Commit Graph

38 Commits

Author SHA1 Message Date
alan-baker
d35a78db57
Switch SPIRV-Tools to use spirv.hpp11 internally (#4981)
Fixes #4960

* Switches to using enum classes with an underlying type to avoid
  undefined behaviour
2022-11-04 17:27:10 -04:00
Alastair Donaldson
9c4481419e
spirv-fuzz: Allow inapplicable transformations to be ignored (#4407)
spirv-fuzz features transformations that should be applicable by
construction. Assertions are used to detect when such transformations
turn out to be inapplicable. Failures of such assertions indicate bugs
in the fuzzer. However, when using the fuzzer at scale (e.g. in
ClusterFuzz) reports of these assertion failures create noise, and
cause the fuzzer to exit early. This change adds an option whereby
inapplicable transformations can be ignored. This reduces noise and
allows fuzzing to continue even when a transformation that should be
applicable but is not has been erroneously created.
2021-07-28 22:59:37 +01:00
Vasyl Teliman
e2ac64bdf0
spirv-fuzz: Move ApplyTransformation to .cpp file (#4258)
Sometimes, you need to change these functions during debugging (e.g.,
figure out why the transformation is inapplicable). When that happens,
you need to recompile the whole fuzzer just because these functions
are in the header file. This PR fixes the situation.
2021-05-26 00:39:51 +01:00
Alastair Donaldson
bf1a11dab7
spirv-fuzz: Wrap early terminators before merging returns (#3925)
Incorporates some other fixes for issues that were brought to light by
adding this functionality.

Fixes #3717.
Fixes #3924.
2020-10-16 19:29:39 +01:00
Stefano Milizia
67525bded1
spirv-fuzz: Create synonym of int constant using a loop (#3790)
This transformation, given a constant integer (scalar or vector) C,
constants I and S of compatible type and scalar 32-bit integer constant
N, such that C = I - S*N, adds a loop which subtracts S from I, N
times, creating a synonym for C.

The related fuzzer pass randomly chooses constants to which to add
synonyms using this transformation, and the location where they should
be added.

Fixes #3616.
2020-09-23 14:10:02 +01:00
Vasyl Teliman
8fc504110a
spirv-fuzz: Remove CanFindOrCreateZeroConstant (#3807)
Replace FuzzerPass::CanFindOrCreateZeroConstant with
fuzzerutil::CanCreateConstant.
2020-09-16 14:22:22 +01:00
Vasyl Teliman
e7c84feda0
spirv-fuzz: Skip unreachable blocks (#3729)
Fixes #3722, fixes #3713, fixes #3714.
2020-09-15 23:35:42 +01:00
Stefano Milizia
f62357e7b8
spirv-fuzz: Transformation to flatten conditional branch (#3667)
This transformation, given the header of a selection construct with
branching instruction OpBranchConditional, flattens it.
Side-effecting operations such as OpLoad, OpStore and OpFunctionCall
are enclosed within smaller conditionals.
It is applicable if the construct does not contain inner selection
constructs or loops, or atomic or barrier instructions.

The corresponding fuzzer pass looks for selection headers and
tries to flatten them.

Needed for the issue #3544, but it does not fix it completely.
2020-09-15 10:31:01 +01:00
Vasyl Teliman
d7f078f27d
spirv-fuzz: TransformationMutatePointer (#3737)
Fixes #3624.
2020-09-01 12:45:13 +01:00
Antoni Karpiński
a711c594b8
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606)
Adds FuzzerPassAddCompositeInserts, which randomly adds new
OpCompositeInsert instructions. Each OpCompositeInsert instruction
yields a copy of an original composite with one subcomponent replaced
with an existing or newly added object. Synonym facts are added for the
unchanged components in the original and added composite, and for the
replaced subcomponent and the object, if possible.

Fixes #2859
2020-08-19 13:56:03 +01:00
Antoni Karpiński
582c276d43
spirv-fuzz: Support pointer types in FuzzerPassAddParameters (#3627)
For FuzzerPassAddParameters, adds pointer types (that have the storage
class Function or Private) to the pool of available types for new
parameters. If there are no variables of the chosen pointer type, it
invokes TransformationAddLocalVariable / TransformationAddGlobalVariable
to add one.

Part of #3403
2020-08-19 11:18:47 +01:00
Stefano Milizia
efc85ff661
spirv-fuzz: make outliner pass use additional transformations (#3604)
This PR changes FuzzerPassOutlineFunctions so that it uses some
transformation that make the TransformationOutlineFunction
transformation applicable in more cases. See the discussion in
#3095 for more details.

