Commit Graph

176 Commits

Author SHA1 Message Date
Antoni Karpiński
244e6c1be6
spirv-fuzz: Add TransformationDuplicateRegionWithSelection (#3773)
Adds a transformation that inserts a conditional statement with a
boolean expression of arbitrary value and duplicates a given
single-entry, single-exit region, so that it is present in each
conditional branch and will be executed regardless of which branch will
be taken.

Fixes #3614.
2020-09-11 11:48:19 +01:00
Alastair Donaldson
ed9863e46e
Favour 'integrity' over 'coherence' as a replacement for 'sanity'. (#3619) 2020-09-10 09:52:21 -04:00
Stefano Milizia
fd05605bef
spirv-fuzz: Transformation to convert OpSelect to conditional branch (#3681)
This transformation takes an OpSelect instruction and replaces it with
a conditional branch, selecting the correct value using an OpPhi
instruction.

Fixes part of the issue #3544.
2020-09-03 10:19:02 +01:00
Vasyl Teliman
c341f7a6cd
spirv-fuzz: Add support for BuiltIn decoration (#3736)
Fixes #3676.
2020-09-02 14:14:58 +01:00
Stefano Milizia
c278dada96
spirv-fuzz: Fix GetIdEquivalenceClasses (#3767)
Pointer (if VariablePointers is enabled) to find sets of potential
synonyms.

However, some instructions with these types cannot be used in an OpPhi:

- OpFunction cannot be used as a value
- OpUndef should not be used, because it yields an undefined value for
  each use
Fixes #3761.
2020-09-02 01:07:59 +01:00
Stefano Milizia
788468408e
spirv-fuzz: Replace id in OpPhi coming from a dead predecessor (#3744)
This transformation takes the id of an OpPhi instruction, of a dead
predecessor of the block containing it and a replacement id of
available to use and of the same type as the OpPhi, and changes
the id in the OpPhi corresponding to the given predecessor.

For example, %id = OpPhi %type %v1 %p1 %v2 %p2
becomes %id = OpPhi %type %v3 %p1 %v2 %p2
if the transformation is given %id, %p1 and %v3, %p1 is a dead block,
%v3 is type type and it is available to use at the end of %p1.

The fuzzer pass randomly decides to apply the transformation to OpPhi
instructions for which at least one of the predecessors is dead

Fixes #3726.
2020-09-02 01:06:38 +01:00
Stefano Milizia
3daabd3212
spirv-fuzz: Transformation to replace the use of an irrelevant id (#3697)
A transformation that replaces the use of an irrelevant id with
another id of the same type.

The related fuzzer pass, for every use of an irrelevant id,
checks whether the id can be replaced in that use by another
id of the same type and randomly decides whether to replace
it.

Fixes #3503.
2020-09-01 16:28:04 +01:00
Vasyl Teliman
d7f078f27d
spirv-fuzz: TransformationMutatePointer (#3737)
Fixes #3624.
2020-09-01 12:45:13 +01:00
Stefano Milizia
43a5186011
spirv-fuzz: Compute interprocedural loop nesting depth of blocks (#3753)
This PR extends CallGraph with functions to return:

- a list of functions in lexicographical order, with respect to
  function calls
- the maximum loop nesting depth that a function can be called from
  (computed interprocedurally, e.g. if foo() calls bar() at depth 2
  and bar() calls baz() at depth 1, the maximum depth of baz() will
  be 3).
2020-09-01 12:23:58 +01:00
Stefano Milizia
08291a3a9e
spirv-fuzz: Create synonym via OpPhi and existing synonyms (#3701)
A transformation that adds new OpPhi instructions to blocks with >=1
predecessors, so that its value depends on previously-defined ids of
the right type, which are all synonymous. This instruction is also
recorded as synonymous to the others.

The related fuzzer pass still needs to be implemented.

