Commit Graph

23 Commits

Author SHA1 Message Date
Alastair Donaldson
502e982956
spirv-fuzz: Fix to TransformationInlineFunction (#3913)
This fixes a problem where TransformationInlineFunction could lead to
distinct instructions having identical unique ids. It adds a validity
check to detect this problem in general.

Fixes #3911.
2020-10-16 22:58:09 +01:00
Alastair Donaldson
fcb22ecf0f
spirv-fuzz: Report fresh ids in transformations (#3856)
Adds a virtual method, GetFreshIds(), to Transformation. Every
transformation uses this to indicate which ids in its protobuf message
are fresh ids. This means that when replaying a sequence of
transformations the replayer can obtain a smallest id that is not in
use by the module already and that will not be used by any
transformation by necessity. Ids greater than or equal to this id
can be used as overflow ids.

Fixes #3851.
2020-09-29 22:12:49 +01:00
Alastair Donaldson
9e17b9d07a
spirv-fuzz: Return IR and transformation context after replay (#3846)
Before this change, the replayer would return a SPIR-V binary. This
did not allow further transforming the resulting module: it would need
to be re-parsed, and the transformation context arising from the
replayed transformations was not available. This change makes it so
that after replay an IR context and transformation context are
returned instead; the IR context can subsequently be turned into a
binary if desired.

This change paves the way for an upcoming PR to integrate spirv-reduce
with the spirv-fuzz shrinker.
2020-09-25 09:58:10 +01:00
Alastair Donaldson
125b642419
spirv-fuzz: Refactor fuzzer, replayer and shrinker (#3818)
In preparation for some upcoming work on the shrinker, this PR changes
the interfaces of Fuzzer, Replayer and Shrinker so that all data
relevant to each class is provided on construction, meaning that the
"Run" method can become a zero-argument method that returns a status,
transformed binary and sequence of applied transformations via a
struct.

This makes greater use of fields, so that -- especially in Fuzzer --
there is a lot less parameter passing.
2020-09-22 10:07:58 +01:00
Alastair Donaldson
60ce96e2ff
spirv-fuzz: Add pass recommendations (#3757)
This change introduces various strategies for controlling the manner
in which fuzzer passes are applied repeatedly, including infrastructure
to allow fuzzer passes to be recommended based on which passes ran
previously.
2020-09-18 15:51:35 +01:00
Alastair Donaldson
9e26ae0455
spirv-fuzz: Overflow ids (#3734)
This change adds the notion of "overflow ids", which can be used
during shrinking to facilitate applying transformations that would
otherwise have become inapplicable due to earlier transformations
being removed.
2020-08-26 07:49:42 +01:00
Alastair Donaldson
3e7238c68d
spirv-fuzz: Add replay range option (#3535)
This change adds a --replay-range argument to spirv-fuzz that
facilitates applying only a prefix of transformations.
2020-07-15 12:13:23 +01:00
Alastair Donaldson
8d4261bc44
spirv-fuzz: Introduce TransformationContext (#3272)
Some transformations (e.g. TransformationAddFunction) rely on running
the validator to decide whether the transformation is applicable.  A
recent change allowed spirv-fuzz to take validator options, to cater
for the case where a module should be considered valid under
particular conditions.  However, validation during the checking of
transformations had no access to these validator options.

