Commit Graph

389 Commits

Author SHA1 Message Date
Vasyl Teliman
4a92579a45
spirv-fuzz: Add fuzzerutil::FindOrCreate* (#3479)
Part of #3428.
2020-07-02 10:46:49 +01:00
Vasyl Teliman
fba90d6b0a
spirv-fuzz: Add FuzzerPassAddCopyMemoryInstructions (#3391)
Fixes #3382.
2020-06-30 21:13:05 +01:00
Vasyl Teliman
ab10489a02
spirv-fuzz: Add one parameter at a time (#3469)
Fixes #3467.
Fixes #3468.
2020-06-30 15:20:27 +01:00
André Perez
c3680adbd5
Implement the OpMatrixTimesScalar linear algebra case (#3450)
This PR implements the OpMatrixTimesScalar case for the
replace linear algebra instruction transformation.
2020-06-26 15:54:33 +01:00
Vasyl Teliman
29ba53f2a2
spirv-fuzz: Implement FuzzerPassAddParameters (#3399)
Fixes #3384.
2020-06-23 17:40:44 +01:00
Vasyl Teliman
71a5b6770d
spirv-fuzz: Add GetParameters (#3454)
Adds a GetParameters function to fuzzerutil.
2020-06-23 16:41:45 +01:00
Vasyl Teliman
8e586e46a2
spirv-fuzz: Permute OpPhi instruction operands (#3421)
Fixes #3415.
2020-06-23 15:00:28 +01:00
Vasyl Teliman
33cf7c425a
spirv-fuzz: Refactor variable creation (#3414)
Fixes #3413.
2020-06-19 16:40:18 +01:00
Vasyl Teliman
d5306c8e8f
spirv-fuzz: Swap operands in OpBranchConditional (#3423)
Fixes #3415.
2020-06-19 16:38:52 +01:00
André Perez
9494703546
spirv-fuzz: Implement vector shuffle fuzzer pass (#3412)
Fixes #3108.
2020-06-16 11:21:31 +01:00
André Perez
12a4fb3bc1
spirv-fuzz: Add replace linear algebra instruction transformation (#3402)
This PR implements a transformation that replaces
a linear algebra instruction with its mathematical definition.
2020-06-16 11:20:51 +01:00
Vasyl Teliman
30bf46dbe0
Fix operand access (#3427)
Fixes #3426.
2020-06-13 00:03:25 +01:00
Vasyl Teliman
c01f826bc6
spirv-fuzz: Add support for OpSpecConstant* (#3373)
Fixes #3371.
2020-06-10 01:01:15 +01:00
Vasyl Teliman
7c213720bb
spirv-fuzz: Fix replayer bug (#3401)
Fixes #3395.
2020-06-05 14:34:39 +01:00
André Perez
9ed0fef6e1
Add value instruction condition (#3385)
This change fixes an assertion failure related to the push
id through variable transformation. In the fuzzer pass class
it was missing the IdIsAvailableBeforeInstruction condition
that is checked in the IsApplicable function.
2020-06-05 12:30:51 +01:00
André Perez
ffaecad326
Fix instruction function use (#3390)
This change replaces the instruction function GetSingleWordOperand
with GetSingleWordInOperand. Debugging spirv-fuzz, GetSingleWordOperand
was returning the result id of an OpLoad instruction with memory operands.
2020-06-05 12:29:23 +01:00
Vasyl Teliman
94808bd0f0
spirv-fuzz: Fix regression (#3396)
Fixes #3392.
2020-06-05 12:28:07 +01:00
André Perez
f050cca7ec
spirv-fuzz: Add push id through variable transformation (#3359)
Makes an id synonym by storing an id to a new variable and then
loading it back from that variable.

Fixes #3192.
2020-05-29 16:43:38 +01:00
André Perez
d3d89bb90c
spirv-fuzz: Support bit width argument for int and float types (#3378)
This change add support to pass bit width of integer and float types
as argument when creating floating-point and integer types and
constants.
2020-05-26 15:59:11 +01:00
André Perez
55af3902fc
Fix function use (#3372)
This PR fixes a function use of a Instruction object.
2020-05-26 12:28:02 +01:00
Vasyl Teliman
2f69ea849a
spirv-fuzz: Remove FuzzerPassAddUsefulConstructs (#3341)
Fixes #3318.
2020-05-19 15:54:55 +01:00
Vasyl Teliman
522561619a
Add support for StorageBuffer (#3348)
Fixes #3347.
2020-05-19 15:54:05 +01:00
André Perez
a6b0e132ec
Add adjust branch weights transformation (#3336)
In this PR, the classes that represent the adjust branch weights
transformation and fuzzer pass were implemented. This transformation
adjusts the branch weights of a OpBranchConditional instruction.
2020-05-14 11:38:34 +01:00
Alastair Donaldson
a9f2a145e6
spirv-fuzz: Fix to fact manager (#3339)
Reworks the way uniforms with known constants are queried to avoid
unintended side effects to the constant manager.

Fixes #3338.
2020-05-13 22:04:52 +01:00
Alastair Donaldson
045a26e6e3
spirv-fuzz: Get rid of unnecessary template method (#3340)
A template method turned out not to be necessary.
2020-05-13 22:04:24 +01:00
Alastair Donaldson
2e1d208ed9
spirv-fuzz: Do not allow adding stores to read-only pointers (#3316)
Re-uses IsReadOnlyPointer functionality for the optimizer to make the check
that avoids storing through read-only pointers more thorough.
2020-05-01 02:50:44 +01:00
Alastair Donaldson
f278b467df
spirv-fuzz: Do not outline regions that end with a loop header (#3312)
The outliner would outline regions ending with a loop header, making
the block containing the call to the outlined function serve as the
loop header.  This, however, is incorrect in general, since the whole
outlined function -- rather than just the exit block for the region --
would end up getting called every time the loop would iterate.

