Commit Graph

19 Commits

Author SHA1 Message Date
Alastair Donaldson
b1350659b6
spirv-fuzz: Avoid void struct member when outlining functions (#3936)
Fixes #3935.
2020-10-19 17:34:31 +01:00
Vasyl Teliman
bd0dd9cef1
spirv-fuzz: Fix rvalue references (#3883)
Fixes #3659.
2020-10-06 12:06:53 +01:00
Vasyl Teliman
16cc197c8c
spirv-fuzz: Refactor conditions in the fact manager (#3867)
Refactors conditions and names of some methods in the fact manager. Part of #3698.
2020-10-01 11:48:47 +01:00
Alastair Donaldson
fcb22ecf0f
spirv-fuzz: Report fresh ids in transformations (#3856)
Adds a virtual method, GetFreshIds(), to Transformation. Every
transformation uses this to indicate which ids in its protobuf message
are fresh ids. This means that when replaying a sequence of
transformations the replayer can obtain a smallest id that is not in
use by the module already and that will not be used by any
transformation by necessity. Ids greater than or equal to this id
can be used as overflow ids.

Fixes #3851.
2020-09-29 22:12:49 +01:00
Vasyl Teliman
36185f8b09
spirv-fuzz: Move IRContext parameter into constructor (#3837)
This PR converts IRContext parameter in fact managers into a class field. Part of #3698.
2020-09-24 12:27:59 +01:00
Stefano Milizia
1e1c308ded
spirv-fuzz: Pass submanagers to other submanagers when necessary (#3796)
This PR changes the fact manager so that, when calling some of the
functions in submanagers, passes references to other submanagers if
necessary (e.g. to make consistency checks).

In particular:

- DataSynonymAndIdEquationFacts is passed to the AddFactIdIsIrrelevant
  function of IrrelevantValueFacts

- IrrelevantValueFacts is passed to the AddFact functions of
  DataSynonymAndIdEquationFacts

The IRContext is also passed when necessary and the calls to the
corresponding functions in FactManager were updated to be valid and
always use an updated context.

Fixes #3550.
2020-09-15 13:27:14 +01:00
Alastair Donaldson
9e26ae0455
spirv-fuzz: Overflow ids (#3734)
This change adds the notion of "overflow ids", which can be used
during shrinking to facilitate applying transformations that would
otherwise have become inapplicable due to earlier transformations
being removed.
2020-08-26 07:49:42 +01:00
Vasyl Teliman
7e75fea9ec
spirv-fuzz: Remove non-deterministic behaviour (#3608)
Fixes #3607.
2020-07-29 17:47:12 +01:00
Alastair Donaldson
f278b467df
spirv-fuzz: Do not outline regions that end with a loop header (#3312)
The outliner would outline regions ending with a loop header, making
the block containing the call to the outlined function serve as the
loop header.  This, however, is incorrect in general, since the whole
outlined function -- rather than just the exit block for the region --
would end up getting called every time the loop would iterate.

This change restricts the outliner so that the last block in a region
cannot be a loop header.
2020-04-28 13:32:06 +01:00
Alastair Donaldson
ed96301c6c
spirv-fuzz: Fix to outliner (#3302)
Adds an extra condition on when a region can be outlined to avoid the
case where a region ends with a loop head but such that the loop's
continue target is in the region.  (Outlining such a region would mean
that the loop merge is in the original function and the continue target
in the outlined function.)
2020-04-15 11:39:33 +01:00
Alastair Donaldson
c018fc6ae6
spirv-fuzz: Do not outline regions that produce pointer outputs (#3291)
The function outliner uses a struct to return ids that a region
generates and that are used outside that region.  If these ids have
pointer type this would result in a struct with pointer members, which
leads to illegal loading from non-logical pointers if logical
addressing is used.  This change bans that outlining possibility.
2020-04-14 20:22:30 +01:00
Alastair Donaldson
8d4261bc44
spirv-fuzz: Introduce TransformationContext (#3272)
Some transformations (e.g. TransformationAddFunction) rely on running
the validator to decide whether the transformation is applicable.  A
recent change allowed spirv-fuzz to take validator options, to cater
for the case where a module should be considered valid under
particular conditions.  However, validation during the checking of
transformations had no access to these validator options.

