AuroraMiddleware/SPIRV-Tools
1
0
Fork 0
mirror of https://github.com/KhronosGroup/SPIRV-Tools synced 2024-10-20 03:50:05 +00:00
Code Issues Packages Projects Releases Wiki Activity
60ce96e2ff
SPIRV-Tools/source/fuzz/fuzzer.cpp

495 lines
24 KiB
C++
Raw Normal View History

Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
// Copyright (c) 2019 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include "source/fuzz/fuzzer.h"
#include <cassert>
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
#include <memory>
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
#include <numeric>
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
spirv-fuzz: Split the fact manager into multiple files (#3699) Part of #3698. This splits various components of the fact manager into multiple files.
2020-08-25 17:11:37 +00:00
#include "source/fuzz/fact_manager/fact_manager.h"
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
#include "source/fuzz/fuzzer_context.h"
spirv-fuzz: Fuzzer pass that adds access chains (#3182) This change adds a fuzzer pass that sprinkles access chain instructions into a module at random. This allows other passes to have a richer set of pointers available to them, in particular the passes that add loads and stores.
2020-02-11 23:10:57 +00:00
#include "source/fuzz/fuzzer_pass_add_access_chains.h"
spirv-fuzz: Add bit instruction synonym transformation (#3775) This PR implements part of the add bit instruction synonym transformation. For now, the implementation covers the OpBitwiseOr, OpBitwiseXor and OpBitwiseAnd cases.
2020-09-15 22:36:23 +00:00
#include "source/fuzz/fuzzer_pass_add_bit_instruction_synonyms.h"
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606) Adds FuzzerPassAddCompositeInserts, which randomly adds new OpCompositeInsert instructions. Each OpCompositeInsert instruction yields a copy of an original composite with one subcomponent replaced with an existing or newly added object. Synonym facts are added for the unchanged components in the original and added composite, and for the replaced subcomponent and the object, if possible. Fixes #2859
2020-08-19 12:56:03 +00:00
#include "source/fuzz/fuzzer_pass_add_composite_inserts.h"
spirv-fuzz: Fuzzer pass to add composite types (#3171) Adds a fuzzer pass that randomly adds vector and matrix types not already present in the module, and randomly adds structs with random field types and arrays with random base types and sizes. Other passes will be able to create variables and ids using these types.
2020-02-04 14:00:19 +00:00
#include "source/fuzz/fuzzer_pass_add_composite_types.h"
spirv-fuzz: Add FuzzerPassAddCopyMemoryInstructions (#3391) Fixes #3382.
2020-06-30 20:13:05 +00:00
#include "source/fuzz/fuzzer_pass_add_copy_memory.h"
spirv-fuzz: add dead blocks (#3135) This adds a new kind of fact to the fact manager that knows whether a block is dead - i.e. guaranteed to be statically unreachable - and a new transformation for adding a selection construct to a CFG that conditionally branches to a fresh, dead block, such that the branch will never be dynamically taken. Transformations that may create new blocks ('split block' and 'outline function') are updated to propagate dead block facts to newly-created blocks where appropriate. A fuzzer pass randomly adds dead blocks to the module. Future transformations will be able to exploit the fact that such blocks are known to be dead.
2020-01-13 22:04:01 +00:00
#include "source/fuzz/fuzzer_pass_add_dead_blocks.h"
Add fuzzer pass to add dead breaks. (#2654) This pass randomly add breaks to the merge blocks of selection and loop constructs, such that the breaking edges will not be dynamically reachable.
2019-06-05 07:02:16 +00:00
#include "source/fuzz/fuzzer_pass_add_dead_breaks.h"
Transformation and fuzzer pass to add dead continues (#2758) Similar to the existing 'add dead breaks' pass, this adds a pass to add dead continues to blocks in loops where such a transformation is viable. Various functionality common to this new pass and 'add dead breaks' has been factored into 'fuzzer_util', and some small improvements to 'add dead breaks' that were identified while reviewing that code again have been applied. Fixes #2719.
2019-07-25 12:50:33 +00:00
#include "source/fuzz/fuzzer_pass_add_dead_continues.h"
spirv-fuzz: Fuzzer pass to add equation instructions (#3202) This introduces a new fuzzer pass to add instructions to the module that define equations, and support in the fact manager for recording equation facts and deducing synonym facts from equation facts. Initially the only equations that are supported involve OpIAdd, OpISub, OpSNegate and OpLogicalNot, but there is scope for adding support for equations over various other operators.
2020-03-04 14:54:08 +00:00
#include "source/fuzz/fuzzer_pass_add_equation_instructions.h"
spirv-fuzz: Fuzzer pass to add function calls (#3178) Adds a fuzzer pass that inserts function calls into the module at random. Calls from dead blocks can be arbitrary (so long as they do not introduce recursion), while calls from other blocks can only be to livesafe functions. The change fixes some oversights in transformations to replace constants with uniforms and to obfuscate constants which testing of this fuzzer pass identified.
2020-02-10 23:22:34 +00:00
#include "source/fuzz/fuzzer_pass_add_function_calls.h"
spirv-fuzz: Fuzzer passes to add local and global variables (#3175) Adds two new fuzzer passes to add variables to a module: one that adds Private storage class global variables, another that adds Function storage class local variables.