Fixes #3095.
2020-08-06 12:29:26 +01:00
Stefano Milizia
96bcc82743
spirv-fuzz: Pass to replace int operands with ints of opposite signedness (#3612)
This PR introduces a new fuzzer pass, which:

- finds all integer vectors or constants
- finds or creates the corresponding constants with opposite
  signedness
- records such constants as synonyms of the first ones
- replaces the usages of the original constants with the new ones
  if allowed

Fixes #2677.
2020-07-30 19:48:29 +01:00
Stefano Milizia
f8920bcfab
spirv-fuzz: Generalise transformation access chain (#3546)
This PR generalises TransformationAddAccessChain so that dynamic
indices for non-struct composites (with clamping to ensure that
accesses are in-bound) are allowed.

The transformation will add instructions to clamp any index to
a non-struct composite, regardless of whether it is a constant
or not.

Fixes #3179.
2020-07-27 11:28:12 +01:00
Vasyl Teliman
d6306537dc
spirv-fuzz: Don't use default parameters (#3583)
Fixes #3177.
2020-07-24 07:57:49 +01:00
Vasyl Teliman
a3b0adc306
spirv-fuzz: Add is_irrelevant parameter (#3563)
Part of #3177.
Adjusts functions to create constants.
2020-07-21 08:59:13 +01:00
Stefano Milizia
fb32c40741
Change MaybeApplyTransformation to return a boolean (#3555)
Also refactor the code accordingly.
2020-07-17 16:01:25 +01:00
Stefano Milizia
7dfd9b8680
spirv-fuzz: Implement MaybeApplyTransformation helper function (#3540)
This function can be used to apply a transformation only if it is
applicable and use it wherever this pattern is used.

Fixes #3530.
2020-07-17 13:01:35 +01:00
Stefano Milizia
f12c40f5a6
spirv-fuzz: Fuzzer pass to interchange zero-like constants (#3524)
This fuzzer pass:

For each zero-like constant, either finds the existing definition of
the corresponding toggled one (OpConstantNull becomes zero-valued
scalar OpConstant or vice versa) or creates a new one if it doesn't
exist and records that the two are synonyms

For each use of these constants, probabilistically decides whether to
change it with the corresponding toggled constant id (as described in
#3486 )

Only uses inside blocks of instructions are considered and not, for
example, in instructions declaring other constants.
2020-07-15 12:58:29 +01:00
Vasyl Teliman
40c3c1cace
spirv-fuzz: TransformationAddSynonyms (#3447)
Part of #3440.
2020-07-12 09:59:08 +01:00
Vasyl Teliman
4a92579a45
spirv-fuzz: Add fuzzerutil::FindOrCreate* (#3479)
Part of #3428.
2020-07-02 10:46:49 +01:00
André Perez
d3d89bb90c
spirv-fuzz: Support bit width argument for int and float types (#3378)
This change add support to pass bit width of integer and float types
as argument when creating floating-point and integer types and
constants.
2020-05-26 15:59:11 +01:00
Vasyl Teliman
2f69ea849a
spirv-fuzz: Remove FuzzerPassAddUsefulConstructs (#3341)
Fixes #3318.
2020-05-19 15:54:55 +01:00
Alastair Donaldson
045a26e6e3
spirv-fuzz: Get rid of unnecessary template method (#3340)
A template method turned out not to be necessary.
2020-05-13 22:04:24 +01:00
Alastair Donaldson
bfd25ace08
spirv-fuzz: Limit adding of new variables to 'basic' types (#3257)
To avoid problems where global and local variables of opaque or
runtime-sized types are added to a module, this change introduces the
notion of a 'basic type' -- a type made up from floats, ints, bools,
or vectors, matrices, structs and fixed-size arrays of basic types.
Added variables have to be of basic type.
2020-04-02 17:35:18 +01:00
Alastair Donaldson
8d4261bc44
spirv-fuzz: Introduce TransformationContext (#3272)
Some transformations (e.g. TransformationAddFunction) rely on running
the validator to decide whether the transformation is applicable.  A
recent change allowed spirv-fuzz to take validator options, to cater
for the case where a module should be considered valid under
particular conditions.  However, validation during the checking of
transformations had no access to these validator options.

