Commit Graph

66 Commits

Author SHA1 Message Date
Vasyl Teliman
99ad4f1e29
spirv-fuzz: Don't replace irrelevant indices in OpAccessChain (#3988)
Part of #3980.
2020-10-23 14:52:22 +01:00
Alastair Donaldson
5600fb85b6
spirv-fuzz: Avoid the type manager when looking for struct types (#3963)
Fixes #3947.
2020-10-21 18:28:05 +01:00
Alastair Donaldson
502e982956
spirv-fuzz: Fix to TransformationInlineFunction (#3913)
This fixes a problem where TransformationInlineFunction could lead to
distinct instructions having identical unique ids. It adds a validity
check to detect this problem in general.

Fixes #3911.
2020-10-16 22:58:09 +01:00
Alastair Donaldson
57b3723c5c
spirv-fuzz: Do not allow creation of constants of block-decorated structs (#3903)
Fixes #3902.
2020-10-13 18:35:41 +01:00
Alastair Donaldson
65b2a9e814
spirv-fuzz: Transformation to add wrappers for OpKill and similar (#3881)
Part of #3717.
2020-10-06 12:07:56 +01:00
Alastair Donaldson
f151337880
spirv-fuzz: Avoid using block-decorated structs in transformations (#3877)
Fixes #3875.
2020-10-02 20:01:08 +01:00
Stefano Milizia
fc7860e2db
spirv-fuzz: Merge the return instructions in a function (#3838)
This PR introduces TransformationMergeFunctionReturns, which changes
a function so that it only has one reachable return statement.

Fixes #3655.
2020-10-02 04:45:44 +01:00
Stefano Milizia
67525bded1
spirv-fuzz: Create synonym of int constant using a loop (#3790)
This transformation, given a constant integer (scalar or vector) C,
constants I and S of compatible type and scalar 32-bit integer constant
N, such that C = I - S*N, adds a loop which subtracts S from I, N
times, creating a synonym for C.

The related fuzzer pass randomly chooses constants to which to add
synonyms using this transformation, and the location where they should
be added.

Fixes #3616.
2020-09-23 14:10:02 +01:00
Vasyl Teliman
e7c84feda0
spirv-fuzz: Skip unreachable blocks (#3729)
Fixes #3722, fixes #3713, fixes #3714.
2020-09-15 23:35:42 +01:00
Stefano Milizia
f62357e7b8
spirv-fuzz: Transformation to flatten conditional branch (#3667)
This transformation, given the header of a selection construct with
branching instruction OpBranchConditional, flattens it.
Side-effecting operations such as OpLoad, OpStore and OpFunctionCall
are enclosed within smaller conditionals.
It is applicable if the construct does not contain inner selection
constructs or loops, or atomic or barrier instructions.

The corresponding fuzzer pass looks for selection headers and
tries to flatten them.

Needed for the issue #3544, but it does not fix it completely.
2020-09-15 10:31:01 +01:00
Stefano Milizia
fd05605bef
spirv-fuzz: Transformation to convert OpSelect to conditional branch (#3681)
This transformation takes an OpSelect instruction and replaces it with
a conditional branch, selecting the correct value using an OpPhi
instruction.

Fixes part of the issue #3544.
2020-09-03 10:19:02 +01:00
Vasyl Teliman
c341f7a6cd
spirv-fuzz: Add support for BuiltIn decoration (#3736)
Fixes #3676.
2020-09-02 14:14:58 +01:00
Stefano Milizia
3daabd3212
spirv-fuzz: Transformation to replace the use of an irrelevant id (#3697)
A transformation that replaces the use of an irrelevant id with
another id of the same type.

The related fuzzer pass, for every use of an irrelevant id,
checks whether the id can be replaced in that use by another
id of the same type and randomly decides whether to replace
it.

Fixes #3503.
2020-09-01 16:28:04 +01:00
Vasyl Teliman
d7f078f27d
spirv-fuzz: TransformationMutatePointer (#3737)
Fixes #3624.
2020-09-01 12:45:13 +01:00
Antoni Karpiński
a711c594b8
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606)
Adds FuzzerPassAddCompositeInserts, which randomly adds new
OpCompositeInsert instructions. Each OpCompositeInsert instruction
yields a copy of an original composite with one subcomponent replaced
with an existing or newly added object. Synonym facts are added for the
unchanged components in the original and added composite, and for the
replaced subcomponent and the object, if possible.

Fixes #2859
2020-08-19 13:56:03 +01:00
André Perez
e28436f2b8
spirv-fuzz: Check termination instructions when donating modules (#3710)
The FuzzerPassDonateModules was not checking if the function to donate had
a block with OpKill or OpUnreachable as its termination instruction.