2020-02-05 21:07:44 +00:00
#include "source/fuzz/fuzzer_pass_add_global_variables.h"
spirv-fuzz: Add image sample unused components transformation (#3439) Fixes #3375.
2020-07-08 16:07:04 +00:00
#include "source/fuzz/fuzzer_pass_add_image_sample_unused_components.h"
spirv-fuzz: Add fuzzer passes to add loads/stores (#3176) This change adds fuzzer passes that sprinkle loads and stores into a module at random, with stores restricted to occur in either dead blocks, or to use pointers for which it is known that the pointee value does not influence the module's overall behaviour. The change also generalises the VariableValueIsArbitrary fact to PointeeValueIsIrrelevant, to allow stores through access chains or object copies of variables whose values are known to be irrelevant. The change includes some other minor refactorings.
2020-02-06 16:54:34 +00:00
#include "source/fuzz/fuzzer_pass_add_loads.h"
spirv-fuzz: Fuzzer passes to add local and global variables (#3175) Adds two new fuzzer passes to add variables to a module: one that adds Private storage class global variables, another that adds Function storage class local variables.
2020-02-05 21:07:44 +00:00
#include "source/fuzz/fuzzer_pass_add_local_variables.h"
spirv-fuzz: Fuzzer pass to randomly apply loop preheaders (#3668) This PR introduces FuzzerPassAddLoopPreheaders, which: - Finds existing loop headers - If they have no simple preheader (where simple means that the preheader itself is not a loop header), randomly decides whether to add one. Fixes #3621.
2020-08-14 11:44:28 +00:00
#include "source/fuzz/fuzzer_pass_add_loop_preheaders.h"
spirv-fuzz: Add fuzzer pass to add NoContraction decorations (#2950) A new pass that allows the fuzzer to add NoContraction decorations to arithmetic instructions. Fixes #2936.
2019-10-11 08:15:47 +00:00
#include "source/fuzz/fuzzer_pass_add_no_contraction_decorations.h"
spirv-fuzz: Create synonym via OpPhi and existing synonyms (#3701) A transformation that adds new OpPhi instructions to blocks with >=1 predecessors, so that its value depends on previously-defined ids of the right type, which are all synonymous. This instruction is also recorded as synonymous to the others. The related fuzzer pass still needs to be implemented. Fixes #3592 .
2020-08-27 14:59:54 +00:00
#include "source/fuzz/fuzzer_pass_add_opphi_synonyms.h"
spirv-fuzz: Implement FuzzerPassAddParameters (#3399) Fixes #3384.
2020-06-23 16:40:44 +00:00
#include "source/fuzz/fuzzer_pass_add_parameters.h"
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606) Adds FuzzerPassAddCompositeInserts, which randomly adds new OpCompositeInsert instructions. Each OpCompositeInsert instruction yields a copy of an original composite with one subcomponent replaced with an existing or newly added object. Synonym facts are added for the unchanged components in the original and added composite, and for the replaced subcomponent and the object, if possible. Fixes #2859
2020-08-19 12:56:03 +00:00
#include "source/fuzz/fuzzer_pass_add_relaxed_decorations.h"
spirv-fuzz: Add fuzzer passes to add loads/stores (#3176) This change adds fuzzer passes that sprinkle loads and stores into a module at random, with stores restricted to occur in either dead blocks, or to use pointers for which it is known that the pointee value does not influence the module's overall behaviour. The change also generalises the VariableValueIsArbitrary fact to PointeeValueIsIrrelevant, to allow stores through access chains or object copies of variables whose values are known to be irrelevant. The change includes some other minor refactorings.
2020-02-06 16:54:34 +00:00
#include "source/fuzz/fuzzer_pass_add_stores.h"
spirv-fuzz: TransformationAddSynonyms (#3447) Part of #3440.
2020-07-12 08:59:08 +00:00
#include "source/fuzz/fuzzer_pass_add_synonyms.h"
spirv-fuzz: Implement vector shuffle fuzzer pass (#3412) Fixes #3108.
2020-06-16 10:21:31 +00:00
#include "source/fuzz/fuzzer_pass_add_vector_shuffle_instructions.h"
Add adjust branch weights transformation (#3336) In this PR, the classes that represent the adjust branch weights transformation and fuzzer pass were implemented. This transformation adjusts the branch weights of a OpBranchConditional instruction.
2020-05-14 10:38:34 +00:00
#include "source/fuzz/fuzzer_pass_adjust_branch_weights.h"
spirv-fuzz: Add fuzzer pass to change function controls (#2951) A new pass that allows the fuzzer to change the 'function control' operand of OpFunction instructions. Fixes #2939.
2019-10-11 06:10:47 +00:00
#include "source/fuzz/fuzzer_pass_adjust_function_controls.h"
spirv-fuzz: Add fuzzer pass to change loop controls (#2949) A new pass that allows the fuzzer to change the 'loop control' operand (and associated literal operands) of OpLoopMerge instructions. Fixes #2938. Fixes #2943.
