AuroraMiddleware/SPIRV-Tools
1
0
Fork 0
mirror of https://github.com/KhronosGroup/SPIRV-Tools synced 2024-11-23 12:10:06 +00:00
Code Issues Packages Projects Releases Wiki Activity
c9b254d045
SPIRV-Tools/source/fuzz/fuzzer.cpp

356 lines
16 KiB
C++
Raw Normal View History

Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
// Copyright (c) 2019 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include "source/fuzz/fuzzer.h"
#include <cassert>
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
#include <memory>
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
#include <sstream>
spirv-fuzz: fuzzer pass to adjust memory access operands (#2968) A new pass that gives spirv-fuzz the ability to adjust the memory operand masks associated with memory access instructions (such as OpLoad and OpCopy Memory). Fixes #2940.
2019-10-22 17:05:35 +00:00
#include "fuzzer_pass_adjust_memory_operands_masks.h"
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
#include "source/fuzz/fact_manager.h"
#include "source/fuzz/fuzzer_context.h"
spirv-fuzz: Fuzzer pass that adds access chains (#3182) This change adds a fuzzer pass that sprinkles access chain instructions into a module at random. This allows other passes to have a richer set of pointers available to them, in particular the passes that add loads and stores.
2020-02-11 23:10:57 +00:00
#include "source/fuzz/fuzzer_pass_add_access_chains.h"
spirv-fuzz: Fuzzer pass to add composite types (#3171) Adds a fuzzer pass that randomly adds vector and matrix types not already present in the module, and randomly adds structs with random field types and arrays with random base types and sizes. Other passes will be able to create variables and ids using these types.
2020-02-04 14:00:19 +00:00
#include "source/fuzz/fuzzer_pass_add_composite_types.h"
spirv-fuzz: Add FuzzerPassAddCopyMemoryInstructions (#3391) Fixes #3382.
2020-06-30 20:13:05 +00:00
#include "source/fuzz/fuzzer_pass_add_copy_memory.h"
spirv-fuzz: add dead blocks (#3135) This adds a new kind of fact to the fact manager that knows whether a block is dead - i.e. guaranteed to be statically unreachable - and a new transformation for adding a selection construct to a CFG that conditionally branches to a fresh, dead block, such that the branch will never be dynamically taken. Transformations that may create new blocks ('split block' and 'outline function') are updated to propagate dead block facts to newly-created blocks where appropriate. A fuzzer pass randomly adds dead blocks to the module. Future transformations will be able to exploit the fact that such blocks are known to be dead.
2020-01-13 22:04:01 +00:00
#include "source/fuzz/fuzzer_pass_add_dead_blocks.h"
Add fuzzer pass to add dead breaks. (#2654) This pass randomly add breaks to the merge blocks of selection and loop constructs, such that the breaking edges will not be dynamically reachable.
2019-06-05 07:02:16 +00:00
#include "source/fuzz/fuzzer_pass_add_dead_breaks.h"
Transformation and fuzzer pass to add dead continues (#2758) Similar to the existing 'add dead breaks' pass, this adds a pass to add dead continues to blocks in loops where such a transformation is viable. Various functionality common to this new pass and 'add dead breaks' has been factored into 'fuzzer_util', and some small improvements to 'add dead breaks' that were identified while reviewing that code again have been applied. Fixes #2719.
2019-07-25 12:50:33 +00:00
#include "source/fuzz/fuzzer_pass_add_dead_continues.h"
spirv-fuzz: Fuzzer pass to add equation instructions (#3202) This introduces a new fuzzer pass to add instructions to the module that define equations, and support in the fact manager for recording equation facts and deducing synonym facts from equation facts. Initially the only equations that are supported involve OpIAdd, OpISub, OpSNegate and OpLogicalNot, but there is scope for adding support for equations over various other operators.
2020-03-04 14:54:08 +00:00
#include "source/fuzz/fuzzer_pass_add_equation_instructions.h"
spirv-fuzz: Fuzzer pass to add function calls (#3178) Adds a fuzzer pass that inserts function calls into the module at random. Calls from dead blocks can be arbitrary (so long as they do not introduce recursion), while calls from other blocks can only be to livesafe functions. The change fixes some oversights in transformations to replace constants with uniforms and to obfuscate constants which testing of this fuzzer pass identified.
2020-02-10 23:22:34 +00:00
#include "source/fuzz/fuzzer_pass_add_function_calls.h"
spirv-fuzz: Fuzzer passes to add local and global variables (#3175) Adds two new fuzzer passes to add variables to a module: one that adds Private storage class global variables, another that adds Function storage class local variables.
2020-02-05 21:07:44 +00:00
#include "source/fuzz/fuzzer_pass_add_global_variables.h"
spirv-fuzz: Add image sample unused components transformation (#3439) Fixes #3375.