This change restricts the outliner so that the last block in a region
cannot be a loop header.
2020-04-28 13:32:06 +01:00
Alastair Donaldson
94d6002dc5
spirv-fuzz: Pass on validator options during shrinking (#3317)
Fixes an issue where the shrinker's validator options were not
actually being passed to the validator.
2020-04-27 14:25:46 +01:00
Alastair Donaldson
88faf63ad3
spirv-fuzz: Clamp statically out-of-bounds accesses in code donation (#3315)
It has been resolved that statically out-of-bounds accesses are not
invalid in SPIR-V (they lead to undefind behaviour at runtime but
should not cause a module to be rejected during validation).  This
change tolerates such accesses in donated code, clamping them in-bound
as part of making a function live-safe.
2020-04-27 14:24:54 +01:00
Alastair Donaldson
b74199a22d
spirv-fuzz: Fix memory management in the fact manager (#3313)
Fixes a bug where, while recursively adding id equation facts, a
reference to a set of id equations could be used after it had been
freed (due to equivalence classes of equations being merged).
2020-04-27 14:24:11 +01:00
Alastair Donaldson
d158ffe540
spirv-fuzz: Do not replace the Sample argument in OpImageTexelPointer (#3311)
The Sample argument of OpImageTexelPointer is sometimes required to be
a zero constant.  It thus cannot be replaced with a synonym in
general.  This change avoids replacing this argument with a synonym.
2020-04-27 14:23:11 +01:00
Alastair Donaldson
67f4838659
spirv-fuzz: Make handling of synonym facts more efficient (#3301)
The fact manager maintains an equivalence relation on data descriptors
that tracks when one data descriptor could be used in place of
another.  An algorithm to compute the closure of such facts allows
deducing new synonym facts from existing facts.  E.g., for two 2D
vectors u and v it is known that u.x is synonymous with v.x and u.y is
synonymous with v.y, it can be deduced that u and v are synonymous.

The closure computation algorithm is very expensive if we get large
equivalence relations.

This change addresses this in three ways:

- The size of equivalence relations is reduced by limiting the extent
  to which the components of a composite are recursively noted as
  being equivalent, so that when we have large synonymous arrays we do
  not record all array elements as being pairwise equivalent.

- When computing the closure of facts, equivalence classes above a
  certain size are simply skipped (which can lead to missed facts)

- The closure computation is performed less frequently - it is invoked
  explicitly before fuzzer passes that will benefit from data synonym
  facts.  A new transformation is used to control its invocation, so
  that fuzzing and replaying do not get out of sync.

The change also tidies up the order in which some getters are declared
in FuzzerContext.
2020-04-20 19:02:49 +01:00
Alastair Donaldson
ed96301c6c
spirv-fuzz: Fix to outliner (#3302)
Adds an extra condition on when a region can be outlined to avoid the
case where a region ends with a loop head but such that the loop's
continue target is in the region.  (Outlining such a region would mean
that the loop merge is in the original function and the continue target
in the outlined function.)
2020-04-15 11:39:33 +01:00
Alastair Donaldson
c018fc6ae6
spirv-fuzz: Do not outline regions that produce pointer outputs (#3291)
The function outliner uses a struct to return ids that a region
generates and that are used outside that region.  If these ids have
pointer type this would result in a struct with pointer members, which
leads to illegal loading from non-logical pointers if logical
addressing is used.  This change bans that outlining possibility.
2020-04-14 20:22:30 +01:00
Alastair Donaldson
f460cca9dc
spirv-fuzz: Handle OpRuntimeArray when replacing ids with synonyms (#3292)
Provides support for runtime arrays in the code that traverses
composite types when checking applicability of transformations that
replace ids with synonyms.
2020-04-14 20:21:58 +01:00
Alastair Donaldson
2f180468a7
spirv-fuzz: Handle image storage class in donation (#3290)
Demotes the image storage class to Private during donation.  Also
fixes an issue where instructions that depended on non-donated global
values would not be handled properly.
2020-04-14 20:21:33 +01:00
Alastair Donaldson
f82d47003e
spirv-fuzz: Respect rules for OpSampledImage (#3287)
The SPIR-V data rules say that all uses of an OpSampledImage
instruction must be in the same block as the instruction, and highly
restrict those instructions that can consume the result id of an
OpSampledImage.

This adapts the transformations that split blocks and create synonyms
to avoid separating an OpSampledImage use from its definition, and to
avoid synonym-creation instructions such as OpCopyObject consuming an
OpSampledImage result id.
2020-04-14 20:17:42 +01:00
Alastair Donaldson
7ce2db1763
spirv-fuzz: Fix comment. (#3300) 2020-04-14 20:17:05 +01:00
Alastair Donaldson
538512e8e8
spirv-fuzz: Improve the handling of equation facts (#3281)
The management of equation facts suffered from two problems:

(1) The processing of an equation fact required the data descriptors
    used in the equation to be in canonical form.  However, during
    fact processing it can be deduced that certain data descriptors
    are equivalent, causing their equivalence classes to be merged,
    and that could cause previously canonical data descriptors to no
    longer be canonical.

(2) Related to this, if id equations were known about a canonical data
    descriptor dd1, and other id equations known about a different
    canonical data descriptor dd2, the equation facts about these data
    descriptors were not being merged in the event that dd1 and dd2
    were deduced to be equivalent.

This changes solves (1) by not requiring equation facts to be in
canonical form while processing them, but instead always checking
whether (not necessary canonical) data descriptors are equivalent when
looking for corollaries of equation facts, rather than comparing them
using ==.

Problem (2) is solved by adding logic to merge sets of equations when
data descriptors are made equivalent.

In addition, the change also requires elements to be registered in an
equivalence relation before they can be made equivalent, rather than
being added (if not already present) at the point of being made
equivalent.
2020-04-07 17:38:27 +01:00
Alastair Donaldson
183e3242a3
spirv-fuzz: Handle more general SPIR-V in donation (#3280)
This change increases the extent to which arbitrary SPIR-V can be used
by the fuzzer pass that donates modules. It handles the case where
various ingredients (such as types, variables and particular
instructions) cannot be donated by omitting them, and then either
omitting their dependencies or replacing their dependencies with
alternative instructions.

The change pays particular attention to allowing code that manipulates
image types to be handled (by skipping anything image-specific).
2020-04-07 17:37:51 +01:00
Alastair Donaldson
4af38c49bf
spirv-fuzz: Improve support for compute shaders in donation (#3277)
(1) Runtime arrays are turned into fixed-size arrays, by turning
    OpTypeRuntimeArray into OpTypeArray and uses of OpArrayLength into
    uses of the constant used for the length of the fixed-size array.

