Commit Graph

85 Commits

Author SHA1 Message Date
Vasyl Teliman
615fbe6cbc
spirv-fuzz: TransformationWrapRegionInSelection (#3674)
Fixes #3675.
2020-10-01 09:54:10 +01:00
Stefano Milizia
67525bded1
spirv-fuzz: Create synonym of int constant using a loop (#3790)
This transformation, given a constant integer (scalar or vector) C,
constants I and S of compatible type and scalar 32-bit integer constant
N, such that C = I - S*N, adds a loop which subtracts S from I, N
times, creating a synonym for C.

The related fuzzer pass randomly chooses constants to which to add
synonyms using this transformation, and the location where they should
be added.

Fixes #3616.
2020-09-23 14:10:02 +01:00
André Perez
e8ce4355ae
spirv-fuzz: Add bit instruction synonym transformation (#3775)
This PR implements part of the add bit instruction synonym transformation.
For now, the implementation covers the OpBitwiseOr, OpBitwiseXor and
OpBitwiseAnd cases.
2020-09-15 23:36:23 +01:00
Vasyl Teliman
e7c84feda0
spirv-fuzz: Skip unreachable blocks (#3729)
Fixes #3722, fixes #3713, fixes #3714.
2020-09-15 23:35:42 +01:00
Stefano Milizia
f62357e7b8
spirv-fuzz: Transformation to flatten conditional branch (#3667)
This transformation, given the header of a selection construct with
branching instruction OpBranchConditional, flattens it.
Side-effecting operations such as OpLoad, OpStore and OpFunctionCall
are enclosed within smaller conditionals.
It is applicable if the construct does not contain inner selection
constructs or loops, or atomic or barrier instructions.

The corresponding fuzzer pass looks for selection headers and
tries to flatten them.

Needed for the issue #3544, but it does not fix it completely.
2020-09-15 10:31:01 +01:00
Antoni Karpiński
244e6c1be6
spirv-fuzz: Add TransformationDuplicateRegionWithSelection (#3773)
Adds a transformation that inserts a conditional statement with a
boolean expression of arbitrary value and duplicates a given
single-entry, single-exit region, so that it is present in each
conditional branch and will be executed regardless of which branch will
be taken.

Fixes #3614.
2020-09-11 11:48:19 +01:00
Stefano Milizia
fd05605bef
spirv-fuzz: Transformation to convert OpSelect to conditional branch (#3681)
This transformation takes an OpSelect instruction and replaces it with
a conditional branch, selecting the correct value using an OpPhi
instruction.

Fixes part of the issue #3544.
2020-09-03 10:19:02 +01:00
Stefano Milizia
788468408e
spirv-fuzz: Replace id in OpPhi coming from a dead predecessor (#3744)
This transformation takes the id of an OpPhi instruction, of a dead
predecessor of the block containing it and a replacement id of
available to use and of the same type as the OpPhi, and changes
the id in the OpPhi corresponding to the given predecessor.

For example, %id = OpPhi %type %v1 %p1 %v2 %p2
becomes %id = OpPhi %type %v3 %p1 %v2 %p2
if the transformation is given %id, %p1 and %v3, %p1 is a dead block,
%v3 is type type and it is available to use at the end of %p1.

The fuzzer pass randomly decides to apply the transformation to OpPhi
instructions for which at least one of the predecessors is dead

Fixes #3726.
2020-09-02 01:06:38 +01:00
Stefano Milizia
3daabd3212
spirv-fuzz: Transformation to replace the use of an irrelevant id (#3697)
A transformation that replaces the use of an irrelevant id with
another id of the same type.

The related fuzzer pass, for every use of an irrelevant id,
checks whether the id can be replaced in that use by another
id of the same type and randomly decides whether to replace
it.

