Commit Graph

93 Commits

Author SHA1 Message Date
Ben Clayton
c5bda7ae5a
Fuzzer: Default the new constructor parameter (#4438)
Introducing a new mandatory parameter makes it very difficult to roll
Chromium to a new version of SPIRV-Tools, as this project is used by
several third-party projects, and an atomic update of all projects
is very hard to coordinate.
2021-08-02 13:37:37 +01:00
Alastair Donaldson
9c4481419e
spirv-fuzz: Allow inapplicable transformations to be ignored (#4407)
spirv-fuzz features transformations that should be applicable by
construction. Assertions are used to detect when such transformations
turn out to be inapplicable. Failures of such assertions indicate bugs
in the fuzzer. However, when using the fuzzer at scale (e.g. in
ClusterFuzz) reports of these assertion failures create noise, and
cause the fuzzer to exit early. This change adds an option whereby
inapplicable transformations can be ignored. This reduces noise and
allows fuzzing to continue even when a transformation that should be
applicable but is not has been erroneously created.
2021-07-28 22:59:37 +01:00
Shiyu Liu
033768c24b
spirv-fuzz: TransformationWrapVectorSynonym that rewrites scalar operations using vectors (#4376)
Adds a new transformation that rewrites a scalar operation (like
OpFAdd, opISub) as an equivalent vector operation, adding a synonym
between the scalar result and an appropriate component of the vector
result.

Fixes #4195.
2021-07-20 11:01:20 +01:00
Shiyu Liu
6cdf07d2b3
spirv-fuzz: Swap positions of two functions in a module (#4236)
Adds a new transformation class that swaps the syntactic position of
two functions in the module, and a fuzzer pass to apply it.

Fixes #4026.
2021-04-27 12:33:08 +01:00
Mostafa Ashraf
8fe39ad581
spirv-fuzz: Permute the order of variables at function scope issue (#4248)
Fixes #4194.
2021-04-26 16:53:55 +01:00
Vasyl Teliman
f227930153
spirv-fuzz: Fix comments #4215
Related to #4214.
2021-03-25 17:20:45 +00:00
Vasyl Teliman
edb8399b0f
spirv-fuzz: Add WGSL compatibility flag to context (#4193)
The new flags allows transformations and fuzzer passes to be enabled
and applied in a WGSL-compatible fashion.
2021-03-21 09:10:15 +00:00
Alastair Donaldson
a732e4c03c
spirv-fuzz: Apply fuzzer pass before checking exit conditions (#4199)
Fixes #4198.
2021-03-19 05:32:54 +00:00
Vasyl Teliman
43cfa9bc1d
spirv-fuzz: Add persistent state to the fuzzer (#4137)
Adds persistent state to the fuzzer so that it can be used as a custom
mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
Alastair Donaldson
02195a029c
spirv-fuzz: Fixes to pass management (#4011) 2020-11-04 10:45:53 +00:00
Alastair Donaldson
bcf5b211db
spirv-fuzz: Add support for reining in rogue fuzzer passes (#3987)
Adds some functions that allow a fuzzer pass to check whether it is
spiralling out of control and exit early.  The fuzzer pass for adding
bit instruction synonyms now uses this.  Also make many methods in
FuzzerContext const.
2020-11-03 16:51:10 +00:00
André Perez
abe2eff36f
spirv-fuzz: Add expand vector reduction transformation (#3869)
The following implementations are introduced:

- Transformation and fuzzer pass for expanding vector reduction.
- Unit tests to cover the instructions with different vector sizes.

Fixes #3768.
2020-10-23 14:59:08 +01:00
Vasyl Teliman
895dafcc1d
spirv-fuzz: Add FuzzerPassAddCompositeExtract (#3904)
Fixes #3806.
2020-10-23 14:49:50 +01:00
Alastair Donaldson
502e982956
spirv-fuzz: Fix to TransformationInlineFunction (#3913)
This fixes a problem where TransformationInlineFunction could lead to
distinct instructions having identical unique ids. It adds a validity
check to detect this problem in general.