2020-07-08 16:07:04 +00:00
#include "source/fuzz/fuzzer_pass_add_image_sample_unused_components.h"
spirv-fuzz: Add fuzzer passes to add loads/stores (#3176) This change adds fuzzer passes that sprinkle loads and stores into a module at random, with stores restricted to occur in either dead blocks, or to use pointers for which it is known that the pointee value does not influence the module's overall behaviour. The change also generalises the VariableValueIsArbitrary fact to PointeeValueIsIrrelevant, to allow stores through access chains or object copies of variables whose values are known to be irrelevant. The change includes some other minor refactorings.
2020-02-06 16:54:34 +00:00
#include "source/fuzz/fuzzer_pass_add_loads.h"
spirv-fuzz: Fuzzer passes to add local and global variables (#3175) Adds two new fuzzer passes to add variables to a module: one that adds Private storage class global variables, another that adds Function storage class local variables.
2020-02-05 21:07:44 +00:00
#include "source/fuzz/fuzzer_pass_add_local_variables.h"
spirv-fuzz: Add fuzzer pass to add NoContraction decorations (#2950) A new pass that allows the fuzzer to add NoContraction decorations to arithmetic instructions. Fixes #2936.
2019-10-11 08:15:47 +00:00
#include "source/fuzz/fuzzer_pass_add_no_contraction_decorations.h"
spirv-fuzz: Implement FuzzerPassAddParameters (#3399) Fixes #3384.
2020-06-23 16:40:44 +00:00
#include "source/fuzz/fuzzer_pass_add_parameters.h"
spirv-fuzz: Add fuzzer passes to add loads/stores (#3176) This change adds fuzzer passes that sprinkle loads and stores into a module at random, with stores restricted to occur in either dead blocks, or to use pointers for which it is known that the pointee value does not influence the module's overall behaviour. The change also generalises the VariableValueIsArbitrary fact to PointeeValueIsIrrelevant, to allow stores through access chains or object copies of variables whose values are known to be irrelevant. The change includes some other minor refactorings.
2020-02-06 16:54:34 +00:00
#include "source/fuzz/fuzzer_pass_add_stores.h"
spirv-fuzz: TransformationAddSynonyms (#3447) Part of #3440.
2020-07-12 08:59:08 +00:00
#include "source/fuzz/fuzzer_pass_add_synonyms.h"
spirv-fuzz: Implement vector shuffle fuzzer pass (#3412) Fixes #3108.
2020-06-16 10:21:31 +00:00
#include "source/fuzz/fuzzer_pass_add_vector_shuffle_instructions.h"
Add adjust branch weights transformation (#3336) In this PR, the classes that represent the adjust branch weights transformation and fuzzer pass were implemented. This transformation adjusts the branch weights of a OpBranchConditional instruction.
2020-05-14 10:38:34 +00:00
#include "source/fuzz/fuzzer_pass_adjust_branch_weights.h"
spirv-fuzz: Add fuzzer pass to change function controls (#2951) A new pass that allows the fuzzer to change the 'function control' operand of OpFunction instructions. Fixes #2939.
2019-10-11 06:10:47 +00:00
#include "source/fuzz/fuzzer_pass_adjust_function_controls.h"
spirv-fuzz: Add fuzzer pass to change loop controls (#2949) A new pass that allows the fuzzer to change the 'loop control' operand (and associated literal operands) of OpLoopMerge instructions. Fixes #2938. Fixes #2943.
2019-10-10 12:34:38 +00:00
#include "source/fuzz/fuzzer_pass_adjust_loop_controls.h"
spirv-fuzz: Add fuzzer pass to change selection controls (#2944) A new pass that allows the fuzzer to change the 'selection control' operand of OpSelectionControl instructions. Fixes #2937.
2019-10-08 10:25:34 +00:00
#include "source/fuzz/fuzzer_pass_adjust_selection_controls.h"
Add fuzzer pass to replace ids with synonyms (#2857) If the fuzzer's fact manager knows that ids A and B are synonymous, it can replace a use of A with a use of B, so long as various conditions hold (e.g. the definition of B must dominate the use of A, and it is not legal to replace a use of an OpConstant in a struct's access chain with a synonym that is not an OpConstant). This change adds a fuzzer pass to sprinke such synonym replacements through the module.
2019-09-18 19:47:08 +00:00
#include "source/fuzz/fuzzer_pass_apply_id_synonyms.h"
spirv-fuzz: add transformation and pass to construct composites (#2941) Adds a fuzzer pass and transformation to create a composite (array, matrix, struct or vector) from available constituent components, and inform the fact manager that each component of the new composite is synonymous with the id that was used to construct it. This allows the "replace id with synonym" pass to then replace uses of said ids with uses of elements extracted from the composite. Fixes #2858.
2019-10-08 13:04:10 +00:00
#include "source/fuzz/fuzzer_pass_construct_composites.h"
Add fuzzer pass to copy objects (#2853) A new fuzzer pass that randomly introduces OpCopyObject instructions that make copies of ids, and uses the fact manager to record the fact that an id %id is synonymous with an id generated by an OpCopyObject applied to %id. (A future pass will exploit such synonym facts.)