Fixes #3709.
2020-08-17 23:30:07 +01:00
Vasyl Teliman
a10e760596
spirv-fuzz: Handle OpPhi during constant obfuscation (#3640)
Fixes #3639.
2020-08-05 19:17:27 +01:00
Vasyl Teliman
9f22236024
spirv-fuzz: Refactor boilerplate in TransformationAddParameter (#3625)
Part of #3534. I forgot to implement this functionality in the original PR.
2020-08-04 15:04:17 +01:00
Vasyl Teliman
ab4fe12a46
spirv-fuzz: Fix memory bugs (#3622) 2020-07-30 16:51:29 +01:00
Vasyl Teliman
7e75fea9ec
spirv-fuzz: Remove non-deterministic behaviour (#3608)
Fixes #3607.
2020-07-29 17:47:12 +01:00
Stefano Milizia
767518e8e1
spirv-fuzz: Relax type checking for int contants (#3573)
Right now, TransformationRecordSynonymousConstants requires the type
ids of two candidate constants to be exactly the same.
This PR adds an exception for integer constants, which can be
considered equivalent even if their signedness is different.
This applies to both integers and vector constants.

The IsApplicable method of ReplaceIdWithSynonym is also updated so
that, in the case of two integer constants which don't have the same
type, they can only be swapped in particular instructions (those
that don't take the signedness into consideration).

Fixes #3536.
2020-07-27 13:34:44 +01:00
Stefano Milizia
f8920bcfab
spirv-fuzz: Generalise transformation access chain (#3546)
This PR generalises TransformationAddAccessChain so that dynamic
indices for non-struct composites (with clamping to ensure that
accesses are in-bound) are allowed.

The transformation will add instructions to clamp any index to
a non-struct composite, regardless of whether it is a constant
or not.

Fixes #3179.
2020-07-27 11:28:12 +01:00
Vasyl Teliman
d6306537dc
spirv-fuzz: Don't use default parameters (#3583)
Fixes #3177.
2020-07-24 07:57:49 +01:00
Vasyl Teliman
1aaf5c6134
spirv-fuzz: Create a helper in fuzzerutil to reuse function type (#3572)
Fixes #3534.
2020-07-23 18:01:12 +01:00
Vasyl Teliman
bc2f78b7d9
spirv-fuzz: Fix usages of irrelevant constants (#3566)
Part of #3177.
2020-07-22 19:03:58 +01:00
Vasyl Teliman
fe9e5db890
spirv-fuzz: TransformationReplaceParamsWithStruct (#3455)
Fixes #3453.
2020-07-21 21:02:32 +01:00
Vasyl Teliman
5dc96d5d27
spirv-fuzz: Use irrelevant constants (#3565)
Part of #3177.
2020-07-21 13:30:28 +01:00
Vasyl Teliman
a3b0adc306
spirv-fuzz: Add is_irrelevant parameter (#3563)
Part of #3177.
Adjusts functions to create constants.
2020-07-21 08:59:13 +01:00
Stefano Milizia
f12c40f5a6
spirv-fuzz: Fuzzer pass to interchange zero-like constants (#3524)
This fuzzer pass:

For each zero-like constant, either finds the existing definition of
the corresponding toggled one (OpConstantNull becomes zero-valued
scalar OpConstant or vice versa) or creates a new one if it doesn't
exist and records that the two are synonyms

For each use of these constants, probabilistically decides whether to
change it with the corresponding toggled constant id (as described in
#3486 )