(2) Atomic instructions are not donated, and uses of their results are
    replaced with uses of constants of the result type.
2020-04-06 16:08:14 +01:00
Alastair Donaldson
e95fbfb1f5
spirv-fuzz: Transformation to add OpConstantNull (#3273)
Adds a transformation for adding OpConstantNull to a module, for
appropriate data types.
2020-04-02 19:25:30 +01:00
Alastair Donaldson
5d491a7ed6
spirv-fuzz: Handle isomorphic types property in composite construction (#3262)
The fuzzer pass that constructs composites had an issue where it would
regard isomorphic but distinct structs (similarly arrays) as being
interchangeable when constructing composites.  This change fixes the
problem by relying less on the type manager.
2020-04-02 18:33:19 +01:00
Alastair Donaldson
bfd25ace08
spirv-fuzz: Limit adding of new variables to 'basic' types (#3257)
To avoid problems where global and local variables of opaque or
runtime-sized types are added to a module, this change introduces the
notion of a 'basic type' -- a type made up from floats, ints, bools,
or vectors, matrices, structs and fixed-size arrays of basic types.
Added variables have to be of basic type.
2020-04-02 17:35:18 +01:00
Alastair Donaldson
f28cdeff16
spirv-fuzz: Only replace regular ids with synonyms (#3255)
Fixes an issue where an id use in a non-regular context, e.g. as a
scope parameter to an atomic instruction, would be replaced with a
synonym.
2020-04-02 17:35:00 +01:00
Alastair Donaldson
8d4261bc44
spirv-fuzz: Introduce TransformationContext (#3272)
Some transformations (e.g. TransformationAddFunction) rely on running
the validator to decide whether the transformation is applicable.  A
recent change allowed spirv-fuzz to take validator options, to cater
for the case where a module should be considered valid under
particular conditions.  However, validation during the checking of
transformations had no access to these validator options.

This change introduced TransformationContext, which currently consists
of a fact manager and a set of validator options, but could in the
future have other fields corresponding to other objects that it is
useful to have access to when applying transformations.  Now, instead
of checking and applying transformations in the context of a
FactManager, a TransformationContext is used.  This gives access to
the fact manager as before, and also access to the validator options
when they are needed.
2020-04-02 15:54:46 +01:00
Alastair Donaldson
2fdea57d19
spirv-fuzz: Add validator options (#3254)
Allows several validator options to be passed to the fuzzer, to be
used when validation is invoked during fuzzing.
2020-04-02 14:37:59 +01:00
Vasyl Teliman
6428ad05e7
spirv-fuzz: Support OpPhi when adding dead break and continue (#3225)
Fixes #2856.
2020-03-12 12:40:38 +00:00
Alastair Donaldson
1af1df3b23
spirv-fuzz: Fix vector width issue in 'add equation instructions' pass (#3223)
Fixes #3213.
2020-03-12 10:56:11 +00:00
Vasyl Teliman
7c3de218f4
spirv-fuzz: Remove duplicated functionality (#3220)
Fixes #3218.
2020-03-09 16:17:43 +00:00
André Perez Maselco
659470446c
spirv-fuzz: Allow OpPhi operand to be replaced with a composite synonym (#3221)
In this PR, the class FuzzerPassApplyIdSynonyms was updated to allow OpPhi operand to be replaced with a composite synonym.

Fixes #3209.
2020-03-09 16:16:18 +00:00
André Perez Maselco
4c027048d8
spirv-fuzz: Add toggle access chain instruction transformation (#3211)
In this PR, the classes that represent the toggle access chain
instruction transformation and fuzzer pass were implemented. This
transformation toggles the instructions OpAccessChain and
OpInBoundsAccessChain between them.

Fixes #3193.
2020-03-08 22:33:24 +00:00
Vasyl Teliman
533af49812
spirv-fuzz: Add fuzzer pass to permute function parameters (#3212)
Fixes #3194.
2020-03-08 14:27:05 +00:00
Alastair Donaldson
da4cd21485
spirv-fuzz: Use better function name (#3207)
Changes FuzzerPass::MaybeAddTransformationBeforeEachInstruction to
FuzzerPass::ForEachInstructionWithInstructionDescriptor.

Fixes #3184.
2020-03-06 12:25:57 +00:00
Alastair Donaldson
66a682b6a8
spirv-fuzz: Add swap commutable operands transformation (#3205)
In this PR, the classes that represent the swap commutable operands
transformation and the fuzzer pass were implemented.

Fixes #3205.
2020-03-05 08:18:39 +00:00
Alastair Donaldson
044ecc0b2c
spirv-fuzz: Fuzzer pass to add equation instructions (#3202)
This introduces a new fuzzer pass to add instructions to the module
that define equations, and support in the fact manager for recording
equation facts and deducing synonym facts from equation facts.

Initially the only equations that are supported involve OpIAdd,
OpISub, OpSNegate and OpLogicalNot, but there is scope for adding
support for equations over various other operators.
2020-03-04 14:54:08 +00:00
André Perez Maselco
a6d3a2dd41
Refactor FuzzerPass::ApplyTransformation code duplication. (#3206) 2020-03-04 06:56:38 +00:00
Alastair Donaldson
77fefe765c
spirvfuzz: Fix type-related bug, change undef to zero, and add assert (#3188)
This fixes a bug where the type id of a type instruction, rather than
its result id, was being used.  It also favours using zero as the
return value when replacing an OpKill or OpUnreachable with a return
instruction, and adds a check that the donor module is valid when
doing module donation.

Fixes #3187.
2020-02-14 10:04:03 +00:00
Alastair Donaldson
6c218ec60b
spirv-fuzz: Fuzzer pass that adds access chains (#3182)
This change adds a fuzzer pass that sprinkles access chain
instructions into a module at random. This allows other passes to
have a richer set of pointers available to them, in particular the
passes that add loads and stores.
2020-02-11 23:10:57 +00:00
Alastair Donaldson
77fb303e58
spirv-fuzz: Fuzzer pass to add function calls (#3178)
Adds a fuzzer pass that inserts function calls into the module at
random. Calls from dead blocks can be arbitrary (so long as they do
not introduce recursion), while calls from other blocks can only be to
livesafe functions.