2019-09-11 22:45:20 +00:00
#include "source/fuzz/fuzzer_pass_copy_objects.h"
spirv-fuzz: Add fuzzer pass to perform module donation (#3117) This change adds a fuzzer pass that allows code from other SPIR-V modules to be donated into the module under transformation. It also changes the command-line options of the tools so that, in fuzzing mode, a file must be specified that contains the names of available donor modules.
2020-01-07 08:39:55 +00:00
#include "source/fuzz/fuzzer_pass_donate_modules.h"
spirv-fuzz: TransformationInvertComparisonOperator (#3475) Part of #3440.
2020-07-03 16:37:32 +00:00
#include "source/fuzz/fuzzer_pass_invert_comparison_operators.h"
spirv-fuzz: Fuzzer pass to merge blocks (#3097) This change adds a transformation and associated fuzzer pass for merging adjacent blocks in a module, re-using block merging code from the optimizer.
2019-12-12 15:27:40 +00:00
#include "source/fuzz/fuzzer_pass_merge_blocks.h"
Add fuzzer pass to obfuscate constants. (#2671) Adds a new transformation that can replace a constant with a uniform known to have the same value, and adds a fuzzer pass that (a) replaces a boolean with a comparison of literals (e.g. replacing "true" with "42 > 24"), and then (b) obfuscates the literals appearing in this comparison by replacing them with identically-valued uniforms, if available. The fuzzer_replayer test file has also been updated to allow initial facts to be provided, and to do error checking of the status results returned by the fuzzer and replayer components.
2019-06-18 17:41:08 +00:00
#include "source/fuzz/fuzzer_pass_obfuscate_constants.h"
spirv-fuzz: function outlining fuzzer pass (#3078) A new transformation and associated fuzzer pass in spirv-fuzz that selects single-entry single-exit control flow graph regions and for each selected region outlines the region into a new function and replaces the original region with a call to this function.
2019-12-10 14:47:42 +00:00
#include "source/fuzz/fuzzer_pass_outline_functions.h"
Add spirv-fuzz pass to permute blocks. (#2642) The blocks within each function in the module will be permuted in a randomized manner that respects dominance.
2019-05-31 08:59:06 +00:00
#include "source/fuzz/fuzzer_pass_permute_blocks.h"
spirv-fuzz: Add fuzzer pass to permute function parameters (#3212) Fixes #3194.
2020-03-08 14:27:05 +00:00
#include "source/fuzz/fuzzer_pass_permute_function_parameters.h"
spirv-fuzz: Permute OpPhi instruction operands (#3421) Fixes #3415.
2020-06-23 14:00:28 +00:00
#include "source/fuzz/fuzzer_pass_permute_phi_operands.h"
spirv-fuzz: Add push id through variable transformation (#3359) Makes an id synonym by storing an id to a new variable and then loading it back from that variable. Fixes #3192.
2020-05-29 15:43:38 +00:00
#include "source/fuzz/fuzzer_pass_push_ids_through_variables.h"
spirv-fuzz: Add replace linear algebra instruction transformation (#3402) This PR implements a transformation that replaces a linear algebra instruction with its mathematical definition.
2020-06-16 10:20:51 +00:00
#include "source/fuzz/fuzzer_pass_replace_linear_algebra_instructions.h"
spirv-fuzz: TransformationReplaceParameterWithGlobal (#3434) Fixes #3432.
2020-07-09 10:03:49 +00:00
#include "source/fuzz/fuzzer_pass_replace_parameter_with_global.h"
Add "split block" transformation. (#2633) With this pass, the fuzzer can split blocks in the input module. This is mainly useful in order to give other (future) transformations more opportunities to apply.
2019-05-29 15:42:46 +00:00
#include "source/fuzz/fuzzer_pass_split_blocks.h"
spirv-fuzz: Add swap commutable operands transformation (#3205) In this PR, the classes that represent the swap commutable operands transformation and the fuzzer pass were implemented. Fixes #3205.
2020-03-05 08:18:39 +00:00
#include "source/fuzz/fuzzer_pass_swap_commutable_operands.h"
spirv-fuzz: Swap operands in OpBranchConditional (#3423) Fixes #3415.
2020-06-19 15:38:52 +00:00
#include "source/fuzz/fuzzer_pass_swap_conditional_branch_operands.h"
spirv-fuzz: Add toggle access chain instruction transformation (#3211) In this PR, the classes that represent the toggle access chain instruction transformation and fuzzer pass were implemented. This transformation toggles the instructions OpAccessChain and OpInBoundsAccessChain between them. Fixes #3193.
