Commit Graph

87 Commits

Author SHA1 Message Date
alan-baker
d35a78db57
Switch SPIRV-Tools to use spirv.hpp11 internally (#4981)
Fixes #4960

* Switches to using enum classes with an underlying type to avoid
  undefined behaviour
2022-11-04 17:27:10 -04:00
Alastair Donaldson
9e65f054d1
spirv-fuzz: Account for differing signedness in WrapVectorSynonym (#4414)
Makes the fuzzer pass and transformation that wraps vector synonyms
aware of the fact that integer operations can have arguments that
differ in signedness, and that the result type of such an operation
can have different sign from the argument types.

Fixes #4413.
2021-09-14 21:09:39 +00:00
Mostafa Ashraf
07f1302352
spirv-fuzz: Support AtomicStore (#4440)
Adds support for atomic operations in TransformationStore and its
associated fuzzer pass.

Fixes #4337.
2021-08-05 14:08:44 +01:00
Alastair Donaldson
11cd875ed8
spirv-fuzz: Use reference in CanMakeSynonymOf (#4401)
The instruction parameter of CanMakeSynonymOf is an input parameter
that should never be null, so a const reference is a more appropriate
type than a const pointer.
2021-07-27 13:18:36 +01:00
Alastair Donaldson
183fb9fe4c
spirv-fuzz: Fix problem with instruction context (#4394)
Adds an additional validity check to ensure that every instruction's
context pointer matches the enclosing IR context. Avoids a redundant
copy constructor call in TransformationDuplicateRegionWithSelection
that was leading to a bad IR context for some instructions.

Related: #4387, #4388.
Fixes #4393.
2021-07-22 23:44:29 +01:00
Alastair Donaldson
cc3fe2b67b
spirv-fuzz: Fix vector wrapping fuzzer pass (#4392)
The fuzzer pass was passing the type of a scalar where a vector type
was required, and was not checking whether synonyms could be made for
the operands to the scalar instruction.
2021-07-22 23:43:45 +01:00
Alastair Donaldson
2419f3be86
spirv-fuzz: Tighten checks on null and undef pointers (#4367)
Adaps the transformations that add OpConstantUndef and OpConstantNull
to a module so that pointer undefs are not allowed, and null pointers
are only allowed if suitable capabilities are present.

Fixes #4357.
2021-07-22 21:34:11 +01:00
Mostafa Ashraf
e0937d7fd1
spirv-fuzz: Don't replace memory semantics / scope operands (#4349)
This change is responsible for avoiding the replacement of constant
operands with another one not constant, in the context of atomic
operations.  The related rule from the SPIR-V spec is: "All used for
Scope and Memory Semantics in shader capability must be of an
OpConstant."

Fixes #4346.
2021-07-15 19:03:51 +01:00
Alastair Donaldson
4fcdc58946
Add IsReachable function to IRContext (#4323)
There was a lot of code in the codebase that would get the dominator
analysis for a function and then use it to check whether a block is
reachable. In the fuzzer, a utility method had been introduced to make
this more concise, but it was not being used consistently.

This change moves the utility method to IRContext, so that it can be
used throughout the codebase, and refactors all existing checks for
block reachability to use the utility method.
2021-06-28 20:00:14 +01:00
Shiyu Liu
1020e394cb
spirv-fuzz: Fix underflow problem in fuzzer_pass_swap_two_functions (#4253)
Addresses a comment mentioned in #4236.

Simplifies implementation of GetFunctionIterator().
2021-05-04 09:40:55 +01:00
Shiyu Liu
6cdf07d2b3
spirv-fuzz: Swap positions of two functions in a module (#4236)
Adds a new transformation class that swaps the syntactic position of
two functions in the module, and a fuzzer pass to apply it.

Fixes #4026.
2021-04-27 12:33:08 +01:00
Alastair Donaldson
6382cbb497
spirv-fuzz: Avoid invalidating analyses in various transformations (#4205)
Avoids invalidating all analyses in transformations that add
constants, OpUndef and global and local variables.
2021-03-20 22:48:02 +00:00
Alastair Donaldson
75d7c14cfb
spirv-fuzz: Remove AddType methods from fuzzerutil (#4204)
Types should only be added to the module by spirv-fuzz via
transformations, so this change removes the AddType methods from
fuzzerutil, which were only called once each from the appropriate
transformation.