The change fixes some oversights in transformations to replace
constants with uniforms and to obfuscate constants which testing of
this fuzzer pass identified.
2020-02-10 23:22:34 +00:00
Alastair Donaldson
3d4a0dd48f
spirv-fuzz: Ensure that donated variables are always initialized (#3181)
This change ensures that global and local variables donated from other
modules are always initialized at their declaration in the module
being transformed.  This is to help limit issues related to undefined
behaviour that might arise due to accessing uninitialized memory.

The change also introduces some helper functions in fuzzer_util to
make it easier to find the pointee types of pointer types.
2020-02-10 20:10:41 +00:00
Alastair Donaldson
fe10239f92
spirv-fuzz: Add fuzzer passes to add loads/stores (#3176)
This change adds fuzzer passes that sprinkle loads and stores into a
module at random, with stores restricted to occur in either dead
blocks, or to use pointers for which it is known that the pointee
value does not influence the module's overall behaviour.

The change also generalises the VariableValueIsArbitrary fact to
PointeeValueIsIrrelevant, to allow stores through access chains or
object copies of variables whose values are known to be irrelevant.

The change includes some other minor refactorings.
2020-02-06 16:54:34 +00:00
Alastair Donaldson
1f03ac1027
spirv-fuzz: Fuzzer passes to add local and global variables (#3175)
Adds two new fuzzer passes to add variables to a module: one that adds
Private storage class global variables, another that adds Function
storage class local variables.
2020-02-05 21:07:44 +00:00
Alastair Donaldson
bb56e892f5
spirv-fuzz: Fuzzer pass to add composite types (#3171)
Adds a fuzzer pass that randomly adds vector and matrix types not
already present in the module, and randomly adds structs with random
field types and arrays with random base types and sizes. Other passes
will be able to create variables and ids using these types.
2020-02-04 14:00:19 +00:00
Alastair Donaldson
b7e0998e3d
spirv-fuzz: Disallow copying of null and undefined pointers (#3172)
If the fuzzer object-copies a pointer we would like to be able to
perform loads from the copy (and stores to it, if its value is known
not to matter).  Undefined and null pointers present a problem here,
so this change disallows copying them.
2020-02-04 11:15:07 +00:00
Alastair Donaldson
1fc7a9ec77
spirv-fuzz: Arbitrary variable facts (#3165)
This change adds a new kind of fact to the fact manager, which records
when a variable (or pointer parameter) refers to an arbitrary value,
so that anything can be stored to it, without affecting the observable
behaviour of the module, and nothing can be guaranteed about values
loaded from it. Donated modules are the current source of such
variables, and other transformations, such as outlining, have been
adapted to propagate these facts appropriately.
2020-01-30 11:25:29 +00:00
Alastair Donaldson
521223b70a
spirv-fuzz: Make functions "livesafe" during donation (#3146)
This change allows the generator to (optionally and at random) make
the functions of a module "livesafe" during donation. This involves
introducing a loop limiter variable to each function and gating the
number of total loop iterations for the function using that variable.
It also involves eliminating OpKill and OpUnreachable instructions
(changing them to OpReturn/OpReturnValue), and clamping access chain
indices so that they are always in-bounds.
2020-01-29 15:52:31 +00:00
Alastair Donaldson
ab7ac60f14
spirv-fuzz: Refactoring and type-related fixes (#3144)
This change refactors some code for walking access chain indexes to
make it mirror the structure of other code (to improve readability in
the first instance and potentially enable a future refactoring to
extract common code), and fixes a problem related to module donation
and function types.
2020-01-21 05:59:57 -08:00
Alastair Donaldson
8013d477ae
spirv-fuzz: add dead blocks (#3135)
This adds a new kind of fact to the fact manager that knows whether a
block is dead - i.e. guaranteed to be statically unreachable - and a
new transformation for adding a selection construct to a CFG that
conditionally branches to a fresh, dead block, such that the branch
will never be dynamically taken. Transformations that may create new
blocks ('split block' and 'outline function') are updated to propagate
dead block facts to newly-created blocks where appropriate. A fuzzer
pass randomly adds dead blocks to the module.

Future transformations will be able to exploit the fact that such
blocks are known to be dead.
2020-01-13 22:04:01 +00:00
Alastair Donaldson
31acc78821
spirv-fuzz: Add fuzzer pass to perform module donation (#3117)
This change adds a fuzzer pass that allows code from other SPIR-V
modules to be donated into the module under transformation.  It also
changes the command-line options of the tools so that, in fuzzing
mode, a file must be specified that contains the names of available
donor modules.
2020-01-07 08:39:55 +00:00
Alastair Donaldson
e01bc6d4e8
spirv-fuzz: Always add new globals to entry point interfaces (#3113)
In the context of SPIR-V 1.4 or higher, global variables cannot be
used by an instruction unless they are listed in the interface of all
entry points that might invoke the instruction.  This change
conservatively adds new global variables to the interfaces of all
entry points (if the SPIR-V version is 1.4 or higher).

Issue #3111 notes that a more rigorous approach to entry point
interfaces could be taken in spirv-fuzz, which would allow being less
conservative here.
2019-12-19 21:16:09 +00:00
Alastair Donaldson
dcb7169bbd
spirv-fuzz: Transformation to add a new function to a module (#3114)
This adds a large transformation that can add a new function to a
SPIR-V module.  This paves the way for donation of code from one
module to another.
2019-12-19 21:15:09 +00:00
Alastair Donaldson
2e41d5ece7
spirv-fuzz: Avoid passing access chains as parameters (#3112)
This change prevents the spirv-fuzz function outliner from outlining a
region that uses the result of an OpAccessChain not defined inside the
region.  Such accesses were turning into parameters to the outlined
function, and the result of an OpAccessChain cannot be passed as a
function parameter according to the SPIR-V specification.
2019-12-19 17:34:36 +00:00
Alastair Donaldson
38d7fbaad0
spirv-fuzz: Transformations to add types, constants and variables (#3101)
This change adds several transformations that allow types, constants,
undefined values and global variables to be added to a module.
2019-12-16 23:54:13 +00:00
Alastair Donaldson
96354f5047
spirv-fuzz: Fuzzer pass to merge blocks (#3097)
This change adds a transformation and associated fuzzer pass for
merging adjacent blocks in a module, re-using block merging code from
the optimizer.
2019-12-12 15:27:40 +00:00
Alastair Donaldson
0a2b38d082
spirv-fuzz: function outlining fuzzer pass (#3078)
A new transformation and associated fuzzer pass in spirv-fuzz that
selects single-entry single-exit control flow graph regions and for
each selected region outlines the region into a new function and
replaces the original region with a call to this function.
2019-12-10 14:47:42 +00:00
Alastair Donaldson
983b5b4fcc
spirv-fuzz: Use validator to check break/continue dominance conditions (#3089)
The passes that add dead breaks and continues suffer from the
challenge that a new control flow graph edge can change dominance
information, leading to the potenital for definitions to no longer
dominate their uses.  The attempt at guarding against this was known
to be incomplete.  This change calls on the SPIR-V validator to do the
necessary checking: in deciding whether adding such an edge would be
legitimate, we clone the module, add the edge, and use the validator
to check whether the transformed clone is valid.