Fixes #3503.
2020-09-01 16:28:04 +01:00
Vasyl Teliman
d7f078f27d
spirv-fuzz: TransformationMutatePointer (#3737)
Fixes #3624.
2020-09-01 12:45:13 +01:00
Stefano Milizia
43a5186011
spirv-fuzz: Compute interprocedural loop nesting depth of blocks (#3753)
This PR extends CallGraph with functions to return:

- a list of functions in lexicographical order, with respect to
  function calls
- the maximum loop nesting depth that a function can be called from
  (computed interprocedurally, e.g. if foo() calls bar() at depth 2
  and bar() calls baz() at depth 1, the maximum depth of baz() will
  be 3).
2020-09-01 12:23:58 +01:00
Stefano Milizia
08291a3a9e
spirv-fuzz: Create synonym via OpPhi and existing synonyms (#3701)
A transformation that adds new OpPhi instructions to blocks with >=1
predecessors, so that its value depends on previously-defined ids of
the right type, which are all synonymous. This instruction is also
recorded as synonymous to the others.

The related fuzzer pass still needs to be implemented.

Fixes #3592 .
2020-08-27 15:59:54 +01:00
André Perez
5adc5ae643
spirv-fuzz: Add inline function transformation (#3517)
Fixes #3505.
2020-08-25 17:28:23 +01:00
Antoni Karpiński
a711c594b8
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606)
Adds FuzzerPassAddCompositeInserts, which randomly adds new
OpCompositeInsert instructions. Each OpCompositeInsert instruction
yields a copy of an original composite with one subcomponent replaced
with an existing or newly added object. Synonym facts are added for the
unchanged components in the original and added composite, and for the
replaced subcomponent and the object, if possible.

Fixes #2859
2020-08-19 13:56:03 +01:00
Vasyl Teliman
b7056e7e03
spirv-fuzz: FuzzerPassPropagateInstructionsUp (#3478)
Given an instruction (that may use an OpPhi result from the same block as an input operand), try to clone the instruction into each predecessor block, replacing the input operand with the corresponding OpPhi input operand in each case, if necessary.

Fixes #3458.
2020-08-11 10:24:32 +01:00
Antoni Karpiński
7b2dd11dda
spirv-fuzz: TransformationReplaceAddSubMulWithCarryingExtended (#3598)
Replaces OpIAdd with OpIAddCarry, OpISub with OpISubBorrow, OpIMul with
OpUMulExtended or OpSMulExtended and stores the result into a fresh_id
representing a structure. Extracts the first element of the result into
the original result_id. This value is the same as the result of the
original instruction.

Fixes #3577
2020-08-06 17:30:34 +01:00
André Perez
6d7f34fbfe
spirv-fuzz: Add TransformationMakeVectorOperationDynamic (#3597)
Fixes #3588.
2020-08-06 15:50:18 +01:00
Stefano Milizia
efc85ff661
spirv-fuzz: make outliner pass use additional transformations (#3604)
This PR changes FuzzerPassOutlineFunctions so that it uses some
transformation that make the TransformationOutlineFunction
transformation applicable in more cases. See the discussion in
#3095 for more details.

Fixes #3095.
2020-08-06 12:29:26 +01:00
Vasyl Teliman
92a71657fc
spirv-fuzz: TransformationMoveInstructionDown (#3477)
Swaps an instruction with the next instruction in the block.

Fixes #3457.
2020-08-03 16:45:24 +01:00
Stefano Milizia
2aaa8653da
spirv-fuzz: Transformation to add loop preheader (#3599)
This PR introduces TransformationAddLoopPreheader, which, given
a loop header and enough fresh ids, adds a loop preheader, updating
all the references so that this new block is the only out-of-loop
predecessor of the header, which branches unconditionally to the
header.

See the discussion in #3095.
2020-07-30 20:18:19 +01:00
Antoni Karpiński
8a5500656e
spirv-fuzz: adds TransformationReplaceLoadStoreWithCopyMemory (#3586)
Adds a transformation that takes a pair of instruction descriptors to
OpLoad and OpStore that have the same intermediate value and replaces
the OpStore with an equivalent OpCopyMemory.

Fixes #3353.
2020-07-27 15:17:04 +01:00
Antoni Karpiński
9dc1bfa313
spirv-fuzz: adds TransformationReplaceCopyMemoryWithLoadStore (#3575)
Adds a transformation that replaces instruction OpCopyMemory with
loading the source variable to an intermediate value and storing this
value into the target variable of the original OpCopyMemory instruction.