The transformations have been adapted so that they avoid redundantly
invalidating all analyses - they now update the def-use manager and
invalidate only the type manager.
2021-03-20 08:54:51 +00:00
Vasyl Teliman
e6a9f4e430
spirv-fuzz: Fix the bug in TransformationReplaceBranchFromDeadBlockWithExit (#4140)
Fixes #4136.
2021-03-05 14:27:37 +00:00
Alastair Donaldson
f7043c0de6
spirv-fuzz: Handle Vulkan SPIR-V versions (#4156)
Fixes #4155.
2021-03-03 22:29:57 +00:00
Vasyl Teliman
43cfa9bc1d
spirv-fuzz: Add persistent state to the fuzzer (#4137)
Adds persistent state to the fuzzer so that it can be used as a custom
mutator for mutation-based fuzzing.
2021-03-03 15:34:53 +00:00
Vasyl Teliman
99ad4f1e29
spirv-fuzz: Don't replace irrelevant indices in OpAccessChain (#3988)
Part of #3980.
2020-10-23 14:52:22 +01:00
Alastair Donaldson
8496780f57
spirv-fuzz: Fix to id availability (#3971)
Fixes #3958.
2020-10-21 22:52:47 +01:00
Alastair Donaldson
5600fb85b6
spirv-fuzz: Avoid the type manager when looking for struct types (#3963)
Fixes #3947.
2020-10-21 18:28:05 +01:00
Alastair Donaldson
502e982956
spirv-fuzz: Fix to TransformationInlineFunction (#3913)
This fixes a problem where TransformationInlineFunction could lead to
distinct instructions having identical unique ids. It adds a validity
check to detect this problem in general.

Fixes #3911.
2020-10-16 22:58:09 +01:00
Alastair Donaldson
57b3723c5c
spirv-fuzz: Do not allow creation of constants of block-decorated structs (#3903)
Fixes #3902.
2020-10-13 18:35:41 +01:00
Alastair Donaldson
65b2a9e814
spirv-fuzz: Transformation to add wrappers for OpKill and similar (#3881)
Part of #3717.
2020-10-06 12:07:56 +01:00
Alastair Donaldson
f151337880
spirv-fuzz: Avoid using block-decorated structs in transformations (#3877)
Fixes #3875.
2020-10-02 20:01:08 +01:00
Stefano Milizia
fc7860e2db
spirv-fuzz: Merge the return instructions in a function (#3838)
This PR introduces TransformationMergeFunctionReturns, which changes
a function so that it only has one reachable return statement.

Fixes #3655.
2020-10-02 04:45:44 +01:00
Vasyl Teliman
36185f8b09
spirv-fuzz: Move IRContext parameter into constructor (#3837)
This PR converts IRContext parameter in fact managers into a class field. Part of #3698.
2020-09-24 12:27:59 +01:00
Stefano Milizia
67525bded1
spirv-fuzz: Create synonym of int constant using a loop (#3790)
This transformation, given a constant integer (scalar or vector) C,
constants I and S of compatible type and scalar 32-bit integer constant
N, such that C = I - S*N, adds a loop which subtracts S from I, N
times, creating a synonym for C.

The related fuzzer pass randomly chooses constants to which to add
synonyms using this transformation, and the location where they should
be added.

Fixes #3616.
2020-09-23 14:10:02 +01:00
Stefano Milizia
2945963cce
spirv-fuzz: Consider all ids from dead blocks irrelevant (#3795)
This PR modifies the FactManager methods IdIsIrrelevant and GetIrrelevantIds so
that an id is always considered irrelevant if it comes from a dead block.

Fixes #3733.
2020-09-18 11:45:02 +01:00
Vasyl Teliman
e7c84feda0
spirv-fuzz: Skip unreachable blocks (#3729)
Fixes #3722, fixes #3713, fixes #3714.
2020-09-15 23:35:42 +01:00
Vasyl Teliman
3131686d2e
spirv-fuzz: Handle invalid ids in fact manager (#3742)
Fixes #3741.
2020-09-15 17:03:09 +01:00
Stefano Milizia
f62357e7b8
spirv-fuzz: Transformation to flatten conditional branch (#3667)
This transformation, given the header of a selection construct with
branching instruction OpBranchConditional, flattens it.
Side-effecting operations such as OpLoad, OpStore and OpFunctionCall
are enclosed within smaller conditionals.
It is applicable if the construct does not contain inner selection
constructs or loops, or atomic or barrier instructions.

The corresponding fuzzer pass looks for selection headers and
tries to flatten them.

Needed for the issue #3544, but it does not fix it completely.
2020-09-15 10:31:01 +01:00
Stefano Milizia
fd05605bef
spirv-fuzz: Transformation to convert OpSelect to conditional branch (#3681)
This transformation takes an OpSelect instruction and replaces it with
a conditional branch, selecting the correct value using an OpPhi
instruction.

Fixes part of the issue #3544.
2020-09-03 10:19:02 +01:00
Vasyl Teliman
c341f7a6cd
spirv-fuzz: Add support for BuiltIn decoration (#3736)
Fixes #3676.
2020-09-02 14:14:58 +01:00
Stefano Milizia
3daabd3212
spirv-fuzz: Transformation to replace the use of an irrelevant id (#3697)
A transformation that replaces the use of an irrelevant id with
another id of the same type.