This strategy is heavy-weight, and should be used sparingly, but seems
like a good option when the validity of transformations is intricate,
to avoid reimplementing swathes of validation logic in the fuzzer.

Fixes #2919.
2019-12-06 16:38:17 +00:00
Alastair Donaldson
52e9cc9301
spirv-fuzz: Improve debugging facilities (#3074)
Adds an option to run the validator on the SPIR-V binary after each
fuzzer pass has been applied, to help identify when the fuzzer has
made the module invalid.  Also adds a helper method to allow dumping
of the sequence of transformations that have been applied to a JSON
file.
2019-11-27 18:05:56 +00:00
David Neto
3da910d55f
Avoid uninit warning in GCC (#3044) 2019-11-13 17:15:11 -05:00
Alastair Donaldson
c5e6761ac8
spirv-fuzz: Eliminate spurious semicolons (#3025)
Some unintended semicolons that are harmless on most platforms led to
compiler warnings on another platform.
2019-11-08 17:58:59 +00:00
Alastair Donaldson
041f0a0249
spirv-fuzz: simplify transformation for replacing an id with a synonym (#3020)
Prior to this change, TransformationReplaceIdWithSynonym was designed
to be able to replace an id with some synonymous data descriptor,
possibly necessitating extracting from a composite into a fresh id in
order to get at the synonymous data.  This change simplifies things so
that TransformationReplaceIdWithSynonym just allows one id to be
replaced by another id.  It is the responsibility of the associated
fuzzer pass - FuzzerPassApplyIdSynonyms - to perform the extraction
operations, using e.g. TransformationCompositeExtract.
2019-11-07 16:19:06 +00:00
Paul Thomson
989f62fb97 Remove semicolon (#3022) 2019-11-07 13:20:49 +00:00
Alastair Donaldson
dc59b4b075
spirv-fuzz: vector shuffle transformation (#3015)
Inroduces a new transformation that adds a vector shuffle instruction
to the module, with associated facts about how the result vector of
the shuffle relates to the input vectors.

A fuzzer pass to add such transformations is not yet in place.
2019-11-06 17:11:54 +00:00
Alastair Donaldson
3724cfbea8
spirv-fuzz: better computation of data synonym facts (#3010)
When a data synonym fact about two composites is added, data synonym
facts between all sub-components of the composites are also added.

Furthermore, when data synonym facts been all sub-components of two
composites are known, a data synonym fact relating the two composites
is added. Identification of this case is done in a lazy manner, when
questions about data synonym facts are asked.

The change introduces helper methods to get the size of an array type
and the number of elements of a struct type, and fixes
TransformationCompositeExtract to invalidate analyses appropriately.
2019-11-05 16:45:14 +00:00
Alastair Donaldson
fb6bac889e
spirv-fuzz: make equivalence classes deterministic (#3011)
An equivalence relation is computed by traversing the tree of values
rooted at the class's representative. Children were represented by
unordered sets, meaning that the order of values in an equivalence
class could be nondeterministic. This change makes things
deterministic by representing children using a vector.

The path compression optimization employed in the implementation of
the underlying union-find data structure has the potential to change
the order in which elements appear in an equivalence class by changing
the structure of the tree, so the guarantee of determinism is limited
to being a deterministic function of the manner in which the
equivalence relation is updated and inspected.
2019-11-05 15:34:05 +00:00
Alastair Donaldson
f1e5cd73f6
spirv-fuzz: improvements to representation of data synonym facts (#3006)
This change fixes a bug in EquivalenceRelation, changes the interface
of EquivalenceRelation to avoid exposing (potentially
nondeterministic) unordered sets, and changes the interface of
FactManager to allow querying data synonyms directly. These interface
changes have required a lot of corresponding changes to client code
and tests.
2019-11-01 17:50:01 +00:00
Alastair Donaldson
fac166162f
spirv-fuzz: Transformation to extract from a composite object (#2991)
At present, TransformationReplaceIdWithSynonym both extracts elements
from composite objects and replaces uses of ids with synonyms.  This
new TransformationCompositeExtract class will allow that
transformation to be broken into smaller transformations.
2019-10-28 09:33:08 +00:00
Alastair Donaldson
ec12de9131
spirv-fuzz: rename class, and fix bug related to dominance (#2990)
Class TransformationConstructComposite has been renamed to
TransformationCompositeConstruct, to correspond to the name of the
SPIR-V instruction (as is done with e.g. TransformationCopyObject).
Running tests revealed an issue related to checking dominance in
TransformationReplaceIdWithSynonym, which is also fixed here.
2019-10-27 18:11:07 +00:00
Alastair Donaldson
0dbd4e358a
spirv-fuzz: Rework management of data synonyms (#2989)
This change uses the recently-added equivalence relation class to
re-work the way synonyms between data values are managed by the fact
manager.