This change introduced TransformationContext, which currently consists
of a fact manager and a set of validator options, but could in the
future have other fields corresponding to other objects that it is
useful to have access to when applying transformations.  Now, instead
of checking and applying transformations in the context of a
FactManager, a TransformationContext is used.  This gives access to
the fact manager as before, and also access to the validator options
when they are needed.
2020-04-02 15:54:46 +01:00
Alastair Donaldson
fe10239f92
spirv-fuzz: Add fuzzer passes to add loads/stores (#3176)
This change adds fuzzer passes that sprinkle loads and stores into a
module at random, with stores restricted to occur in either dead
blocks, or to use pointers for which it is known that the pointee
value does not influence the module's overall behaviour.

The change also generalises the VariableValueIsArbitrary fact to
PointeeValueIsIrrelevant, to allow stores through access chains or
object copies of variables whose values are known to be irrelevant.

The change includes some other minor refactorings.
2020-02-06 16:54:34 +00:00
Alastair Donaldson
1fc7a9ec77
spirv-fuzz: Arbitrary variable facts (#3165)
This change adds a new kind of fact to the fact manager, which records
when a variable (or pointer parameter) refers to an arbitrary value,
so that anything can be stored to it, without affecting the observable
behaviour of the module, and nothing can be guaranteed about values
loaded from it. Donated modules are the current source of such
variables, and other transformations, such as outlining, have been
adapted to propagate these facts appropriately.
2020-01-30 11:25:29 +00:00
Alastair Donaldson
521223b70a
spirv-fuzz: Make functions "livesafe" during donation (#3146)
This change allows the generator to (optionally and at random) make
the functions of a module "livesafe" during donation. This involves
introducing a loop limiter variable to each function and gating the
number of total loop iterations for the function using that variable.
It also involves eliminating OpKill and OpUnreachable instructions
(changing them to OpReturn/OpReturnValue), and clamping access chain
indices so that they are always in-bounds.
2020-01-29 15:52:31 +00:00
Alastair Donaldson
ab7ac60f14
spirv-fuzz: Refactoring and type-related fixes (#3144)
This change refactors some code for walking access chain indexes to
make it mirror the structure of other code (to improve readability in
the first instance and potentially enable a future refactoring to
extract common code), and fixes a problem related to module donation
and function types.
2020-01-21 05:59:57 -08:00
Alastair Donaldson
8013d477ae
spirv-fuzz: add dead blocks (#3135)
This adds a new kind of fact to the fact manager that knows whether a
block is dead - i.e. guaranteed to be statically unreachable - and a
new transformation for adding a selection construct to a CFG that
conditionally branches to a fresh, dead block, such that the branch
will never be dynamically taken. Transformations that may create new
blocks ('split block' and 'outline function') are updated to propagate
dead block facts to newly-created blocks where appropriate. A fuzzer
pass randomly adds dead blocks to the module.

Future transformations will be able to exploit the fact that such
blocks are known to be dead.
2020-01-13 22:04:01 +00:00
Alastair Donaldson
2e41d5ece7
spirv-fuzz: Avoid passing access chains as parameters (#3112)
This change prevents the spirv-fuzz function outliner from outlining a
region that uses the result of an OpAccessChain not defined inside the
region.  Such accesses were turning into parameters to the outlined
function, and the result of an OpAccessChain cannot be passed as a
function parameter according to the SPIR-V specification.
2019-12-19 17:34:36 +00:00
Alastair Donaldson
0a2b38d082
spirv-fuzz: function outlining fuzzer pass (#3078)
A new transformation and associated fuzzer pass in spirv-fuzz that
selects single-entry single-exit control flow graph regions and for
each selected region outlines the region into a new function and
replaces the original region with a call to this function.
2019-12-10 14:47:42 +00:00