Fixes #3592 .
2020-08-27 15:59:54 +01:00
Alastair Donaldson
50cf38b8c9
spirv-fuzz: Do not make synonyms of void result ids (#3747)
Fixes #3746.
2020-08-27 09:39:20 +01:00
Alastair Donaldson
9e26ae0455
spirv-fuzz: Overflow ids (#3734)
This change adds the notion of "overflow ids", which can be used
during shrinking to facilitate applying transformations that would
otherwise have become inapplicable due to earlier transformations
being removed.
2020-08-26 07:49:42 +01:00
Vasyl Teliman
230f363e6d
spirv-fuzz: Split the fact manager into multiple files (#3699)
Part of #3698.

This splits various components of the fact manager into multiple files.
2020-08-25 18:11:37 +01:00
André Perez
5adc5ae643
spirv-fuzz: Add inline function transformation (#3517)
Fixes #3505.
2020-08-25 17:28:23 +01:00
André Perez
4dd122392f
spirv-fuzz: Add words instead of logical operands (#3728)
Fixes #3727.
2020-08-21 11:14:13 +01:00
Antoni Karpiński
a711c594b8
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606)
Adds FuzzerPassAddCompositeInserts, which randomly adds new
OpCompositeInsert instructions. Each OpCompositeInsert instruction
yields a copy of an original composite with one subcomponent replaced
with an existing or newly added object. Synonym facts are added for the
unchanged components in the original and added composite, and for the
replaced subcomponent and the object, if possible.

Fixes #2859
2020-08-19 13:56:03 +01:00
Antoni Karpiński
582c276d43
spirv-fuzz: Support pointer types in FuzzerPassAddParameters (#3627)
For FuzzerPassAddParameters, adds pointer types (that have the storage
class Function or Private) to the pool of available types for new
parameters. If there are no variables of the chosen pointer type, it
invokes TransformationAddLocalVariable / TransformationAddGlobalVariable
to add one.

Part of #3403
2020-08-19 11:18:47 +01:00
André Perez
82f4bf128a
spirv-fuzz: Check header dominance when adding dead block (#3694)
`TransformationAddDeadBlock` did not check whether the existing block
(that will become a selection header) dominates its successor block (that
will become its merge block).

This change adds the check.

Fixes #3690.
2020-08-17 17:47:13 +01:00
Antoni Karpiński
c20995ef80
spirv-fuzz: Improve code coverage of tests (#3686)
Improves the code coverage of tests for the following transformations:

1. TransformationAddRelaxedDecoration
2. TransformationReplaceCopyMemoryWithLoadStore
3. TransformationReplaceCopyObjectWithStoreLoad
4. TransformationReplaceLoadStoreWithCopyMemory
5. TransformationReplaceAddSubMulWithCarryingExtended
2020-08-14 12:47:21 +01:00
Vasyl Teliman
72ea7bec4a
spirv-fuzz: Support identical predecessors in TransformationPropagateInstructionUp (#3689)
Support identical predecessors in TransformationPropagateInstructionUp.

A basic block may have multiple identical predecessors as follows:

%1 = OpLabel
OpSelectionMerge %2 None
OpBranchConditional %true %2 %2
%2 = OpLabel
...

This case wasn't supported before.
2020-08-14 12:29:36 +01:00
André Perez
df859f77da
spirv-fuzz: Check integer and float width capabilities (#3670)
`TransformationAddTypeFloat` and `TransformationAddTypeInt` did not check whether the required capabilities were present when adding 16-bit, 64-bit, and 8-bit types.

This change adds these checks in the `IsApplicable` method of each transformation.

Fixes #3669.
2020-08-12 22:05:36 +01:00
André Perez
2641d33516
spirv-fuzz: consider additional access chain instructions (#3672)
`TransformationReplaceIdWithSynonym` is careful to avoid replacing id uses that index into a struct with synonyms because the indices must only be `OpConstant` instructions. However, the check only considered `OpAccessChain` instructions, even though the same restriction applies to `OpInBoundsAccessChain`, `OpPtrAccessChain`, etc. 

This change extends the check to include all access chain instructions.