2019-10-10 12:34:38 +00:00
#include "source/fuzz/fuzzer_pass_adjust_loop_controls.h"
spirv-fuzz: Fuzzer pass to interchange zero-like constants (#3524) This fuzzer pass: For each zero-like constant, either finds the existing definition of the corresponding toggled one (OpConstantNull becomes zero-valued scalar OpConstant or vice versa) or creates a new one if it doesn't exist and records that the two are synonyms For each use of these constants, probabilistically decides whether to change it with the corresponding toggled constant id (as described in #3486 ) Only uses inside blocks of instructions are considered and not, for example, in instructions declaring other constants.
2020-07-15 11:58:29 +00:00
#include "source/fuzz/fuzzer_pass_adjust_memory_operands_masks.h"
spirv-fuzz: Add fuzzer pass to change selection controls (#2944) A new pass that allows the fuzzer to change the 'selection control' operand of OpSelectionControl instructions. Fixes #2937.
2019-10-08 10:25:34 +00:00
#include "source/fuzz/fuzzer_pass_adjust_selection_controls.h"
Add fuzzer pass to replace ids with synonyms (#2857) If the fuzzer's fact manager knows that ids A and B are synonymous, it can replace a use of A with a use of B, so long as various conditions hold (e.g. the definition of B must dominate the use of A, and it is not legal to replace a use of an OpConstant in a struct's access chain with a synonym that is not an OpConstant). This change adds a fuzzer pass to sprinke such synonym replacements through the module.
2019-09-18 19:47:08 +00:00
#include "source/fuzz/fuzzer_pass_apply_id_synonyms.h"
spirv-fuzz: add transformation and pass to construct composites (#2941) Adds a fuzzer pass and transformation to create a composite (array, matrix, struct or vector) from available constituent components, and inform the fact manager that each component of the new composite is synonymous with the id that was used to construct it. This allows the "replace id with synonym" pass to then replace uses of said ids with uses of elements extracted from the composite. Fixes #2858.
2019-10-08 13:04:10 +00:00
#include "source/fuzz/fuzzer_pass_construct_composites.h"
Add fuzzer pass to copy objects (#2853) A new fuzzer pass that randomly introduces OpCopyObject instructions that make copies of ids, and uses the fact manager to record the fact that an id %id is synonymous with an id generated by an OpCopyObject applied to %id. (A future pass will exploit such synonym facts.)
2019-09-11 22:45:20 +00:00
#include "source/fuzz/fuzzer_pass_copy_objects.h"
spirv-fuzz: Add fuzzer pass to perform module donation (#3117) This change adds a fuzzer pass that allows code from other SPIR-V modules to be donated into the module under transformation. It also changes the command-line options of the tools so that, in fuzzing mode, a file must be specified that contains the names of available donor modules.
2020-01-07 08:39:55 +00:00
#include "source/fuzz/fuzzer_pass_donate_modules.h"
spirv-fuzz: Add TransformationDuplicateRegionWithSelection (#3773) Adds a transformation that inserts a conditional statement with a boolean expression of arbitrary value and duplicates a given single-entry, single-exit region, so that it is present in each conditional branch and will be executed regardless of which branch will be taken. Fixes #3614.
2020-09-11 10:48:19 +00:00
#include "source/fuzz/fuzzer_pass_duplicate_regions_with_selections.h"
spirv-fuzz: Transformation to flatten conditional branch (#3667) This transformation, given the header of a selection construct with branching instruction OpBranchConditional, flattens it. Side-effecting operations such as OpLoad, OpStore and OpFunctionCall are enclosed within smaller conditionals. It is applicable if the construct does not contain inner selection constructs or loops, or atomic or barrier instructions. The corresponding fuzzer pass looks for selection headers and tries to flatten them. Needed for the issue #3544, but it does not fix it completely.
2020-09-15 09:31:01 +00:00
#include "source/fuzz/fuzzer_pass_flatten_conditional_branches.h"
spirv-fuzz: Add inline function transformation (#3517) Fixes #3505.
2020-08-25 16:28:23 +00:00
#include "source/fuzz/fuzzer_pass_inline_functions.h"
spirv-fuzz: Pass to replace int operands with ints of opposite signedness (#3612) This PR introduces a new fuzzer pass, which: - finds all integer vectors or constants - finds or creates the corresponding constants with opposite signedness - records such constants as synonyms of the first ones - replaces the usages of the original constants with the new ones if allowed Fixes #2677.
2020-07-30 18:48:29 +00:00
#include "source/fuzz/fuzzer_pass_interchange_signedness_of_integer_operands.h"
spirv-fuzz: Fuzzer pass to interchange zero-like constants (#3524) This fuzzer pass: For each zero-like constant, either finds the existing definition of the corresponding toggled one (OpConstantNull becomes zero-valued scalar OpConstant or vice versa) or creates a new one if it doesn't exist and records that the two are synonyms For each use of these constants, probabilistically decides whether to change it with the corresponding toggled constant id (as described in #3486 ) Only uses inside blocks of instructions are considered and not, for example, in instructions declaring other constants.
2020-07-15 11:58:29 +00:00
#include "source/fuzz/fuzzer_pass_interchange_zero_like_constants.h"
spirv-fuzz: TransformationInvertComparisonOperator (#3475) Part of #3440.
2020-07-03 16:37:32 +00:00
#include "source/fuzz/fuzzer_pass_invert_comparison_operators.h"
spirv-fuzz: Add TransformationMakeVectorOperationDynamic (#3597) Fixes #3588.
