzzer so that it can be used as a custom mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
bool Fuzzer::ShouldContinueRepeatedPasses(
bool continue_fuzzing_probabilistically) {
if (continue_fuzzing_probabilistically) {
// If we have applied T transformations so far, and the limit on the number
// of transformations to apply is L (where T < L), the chance that we will
// continue fuzzing is:
//
// 1 - T/(2*L)
//
// That is, the chance of continuing decreases as more transformations are
// applied. Using 2*L instead of L increases the number of transformations
// that are applied on average.
auto transformations_applied_so_far = static_cast<uint32_t>(
transformation_sequence_out_.transformation_size());
auto chance_of_continuing = static_cast<uint32_t>(
100.0 *
(1.0 - (static_cast<double>(transformations_applied_so_far) /
(2.0 * static_cast<double>(
fuzzer_context_->GetTransformationLimit())))));
if (!fuzzer_context_->ChoosePercentage(chance_of_continuing)) {
// We have probabilistically decided to stop.
return false;
}
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
}
// Continue fuzzing!
num_repeated_passes_applied_++;
return true;
}
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
} // namespace fuzz
} // namespace spvtools
Reference in New Issue Copy Permalink