Fixes #3911.
2020-10-16 22:58:09 +01:00
Alastair Donaldson
5c64374dd6
spirv-fuzz: Avoid creating blocks without parents (#3908)
The validity check during fuzzing and in unit tests is strengthened to
require that every block has its enclosing function as its parent.
TransformationMergeFunctionReturns is fixed so that it ensures parents
are set appropriately.

Fixes #3907.
2020-10-13 19:48:18 +01:00
Alastair Donaldson
fc8264854c
spirv-fuzz: Replace dead-block terminators with OpKill etc. (#3882)
Fixes #3615.
2020-10-06 15:59:05 +01:00
Vasyl Teliman
63cc22d645
spirv-fuzz: TransformationPropagateInstructionDown (#3692)
Fixes #3691.
2020-10-06 13:38:19 +01:00
Alastair Donaldson
74a711a76d
spirv-fuzz: Only recommend passes when a pass had an effect (#3863)
Fixes #3817.
2020-10-02 04:48:39 +01:00
Stefano Milizia
fc7860e2db
spirv-fuzz: Merge the return instructions in a function (#3838)
This PR introduces TransformationMergeFunctionReturns, which changes
a function so that it only has one reachable return statement.

Fixes #3655.
2020-10-02 04:45:44 +01:00
Vasyl Teliman
16cc197c8c
spirv-fuzz: Refactor conditions in the fact manager (#3867)
Refactors conditions and names of some methods in the fact manager. Part of #3698.
2020-10-01 11:48:47 +01:00
Vasyl Teliman
615fbe6cbc
spirv-fuzz: TransformationWrapRegionInSelection (#3674)
Fixes #3675.
2020-10-01 09:54:10 +01:00
Alastair Donaldson
f2b8a4ee51
spirv-fuzz: Enable some passes with high probability (#3860)
Fixes #3764.
2020-10-01 09:07:06 +01:00
Alastair Donaldson
9edeeafdb6
spirv-fuzz: Use unique_ptr<FactManager> in TransformationContext (#3844)
TransformationContext now holds a std::unique_ptr to a FactManager,
rather than a plain pointer. This makes it easier for clients of
TransformationContext to work with heap-allocated instances of
TransformationContext, which is needed in some upcoming work.
2020-09-24 17:28:49 +01:00
Vasyl Teliman
36185f8b09
spirv-fuzz: Move IRContext parameter into constructor (#3837)
This PR converts IRContext parameter in fact managers into a class field. Part of #3698.
2020-09-24 12:27:59 +01:00
Stefano Milizia
67525bded1
spirv-fuzz: Create synonym of int constant using a loop (#3790)
This transformation, given a constant integer (scalar or vector) C,
constants I and S of compatible type and scalar 32-bit integer constant
N, such that C = I - S*N, adds a loop which subtracts S from I, N
times, creating a synonym for C.

The related fuzzer pass randomly chooses constants to which to add
synonyms using this transformation, and the location where they should
be added.

Fixes #3616.
2020-09-23 14:10:02 +01:00
Alastair Donaldson
125b642419
spirv-fuzz: Refactor fuzzer, replayer and shrinker (#3818)
In preparation for some upcoming work on the shrinker, this PR changes
the interfaces of Fuzzer, Replayer and Shrinker so that all data
relevant to each class is provided on construction, meaning that the
"Run" method can become a zero-argument method that returns a status,
transformed binary and sequence of applied transformations via a
struct.