2020-03-08 22:33:24 +00:00
#include "source/fuzz/fuzzer_pass_toggle_access_chain_instruction.h"
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
#include "source/fuzz/protobufs/spirvfuzz_protobufs.h"
#include "source/fuzz/pseudo_random_generator.h"
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
#include "source/fuzz/transformation_context.h"
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
#include "source/opt/build_module.h"
#include "source/spirv_fuzzer_options.h"
#include "source/util/make_unique.h"
namespace spvtools {
namespace fuzz {
namespace {
const uint32_t kIdBoundGap = 100;
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
const uint32_t kTransformationLimit = 500;
const uint32_t kChanceOfApplyingAnotherPass = 85;
spirv-fuzz: Add fuzzer pass to perform module donation (#3117) This change adds a fuzzer pass that allows code from other SPIR-V modules to be donated into the module under transformation. It also changes the command-line options of the tools so that, in fuzzing mode, a file must be specified that contains the names of available donor modules.
2020-01-07 08:39:55 +00:00
// A convenience method to add a fuzzer pass to |passes| with probability 0.5.
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
// All fuzzer passes take |ir_context|, |transformation_context|,
// |fuzzer_context| and |transformation_sequence_out| as parameters. Extra
// arguments can be provided via |extra_args|.
spirv-fuzz: Add fuzzer pass to perform module donation (#3117) This change adds a fuzzer pass that allows code from other SPIR-V modules to be donated into the module under transformation. It also changes the command-line options of the tools so that, in fuzzing mode, a file must be specified that contains the names of available donor modules.
2020-01-07 08:39:55 +00:00
template <typename T, typename... Args>
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
void MaybeAddPass(
std::vector<std::unique_ptr<FuzzerPass>>* passes,
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
opt::IRContext* ir_context, TransformationContext* transformation_context,
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
FuzzerContext* fuzzer_context,
spirv-fuzz: Add fuzzer pass to perform module donation (#3117) This change adds a fuzzer pass that allows code from other SPIR-V modules to be donated into the module under transformation. It also changes the command-line options of the tools so that, in fuzzing mode, a file must be specified that contains the names of available donor modules.
2020-01-07 08:39:55 +00:00
protobufs::TransformationSequence* transformation_sequence_out,
Args&&... extra_args) {
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
if (fuzzer_context->ChooseEven()) {
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
passes->push_back(MakeUnique<T>(ir_context, transformation_context,
fuzzer_context, transformation_sequence_out,
spirv-fuzz: Add fuzzer pass to perform module donation (#3117) This change adds a fuzzer pass that allows code from other SPIR-V modules to be donated into the module under transformation. It also changes the command-line options of the tools so that, in fuzzing mode, a file must be specified that contains the names of available donor modules.
2020-01-07 08:39:55 +00:00
std::forward<Args>(extra_args)...));
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
}
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
}
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
} // namespace
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
struct Fuzzer::Impl {
spirv-fuzz: Add validator options (#3254) Allows several validator options to be passed to the fuzzer, to be used when validation is invoked during fuzzing.
2020-04-02 13:37:59 +00:00
Impl(spv_target_env env, uint32_t random_seed, bool validate_after_each_pass,
spv_validator_options options)
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
: target_env(env),
seed(random_seed),
spirv-fuzz: Add validator options (#3254) Allows several validator options to be passed to the fuzzer, to be used when validation is invoked during fuzzing.
2020-04-02 13:37:59 +00:00
validate_after_each_fuzzer_pass(validate_after_each_pass),
validator_options(options) {}
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
bool ApplyPassAndCheckValidity(FuzzerPass* pass,
const opt::IRContext& ir_context,
const spvtools::SpirvTools& tools) const;
const spv_target_env target_env; // Target environment.
spirv-fuzz: Add validator options (#3254) Allows several validator options to be passed to the fuzzer, to be used when validation is invoked during fuzzing.
2020-04-02 13:37:59 +00:00
MessageConsumer consumer; // Message consumer.
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
const uint32_t seed; // Seed for random number generator.
bool validate_after_each_fuzzer_pass; // Determines whether the validator
spirv-fuzz: Add validator options (#3254) Allows several validator options to be passed to the fuzzer, to be used when validation is invoked during fuzzing.
2020-04-02 13:37:59 +00:00
// should be invoked after every fuzzer
// pass.
spv_validator_options validator_options; // Options to control validation.
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
};
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
Fuzzer::Fuzzer(spv_target_env env, uint32_t seed,
spirv-fuzz: Add validator options (#3254) Allows several validator options to be passed to the fuzzer, to be used when validation is invoked during fuzzing.