Only uses inside blocks of instructions are considered and not, for
example, in instructions declaring other constants.
2020-07-15 12:58:29 +01:00
André Perez
c9b254d045
spirv-fuzz: Support adding dead break from back-edge block (#3519)
Fixes #2577.
2020-07-14 12:32:16 +01:00
Vasyl Teliman
40c3c1cace
spirv-fuzz: TransformationAddSynonyms (#3447)
Part of #3440.
2020-07-12 09:59:08 +01:00
Vasyl Teliman
13dc28ce71
spirv-fuzz: Remove unused functions (#3510) 2020-07-11 08:57:07 +01:00
Vasyl Teliman
de56c34bd6
spirv-fuzz: TransformationReplaceParameterWithGlobal (#3434)
Fixes #3432.
2020-07-09 11:03:49 +01:00
Vasyl Teliman
6d61c1159e
spirv-fuzz: fuzzerutil::MaybeGetConstant* #3487
Part of #3428.
2020-07-07 10:46:04 +01:00
Vasyl Teliman
4a92579a45
spirv-fuzz: Add fuzzerutil::FindOrCreate* (#3479)
Part of #3428.
2020-07-02 10:46:49 +01:00
Vasyl Teliman
ab10489a02
spirv-fuzz: Add one parameter at a time (#3469)
Fixes #3467.
Fixes #3468.
2020-06-30 15:20:27 +01:00
Vasyl Teliman
71a5b6770d
spirv-fuzz: Add GetParameters (#3454)
Adds a GetParameters function to fuzzerutil.
2020-06-23 16:41:45 +01:00
Vasyl Teliman
8e586e46a2
spirv-fuzz: Permute OpPhi instruction operands (#3421)
Fixes #3415.
2020-06-23 15:00:28 +01:00
Vasyl Teliman
33cf7c425a
spirv-fuzz: Refactor variable creation (#3414)
Fixes #3413.
2020-06-19 16:40:18 +01:00
Vasyl Teliman
94808bd0f0
spirv-fuzz: Fix regression (#3396)
Fixes #3392.
2020-06-05 12:28:07 +01:00
Vasyl Teliman
2f69ea849a
spirv-fuzz: Remove FuzzerPassAddUsefulConstructs (#3341)
Fixes #3318.
2020-05-19 15:54:55 +01:00
Alastair Donaldson
e95fbfb1f5
spirv-fuzz: Transformation to add OpConstantNull (#3273)
Adds a transformation for adding OpConstantNull to a module, for
appropriate data types.
2020-04-02 19:25:30 +01:00
Alastair Donaldson
8d4261bc44
spirv-fuzz: Introduce TransformationContext (#3272)
Some transformations (e.g. TransformationAddFunction) rely on running
the validator to decide whether the transformation is applicable.  A
recent change allowed spirv-fuzz to take validator options, to cater
for the case where a module should be considered valid under
particular conditions.  However, validation during the checking of
transformations had no access to these validator options.

This change introduced TransformationContext, which currently consists
of a fact manager and a set of validator options, but could in the
future have other fields corresponding to other objects that it is
useful to have access to when applying transformations.  Now, instead
of checking and applying transformations in the context of a
FactManager, a TransformationContext is used.  This gives access to
the fact manager as before, and also access to the validator options
when they are needed.
2020-04-02 15:54:46 +01:00
Vasyl Teliman
7c3de218f4
spirv-fuzz: Remove duplicated functionality (#3220)
Fixes #3218.
2020-03-09 16:17:43 +00:00
Vasyl Teliman
533af49812
spirv-fuzz: Add fuzzer pass to permute function parameters (#3212)
Fixes #3194.
2020-03-08 14:27:05 +00:00
Alastair Donaldson
6c218ec60b
spirv-fuzz: Fuzzer pass that adds access chains (#3182)
This change adds a fuzzer pass that sprinkles access chain
instructions into a module at random. This allows other passes to
have a richer set of pointers available to them, in particular the
passes that add loads and stores.
2020-02-11 23:10:57 +00:00
Alastair Donaldson
3d4a0dd48f
spirv-fuzz: Ensure that donated variables are always initialized (#3181)
This change ensures that global and local variables donated from other
modules are always initialized at their declaration in the module
being transformed.  This is to help limit issues related to undefined
behaviour that might arise due to accessing uninitialized memory.

The change also introduces some helper functions in fuzzer_util to
make it easier to find the pointee types of pointer types.
2020-02-10 20:10:41 +00:00
Alastair Donaldson
fe10239f92
spirv-fuzz: Add fuzzer passes to add loads/stores (#3176)
This change adds fuzzer passes that sprinkle loads and stores into a
module at random, with stores restricted to occur in either dead
blocks, or to use pointers for which it is known that the pointee
value does not influence the module's overall behaviour.

The change also generalises the VariableValueIsArbitrary fact to
PointeeValueIsIrrelevant, to allow stores through access chains or
object copies of variables whose values are known to be irrelevant.

The change includes some other minor refactorings.
2020-02-06 16:54:34 +00:00
Alastair Donaldson
1f03ac1027
spirv-fuzz: Fuzzer passes to add local and global variables (#3175)
Adds two new fuzzer passes to add variables to a module: one that adds
Private storage class global variables, another that adds Function
storage class local variables.
2020-02-05 21:07:44 +00:00
Alastair Donaldson
ab7ac60f14
spirv-fuzz: Refactoring and type-related fixes (#3144)
This change refactors some code for walking access chain indexes to
make it mirror the structure of other code (to improve readability in
the first instance and potentially enable a future refactoring to
extract common code), and fixes a problem related to module donation
and function types.
2020-01-21 05:59:57 -08:00