Fixes #3671.
2020-08-12 21:58:53 +01:00
Vasyl Teliman
b7056e7e03
spirv-fuzz: FuzzerPassPropagateInstructionsUp (#3478)
Given an instruction (that may use an OpPhi result from the same block as an input operand), try to clone the instruction into each predecessor block, replacing the input operand with the corresponding OpPhi input operand in each case, if necessary.

Fixes #3458.
2020-08-11 10:24:32 +01:00
Antoni Karpiński
7b2dd11dda
spirv-fuzz: TransformationReplaceAddSubMulWithCarryingExtended (#3598)
Replaces OpIAdd with OpIAddCarry, OpISub with OpISubBorrow, OpIMul with
OpUMulExtended or OpSMulExtended and stores the result into a fresh_id
representing a structure. Extracts the first element of the result into
the original result_id. This value is the same as the result of the
original instruction.

Fixes #3577
2020-08-06 17:30:34 +01:00
André Perez
6d7f34fbfe
spirv-fuzz: Add TransformationMakeVectorOperationDynamic (#3597)
Fixes #3588.
2020-08-06 15:50:18 +01:00
Stefano Milizia
efc85ff661
spirv-fuzz: make outliner pass use additional transformations (#3604)
This PR changes FuzzerPassOutlineFunctions so that it uses some
transformation that make the TransformationOutlineFunction
transformation applicable in more cases. See the discussion in
#3095 for more details.

Fixes #3095.
2020-08-06 12:29:26 +01:00
Vasyl Teliman
0419751b0c
spirv-fuzz: Handle OpPhis in livesafe functions (#3642)
Fixes #3641.
2020-08-05 19:21:37 +01:00
Vasyl Teliman
a10e760596
spirv-fuzz: Handle OpPhi during constant obfuscation (#3640)
Fixes #3639.
2020-08-05 19:17:27 +01:00
Vasyl Teliman
8bc27a1cfb
spirv-fuzz: Remove OpFunctionCall operands in correct order (#3630)
Fixes #3629.
2020-08-04 19:10:21 +01:00
Vasyl Teliman
d9c73ebd9e
spirv-fuzz: Handle capabilities during module donation (#3651)
Fixes #3648.
2020-08-04 17:11:29 +01:00
Vasyl Teliman
9f22236024
spirv-fuzz: Refactor boilerplate in TransformationAddParameter (#3625)
Part of #3534. I forgot to implement this functionality in the original PR.
2020-08-04 15:04:17 +01:00
Vasyl Teliman
92a71657fc
spirv-fuzz: TransformationMoveInstructionDown (#3477)
Swaps an instruction with the next instruction in the block.

Fixes #3457.
2020-08-03 16:45:24 +01:00
Stefano Milizia
2aaa8653da
spirv-fuzz: Transformation to add loop preheader (#3599)
This PR introduces TransformationAddLoopPreheader, which, given
a loop header and enough fresh ids, adds a loop preheader, updating
all the references so that this new block is the only out-of-loop
predecessor of the header, which branches unconditionally to the
header.

See the discussion in #3095.
2020-07-30 20:18:19 +01:00
André Perez
c6e6597c4f
spirv-fuzz: Implement the OpOuterProduct linear algebra case (#3617)
Fixes #3354.
2020-07-29 23:46:56 +01:00
Vasyl Teliman
054f034ea9
spirv-fuzz: Compute corollary facts from OpBitcast (#3538)
Splits #3523 in two parts. This part implements functionality to
compute corollary facts from OpBitcast equation facts.
2020-07-29 22:06:31 +01:00
Vasyl Teliman
863b8e3d3d
spirv-fuzz: Relax type constraints in DataSynonym facts (#3602)
Fixes #3595.
2020-07-29 17:48:01 +01:00
Alastair Donaldson
f9b088fe0d
Avoid use of 'sanity' and 'sanity check' in the code base (#3585)
In line with:

  https://source.android.com/setup/contribute/respectful-code

this change uses the terms 'coherence' and 'coherence check' where
'sanity' and 'sanity check' were previously used.
2020-07-28 23:55:02 -04:00
André Perez
150be20d43
spirv-fuzz: Add condition to make functions livesafe (#3587)
Fixes #3162.
2020-07-28 01:01:59 +01:00
André Perez
1dfc6fc7e5
spirv-fuzz: Implement the OpTranspose linear algebra case (#3589)
This PR implements the OpTranspose case for the
replace linear algebra instruction transformation.
2020-07-27 19:19:13 +01:00
Antoni Karpiński
8a5500656e
spirv-fuzz: adds TransformationReplaceLoadStoreWithCopyMemory (#3586)
Adds a transformation that takes a pair of instruction descriptors to
OpLoad and OpStore that have the same intermediate value and replaces
the OpStore with an equivalent OpCopyMemory.