2020-04-02 13:37:59 +00:00
bool validate_after_each_fuzzer_pass,
spv_validator_options validator_options)
: impl_(MakeUnique<Impl>(env, seed, validate_after_each_fuzzer_pass,
validator_options)) {}
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
Fuzzer::~Fuzzer() = default;
void Fuzzer::SetMessageConsumer(MessageConsumer c) {
impl_->consumer = std::move(c);
}
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
bool Fuzzer::Impl::ApplyPassAndCheckValidity(
FuzzerPass* pass, const opt::IRContext& ir_context,
const spvtools::SpirvTools& tools) const {
pass->Apply();
if (validate_after_each_fuzzer_pass) {
std::vector<uint32_t> binary_to_validate;
ir_context.module()->ToBinary(&binary_to_validate, false);
spirv-fuzz: Add validator options (#3254) Allows several validator options to be passed to the fuzzer, to be used when validation is invoked during fuzzing.
2020-04-02 13:37:59 +00:00
if (!tools.Validate(&binary_to_validate[0], binary_to_validate.size(),
validator_options)) {
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
consumer(SPV_MSG_INFO, nullptr, {},
"Binary became invalid during fuzzing (set a breakpoint to "
"inspect); stopping.");
return false;
}
}
return true;
}
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
Fuzzer::FuzzerResultStatus Fuzzer::Run(
const std::vector<uint32_t>& binary_in,
const protobufs::FactSequence& initial_facts,
spirv-fuzz: Add fuzzer pass to perform module donation (#3117) This change adds a fuzzer pass that allows code from other SPIR-V modules to be donated into the module under transformation. It also changes the command-line options of the tools so that, in fuzzing mode, a file must be specified that contains the names of available donor modules.
2020-01-07 08:39:55 +00:00
const std::vector<fuzzerutil::ModuleSupplier>& donor_suppliers,
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
std::vector<uint32_t>* binary_out,
Shrinker for spirv-fuzz (#2708) Adds to spirv-fuzz the option to shrink a sequence of transformations that lead to an interesting binary to be generated, to find a smaller sub-sequence of transformations that still lead to an interesting (but hopefully simpler) binary being generated. The notion of what counts as "interesting" comes from a user-provided script, the "interestingness function", similar to the way the spirv-reduce tool works. The shrinking process will give up after a maximum number of steps, which can be configured on the command line. Tests for the combination of fuzzing and shrinking are included, using a variety of interestingness functions.
2019-07-07 07:55:30 +00:00
protobufs::TransformationSequence* transformation_sequence_out) const {
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
// Check compatibility between the library version being linked with and the
// header files being used.
GOOGLE_PROTOBUF_VERIFY_VERSION;
spvtools::SpirvTools tools(impl_->target_env);
Shrinker for spirv-fuzz (#2708) Adds to spirv-fuzz the option to shrink a sequence of transformations that lead to an interesting binary to be generated, to find a smaller sub-sequence of transformations that still lead to an interesting (but hopefully simpler) binary being generated. The notion of what counts as "interesting" comes from a user-provided script, the "interestingness function", similar to the way the spirv-reduce tool works. The shrinking process will give up after a maximum number of steps, which can be configured on the command line. Tests for the combination of fuzzing and shrinking are included, using a variety of interestingness functions.
2019-07-07 07:55:30 +00:00
tools.SetMessageConsumer(impl_->consumer);
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
if (!tools.IsValid()) {
impl_->consumer(SPV_MSG_ERROR, nullptr, {},
"Failed to create SPIRV-Tools interface; stopping.");
return Fuzzer::FuzzerResultStatus::kFailedToCreateSpirvToolsInterface;
}
// Initial binary should be valid.
spirv-fuzz: Add validator options (#3254) Allows several validator options to be passed to the fuzzer, to be used when validation is invoked during fuzzing.
2020-04-02 13:37:59 +00:00
if (!tools.Validate(&binary_in[0], binary_in.size(),
impl_->validator_options)) {
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
impl_->consumer(SPV_MSG_ERROR, nullptr, {},
"Initial binary is invalid; stopping.");
return Fuzzer::FuzzerResultStatus::kInitialBinaryInvalid;
}
// Build the module from the input binary.
std::unique_ptr<opt::IRContext> ir_context = BuildModule(
impl_->target_env, impl_->consumer, binary_in.data(), binary_in.size());
assert(ir_context);
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
// Make a PRNG from the seed passed to the fuzzer on creation.
PseudoRandomGenerator random_generator(impl_->seed);
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
// The fuzzer will introduce new ids into the module. The module's id bound
// gives the smallest id that can be used for this purpose. We add an offset
// to this so that there is a sizeable gap between the ids used in the
// original module and the ids used for fuzzing, as a readability aid.
//
// TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/2541) consider the
// case where the maximum id bound is reached.
auto minimum_fresh_id = ir_context->module()->id_bound() + kIdBoundGap;
FuzzerContext fuzzer_context(&random_generator, minimum_fresh_id);
FactManager fact_manager;
Warn when input facts are invalid. (#2699) Fixes #2621. Instead of aborting when an invalid input fact is provided, the tool now warns about the invalid fact and then ignores it. This is convenient for example if facts are specified about uniforms with descriptor sets and bindings that happen to not be present in the input binary.