The tests for 'transformation_replace_id_with_synonym' have been
temporarily removed.  This is because those tests are going to be
split into a number of test classes in an upcoming PR, once some other
refactorings have been applied, and it would be burdensome to
temporarily refactor all the tests to be in a working state for this
intermediate change.
2019-10-25 17:37:55 +01:00
Alastair Donaldson
b34fa73193
spirv-fuzz: add class to represent equivalence relation (#2988)
Adds a templated class for representing an equivalence relation on a
value data type.  This will be used by spirv-fuzz for representing
sets of distinct pieces of data in a shader that are known to have
equal values.
2019-10-25 12:46:52 +01:00
Alastair Donaldson
570582d8d6
spirv-fuzz: fuzzer pass to adjust memory access operands (#2968)
A new pass that gives spirv-fuzz the ability to adjust the memory
operand masks associated with memory access instructions (such as
OpLoad and OpCopy Memory).

Fixes #2940.
2019-10-22 18:05:35 +01:00
Alastair Donaldson
8357b878d1
spirv-fuzz: add missing functionality for matrix composites (#2974)
Support for matrix composites had been omitted in a previous PR; this
change adds the support that was missing.

Fixes #2971.
2019-10-22 14:23:13 +01:00
Aaron Barany
9c0ae6bb8e Improved CMake install step. (#2963)
Added exports for libraries. External libraries that themselves use
libraries require all dependencies have exports, so not having exports can
cause major problems when used within other projects.

Install paths for exports are now placed in the proper directories expected
by Windows and *nix systems. Config files are generated as well, which
should work with CMake's find_package() function once installed.
2019-10-17 11:36:55 -04:00
Alastair Donaldson
00170cc5e6
spirv-fuzz: Refactor 'copy object' and 'construct composite' transformations (#2966)
Rework these transformations to identify instructions via (base,
opcode, skip-count) triples, rather than (base, offset) pairs.
2019-10-15 20:00:17 +01:00
Alastair Donaldson
1b6fd37fa6
spirv-fuzz: Refactor 'split blocks' to identify instructions differently (#2961)
This change refactors the 'split blocks' transformation so that an
instruction is identified via a base, opcode, and number of those
opcodes to be skipped when searching from the base, as opposed to the
previous design which used a base and offset.
2019-10-14 17:00:46 +01:00
Alastair Donaldson
3eda1b9ff1
spirv-fuzz: Rework id descriptors (#2959)
A refactoring that separates the identification of an instruction from
the identification of a use in an instruction, to enable the former to
be used independently of the latter.
2019-10-11 10:13:06 +01:00
Alastair Donaldson
eba98c4eb7
spirv-fuzz: Add fuzzer pass to add NoContraction decorations (#2950)
A new pass that allows the fuzzer to add NoContraction decorations to
arithmetic instructions.

Fixes #2936.
2019-10-11 09:15:47 +01:00
Alastair Donaldson
91232f7f75
spirv-fuzz: Add fuzzer pass to change function controls (#2951)
A new pass that allows the fuzzer to change the 'function control'
operand of OpFunction instructions.

Fixes #2939.
2019-10-11 07:10:47 +01:00
Alastair Donaldson
253806adc4
spirv-fuzz: Add fuzzer pass to change loop controls (#2949)
A new pass that allows the fuzzer to change the 'loop control' operand
(and associated literal operands) of OpLoopMerge instructions.

Fixes #2938.
Fixes #2943.
2019-10-10 13:34:38 +01:00
Alastair Donaldson
1cea3b7853
Fixed include paths and order according to Google style. (#2957) 2019-10-10 11:26:51 +01:00
Alastair Donaldson
5910bb8e94
spirv-fuzz: add transformation and pass to construct composites (#2941)
Adds a fuzzer pass and transformation to create a composite (array,
matrix, struct or vector) from available constituent components, and
inform the fact manager that each component of the new composite is
synonymous with the id that was used to construct it. This allows the
"replace id with synonym" pass to then replace uses of said ids with
uses of elements extracted from the composite.

Fixes #2858.
2019-10-08 14:04:10 +01:00
Alastair Donaldson
81d227f36b
spirv-fuzz: add disabled test to document known issue (#2942)
Issue #2919 identifies a problem in spirv-fuzz's ability to determine
when it is safe to add a new control flow edge without breaking
dominance rules.  This change adds a (currently disabled) test to
expose the issue, and a comment to document that the current solution
is incomplete.
2019-10-08 11:26:08 +01:00
Alastair Donaldson
26dba32c43
spirv-fuzz: Add fuzzer pass to change selection controls (#2944)
A new pass that allows the fuzzer to change the 'selection control'
operand of OpSelectionControl instructions.

Fixes #2937.
2019-10-08 11:25:34 +01:00
Alastair Donaldson
8fa0f1a656
spirv-fuzz: option to convert shader into a form that renders red (#2934)
Adds a spirv-fuzz option for converting a SPIR-V shader into a shader
that renders red, whilst containing the body of the original shader.
This is for aiding in compiler crash bug reporting.
2019-10-03 19:10:50 +01:00
Alastair Donaldson
84b1976061
spirv-fuzz: do not allow a dead break to target an unreachable block (#2917)
Because dominance information becomes a bit unreliable when blocks are
unreachable, this change makes it so that the 'dead break'
transformation will not introduce a break to an unreachable block.

Fixes #2907.
2019-09-26 10:57:05 +01:00
Alastair Donaldson
27238bcca0
spirv-fuzz: preserve some analyses when permuting blocks (#2918)
The performance of the fuzzer was unacceptable in the 'permute blocks'
transformation, due to dominator analysis being repeatedly invalidated
and recomputed.  This change preserves the dominator analysis,
together with the CFG analysis, when a block is moved down.
2019-09-26 10:56:43 +01:00
Alastair Donaldson
70097c7761
spirv-fuzz: do not replace struct indices with synonyms (#2915)
This change introduces a robust check for whether an index in an
access chain is indexing into a struct, in which case the index needs
to be an OpConstant and cannot be replaced with a synonym.

Fixes #2906.
2019-09-25 16:52:35 +01:00
Alastair Donaldson
c1e03834e3
spirv-fuzz: Fixes to preconditions for adding dead break/continue edges (#2904)
Issues #2898 and #2900 identify some cases where adding a dead
continue would lead to an invalid module, and these turned out to be
due to the lack of sensible dominance information when a continue
target is unreachable. This change requires that the header of a loop
dominates the loop's continue target if a dead continue is to be
added.