2020-08-06 14:50:18 +00:00
#include "source/fuzz/fuzzer_pass_make_vector_operations_dynamic.h"
spirv-fuzz: Fuzzer pass to merge blocks (#3097) This change adds a transformation and associated fuzzer pass for merging adjacent blocks in a module, re-using block merging code from the optimizer.
2019-12-12 15:27:40 +00:00
#include "source/fuzz/fuzzer_pass_merge_blocks.h"
spirv-fuzz: TransformationMutatePointer (#3737) Fixes #3624.
2020-09-01 11:45:13 +00:00
#include "source/fuzz/fuzzer_pass_mutate_pointers.h"
Add fuzzer pass to obfuscate constants. (#2671) Adds a new transformation that can replace a constant with a uniform known to have the same value, and adds a fuzzer pass that (a) replaces a boolean with a comparison of literals (e.g. replacing "true" with "42 > 24"), and then (b) obfuscates the literals appearing in this comparison by replacing them with identically-valued uniforms, if available. The fuzzer_replayer test file has also been updated to allow initial facts to be provided, and to do error checking of the status results returned by the fuzzer and replayer components.
2019-06-18 17:41:08 +00:00
#include "source/fuzz/fuzzer_pass_obfuscate_constants.h"
spirv-fuzz: function outlining fuzzer pass (#3078) A new transformation and associated fuzzer pass in spirv-fuzz that selects single-entry single-exit control flow graph regions and for each selected region outlines the region into a new function and replaces the original region with a call to this function.
2019-12-10 14:47:42 +00:00
#include "source/fuzz/fuzzer_pass_outline_functions.h"
Add spirv-fuzz pass to permute blocks. (#2642) The blocks within each function in the module will be permuted in a randomized manner that respects dominance.
2019-05-31 08:59:06 +00:00
#include "source/fuzz/fuzzer_pass_permute_blocks.h"
spirv-fuzz: Add fuzzer pass to permute function parameters (#3212) Fixes #3194.
2020-03-08 14:27:05 +00:00
#include "source/fuzz/fuzzer_pass_permute_function_parameters.h"
spirv-fuzz: TransformationMoveInstructionDown (#3477) Swaps an instruction with the next instruction in the block. Fixes #3457.
2020-08-03 15:45:24 +00:00
#include "source/fuzz/fuzzer_pass_permute_instructions.h"
spirv-fuzz: Permute OpPhi instruction operands (#3421) Fixes #3415.
2020-06-23 14:00:28 +00:00
#include "source/fuzz/fuzzer_pass_permute_phi_operands.h"
spirv-fuzz: FuzzerPassPropagateInstructionsUp (#3478) Given an instruction (that may use an OpPhi result from the same block as an input operand), try to clone the instruction into each predecessor block, replacing the input operand with the corresponding OpPhi input operand in each case, if necessary. Fixes #3458.
2020-08-11 09:24:32 +00:00
#include "source/fuzz/fuzzer_pass_propagate_instructions_up.h"
spirv-fuzz: Add push id through variable transformation (#3359) Makes an id synonym by storing an id to a new variable and then loading it back from that variable. Fixes #3192.
2020-05-29 15:43:38 +00:00
#include "source/fuzz/fuzzer_pass_push_ids_through_variables.h"
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606) Adds FuzzerPassAddCompositeInserts, which randomly adds new OpCompositeInsert instructions. Each OpCompositeInsert instruction yields a copy of an original composite with one subcomponent replaced with an existing or newly added object. Synonym facts are added for the unchanged components in the original and added composite, and for the replaced subcomponent and the object, if possible. Fixes #2859
2020-08-19 12:56:03 +00:00
#include "source/fuzz/fuzzer_pass_replace_adds_subs_muls_with_carrying_extended.h"
#include "source/fuzz/fuzzer_pass_replace_copy_memories_with_loads_stores.h"
#include "source/fuzz/fuzzer_pass_replace_copy_objects_with_stores_loads.h"
spirv-fuzz: Transformation to replace the use of an irrelevant id (#3697) A transformation that replaces the use of an irrelevant id with another id of the same type. The related fuzzer pass, for every use of an irrelevant id, checks whether the id can be replaced in that use by another id of the same type and randomly decides whether to replace it. Fixes #3503.
2020-09-01 15:28:04 +00:00
#include "source/fuzz/fuzzer_pass_replace_irrelevant_ids.h"
spirv-fuzz: Add replace linear algebra instruction transformation (#3402) This PR implements a transformation that replaces a linear algebra instruction with its mathematical definition.
