Commit Graph

16 Commits

Author SHA1 Message Date
Alastair Donaldson
570582d8d6
spirv-fuzz: fuzzer pass to adjust memory access operands (#2968)
A new pass that gives spirv-fuzz the ability to adjust the memory
operand masks associated with memory access instructions (such as
OpLoad and OpCopy Memory).

Fixes #2940.
2019-10-22 18:05:35 +01:00
Alastair Donaldson
eba98c4eb7
spirv-fuzz: Add fuzzer pass to add NoContraction decorations (#2950)
A new pass that allows the fuzzer to add NoContraction decorations to
arithmetic instructions.

Fixes #2936.
2019-10-11 09:15:47 +01:00
Alastair Donaldson
91232f7f75
spirv-fuzz: Add fuzzer pass to change function controls (#2951)
A new pass that allows the fuzzer to change the 'function control'
operand of OpFunction instructions.

Fixes #2939.
2019-10-11 07:10:47 +01:00
Alastair Donaldson
253806adc4
spirv-fuzz: Add fuzzer pass to change loop controls (#2949)
A new pass that allows the fuzzer to change the 'loop control' operand
(and associated literal operands) of OpLoopMerge instructions.

Fixes #2938.
Fixes #2943.
2019-10-10 13:34:38 +01:00
Alastair Donaldson
5910bb8e94
spirv-fuzz: add transformation and pass to construct composites (#2941)
Adds a fuzzer pass and transformation to create a composite (array,
matrix, struct or vector) from available constituent components, and
inform the fact manager that each component of the new composite is
synonymous with the id that was used to construct it. This allows the
"replace id with synonym" pass to then replace uses of said ids with
uses of elements extracted from the composite.

Fixes #2858.
2019-10-08 14:04:10 +01:00
Alastair Donaldson
26dba32c43
spirv-fuzz: Add fuzzer pass to change selection controls (#2944)
A new pass that allows the fuzzer to change the 'selection control'
operand of OpSelectionControl instructions.

Fixes #2937.
2019-10-08 11:25:34 +01:00
Alastair Donaldson
958f7e72a7
Employ the "swarm testing" idea in spirv-fuzz (#2890)
This change to spirv-fuzz uses ideas from "Swarm Testing" (Groce et al. 2012), so that a random subset of fuzzer passes are enabled. These passes are then applied repeatedly in a randomized fashion, with the aggression with which they are applied being randomly chosen per pass.

There is plenty of scope for refining the probabilities introduce in this change; this is just meant to be a reasonable first effort.
2019-09-23 16:29:19 +01:00
Alastair Donaldson
0a07cd1c9a
Add fuzzer pass to replace ids with synonyms (#2857)
If the fuzzer's fact manager knows that ids A and B are synonymous, it
can replace a use of A with a use of B, so long as various conditions
hold (e.g. the definition of B must dominate the use of A, and it is
not legal to replace a use of an OpConstant in a struct's access chain
with a synonym that is not an OpConstant).

This change adds a fuzzer pass to sprinke such synonym replacements
through the module.
2019-09-18 20:47:08 +01:00
Alastair Donaldson
ad7f2c5c4c
Add fuzzer pass to copy objects (#2853)
A new fuzzer pass that randomly introduces OpCopyObject instructions
that make copies of ids, and uses the fact manager to record the fact
that an id %id is synonymous with an id generated by an OpCopyObject
applied to %id. (A future pass will exploit such synonym facts.)
2019-09-11 23:45:20 +01:00
Alastair Donaldson
e2e95172df
Rework management of probabilities in spirv-fuzz (#2839)
Before this change there was quite a lot of duplication in the code
being used to choose random percentages, and some of it was incorrect
so that a percentage chance of (100-N)% instead of N% was being used.
Also there was a lot of duplicate code to choose a random index into a
vector.  This change eliminates that duplication (fixing up the
percentage problem), and gets rid of direct access to the random
number generator being used for fuzzing, so that all randomization
requests must go through the FuzzerContext class, discouraging future
ad-hoc uses of the random number generator.
2019-09-10 15:02:25 +01:00
Alastair Donaldson
1a89ac8b28
Transformation and fuzzer pass to add dead continues (#2758)
Similar to the existing 'add dead breaks' pass, this adds a pass to
add dead continues to blocks in loops where such a transformation is
viable.  Various functionality common to this new pass and 'add dead
breaks' has been factored into 'fuzzer_util', and some small
improvements to 'add dead breaks' that were identified while reviewing
that code again have been applied.

Fixes #2719.
2019-07-25 13:50:33 +01:00
Alastair Donaldson
001e823b65
Add fuzzer pass to obfuscate constants. (#2671)
Adds a new transformation that can replace a constant with a uniform known to have the same value, and adds a fuzzer pass that (a) replaces a boolean with a comparison of literals (e.g. replacing "true" with "42 > 24"), and then (b) obfuscates the literals appearing in this comparison by replacing them with identically-valued uniforms, if available.

The fuzzer_replayer test file has also been updated to allow initial facts to be provided, and to do error checking of the status results returned by the fuzzer and replayer components.
2019-06-18 18:41:08 +01:00
Alastair Donaldson
4a00a80c40
Add fuzzer pass to add dead breaks. (#2654)
This pass randomly add breaks to the merge blocks of selection and
loop constructs, such that the breaking edges will not be dynamically
reachable.
2019-06-05 08:02:16 +01:00
Alastair Donaldson
209ff0ce90
Add spirv-fuzz pass to permute blocks. (#2642)
The blocks within each function in the module will be permuted in a
randomized manner that respects dominance.
2019-05-31 09:59:06 +01:00
Alastair Donaldson
1b71e45338
Add "split block" transformation. (#2633)
With this pass, the fuzzer can split blocks in the input module.  This
is mainly useful in order to give other (future) transformations more
opportunities to apply.
2019-05-29 16:42:46 +01:00
Alastair Donaldson
fe9f870130
Add library for spirv-fuzz (#2618)
Adds a library for spirv-fuzz, consisting of a Fuzzer class that will
transform a module with respect to (a) facts about the module provided
via a FactManager class, and (b) a source of random numbers and
parameters to control the transformation process provided via a
FuzzerContext class.  Transformations will be applied via classes that
implement a FuzzerPass interface, and both facts and transformations
will be represented via protobuf messages.  Currently there are no
concrete facts, transformations nor fuzzer passes; these will follow.
2019-05-27 14:34:55 +01:00