Fixes #3352
2020-07-23 15:14:20 +01:00
Antoni Karpiński
586a12b9d4
spirv-fuzz: adds TransformationReplaceCopyObjectWithStoreLoad (#3567)
Adds a transformation that replaces instruction OpCopyObject with
storing into a new variable and immediately loading this variable to
|result_id| of the original OpCopyObject instruction.

Fixes #3351.
2020-07-23 08:17:45 +01:00
Vasyl Teliman
fe9e5db890
spirv-fuzz: TransformationReplaceParamsWithStruct (#3455)
Fixes #3453.
2020-07-21 21:02:32 +01:00
Antoni Karpiński
0d8fe0fba0
spirv-fuzz: add TransformationAddRelaxedDecoration (#3545)
Add TransformationAddRelaxedDecoration, which adds the RelaxedPrecision decoration to ids of numeric instructions (those yielding 32-bit ints or floats) in dead blocks.

Fixes #3502
2020-07-20 13:13:07 +01:00
Vasyl Teliman
2fa735dc06
spirv-fuzz: Remove TransformationCopyObject (#3531)
Fixes #3509.
2020-07-15 17:37:19 +01:00
Alastair Donaldson
3e7238c68d
spirv-fuzz: Add replay range option (#3535)
This change adds a --replay-range argument to spirv-fuzz that
facilitates applying only a prefix of transformations.
2020-07-15 12:13:23 +01:00
Vasyl Teliman
40c3c1cace
spirv-fuzz: TransformationAddSynonyms (#3447)
Part of #3440.
2020-07-12 09:59:08 +01:00
Stefano Milizia
5f8cdd8b45
Implement transformation to record synonymous constants. (#3494)
Adds a fact-only transformation that records that two constants in the module are synonymous.
2020-07-10 14:02:14 +01:00
Vasyl Teliman
de56c34bd6
spirv-fuzz: TransformationReplaceParameterWithGlobal (#3434)
Fixes #3432.
2020-07-09 11:03:49 +01:00
André Perez
daa3b47ed4
spirv-fuzz: Add image sample unused components transformation (#3439)
Fixes #3375.
2020-07-08 17:07:04 +01:00
Vasyl Teliman
bd2a9ea852
spirv-fuzz: TransformationInvertComparisonOperator (#3475)
Part of #3440.
2020-07-03 17:37:32 +01:00
Vasyl Teliman
fba90d6b0a
spirv-fuzz: Add FuzzerPassAddCopyMemoryInstructions (#3391)
Fixes #3382.
2020-06-30 21:13:05 +01:00
Vasyl Teliman
ab10489a02
spirv-fuzz: Add one parameter at a time (#3469)
Fixes #3467.
Fixes #3468.
2020-06-30 15:20:27 +01:00
Vasyl Teliman
29ba53f2a2
spirv-fuzz: Implement FuzzerPassAddParameters (#3399)
Fixes #3384.
2020-06-23 17:40:44 +01:00
Vasyl Teliman
8e586e46a2
spirv-fuzz: Permute OpPhi instruction operands (#3421)
Fixes #3415.
2020-06-23 15:00:28 +01:00
Vasyl Teliman
d5306c8e8f
spirv-fuzz: Swap operands in OpBranchConditional (#3423)
Fixes #3415.
2020-06-19 16:38:52 +01:00
André Perez
12a4fb3bc1
spirv-fuzz: Add replace linear algebra instruction transformation (#3402)
This PR implements a transformation that replaces
a linear algebra instruction with its mathematical definition.
2020-06-16 11:20:51 +01:00
André Perez
f050cca7ec
spirv-fuzz: Add push id through variable transformation (#3359)
Makes an id synonym by storing an id to a new variable and then
loading it back from that variable.