2020-06-16 10:20:51 +00:00
#include "source/fuzz/fuzzer_pass_replace_linear_algebra_instructions.h"
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606) Adds FuzzerPassAddCompositeInserts, which randomly adds new OpCompositeInsert instructions. Each OpCompositeInsert instruction yields a copy of an original composite with one subcomponent replaced with an existing or newly added object. Synonym facts are added for the unchanged components in the original and added composite, and for the replaced subcomponent and the object, if possible. Fixes #2859
2020-08-19 12:56:03 +00:00
#include "source/fuzz/fuzzer_pass_replace_loads_stores_with_copy_memories.h"
spirv-fuzz: Replace id in OpPhi coming from a dead predecessor (#3744) This transformation takes the id of an OpPhi instruction, of a dead predecessor of the block containing it and a replacement id of available to use and of the same type as the OpPhi, and changes the id in the OpPhi corresponding to the given predecessor. For example, %id = OpPhi %type %v1 %p1 %v2 %p2 becomes %id = OpPhi %type %v3 %p1 %v2 %p2 if the transformation is given %id, %p1 and %v3, %p1 is a dead block, %v3 is type type and it is available to use at the end of %p1. The fuzzer pass randomly decides to apply the transformation to OpPhi instructions for which at least one of the predecessors is dead Fixes #3726.
2020-09-02 00:06:38 +00:00
#include "source/fuzz/fuzzer_pass_replace_opphi_ids_from_dead_predecessors.h"
spirv-fuzz: Transformation to convert OpSelect to conditional branch (#3681) This transformation takes an OpSelect instruction and replaces it with a conditional branch, selecting the correct value using an OpPhi instruction. Fixes part of the issue #3544.
2020-09-03 09:19:02 +00:00
#include "source/fuzz/fuzzer_pass_replace_opselects_with_conditional_branches.h"
spirv-fuzz: TransformationReplaceParameterWithGlobal (#3434) Fixes #3432.
2020-07-09 10:03:49 +00:00
#include "source/fuzz/fuzzer_pass_replace_parameter_with_global.h"
spirv-fuzz: TransformationReplaceParamsWithStruct (#3455) Fixes #3453.
2020-07-21 20:02:32 +00:00
#include "source/fuzz/fuzzer_pass_replace_params_with_struct.h"
Add "split block" transformation. (#2633) With this pass, the fuzzer can split blocks in the input module. This is mainly useful in order to give other (future) transformations more opportunities to apply.
2019-05-29 15:42:46 +00:00
#include "source/fuzz/fuzzer_pass_split_blocks.h"
spirv-fuzz: Add swap commutable operands transformation (#3205) In this PR, the classes that represent the swap commutable operands transformation and the fuzzer pass were implemented. Fixes #3205.
2020-03-05 08:18:39 +00:00
#include "source/fuzz/fuzzer_pass_swap_commutable_operands.h"
spirv-fuzz: Swap operands in OpBranchConditional (#3423) Fixes #3415.
2020-06-19 15:38:52 +00:00
#include "source/fuzz/fuzzer_pass_swap_conditional_branch_operands.h"
spirv-fuzz: Add toggle access chain instruction transformation (#3211) In this PR, the classes that represent the toggle access chain instruction transformation and fuzzer pass were implemented. This transformation toggles the instructions OpAccessChain and OpInBoundsAccessChain between them. Fixes #3193.
2020-03-08 22:33:24 +00:00
#include "source/fuzz/fuzzer_pass_toggle_access_chain_instruction.h"
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
#include "source/fuzz/pass_management/repeated_pass_manager.h"
#include "source/fuzz/pass_management/repeated_pass_manager_looped_with_recommendations.h"
#include "source/fuzz/pass_management/repeated_pass_manager_random_with_recommendations.h"
#include "source/fuzz/pass_management/repeated_pass_manager_simple.h"
#include "source/fuzz/pass_management/repeated_pass_recommender_standard.h"
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
#include "source/fuzz/protobufs/spirvfuzz_protobufs.h"
#include "source/fuzz/pseudo_random_generator.h"
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
#include "source/fuzz/transformation_context.h"
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
#include "source/opt/build_module.h"
#include "source/spirv_fuzzer_options.h"
#include "source/util/make_unique.h"
namespace spvtools {
namespace fuzz {
namespace {
const uint32_t kIdBoundGap = 100;
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
const uint32_t kTransformationLimit = 2000;
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
} // namespace
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
Fuzzer::Fuzzer(spv_target_env target_env, uint32_t seed, bool enable_all_passes,
RepeatedPassStrategy repeated_pass_strategy,
spirv-fuzz: Add validator options (#3254) Allows several validator options to be passed to the fuzzer, to be used when validation is invoked during fuzzing.