2019-06-26 15:40:19 +00:00
fact_manager.AddFacts(impl_->consumer, initial_facts, ir_context.get());
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
TransformationContext transformation_context(&fact_manager,
impl_->validator_options);
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
Add "split block" transformation. (#2633) With this pass, the fuzzer can split blocks in the input module. This is mainly useful in order to give other (future) transformations more opportunities to apply.
2019-05-29 15:42:46 +00:00
// Apply some semantics-preserving passes.
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
std::vector<std::unique_ptr<FuzzerPass>> passes;
while (passes.empty()) {
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
MaybeAddPass<FuzzerPassAddAccessChains>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
MaybeAddPass<FuzzerPassAddCompositeTypes>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Add FuzzerPassAddCopyMemoryInstructions (#3391) Fixes #3382.
2020-06-30 20:13:05 +00:00
MaybeAddPass<FuzzerPassAddCopyMemory>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
MaybeAddPass<FuzzerPassAddDeadBlocks>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
MaybeAddPass<FuzzerPassAddDeadBreaks>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
MaybeAddPass<FuzzerPassAddDeadContinues>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Fuzzer pass to add equation instructions (#3202) This introduces a new fuzzer pass to add instructions to the module that define equations, and support in the fact manager for recording equation facts and deducing synonym facts from equation facts. Initially the only equations that are supported involve OpIAdd, OpISub, OpSNegate and OpLogicalNot, but there is scope for adding support for equations over various other operators.
2020-03-04 14:54:08 +00:00
MaybeAddPass<FuzzerPassAddEquationInstructions>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: Fuzzer pass to add equation instructions (#3202) This introduces a new fuzzer pass to add instructions to the module that define equations, and support in the fact manager for recording equation facts and deducing synonym facts from equation facts. Initially the only equations that are supported involve OpIAdd, OpISub, OpSNegate and OpLogicalNot, but there is scope for adding support for equations over various other operators.
2020-03-04 14:54:08 +00:00
transformation_sequence_out);
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
MaybeAddPass<FuzzerPassAddFunctionCalls>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
MaybeAddPass<FuzzerPassAddGlobalVariables>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Add image sample unused components transformation (#3439) Fixes #3375.
2020-07-08 16:07:04 +00:00
MaybeAddPass<FuzzerPassAddImageSampleUnusedComponents>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
MaybeAddPass<FuzzerPassAddLoads>(&passes, ir_context.get(),
&transformation_context, &fuzzer_context,
spirv-fuzz: Add fuzzer passes to add loads/stores (#3176) This change adds fuzzer passes that sprinkle loads and stores into a module at random, with stores restricted to occur in either dead blocks, or to use pointers for which it is known that the pointee value does not influence the module's overall behaviour. The change also generalises the VariableValueIsArbitrary fact to PointeeValueIsIrrelevant, to allow stores through access chains or object copies of variables whose values are known to be irrelevant. The change includes some other minor refactorings.
2020-02-06 16:54:34 +00:00
transformation_sequence_out);
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
MaybeAddPass<FuzzerPassAddLocalVariables>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Implement FuzzerPassAddParameters (#3399) Fixes #3384.
2020-06-23 16:40:44 +00:00
MaybeAddPass<FuzzerPassAddParameters>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
MaybeAddPass<FuzzerPassAddStores>(&passes, ir_context.get(),
&transformation_context, &fuzzer_context,
spirv-fuzz: Add fuzzer passes to add loads/stores (#3176) This change adds fuzzer passes that sprinkle loads and stores into a module at random, with stores restricted to occur in either dead blocks, or to use pointers for which it is known that the pointee value does not influence the module's overall behaviour. The change also generalises the VariableValueIsArbitrary fact to PointeeValueIsIrrelevant, to allow stores through access chains or object copies of variables whose values are known to be irrelevant. The change includes some other minor refactorings.
2020-02-06 16:54:34 +00:00
transformation_sequence_out);
spirv-fuzz: TransformationAddSynonyms (#3447) Part of #3440.
2020-07-12 08:59:08 +00:00
MaybeAddPass<FuzzerPassAddSynonyms>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Implement vector shuffle fuzzer pass (#3412) Fixes #3108.
2020-06-16 10:21:31 +00:00
MaybeAddPass<FuzzerPassAddVectorShuffleInstructions>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
MaybeAddPass<FuzzerPassApplyIdSynonyms>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
MaybeAddPass<FuzzerPassConstructComposites>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
MaybeAddPass<FuzzerPassCopyObjects>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Add fuzzer pass to perform module donation (#3117) This change adds a fuzzer pass that allows code from other SPIR-V modules to be donated into the module under transformation. It also changes the command-line options of the tools so that, in fuzzing mode, a file must be specified that contains the names of available donor modules.