Fixes #3192.
2020-05-29 16:43:38 +01:00
Vasyl Teliman
2f69ea849a
spirv-fuzz: Remove FuzzerPassAddUsefulConstructs (#3341)
Fixes #3318.
2020-05-19 15:54:55 +01:00
André Perez
a6b0e132ec
Add adjust branch weights transformation (#3336)
In this PR, the classes that represent the adjust branch weights
transformation and fuzzer pass were implemented. This transformation
adjusts the branch weights of a OpBranchConditional instruction.
2020-05-14 11:38:34 +01:00
Alastair Donaldson
67f4838659
spirv-fuzz: Make handling of synonym facts more efficient (#3301)
The fact manager maintains an equivalence relation on data descriptors
that tracks when one data descriptor could be used in place of
another.  An algorithm to compute the closure of such facts allows
deducing new synonym facts from existing facts.  E.g., for two 2D
vectors u and v it is known that u.x is synonymous with v.x and u.y is
synonymous with v.y, it can be deduced that u and v are synonymous.

The closure computation algorithm is very expensive if we get large
equivalence relations.

This change addresses this in three ways:

- The size of equivalence relations is reduced by limiting the extent
  to which the components of a composite are recursively noted as
  being equivalent, so that when we have large synonymous arrays we do
  not record all array elements as being pairwise equivalent.

- When computing the closure of facts, equivalence classes above a
  certain size are simply skipped (which can lead to missed facts)

- The closure computation is performed less frequently - it is invoked
  explicitly before fuzzer passes that will benefit from data synonym
  facts.  A new transformation is used to control its invocation, so
  that fuzzing and replaying do not get out of sync.

The change also tidies up the order in which some getters are declared
in FuzzerContext.
2020-04-20 19:02:49 +01:00
Alastair Donaldson
e95fbfb1f5
spirv-fuzz: Transformation to add OpConstantNull (#3273)
Adds a transformation for adding OpConstantNull to a module, for
appropriate data types.
2020-04-02 19:25:30 +01:00
Alastair Donaldson
5d491a7ed6
spirv-fuzz: Handle isomorphic types property in composite construction (#3262)
The fuzzer pass that constructs composites had an issue where it would
regard isomorphic but distinct structs (similarly arrays) as being
interchangeable when constructing composites.  This change fixes the
problem by relying less on the type manager.
2020-04-02 18:33:19 +01:00
André Perez Maselco
4c027048d8
spirv-fuzz: Add toggle access chain instruction transformation (#3211)
In this PR, the classes that represent the toggle access chain
instruction transformation and fuzzer pass were implemented. This
transformation toggles the instructions OpAccessChain and
OpInBoundsAccessChain between them.

Fixes #3193.
2020-03-08 22:33:24 +00:00
Vasyl Teliman
533af49812
spirv-fuzz: Add fuzzer pass to permute function parameters (#3212)
Fixes #3194.
2020-03-08 14:27:05 +00:00
Alastair Donaldson
66a682b6a8
spirv-fuzz: Add swap commutable operands transformation (#3205)
In this PR, the classes that represent the swap commutable operands
transformation and the fuzzer pass were implemented.

Fixes #3205.
2020-03-05 08:18:39 +00:00
Alastair Donaldson
044ecc0b2c
spirv-fuzz: Fuzzer pass to add equation instructions (#3202)
This introduces a new fuzzer pass to add instructions to the module
that define equations, and support in the fact manager for recording
equation facts and deducing synonym facts from equation facts.

Initially the only equations that are supported involve OpIAdd,
OpISub, OpSNegate and OpLogicalNot, but there is scope for adding
support for equations over various other operators.
2020-03-04 14:54:08 +00:00
Alastair Donaldson
6c218ec60b
spirv-fuzz: Fuzzer pass that adds access chains (#3182)
This change adds a fuzzer pass that sprinkles access chain
instructions into a module at random. This allows other passes to
have a richer set of pointers available to them, in particular the
passes that add loads and stores.
2020-02-11 23:10:57 +00:00
Alastair Donaldson
77fb303e58
spirv-fuzz: Fuzzer pass to add function calls (#3178)
Adds a fuzzer pass that inserts function calls into the module at
random. Calls from dead blocks can be arbitrary (so long as they do
not introduce recursion), while calls from other blocks can only be to
livesafe functions.

The change fixes some oversights in transformations to replace
constants with uniforms and to obfuscate constants which testing of
this fuzzer pass identified.
2020-02-10 23:22:34 +00:00