2020-04-02 13:37:59 +00:00
bool validate_after_each_fuzzer_pass,
spv_validator_options validator_options)
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
: target_env_(target_env),
seed_(seed),
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
enable_all_passes_(enable_all_passes),
repeated_pass_strategy_(repeated_pass_strategy),
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
validate_after_each_fuzzer_pass_(validate_after_each_fuzzer_pass),
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
validator_options_(validator_options),
num_repeated_passes_applied_(0) {}
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
Fuzzer::~Fuzzer() = default;
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
void Fuzzer::SetMessageConsumer(MessageConsumer consumer) {
consumer_ = std::move(consumer);
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
}
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
template <typename FuzzerPassT, typename... Args>
void Fuzzer::MaybeAddRepeatedPass(
RepeatedPassInstances* pass_instances, opt::IRContext* ir_context,
TransformationContext* transformation_context,
FuzzerContext* fuzzer_context,
protobufs::TransformationSequence* transformation_sequence_out,
Args&&... extra_args) const {
if (enable_all_passes_ || fuzzer_context->ChooseEven()) {
pass_instances->SetPass(MakeUnique<FuzzerPassT>(
ir_context, transformation_context, fuzzer_context,
transformation_sequence_out, std::forward<Args>(extra_args)...));
}
}
template <typename FuzzerPassT, typename... Args>
void Fuzzer::MaybeAddFinalPass(
std::vector<std::unique_ptr<FuzzerPass>>* passes,
opt::IRContext* ir_context, TransformationContext* transformation_context,
FuzzerContext* fuzzer_context,
protobufs::TransformationSequence* transformation_sequence_out,
Args&&... extra_args) const {
if (enable_all_passes_ || fuzzer_context->ChooseEven()) {
passes->push_back(MakeUnique<FuzzerPassT>(
ir_context, transformation_context, fuzzer_context,
transformation_sequence_out, std::forward<Args>(extra_args)...));
}
}
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
bool Fuzzer::ApplyPassAndCheckValidity(
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
FuzzerPass* pass, const opt::IRContext& ir_context,
const spvtools::SpirvTools& tools) const {
pass->Apply();
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
if (validate_after_each_fuzzer_pass_) {
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
std::vector<uint32_t> binary_to_validate;
ir_context.module()->ToBinary(&binary_to_validate, false);
spirv-fuzz: Add validator options (#3254) Allows several validator options to be passed to the fuzzer, to be used when validation is invoked during fuzzing.
2020-04-02 13:37:59 +00:00
if (!tools.Validate(&binary_to_validate[0], binary_to_validate.size(),
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
validator_options_)) {
consumer_(SPV_MSG_INFO, nullptr, {},
"Binary became invalid during fuzzing (set a breakpoint to "
"inspect); stopping.");
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
return false;
}
}
return true;
}
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
Fuzzer::FuzzerResultStatus Fuzzer::Run(
const std::vector<uint32_t>& binary_in,
const protobufs::FactSequence& initial_facts,
spirv-fuzz: Add fuzzer pass to perform module donation (#3117) This change adds a fuzzer pass that allows code from other SPIR-V modules to be donated into the module under transformation. It also changes the command-line options of the tools so that, in fuzzing mode, a file must be specified that contains the names of available donor modules.
2020-01-07 08:39:55 +00:00
const std::vector<fuzzerutil::ModuleSupplier>& donor_suppliers,
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
std::vector<uint32_t>* binary_out,
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
protobufs::TransformationSequence* transformation_sequence_out) {
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
// Check compatibility between the library version being linked with and the
// header files being used.
GOOGLE_PROTOBUF_VERIFY_VERSION;
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
spvtools::SpirvTools tools(target_env_);
tools.SetMessageConsumer(consumer_);
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
if (!tools.IsValid()) {
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
consumer_(SPV_MSG_ERROR, nullptr, {},
"Failed to create SPIRV-Tools interface; stopping.");
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
return Fuzzer::FuzzerResultStatus::kFailedToCreateSpirvToolsInterface;
}
// Initial binary should be valid.
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
if (!tools.Validate(&binary_in[0], binary_in.size(), validator_options_)) {
consumer_(SPV_MSG_ERROR, nullptr, {},
"Initial binary is invalid; stopping.");
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
return Fuzzer::FuzzerResultStatus::kInitialBinaryInvalid;
}
// Build the module from the input binary.
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
std::unique_ptr<opt::IRContext> ir_context =
BuildModule(target_env_, consumer_, binary_in.data(), binary_in.size());
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
assert(ir_context);
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
// Make a PRNG from the seed passed to the fuzzer on creation.
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
PseudoRandomGenerator random_generator(seed_);
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
// The fuzzer will introduce new ids into the module. The module's id bound
// gives the smallest id that can be used for this purpose. We add an offset
// to this so that there is a sizeable gap between the ids used in the
// original module and the ids used for fuzzing, as a readability aid.
//
// TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/2541) consider the
// case where the maximum id bound is reached.
auto minimum_fresh_id = ir_context->module()->id_bound() + kIdBoundGap;
FuzzerContext fuzzer_context(&random_generator, minimum_fresh_id);
FactManager fact_manager;
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
fact_manager.AddFacts(consumer_, initial_facts, ir_context.get());
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
TransformationContext transformation_context(&fact_manager,
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
validator_options_);
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
RepeatedPassInstances pass_instances{};
do {
// Each call to MaybeAddRepeatedPass randomly decides whether the given pass
// should be enabled, and adds an instance of the pass to |pass_instances|
// if it is enabled.
// TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/3764): Consider
// enabling some passes always, or with higher probability.