2020-01-07 08:39:55 +00:00
MaybeAddPass<FuzzerPassDonateModules>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: Add fuzzer pass to perform module donation (#3117) This change adds a fuzzer pass that allows code from other SPIR-V modules to be donated into the module under transformation. It also changes the command-line options of the tools so that, in fuzzing mode, a file must be specified that contains the names of available donor modules.
2020-01-07 08:39:55 +00:00
transformation_sequence_out, donor_suppliers);
spirv-fuzz: TransformationInvertComparisonOperator (#3475) Part of #3440.
2020-07-03 16:37:32 +00:00
MaybeAddPass<FuzzerPassInvertComparisonOperators>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
MaybeAddPass<FuzzerPassMergeBlocks>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
MaybeAddPass<FuzzerPassObfuscateConstants>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
MaybeAddPass<FuzzerPassOutlineFunctions>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
MaybeAddPass<FuzzerPassPermuteBlocks>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Add fuzzer pass to permute function parameters (#3212) Fixes #3194.
2020-03-08 14:27:05 +00:00
MaybeAddPass<FuzzerPassPermuteFunctionParameters>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Add push id through variable transformation (#3359) Makes an id synonym by storing an id to a new variable and then loading it back from that variable. Fixes #3192.
2020-05-29 15:43:38 +00:00
MaybeAddPass<FuzzerPassPushIdsThroughVariables>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: TransformationReplaceParameterWithGlobal (#3434) Fixes #3432.
2020-07-09 10:03:49 +00:00
MaybeAddPass<FuzzerPassReplaceParameterWithGlobal>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Add replace linear algebra instruction transformation (#3402) This PR implements a transformation that replaces a linear algebra instruction with its mathematical definition.
2020-06-16 10:20:51 +00:00
MaybeAddPass<FuzzerPassReplaceLinearAlgebraInstructions>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
MaybeAddPass<FuzzerPassSplitBlocks>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: Add fuzzer pass to permute function parameters (#3212) Fixes #3194.
2020-03-08 14:27:05 +00:00
transformation_sequence_out);
spirv-fuzz: Swap operands in OpBranchConditional (#3423) Fixes #3415.
2020-06-19 15:38:52 +00:00
MaybeAddPass<FuzzerPassSwapBranchConditionalOperands>(
&passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
}
Add spirv-fuzz pass to permute blocks. (#2642) The blocks within each function in the module will be permuted in a randomized manner that respects dominance.
2019-05-31 08:59:06 +00:00
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
bool is_first = true;
while (static_cast<uint32_t>(
transformation_sequence_out->transformation_size()) <
kTransformationLimit &&
(is_first ||
fuzzer_context.ChoosePercentage(kChanceOfApplyingAnotherPass))) {
is_first = false;
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
if (!impl_->ApplyPassAndCheckValidity(
passes[fuzzer_context.RandomIndex(passes)].get(), *ir_context,
tools)) {
return Fuzzer::FuzzerResultStatus::kFuzzerPassLedToInvalidModule;
}
Employ the "swarm testing" idea in spirv-fuzz (#2890) This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass. There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 15:29:19 +00:00
}
Add spirv-fuzz pass to permute blocks. (#2642) The blocks within each function in the module will be permuted in a randomized manner that respects dominance.
2019-05-31 08:59:06 +00:00
spirv-fuzz: Add fuzzer pass to change selection controls (#2944) A new pass that allows the fuzzer to change the 'selection control' operand of OpSelectionControl instructions. Fixes #2937.
2019-10-08 10:25:34 +00:00
// Now apply some passes that it does not make sense to apply repeatedly,
// as they do not unlock other passes.
spirv-fuzz: Add fuzzer pass to change function controls (#2951) A new pass that allows the fuzzer to change the 'function control' operand of OpFunction instructions. Fixes #2939.
2019-10-11 06:10:47 +00:00
std::vector<std::unique_ptr<FuzzerPass>> final_passes;
Add adjust branch weights transformation (#3336) In this PR, the classes that represent the adjust branch weights transformation and fuzzer pass were implemented. This transformation adjusts the branch weights of a OpBranchConditional instruction.
2020-05-14 10:38:34 +00:00
MaybeAddPass<FuzzerPassAdjustBranchWeights>(
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: fuzzer pass to adjust memory access operands (#2968) A new pass that gives spirv-fuzz the ability to adjust the memory operand masks associated with memory access instructions (such as OpLoad and OpCopy Memory). Fixes #2940.
2019-10-22 17:05:35 +00:00
MaybeAddPass<FuzzerPassAdjustFunctionControls>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
MaybeAddPass<FuzzerPassAdjustLoopControls>(
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: fuzzer pass to adjust memory access operands (#2968) A new pass that gives spirv-fuzz the ability to adjust the memory operand masks associated with memory access instructions (such as OpLoad and OpCopy Memory). Fixes #2940.