Fixes #3353.
2020-07-27 15:17:04 +01:00
Stefano Milizia
767518e8e1
spirv-fuzz: Relax type checking for int contants (#3573)
Right now, TransformationRecordSynonymousConstants requires the type
ids of two candidate constants to be exactly the same.
This PR adds an exception for integer constants, which can be
considered equivalent even if their signedness is different.
This applies to both integers and vector constants.

The IsApplicable method of ReplaceIdWithSynonym is also updated so
that, in the case of two integer constants which don't have the same
type, they can only be swapped in particular instructions (those
that don't take the signedness into consideration).

Fixes #3536.
2020-07-27 13:34:44 +01:00
Stefano Milizia
f8920bcfab
spirv-fuzz: Generalise transformation access chain (#3546)
This PR generalises TransformationAddAccessChain so that dynamic
indices for non-struct composites (with clamping to ensure that
accesses are in-bound) are allowed.

The transformation will add instructions to clamp any index to
a non-struct composite, regardless of whether it is a constant
or not.

Fixes #3179.
2020-07-27 11:28:12 +01:00
Alastair Donaldson
059ab0819e
spirv-fuzz: Set message consumer in replayer when shrinking (#3591)
Fixes an issue with the shrinker, where the message consumer set for
the shrinker was not being passed on to the replay object that the
shrinker creates.  This meant that messages generated during replay
would cause an exception to be thrown.
2020-07-27 08:11:12 +01:00
Vasyl Teliman
1aaf5c6134
spirv-fuzz: Create a helper in fuzzerutil to reuse function type (#3572)
Fixes #3534.
2020-07-23 18:01:12 +01:00
Vasyl Teliman
89b3bc5a8b
spirv-fuzz: Test usages of IdIsIrrelevant fact (#3578)
Part of #3177.
Fixes #3579.
2020-07-23 17:19:13 +01:00
Antoni Karpiński
9dc1bfa313
spirv-fuzz: adds TransformationReplaceCopyMemoryWithLoadStore (#3575)
Adds a transformation that replaces instruction OpCopyMemory with
loading the source variable to an intermediate value and storing this
value into the target variable of the original OpCopyMemory instruction.

Fixes #3352
2020-07-23 15:14:20 +01:00
Antoni Karpiński
586a12b9d4
spirv-fuzz: adds TransformationReplaceCopyObjectWithStoreLoad (#3567)
Adds a transformation that replaces instruction OpCopyObject with
storing into a new variable and immediately loading this variable to
|result_id| of the original OpCopyObject instruction.

Fixes #3351.
2020-07-23 08:17:45 +01:00
Vasyl Teliman
fe9e5db890
spirv-fuzz: TransformationReplaceParamsWithStruct (#3455)
Fixes #3453.
2020-07-21 21:02:32 +01:00
Stefano Milizia
98395b834a
spirv-fuzz: Extend TransformationRecordSynonymousConstants to allow composite constants (#3537)
Implemented AreEquivalentConstants method to check equivalency of
constants, changing IsApplicable method of
TransformationRecordSynonymousConstants to allow recording equivalence
of composite constants; added some tests to check this.

Tests with arrays and matrices still need to be added.

Fixes #3533.
2020-07-21 12:08:02 +01:00
Vasyl Teliman
8b5ed4448d
spirv-fuzz: Add IdIsIrrelevant fact (#3561)
Part of #3177.
This PR adds a fact to the fact manager.
2020-07-20 20:10:49 +01:00