This change introduced TransformationContext, which currently consists
of a fact manager and a set of validator options, but could in the
future have other fields corresponding to other objects that it is
useful to have access to when applying transformations.  Now, instead
of checking and applying transformations in the context of a
FactManager, a TransformationContext is used.  This gives access to
the fact manager as before, and also access to the validator options
when they are needed.
2020-04-02 15:54:46 +01:00
Alastair Donaldson
2fdea57d19
spirv-fuzz: Add validator options (#3254)
Allows several validator options to be passed to the fuzzer, to be
used when validation is invoked during fuzzing.
2020-04-02 14:37:59 +01:00
Alastair Donaldson
31acc78821
spirv-fuzz: Add fuzzer pass to perform module donation (#3117)
This change adds a fuzzer pass that allows code from other SPIR-V
modules to be donated into the module under transformation.  It also
changes the command-line options of the tools so that, in fuzzing
mode, a file must be specified that contains the names of available
donor modules.
2020-01-07 08:39:55 +00:00
Alastair Donaldson
52e9cc9301
spirv-fuzz: Improve debugging facilities (#3074)
Adds an option to run the validator on the SPIR-V binary after each
fuzzer pass has been applied, to help identify when the fuzzer has
made the module invalid.  Also adds a helper method to allow dumping
of the sequence of transformations that have been applied to a JSON
file.
2019-11-27 18:05:56 +00:00
Alastair Donaldson
8fa0f1a656
spirv-fuzz: option to convert shader into a form that renders red (#2934)
Adds a spirv-fuzz option for converting a SPIR-V shader into a shader
that renders red, whilst containing the body of the original shader.
This is for aiding in compiler crash bug reporting.
2019-10-03 19:10:50 +01:00
Paul Thomson
bd839ca6b5
reduce/fuzz: improve command line args (#2932)
* reduce: add -o. 
* reduce: add --temp-file-prefix. 
* reduce: add interestingness test args. 
* Detect bad args with one dash e.g. -a. 
* reduce: fix validator args. 
* Add = to args that require it. 
* More consistent naming/style across fuzz/reduce. 
* Change some 0 exit codes to 1.
2019-10-03 16:21:05 +01:00
Paul Thomson
44b32176ee
fuzz: add shrinker-temp-file-prefix (#2928)
And relax naming requirements of input and output files.
2019-10-01 16:38:08 +01:00
Paul Thomson
ef4679a58d
spirv-fuzz: allow interestingness script arguments (#2925) 2019-09-27 15:16:26 +01:00
Alastair Donaldson
7275a71654
Allow validation during spirv-fuzz replay (#2873)
To aid in debugging issues in spirv-fuzz, this change adds an option whereby the SPIR-V module is validated after each transformation is applied during replay.  This can assist in finding a transformation that erroneously makes the module invalid, so that said transformation can be debugged.
2019-09-20 10:54:09 +01:00
Paul Thomson
4f14b4c8cc
fuzz: change output extension and fix usage string (#2778) 2019-08-02 10:09:41 +01:00
Alastair Donaldson
b8ab80843f
Shrinker for spirv-fuzz (#2708)
Adds to spirv-fuzz the option to shrink a sequence of transformations
that lead to an interesting binary to be generated, to find a smaller
sub-sequence of transformations that still lead to an interesting (but
hopefully simpler) binary being generated. The notion of what counts
as "interesting" comes from a user-provided script, the
"interestingness function", similar to the way the spirv-reduce tool
works. The shrinking process will give up after a maximum number of
steps, which can be configured on the command line.

Tests for the combination of fuzzing and shrinking are included, using
a variety of interestingness functions.
2019-07-07 08:55:30 +01:00
Alastair Donaldson
6ccb52b864
Warn when input facts are invalid. (#2699)
Fixes #2621.

Instead of aborting when an invalid input fact is provided, the tool
now warns about the invalid fact and then ignores it.  This is
convenient for example if facts are specified about uniforms with
descriptor sets and bindings that happen to not be present in the
input binary.
2019-06-26 16:40:19 +01:00
David Neto
6cc2c8f4ab Another fix uint -> uint32_t (#2676) 2019-06-17 11:28:25 -04:00
David Neto
9477c91dec
Fix uint -> uint32_t in fuzz.cpp (#2675)
Fixes MSVC builds
2019-06-14 17:21:37 -04:00
Alastair Donaldson
42830e5a68
Add replayer tool for spirv-fuzz. (#2664)
The replayer takes an existing sequence of transformations and applies
them to a module.  Replaying a sequence of transformations that were
obtained via fuzzing should lead to an identical module to the module
that was fuzzed.  Tests have been added to check for this.
2019-06-13 14:08:33 +01:00
Alastair Donaldson
37ae8671a5
Add spirv-fuzz tool. (#2631)
The current tool can parse basic command-line argument, but generates
a binary identical to the input binary, since no transformations are
yet implemented.
2019-05-27 15:46:35 +01:00