MaybeAddRepeatedPass<FuzzerPassAddAccessChains>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddBitInstructionSynonyms>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddCompositeInserts>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddCompositeTypes>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddCopyMemory>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddDeadBlocks>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddDeadBreaks>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddDeadContinues>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddEquationInstructions>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddFunctionCalls>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddGlobalVariables>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddImageSampleUnusedComponents>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddLoads>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddLocalVariables>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddLoopPreheaders>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddOpPhiSynonyms>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddParameters>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddRelaxedDecorations>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddStores>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddSynonyms>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassAddVectorShuffleInstructions>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassApplyIdSynonyms>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassConstructComposites>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassCopyObjects>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassDonateModules>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out, donor_suppliers);
MaybeAddRepeatedPass<FuzzerPassDuplicateRegionsWithSelections>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassFlattenConditionalBranches>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassInlineFunctions>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassInvertComparisonOperators>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassMakeVectorOperationsDynamic>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassMergeBlocks>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassMutatePointers>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassObfuscateConstants>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassOutlineFunctions>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassPermuteBlocks>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassPermuteFunctionParameters>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassPermuteInstructions>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassPropagateInstructionsUp>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassPushIdsThroughVariables>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassReplaceAddsSubsMulsWithCarryingExtended>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassReplaceCopyMemoriesWithLoadsStores>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassReplaceCopyObjectsWithStoresLoads>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassReplaceLoadsStoresWithCopyMemories>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassReplaceParameterWithGlobal>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassReplaceLinearAlgebraInstructions>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassReplaceIrrelevantIds>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassReplaceOpPhiIdsFromDeadPredecessors>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassReplaceOpSelectsWithConditionalBranches>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassReplaceParamsWithStruct>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassSplitBlocks>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
MaybeAddRepeatedPass<FuzzerPassSwapBranchConditionalOperands>(
&pass_instances, ir_context.get(), &transformation_context,
&fuzzer_context, transformation_sequence_out);
// There is a theoretical possibility that no pass instances were created
// until now; loop again if so.
} while (pass_instances.GetPasses().empty());
RepeatedPassRecommenderStandard pass_recommender(&pass_instances,
&fuzzer_context);
std::unique_ptr<RepeatedPassManager> repeated_pass_manager = nullptr;
switch (repeated_pass_strategy_) {
case RepeatedPassStrategy::kSimple:
repeated_pass_manager = MakeUnique<RepeatedPassManagerSimple>(
&fuzzer_context, &pass_instances);
break;
case RepeatedPassStrategy::kLoopedWithRecommendations:
repeated_pass_manager =
MakeUnique<RepeatedPassManagerLoopedWithRecommendations>(
&fuzzer_context, &pass_instances, &pass_recommender);
break;
case RepeatedPassStrategy::kRandomWithRecommendations:
repeated_pass_manager =
MakeUnique<RepeatedPassManagerRandomWithRecommendations>(
&fuzzer_context, &pass_instances, &pass_recommender);
break;
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
}
Add spirv-fuzz pass to permute blocks. (#2642) The blocks within each function in the module will be permuted in a randomized manner that respects dominance.
2019-05-31 08:59:06 +00:00
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
do {
if (!ApplyPassAndCheckValidity(repeated_pass_manager->ChoosePass(),
*ir_context, tools)) {
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
return Fuzzer::FuzzerResultStatus::kFuzzerPassLedToInvalidModule;
}
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
} while (
ShouldContinueFuzzing(*transformation_sequence_out, &fuzzer_context));
Add spirv-fuzz pass to permute blocks. (#2642) The blocks within each function in the module will be permuted in a randomized manner that respects dominance.
2019-05-31 08:59:06 +00:00
spirv-fuzz: Add fuzzer pass to change selection controls (#2944) A new pass that allows the fuzzer to change the 'selection control' operand of OpSelectionControl instructions. Fixes #2937.
2019-10-08 10:25:34 +00:00
// Now apply some passes that it does not make sense to apply repeatedly,
// as they do not unlock other passes.
spirv-fuzz: Add fuzzer pass to change function controls (#2951) A new pass that allows the fuzzer to change the 'function control' operand of OpFunction instructions. Fixes #2939.
2019-10-11 06:10:47 +00:00
std::vector<std::unique_ptr<FuzzerPass>> final_passes;
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
MaybeAddFinalPass<FuzzerPassAdjustBranchWeights>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
MaybeAddFinalPass<FuzzerPassAdjustFunctionControls>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: fuzzer pass to adjust memory access operands (#2968) A new pass that gives spirv-fuzz the ability to adjust the memory operand masks associated with memory access instructions (such as OpLoad and OpCopy Memory). Fixes #2940.
2019-10-22 17:05:35 +00:00
transformation_sequence_out);
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
MaybeAddFinalPass<FuzzerPassAdjustLoopControls>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: fuzzer pass to adjust memory access operands (#2968) A new pass that gives spirv-fuzz the ability to adjust the memory operand masks associated with memory access instructions (such as OpLoad and OpCopy Memory). Fixes #2940.
2019-10-22 17:05:35 +00:00
transformation_sequence_out);
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
MaybeAddFinalPass<FuzzerPassAdjustMemoryOperandsMasks>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: Add fuzzer pass to change function controls (#2951) A new pass that allows the fuzzer to change the 'function control' operand of OpFunction instructions. Fixes #2939.
2019-10-11 06:10:47 +00:00
transformation_sequence_out);
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
MaybeAddFinalPass<FuzzerPassAdjustSelectionControls>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
transformation_sequence_out);
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
MaybeAddFinalPass<FuzzerPassAddNoContractionDecorations>(
spirv-fuzz: Pass to replace int operands with ints of opposite signedness (#3612) This PR introduces a new fuzzer pass, which: - finds all integer vectors or constants - finds or creates the corresponding constants with opposite signedness - records such constants as synonyms of the first ones - replaces the usages of the original constants with the new ones if allowed Fixes #2677.