Furthermore, issue #2905 identified a shortcoming in the algorithm
being used to identify when it is OK, from a dominance point of view,
to add a new break/continue edge to a control flow graph. This change
replaces that algorithm with a simpler and more obviously correct
algorithm (that incidentally does not require the new edge to be a
break/continue edge in particular).

Fixes #2898.
Fixes #2900.
Fixes #2905.
2019-09-25 16:51:41 +01:00
Alastair Donaldson
7bc114ba2f
spirv-fuzz: do not replace a pointer argument to a function call with a synonym (#2901)
Before this change, spirv-fuzz would replace a pointer argument to a
function call with a synonym, which is problematic when the synonym is
not a memory object declaration, since function call arguments are
required to be memory object declarations. This change adds a check
to ensure that such a replacement is not made.

Fixes #2896.
2019-09-25 12:17:29 +01:00
Alastair Donaldson
290f6a820d
spirv-fuzz: do not replace boolean constant argument to OpPhi instruction (#2903)
Before this change, spirv-fuzz would replace a constant boolean
argument to an OpPhi with the result of a binary operation, inserting
the instruction to compute the binary operation right before the
OpPhi, leading to an invalid module. This change conservatively
disallows replacing OpPhi arguments. Issue #2902 notes that there is
scope for being less conservative.

Fixes #2897.
2019-09-25 12:16:25 +01:00
Alastair Donaldson
958f7e72a7
Employ the "swarm testing" idea in spirv-fuzz (#2890)
This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass.

There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 16:29:19 +01:00
Alastair Donaldson
b83535da53
Fix operand index in spirv-fuzz (#2895)
This change rectifies a problem where an absolute operand index was
being used when an index restricted to input operands was required.

Fixes #2893.
2019-09-23 16:28:25 +01:00
Alastair Donaldson
7275a71654
Allow validation during spirv-fuzz replay (#2873)
To aid in debugging issues in spirv-fuzz, this change adds an option whereby the SPIR-V module is validated after each transformation is applied during replay.  This can assist in finding a transformation that erroneously makes the module invalid, so that said transformation can be debugged.
2019-09-20 10:54:09 +01:00
David Neto
d06fe08489 Fix comment typo found by protobufs linter (#2884) 2019-09-19 09:47:46 -04:00
Alastair Donaldson
e59b60de07
Fix detection of blocks bypassed by new edge (#2874)
Fixes an issue where the blocks that would be bypassed by a new break
or continue control flow edge were not properly detected.

Fixes #2871.
2019-09-18 20:50:08 +01:00
Alastair Donaldson
ccd7bf1675
Fix CMake issue related to spirv-fuzz (#2877)
spirv-fuzz generates protobuf sources in a 'protobuf' directory.  When
building with Unix Makefiles, compilation would fail due to to this
directory not existing.  This change causes the directory to be
created when the build is prepared.
2019-09-18 20:47:58 +01:00
Alastair Donaldson
0a07cd1c9a
Add fuzzer pass to replace ids with synonyms (#2857)
If the fuzzer's fact manager knows that ids A and B are synonymous, it
can replace a use of A with a use of B, so long as various conditions
hold (e.g. the definition of B must dominate the use of A, and it is
not legal to replace a use of an OpConstant in a struct's access chain
with a synonym that is not an OpConstant).

This change adds a fuzzer pass to sprinke such synonym replacements
through the module.
2019-09-18 20:47:08 +01:00
Alastair Donaldson
ad7f2c5c4c
Add fuzzer pass to copy objects (#2853)
A new fuzzer pass that randomly introduces OpCopyObject instructions
that make copies of ids, and uses the fact manager to record the fact
that an id %id is synonymous with an id generated by an OpCopyObject
applied to %id. (A future pass will exploit such synonym facts.)
2019-09-11 23:45:20 +01:00
Alastair Donaldson
e2e95172df
Rework management of probabilities in spirv-fuzz (#2839)
Before this change there was quite a lot of duplication in the code
being used to choose random percentages, and some of it was incorrect
so that a percentage chance of (100-N)% instead of N% was being used.
Also there was a lot of duplicate code to choose a random index into a
vector.  This change eliminates that duplication (fixing up the
percentage problem), and gets rid of direct access to the random
number generator being used for fuzzing, so that all randomization
requests must go through the FuzzerContext class, discouraging future
ad-hoc uses of the random number generator.
2019-09-10 15:02:25 +01:00
Alastair Donaldson
7ee8f443ea
Fix add-dead-break and add-dead-continue passes to respect dominance (#2838)
The implementation of these passes had overlooked the fact that adding
a new edge to a control flow graph can change dominance information.
Adding a dead break/continue risks causing uses to no longer be
dominated by their definitions.  This change introduces various tests
to expose such scenarios, and augments the preconditions for these
transformations with checks to guard against the situation.
2019-09-10 14:48:27 +01:00
rumblehhh
1dfb5fc12e Export SPIRV-Tools targets on installation (#2785)
This allows the targets to be used in other cmake projects. See the following for more details:
https://cmake.org/cmake/help/latest/manual/cmake-packages.7.html#creating-packages
https://foonathan.net/blog/2016/07/07/cmake-dependency-handling.html
2019-09-04 12:45:26 -04:00
Alastair Donaldson
2c5ed16ba9 Fix end comments in header files (#2829)
The end comments for the #ifndef ... #endif macros in various header
files containd a stray #define.
2019-09-02 17:31:27 -04:00
Alastair Donaldson
698b56a8f0
Add 'copy object' transformation (#2766)
This transformation can introduce an instruction that uses
OpCopyObject to make a copy of some other result id.  This change
introduces the transformation, but does not yet introduce a fuzzer
pass to actually apply it.
2019-08-05 18:00:13 +01:00
Alastair Donaldson
1a89ac8b28
Transformation and fuzzer pass to add dead continues (#2758)
Similar to the existing 'add dead breaks' pass, this adds a pass to
add dead continues to blocks in loops where such a transformation is
viable.  Various functionality common to this new pass and 'add dead
breaks' has been factored into 'fuzzer_util', and some small
improvements to 'add dead breaks' that were identified while reviewing
that code again have been applied.