The related fuzzer pass, for every use of an irrelevant id,
checks whether the id can be replaced in that use by another
id of the same type and randomly decides whether to replace
it.

Fixes #3503.
2020-09-01 16:28:04 +01:00
Vasyl Teliman
d7f078f27d
spirv-fuzz: TransformationMutatePointer (#3737)
Fixes #3624.
2020-09-01 12:45:13 +01:00
Alastair Donaldson
50cf38b8c9
spirv-fuzz: Do not make synonyms of void result ids (#3747)
Fixes #3746.
2020-08-27 09:39:20 +01:00
Vasyl Teliman
1341b58a86
spirv-fuzz: Fix MaybeGetZeroConstant (#3740)
Fixes #3739.
2020-08-25 09:50:00 +01:00
Antoni Karpiński
a711c594b8
spirv-fuzz: add FuzzerPassAddCompositeInserts (#3606)
Adds FuzzerPassAddCompositeInserts, which randomly adds new
OpCompositeInsert instructions. Each OpCompositeInsert instruction
yields a copy of an original composite with one subcomponent replaced
with an existing or newly added object. Synonym facts are added for the
unchanged components in the original and added composite, and for the
replaced subcomponent and the object, if possible.

Fixes #2859
2020-08-19 13:56:03 +01:00
André Perez
e28436f2b8
spirv-fuzz: Check termination instructions when donating modules (#3710)
The FuzzerPassDonateModules was not checking if the function to donate had
a block with OpKill or OpUnreachable as its termination instruction.

Fixes #3709.
2020-08-17 23:30:07 +01:00
Vasyl Teliman
a10e760596
spirv-fuzz: Handle OpPhi during constant obfuscation (#3640)
Fixes #3639.
2020-08-05 19:17:27 +01:00
Vasyl Teliman
9f22236024
spirv-fuzz: Refactor boilerplate in TransformationAddParameter (#3625)
Part of #3534. I forgot to implement this functionality in the original PR.
2020-08-04 15:04:17 +01:00
Vasyl Teliman
ab4fe12a46
spirv-fuzz: Fix memory bugs (#3622) 2020-07-30 16:51:29 +01:00
Vasyl Teliman
7e75fea9ec
spirv-fuzz: Remove non-deterministic behaviour (#3608)
Fixes #3607.
2020-07-29 17:47:12 +01:00
Stefano Milizia
767518e8e1
spirv-fuzz: Relax type checking for int contants (#3573)
Right now, TransformationRecordSynonymousConstants requires the type
ids of two candidate constants to be exactly the same.
This PR adds an exception for integer constants, which can be
considered equivalent even if their signedness is different.
This applies to both integers and vector constants.

The IsApplicable method of ReplaceIdWithSynonym is also updated so
that, in the case of two integer constants which don't have the same
type, they can only be swapped in particular instructions (those
that don't take the signedness into consideration).

Fixes #3536.
2020-07-27 13:34:44 +01:00
Stefano Milizia
f8920bcfab
spirv-fuzz: Generalise transformation access chain (#3546)
This PR generalises TransformationAddAccessChain so that dynamic
indices for non-struct composites (with clamping to ensure that
accesses are in-bound) are allowed.

The transformation will add instructions to clamp any index to
a non-struct composite, regardless of whether it is a constant
or not.

Fixes #3179.
2020-07-27 11:28:12 +01:00
Vasyl Teliman
1aaf5c6134
spirv-fuzz: Create a helper in fuzzerutil to reuse function type (#3572)
Fixes #3534.
2020-07-23 18:01:12 +01:00
Vasyl Teliman
bc2f78b7d9
spirv-fuzz: Fix usages of irrelevant constants (#3566)
Part of #3177.
2020-07-22 19:03:58 +01:00
Vasyl Teliman
fe9e5db890
spirv-fuzz: TransformationReplaceParamsWithStruct (#3455)
Fixes #3453.
2020-07-21 21:02:32 +01:00
Vasyl Teliman
a3b0adc306
spirv-fuzz: Add is_irrelevant parameter (#3563)
Part of #3177.
Adjusts functions to create constants.
2020-07-21 08:59:13 +01:00
Stefano Milizia
f12c40f5a6
spirv-fuzz: Fuzzer pass to interchange zero-like constants (#3524)
This fuzzer pass:

For each zero-like constant, either finds the existing definition of
the corresponding toggled one (OpConstantNull becomes zero-valued
scalar OpConstant or vice versa) or creates a new one if it doesn't
exist and records that the two are synonyms

For each use of these constants, probabilistically decides whether to
change it with the corresponding toggled constant id (as described in
#3486 )

Only uses inside blocks of instructions are considered and not, for
example, in instructions declaring other constants.
2020-07-15 12:58:29 +01:00
André Perez
c9b254d045
spirv-fuzz: Support adding dead break from back-edge block (#3519)
Fixes #2577.
2020-07-14 12:32:16 +01:00