2019-10-22 17:05:35 +00:00
transformation_sequence_out);
MaybeAddPass<FuzzerPassAdjustMemoryOperandsMasks>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: fuzzer pass to adjust memory access operands (#2968) A new pass that gives spirv-fuzz the ability to adjust the memory operand masks associated with memory access instructions (such as OpLoad and OpCopy Memory). Fixes #2940.
2019-10-22 17:05:35 +00:00
transformation_sequence_out);
spirv-fuzz: Add fuzzer pass to change function controls (#2951) A new pass that allows the fuzzer to change the 'function control' operand of OpFunction instructions. Fixes #2939.
2019-10-11 06:10:47 +00:00
MaybeAddPass<FuzzerPassAdjustSelectionControls>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: Add fuzzer pass to change function controls (#2951) A new pass that allows the fuzzer to change the 'function control' operand of OpFunction instructions. Fixes #2939.
2019-10-11 06:10:47 +00:00
transformation_sequence_out);
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
MaybeAddPass<FuzzerPassAddNoContractionDecorations>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
transformation_sequence_out);
spirv-fuzz: Permute OpPhi instruction operands (#3421) Fixes #3415.
2020-06-23 14:00:28 +00:00
MaybeAddPass<FuzzerPassPermutePhiOperands>(
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
transformation_sequence_out);
spirv-fuzz: Add swap commutable operands transformation (#3205) In this PR, the classes that represent the swap commutable operands transformation and the fuzzer pass were implemented. Fixes #3205.
2020-03-05 08:18:39 +00:00
MaybeAddPass<FuzzerPassSwapCommutableOperands>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: Add swap commutable operands transformation (#3205) In this PR, the classes that represent the swap commutable operands transformation and the fuzzer pass were implemented. Fixes #3205.
2020-03-05 08:18:39 +00:00
transformation_sequence_out);
spirv-fuzz: Add toggle access chain instruction transformation (#3211) In this PR, the classes that represent the toggle access chain instruction transformation and fuzzer pass were implemented. This transformation toggles the instructions OpAccessChain and OpInBoundsAccessChain between them. Fixes #3193.
2020-03-08 22:33:24 +00:00
MaybeAddPass<FuzzerPassToggleAccessChainInstruction>(
spirv-fuzz: Introduce TransformationContext (#3272) Some transformations (e.g. TransformationAddFunction) rely on running the validator to decide whether the transformation is applicable. A recent change allowed spirv-fuzz to take validator options, to cater for the case where a module should be considered valid under particular conditions. However, validation during the checking of transformations had no access to these validator options. This change introduced TransformationContext, which currently consists of a fact manager and a set of validator options, but could in the future have other fields corresponding to other objects that it is useful to have access to when applying transformations. Now, instead of checking and applying transformations in the context of a FactManager, a TransformationContext is used. This gives access to the fact manager as before, and also access to the validator options when they are needed.
2020-04-02 14:54:46 +00:00
&final_passes, ir_context.get(), &transformation_context, &fuzzer_context,
spirv-fuzz: Add toggle access chain instruction transformation (#3211) In this PR, the classes that represent the toggle access chain instruction transformation and fuzzer pass were implemented. This transformation toggles the instructions OpAccessChain and OpInBoundsAccessChain between them. Fixes #3193.
2020-03-08 22:33:24 +00:00
transformation_sequence_out);
spirv-fuzz: Add fuzzer pass to change function controls (#2951) A new pass that allows the fuzzer to change the 'function control' operand of OpFunction instructions. Fixes #2939.
2019-10-11 06:10:47 +00:00
for (auto& pass : final_passes) {
spirv-fuzz: Improve debugging facilities (#3074) Adds an option to run the validator on the SPIR-V binary after each fuzzer pass has been applied, to help identify when the fuzzer has made the module invalid. Also adds a helper method to allow dumping of the sequence of transformations that have been applied to a JSON file.
2019-11-27 18:05:56 +00:00
if (!impl_->ApplyPassAndCheckValidity(pass.get(), *ir_context, tools)) {
return Fuzzer::FuzzerResultStatus::kFuzzerPassLedToInvalidModule;
}
spirv-fuzz: Add fuzzer pass to add NoContraction decorations (#2950) A new pass that allows the fuzzer to add NoContraction decorations to arithmetic instructions. Fixes #2936.
2019-10-11 08:15:47 +00:00
}
Add library for spirv-fuzz (#2618) Adds a library for spirv-fuzz, consisting of a Fuzzer class that will transform a module with respect to (a) facts about the module provided via a FactManager class, and (b) a source of random numbers and parameters to control the transformation process provided via a FuzzerContext class. Transformations will be applied via classes that implement a FuzzerPass interface, and both facts and transformations will be represented via protobuf messages. Currently there are no concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 13:34:55 +00:00
// Encode the module as a binary.
ir_context->module()->ToBinary(binary_out, false);
return Fuzzer::FuzzerResultStatus::kComplete;
}
} // namespace fuzz
} // namespace spvtools
Reference in New Issue Copy Permalink