This makes greater use of fields, so that -- especially in Fuzzer --
there is a lot less parameter passing.
2020-09-22 10:07:58 +01:00
Alastair Donaldson
60ce96e2ff
spirv-fuzz: Add pass recommendations (#3757)
This change introduces various strategies for controlling the manner
in which fuzzer passes are applied repeatedly, including infrastructure
to allow fuzzer passes to be recommended based on which passes ran
previously.
2020-09-18 15:51:35 +01:00
André Perez
e8ce4355ae
spirv-fuzz: Add bit instruction synonym transformation (#3775)
This PR implements part of the add bit instruction synonym transformation.
For now, the implementation covers the OpBitwiseOr, OpBitwiseXor and
OpBitwiseAnd cases.
2020-09-15 23:36:23 +01:00
Stefano Milizia
f62357e7b8
spirv-fuzz: Transformation to flatten conditional branch (#3667)
This transformation, given the header of a selection construct with
branching instruction OpBranchConditional, flattens it.
Side-effecting operations such as OpLoad, OpStore and OpFunctionCall
are enclosed within smaller conditionals.
It is applicable if the construct does not contain inner selection
constructs or loops, or atomic or barrier instructions.

The corresponding fuzzer pass looks for selection headers and
tries to flatten them.

Needed for the issue #3544, but it does not fix it completely.
2020-09-15 10:31:01 +01:00
Antoni Karpiński
244e6c1be6
spirv-fuzz: Add TransformationDuplicateRegionWithSelection (#3773)
Adds a transformation that inserts a conditional statement with a
boolean expression of arbitrary value and duplicates a given
single-entry, single-exit region, so that it is present in each
conditional branch and will be executed regardless of which branch will
be taken.

Fixes #3614.
2020-09-11 11:48:19 +01:00
Stefano Milizia
fd05605bef
spirv-fuzz: Transformation to convert OpSelect to conditional branch (#3681)
This transformation takes an OpSelect instruction and replaces it with
a conditional branch, selecting the correct value using an OpPhi
instruction.

Fixes part of the issue #3544.
2020-09-03 10:19:02 +01:00
Stefano Milizia
788468408e
spirv-fuzz: Replace id in OpPhi coming from a dead predecessor (#3744)
This transformation takes the id of an OpPhi instruction, of a dead
predecessor of the block containing it and a replacement id of
available to use and of the same type as the OpPhi, and changes
the id in the OpPhi corresponding to the given predecessor.

For example, %id = OpPhi %type %v1 %p1 %v2 %p2
becomes %id = OpPhi %type %v3 %p1 %v2 %p2
if the transformation is given %id, %p1 and %v3, %p1 is a dead block,
%v3 is type type and it is available to use at the end of %p1.

The fuzzer pass randomly decides to apply the transformation to OpPhi
instructions for which at least one of the predecessors is dead

Fixes #3726.
2020-09-02 01:06:38 +01:00
Stefano Milizia
3daabd3212
spirv-fuzz: Transformation to replace the use of an irrelevant id (#3697)
A transformation that replaces the use of an irrelevant id with
another id of the same type.

The related fuzzer pass, for every use of an irrelevant id,
checks whether the id can be replaced in that use by another
id of the same type and randomly decides whether to replace
it.

Fixes #3503.
2020-09-01 16:28:04 +01:00
Vasyl Teliman
d7f078f27d
spirv-fuzz: TransformationMutatePointer (#3737)
Fixes #3624.
2020-09-01 12:45:13 +01:00
Alastair Donaldson
f428aa39ca
spirv-fuzz: Remove opaque pointer design pattern (#3755)
There's no real need for Fuzzer, Replayer and Shrinker to use the
opaque pointer design pattern.  This change removes it, paving the way
for making some upcoming changes to Fuzzer easier.
2020-08-28 13:30:06 +01:00
Stefano Milizia
08291a3a9e
spirv-fuzz: Create synonym via OpPhi and existing synonyms (#3701)
A transformation that adds new OpPhi instructions to blocks with >=1
predecessors, so that its value depends on previously-defined ids of
the right type, which are all synonymous. This instruction is also
recorded as synonymous to the others.

The related fuzzer pass still needs to be implemented.

Fixes #3592 .
2020-08-27 15:59:54 +01:00
Vasyl Teliman
230f363e6d
spirv-fuzz: Split the fact manager into multiple files (#3699)
Part of #3698.