This change introduced TransformationContext, which currently consists
of a fact manager and a set of validator options, but could in the
future have other fields corresponding to other objects that it is
useful to have access to when applying transformations.  Now, instead
of checking and applying transformations in the context of a
FactManager, a TransformationContext is used.  This gives access to
the fact manager as before, and also access to the validator options
when they are needed.
2020-04-02 15:54:46 +01:00
Vasyl Teliman
533af49812
spirv-fuzz: Add fuzzer pass to permute function parameters (#3212)
Fixes #3194.
2020-03-08 14:27:05 +00:00
Alastair Donaldson
da4cd21485
spirv-fuzz: Use better function name (#3207)
Changes FuzzerPass::MaybeAddTransformationBeforeEachInstruction to
FuzzerPass::ForEachInstructionWithInstructionDescriptor.

Fixes #3184.
2020-03-06 12:25:57 +00:00
Alastair Donaldson
6c218ec60b
spirv-fuzz: Fuzzer pass that adds access chains (#3182)
This change adds a fuzzer pass that sprinkles access chain
instructions into a module at random. This allows other passes to
have a richer set of pointers available to them, in particular the
passes that add loads and stores.
2020-02-11 23:10:57 +00:00
Alastair Donaldson
77fb303e58
spirv-fuzz: Fuzzer pass to add function calls (#3178)
Adds a fuzzer pass that inserts function calls into the module at
random. Calls from dead blocks can be arbitrary (so long as they do
not introduce recursion), while calls from other blocks can only be to
livesafe functions.

The change fixes some oversights in transformations to replace
constants with uniforms and to obfuscate constants which testing of
this fuzzer pass identified.
2020-02-10 23:22:34 +00:00
Alastair Donaldson
1f03ac1027
spirv-fuzz: Fuzzer passes to add local and global variables (#3175)
Adds two new fuzzer passes to add variables to a module: one that adds
Private storage class global variables, another that adds Function
storage class local variables.
2020-02-05 21:07:44 +00:00
Alastair Donaldson
bb56e892f5
spirv-fuzz: Fuzzer pass to add composite types (#3171)
Adds a fuzzer pass that randomly adds vector and matrix types not
already present in the module, and randomly adds structs with random
field types and arrays with random base types and sizes. Other passes
will be able to create variables and ids using these types.
2020-02-04 14:00:19 +00:00
Alastair Donaldson
521223b70a
spirv-fuzz: Make functions "livesafe" during donation (#3146)
This change allows the generator to (optionally and at random) make
the functions of a module "livesafe" during donation. This involves
introducing a loop limiter variable to each function and gating the
number of total loop iterations for the function using that variable.
It also involves eliminating OpKill and OpUnreachable instructions
(changing them to OpReturn/OpReturnValue), and clamping access chain
indices so that they are always in-bounds.
2020-01-29 15:52:31 +00:00
Alastair Donaldson
31acc78821
spirv-fuzz: Add fuzzer pass to perform module donation (#3117)
This change adds a fuzzer pass that allows code from other SPIR-V
modules to be donated into the module under transformation.  It also
changes the command-line options of the tools so that, in fuzzing
mode, a file must be specified that contains the names of available
donor modules.
2020-01-07 08:39:55 +00:00
Alastair Donaldson
00170cc5e6
spirv-fuzz: Refactor 'copy object' and 'construct composite' transformations (#2966)
Rework these transformations to identify instructions via (base,
opcode, skip-count) triples, rather than (base, offset) pairs.
2019-10-15 20:00:17 +01:00
Alastair Donaldson
5910bb8e94
spirv-fuzz: add transformation and pass to construct composites (#2941)
Adds a fuzzer pass and transformation to create a composite (array,
matrix, struct or vector) from available constituent components, and
inform the fact manager that each component of the new composite is
synonymous with the id that was used to construct it. This allows the
"replace id with synonym" pass to then replace uses of said ids with
uses of elements extracted from the composite.

Fixes #2858.
2019-10-08 14:04:10 +01:00
Alastair Donaldson
2c5ed16ba9 Fix end comments in header files (#2829)
The end comments for the #ifndef ... #endif macros in various header
files containd a stray #define.
2019-09-02 17:31:27 -04:00
Alastair Donaldson
fe9f870130
Add library for spirv-fuzz (#2618)
Adds a library for spirv-fuzz, consisting of a Fuzzer class that will
transform a module with respect to (a) facts about the module provided
via a FactManager class, and (b) a source of random numbers and
parameters to control the transformation process provided via a
FuzzerContext class.  Transformations will be applied via classes that
implement a FuzzerPass interface, and both facts and transformations
will be represented via protobuf messages.  Currently there are no
concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 14:34:55 +01:00