2020-07-30 18:48:29 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
MaybeAddFinalPass<FuzzerPassInterchangeSignednessOfIntegerOperands>(
spirv-fuzz: Fuzzer pass to interchange zero-like constants (#3524) This fuzzer pass: For each zero-like constant, either finds the existing definition of the corresponding toggled one (OpConstantNull becomes zero-valued scalar OpConstant or vice versa) or creates a new one if it doesn't exist and records that the two are synonyms For each use of these constants, probabilistically decides whether to change it with the corresponding toggled constant id (as described in #3486 ) Only uses inside blocks of instructions are considered and not, for example, in instructions declaring other constants.
2020-07-15 11:58:29 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
MaybeAddFinalPass<FuzzerPassInterchangeZeroLikeConstants>(
spirv-fuzz: Permute OpPhi instruction operands (#3421) Fixes #3415.
2020-06-23 14:00:28 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
MaybeAddFinalPass<FuzzerPassPermutePhiOperands>(
spirv-fuzz: Replace id in OpPhi coming from a dead predecessor (#3744) This transformation takes the id of an OpPhi instruction, of a dead predecessor of the block containing it and a replacement id of available to use and of the same type as the OpPhi, and changes the id in the OpPhi corresponding to the given predecessor. For example, %id = OpPhi %type %v1 %p1 %v2 %p2 becomes %id = OpPhi %type %v3 %p1 %v2 %p2 if the transformation is given %id, %p1 and %v3, %p1 is a dead block, %v3 is type type and it is available to use at the end of %p1. The fuzzer pass randomly decides to apply the transformation to OpPhi instructions for which at least one of the predecessors is dead Fixes #3726.
2020-09-02 00:06:38 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
MaybeAddFinalPass<FuzzerPassSwapCommutableOperands>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: Add swap commutable operands transformation (#3205) In this PR, the classes that represent the swap commutable operands transformation and the fuzzer pass were implemented. Fixes #3205.
2020-03-05 08:18:39 +00:00
transformation_sequence_out);
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
MaybeAddFinalPass<FuzzerPassToggleAccessChainInstruction>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: Add toggle access chain instruction transformation (#3211) In this PR, the classes that represent the toggle access chain instruction transformation and fuzzer pass were implemented. This transformation toggles the instructions OpAccessChain and OpInBoundsAccessChain between them. Fixes #3193.
2020-03-08 22:33:24 +00:00
transformation_sequence_out);
spirv-fuzz: Add fuzzer pass to change function controls (#2951) A new pass that allows the fuzzer to change the 'function control' operand of OpFunction instructions. Fixes #2939.
2019-10-11 06:10:47 +00:00
for (auto& pass : final_passes) {
spirv-fuzz: Remove opaque pointer design pattern (#3755) There's no real need for Fuzzer, Replayer and Shrinker to use the opaque pointer design pattern. This change removes it, paving the way for making some upcoming changes to Fuzzer easier.
2020-08-28 12:30:06 +00:00
if (!ApplyPassAndCheckValidity(pass.get(), *ir_context, tools)) {
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
return Fuzzer::FuzzerResultStatus::kFuzzerPassLedToInvalidModule;
}
spirv-fuzz: Add fuzzer pass to add NoContraction decorations (#2950) A new pass that allows the fuzzer to add NoContraction decorations to arithmetic instructions. Fixes #2936.
2019-10-11 08:15:47 +00:00
}
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
// Encode the module as a binary.
ir_context->module()->ToBinary(binary_out, false);
return Fuzzer::FuzzerResultStatus::kComplete;
}
spirv-fuzz: Add pass recommendations (#3757) This change introduces various strategies for controlling the manner in which fuzzer passes are applied repeatedly, including infrastructure to allow fuzzer passes to be recommended based on which passes ran previously.
2020-09-18 14:51:35 +00:00
bool Fuzzer::ShouldContinueFuzzing(
const protobufs::TransformationSequence& transformation_sequence_out,
FuzzerContext* fuzzer_context) {
// There's a risk that fuzzing could get stuck, if none of the enabled fuzzer
// passes are able to apply any transformations. To guard against this we
// count the number of times some repeated pass has been applied and ensure
// that fuzzing stops if the number of repeated passes hits the limit on the
// number of transformations that can be applied.
assert(
num_repeated_passes_applied_ <= kTransformationLimit &&
"The number of repeated passes applied must not exceed its upper limit.");
if (num_repeated_passes_applied_ == kTransformationLimit) {
// Stop because fuzzing has got stuck.
return false;
}
auto transformations_applied_so_far =
static_cast<uint32_t>(transformation_sequence_out.transformation_size());
if (transformations_applied_so_far >= kTransformationLimit) {
// Stop because we have reached the transformation limit.
return false;
}
auto chance_of_continuing = static_cast<uint32_t>(
100.0 * (1.0 - (static_cast<double>(transformations_applied_so_far) /
static_cast<double>(kTransformationLimit))));
if (!fuzzer_context->ChoosePercentage(chance_of_continuing)) {
// We have probabilistically decided to stop.
return false;
}
// Continue fuzzing!
num_repeated_passes_applied_++;
return true;
}
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
} // namespace fuzz
} // namespace spvtools
Reference in New Issue Copy Permalink