This splits various components of the fact manager into multiple files.
2020-08-25 18:11:37 +01:00
André Perez
5adc5ae643
spirv-fuzz: Add inline function transformation (#3517)
Fixes #3505.
2020-08-25 17:28:23 +01:00
Antoni Karpiński
a711c594b8
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606)
Adds FuzzerPassAddCompositeInserts, which randomly adds new
OpCompositeInsert instructions. Each OpCompositeInsert instruction
yields a copy of an original composite with one subcomponent replaced
with an existing or newly added object. Synonym facts are added for the
unchanged components in the original and added composite, and for the
replaced subcomponent and the object, if possible.

Fixes #2859
2020-08-19 13:56:03 +01:00
Stefano Milizia
eade36db22
spirv-fuzz: Fuzzer pass to randomly apply loop preheaders (#3668)
This PR introduces FuzzerPassAddLoopPreheaders, which:
- Finds existing loop headers
- If they have no simple preheader (where simple means that the
  preheader itself is not a loop header), randomly decides whether
  to add one.

Fixes #3621.
2020-08-14 12:44:28 +01:00
Vasyl Teliman
b7056e7e03
spirv-fuzz: FuzzerPassPropagateInstructionsUp (#3478)
Given an instruction (that may use an OpPhi result from the same block as an input operand), try to clone the instruction into each predecessor block, replacing the input operand with the corresponding OpPhi input operand in each case, if necessary.

Fixes #3458.
2020-08-11 10:24:32 +01:00
André Perez
6d7f34fbfe
spirv-fuzz: Add TransformationMakeVectorOperationDynamic (#3597)
Fixes #3588.
2020-08-06 15:50:18 +01:00
Vasyl Teliman
92a71657fc
spirv-fuzz: TransformationMoveInstructionDown (#3477)
Swaps an instruction with the next instruction in the block.

Fixes #3457.
2020-08-03 16:45:24 +01:00
Stefano Milizia
96bcc82743
spirv-fuzz: Pass to replace int operands with ints of opposite signedness (#3612)
This PR introduces a new fuzzer pass, which:

- finds all integer vectors or constants
- finds or creates the corresponding constants with opposite
  signedness
- records such constants as synonyms of the first ones
- replaces the usages of the original constants with the new ones
  if allowed

Fixes #2677.
2020-07-30 19:48:29 +01:00
Vasyl Teliman
fe9e5db890
spirv-fuzz: TransformationReplaceParamsWithStruct (#3455)
Fixes #3453.
2020-07-21 21:02:32 +01:00
Stefano Milizia
f12c40f5a6
spirv-fuzz: Fuzzer pass to interchange zero-like constants (#3524)
This fuzzer pass:

For each zero-like constant, either finds the existing definition of
the corresponding toggled one (OpConstantNull becomes zero-valued
scalar OpConstant or vice versa) or creates a new one if it doesn't
exist and records that the two are synonyms

For each use of these constants, probabilistically decides whether to
change it with the corresponding toggled constant id (as described in
#3486 )

Only uses inside blocks of instructions are considered and not, for
example, in instructions declaring other constants.
2020-07-15 12:58:29 +01:00
Vasyl Teliman
40c3c1cace
spirv-fuzz: TransformationAddSynonyms (#3447)
Part of #3440.
2020-07-12 09:59:08 +01:00
Vasyl Teliman
de56c34bd6
spirv-fuzz: TransformationReplaceParameterWithGlobal (#3434)
Fixes #3432.
2020-07-09 11:03:49 +01:00
André Perez
daa3b47ed4
spirv-fuzz: Add image sample unused components transformation (#3439)
Fixes #3375.
2020-07-08 17:07:04 +01:00
Vasyl Teliman
bd2a9ea852
spirv-fuzz: TransformationInvertComparisonOperator (#3475)
Part of #3440.
2020-07-03 17:37:32 +01:00