From 5e5929455f27d4e429c9fb5a615ba38d0fc42867 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Perez?= Date: Wed, 12 Aug 2020 14:59:47 -0300 Subject: [PATCH] spirv-fuzz: Ignore specialization constants (#3664) `FuzzerPassInterchangeSignednessOfIntegerOperands` and `FuzzerPassInterchangeZeroLikeConstants` both included specialization constants when trying to find integer constants with known values. However, this is incorrect behavior because we do not know the value of specialization constants. Furthermore, ConstantManager does not support them, and this led to crashes where we assumed we could look up specialization constants via the ConstantManager. This change fixes both passes to ignore specialization constants. Fixes #3663. --- ...er_pass_interchange_signedness_of_integer_operands.cpp | 7 +++++++ .../fuzz/fuzzer_pass_interchange_zero_like_constants.cpp | 8 +++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/source/fuzz/fuzzer_pass_interchange_signedness_of_integer_operands.cpp b/source/fuzz/fuzzer_pass_interchange_signedness_of_integer_operands.cpp index 6c3aa7bfb..0e40b4963 100644 --- a/source/fuzz/fuzzer_pass_interchange_signedness_of_integer_operands.cpp +++ b/source/fuzz/fuzzer_pass_interchange_signedness_of_integer_operands.cpp @@ -91,6 +91,13 @@ void FuzzerPassInterchangeSignednessOfIntegerOperands::Apply() { uint32_t FuzzerPassInterchangeSignednessOfIntegerOperands:: FindOrCreateToggledIntegerConstant(uint32_t id) { + // |id| must not be a specialization constant because we do not know the value + // of specialization constants. + if (opt::IsSpecConstantInst( + GetIRContext()->get_def_use_mgr()->GetDef(id)->opcode())) { + return 0; + } + auto constant = GetIRContext()->get_constant_mgr()->FindDeclaredConstant(id); // This pass only toggles integer constants. diff --git a/source/fuzz/fuzzer_pass_interchange_zero_like_constants.cpp b/source/fuzz/fuzzer_pass_interchange_zero_like_constants.cpp index 8bd670f3a..20575e115 100644 --- a/source/fuzz/fuzzer_pass_interchange_zero_like_constants.cpp +++ b/source/fuzz/fuzzer_pass_interchange_zero_like_constants.cpp @@ -34,6 +34,12 @@ FuzzerPassInterchangeZeroLikeConstants:: uint32_t FuzzerPassInterchangeZeroLikeConstants::FindOrCreateToggledConstant( opt::Instruction* declaration) { + // |declaration| must not be a specialization constant because we do not know + // the value of specialization constants. + if (opt::IsSpecConstantInst(declaration->opcode())) { + return 0; + } + auto constant = GetIRContext()->get_constant_mgr()->FindDeclaredConstant( declaration->result_id()); @@ -107,4 +113,4 @@ void FuzzerPassInterchangeZeroLikeConstants::Apply() { } } } // namespace fuzz -} // namespace spvtools \ No newline at end of file +} // namespace spvtools