Fixes #2719.
2019-07-25 13:50:33 +01:00
Alastair Donaldson
b8ab80843f
Shrinker for spirv-fuzz (#2708)
Adds to spirv-fuzz the option to shrink a sequence of transformations
that lead to an interesting binary to be generated, to find a smaller
sub-sequence of transformations that still lead to an interesting (but
hopefully simpler) binary being generated. The notion of what counts
as "interesting" comes from a user-provided script, the
"interestingness function", similar to the way the spirv-reduce tool
works. The shrinking process will give up after a maximum number of
steps, which can be configured on the command line.

Tests for the combination of fuzzing and shrinking are included, using
a variety of interestingness functions.
2019-07-07 08:55:30 +01:00
Alastair Donaldson
6ccb52b864
Warn when input facts are invalid. (#2699)
Fixes #2621.

Instead of aborting when an invalid input fact is provided, the tool
now warns about the invalid fact and then ignores it.  This is
convenient for example if facts are specified about uniforms with
descriptor sets and bindings that happen to not be present in the
input binary.
2019-06-26 16:40:19 +01:00
Alastair Donaldson
efde682369
Disallow movement of unreachable blocks. (#2700)
Fixes #2695.  Allowing unreachable blocks to be moved can lead to an
unreachable block A getting placed after an unreachable successor B,
which is a problem if B uses ids that A generates.
2019-06-26 15:32:25 +01:00
Alastair Donaldson
dfcb5a1e10
Refactor fuzzer transformations (#2694)
Introduced abstract class for transformations, and refactored all transformations to inherit from this abstract class.
2019-06-25 20:49:46 +01:00
Alastair Donaldson
51b0d5ce50
Represent uniform facts via descriptor set and binding. (#2681)
* Represent uniform facts via descriptor set and binding.

Previously uniform facts were expressed with resepect to the id of a
uniform variable.  Describing them with respect to a descriptor set
and binding is more convenient from the point of view of expressing
facts about a shader without requiring analysis of its SPIR-V.

* Fix equality testing for uniform buffer element descriptors.

The equality test now checks that the lengths of the index vectors
match.  Added a test that exposes the previous omission.
2019-06-19 20:45:14 +01:00
Alastair Donaldson
001e823b65
Add fuzzer pass to obfuscate constants. (#2671)
Adds a new transformation that can replace a constant with a uniform known to have the same value, and adds a fuzzer pass that (a) replaces a boolean with a comparison of literals (e.g. replacing "true" with "42 > 24"), and then (b) obfuscates the literals appearing in this comparison by replacing them with identically-valued uniforms, if available.

The fuzzer_replayer test file has also been updated to allow initial facts to be provided, and to do error checking of the status results returned by the fuzzer and replayer components.
2019-06-18 18:41:08 +01:00
Alastair Donaldson
42830e5a68
Add replayer tool for spirv-fuzz. (#2664)
The replayer takes an existing sequence of transformations and applies
them to a module.  Replaying a sequence of transformations that were
obtained via fuzzing should lead to an identical module to the module
that was fuzzed.  Tests have been added to check for this.
2019-06-13 14:08:33 +01:00
Alastair Donaldson
9c0830133b
Add constant == uniform facts. (#2660)
Adds a new (and first) kind of fact to the fact manager, which is that
a specific uniform value is guaranteed to be equal to a specific
constant.  The point of this is that such information (if known to be
true by some external source) can be used by spirv-fuzz to transform
the module in interesting ways that a static compiler cannot reverse
via compile-time analysis.

This change introduces protobuf messages for the fact, and adds
capabilities to the fact manager to store this kind of fact and
provide information about it.
2019-06-11 15:56:08 +01:00
Alastair Donaldson
a8ae579f7a
Add transformation to replace a boolean constant with a numeric comparison (#2659)
The transformation can, for example, replace "true" with "12.0 > 6.0",
if constants for those floating-point values are available.

This introduces a new 'id use descriptor' structure, which provides a
way to describe a particular use of an id, and which will be heavily
used in future transformations.  Describing an id use is trivial if
the use occurs in an instruction that itself generates an id, but is
less straightforward if the id of interest is used by an instruction
such as OpStore that does not have a result id.  The 'id use
descriptor' structure caters for such cases.
2019-06-06 22:22:35 +01:00
Alastair Donaldson
08cc49ec59
Fix bug in 'split blocks', and add tests for fuzzer. (#2658)
There turned out to be a bug in the 'split blocks' transformation due
to blocks being split while they were being iterated over.  This
change fixes that issue, and adds tests that were able to expose the
issue by running the fuzzer on some example shaders.
2019-06-05 21:54:47 +01:00
Alastair Donaldson
4a00a80c40
Add fuzzer pass to add dead breaks. (#2654)
This pass randomly add breaks to the merge blocks of selection and
loop constructs, such that the breaking edges will not be dynamically
reachable.
2019-06-05 08:02:16 +01:00
Alastair Donaldson
620197bd65
Add fuzzer pass that adds useful constructs to a module (#2647)
This new pass adds some basic ingredients to a module on which future
passes are likely to depend, such as boolean constants and some
specfic integer and floating-point values.  This is not a fuzzer pass
in the true sense in that it does not employ randomization, but it
makes sense to define it as a fuzzer pass since it is the first of a
number of transformations passes that the fuzzer will run on a module.
2019-06-04 14:55:00 +01:00
Alastair Donaldson
209ff0ce90
Add spirv-fuzz pass to permute blocks. (#2642)
The blocks within each function in the module will be permuted in a
randomized manner that respects dominance.
2019-05-31 09:59:06 +01:00
Alastair Donaldson
1b71e45338
Add "split block" transformation. (#2633)
With this pass, the fuzzer can split blocks in the input module.  This
is mainly useful in order to give other (future) transformations more
opportunities to apply.
2019-05-29 16:42:46 +01:00
Alastair Donaldson
fe9f870130
Add library for spirv-fuzz (#2618)
Adds a library for spirv-fuzz, consisting of a Fuzzer class that will
transform a module with respect to (a) facts about the module provided
via a FactManager class, and (b) a source of random numbers and
parameters to control the transformation process provided via a
FuzzerContext class.  Transformations will be applied via classes that
implement a FuzzerPass interface, and both facts and transformations
will be represented via protobuf messages.  Currently there are no
concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 14:34:55 +01:00