Commit Graph

24 Commits

Author SHA1 Message Date
Alastair Donaldson
502e982956
spirv-fuzz: Fix to TransformationInlineFunction (#3913)
This fixes a problem where TransformationInlineFunction could lead to
distinct instructions having identical unique ids. It adds a validity
check to detect this problem in general.

Fixes #3911.
2020-10-16 22:58:09 +01:00
Stefano Milizia
43a5186011
spirv-fuzz: Compute interprocedural loop nesting depth of blocks (#3753)
This PR extends CallGraph with functions to return:

- a list of functions in lexicographical order, with respect to
  function calls
- the maximum loop nesting depth that a function can be called from
  (computed interprocedurally, e.g. if foo() calls bar() at depth 2
  and bar() calls baz() at depth 1, the maximum depth of baz() will
  be 3).
2020-09-01 12:23:58 +01:00
André Perez
e28436f2b8
spirv-fuzz: Check termination instructions when donating modules (#3710)
The FuzzerPassDonateModules was not checking if the function to donate had
a block with OpKill or OpUnreachable as its termination instruction.

Fixes #3709.
2020-08-17 23:30:07 +01:00
Vasyl Teliman
0419751b0c
spirv-fuzz: Handle OpPhis in livesafe functions (#3642)
Fixes #3641.
2020-08-05 19:21:37 +01:00
Vasyl Teliman
d9c73ebd9e
spirv-fuzz: Handle capabilities during module donation (#3651)
Fixes #3648.
2020-08-04 17:11:29 +01:00
Stefano Milizia
f8920bcfab
spirv-fuzz: Generalise transformation access chain (#3546)
This PR generalises TransformationAddAccessChain so that dynamic
indices for non-struct composites (with clamping to ensure that
accesses are in-bound) are allowed.

The transformation will add instructions to clamp any index to
a non-struct composite, regardless of whether it is a constant
or not.

Fixes #3179.
2020-07-27 11:28:12 +01:00
Vasyl Teliman
d6306537dc
spirv-fuzz: Don't use default parameters (#3583)
Fixes #3177.
2020-07-24 07:57:49 +01:00
Vasyl Teliman
5dc96d5d27
spirv-fuzz: Use irrelevant constants (#3565)
Part of #3177.
2020-07-21 13:30:28 +01:00
Vasyl Teliman
c01f826bc6
spirv-fuzz: Add support for OpSpecConstant* (#3373)
Fixes #3371.
2020-06-10 01:01:15 +01:00
André Perez
d3d89bb90c
spirv-fuzz: Support bit width argument for int and float types (#3378)
This change add support to pass bit width of integer and float types
as argument when creating floating-point and integer types and
constants.
2020-05-26 15:59:11 +01:00
Vasyl Teliman
522561619a
Add support for StorageBuffer (#3348)
Fixes #3347.
2020-05-19 15:54:05 +01:00
Alastair Donaldson
2f180468a7
spirv-fuzz: Handle image storage class in donation (#3290)
Demotes the image storage class to Private during donation.  Also
fixes an issue where instructions that depended on non-donated global
values would not be handled properly.
2020-04-14 20:21:33 +01:00
Alastair Donaldson
183e3242a3
spirv-fuzz: Handle more general SPIR-V in donation (#3280)
This change increases the extent to which arbitrary SPIR-V can be used
by the fuzzer pass that donates modules. It handles the case where
various ingredients (such as types, variables and particular
instructions) cannot be donated by omitting them, and then either
omitting their dependencies or replacing their dependencies with
alternative instructions.

The change pays particular attention to allowing code that manipulates
image types to be handled (by skipping anything image-specific).
2020-04-07 17:37:51 +01:00
Alastair Donaldson
4af38c49bf
spirv-fuzz: Improve support for compute shaders in donation (#3277)
(1) Runtime arrays are turned into fixed-size arrays, by turning
    OpTypeRuntimeArray into OpTypeArray and uses of OpArrayLength into
    uses of the constant used for the length of the fixed-size array.

(2) Atomic instructions are not donated, and uses of their results are
    replaced with uses of constants of the result type.
2020-04-06 16:08:14 +01:00
Alastair Donaldson
e95fbfb1f5
spirv-fuzz: Transformation to add OpConstantNull (#3273)
Adds a transformation for adding OpConstantNull to a module, for
appropriate data types.
2020-04-02 19:25:30 +01:00
Alastair Donaldson
8d4261bc44
spirv-fuzz: Introduce TransformationContext (#3272)
Some transformations (e.g. TransformationAddFunction) rely on running
the validator to decide whether the transformation is applicable.  A
recent change allowed spirv-fuzz to take validator options, to cater
for the case where a module should be considered valid under
particular conditions.  However, validation during the checking of
transformations had no access to these validator options.

This change introduced TransformationContext, which currently consists
of a fact manager and a set of validator options, but could in the
future have other fields corresponding to other objects that it is
useful to have access to when applying transformations.  Now, instead
of checking and applying transformations in the context of a
FactManager, a TransformationContext is used.  This gives access to
the fact manager as before, and also access to the validator options
when they are needed.
2020-04-02 15:54:46 +01:00
Alastair Donaldson
77fefe765c
spirvfuzz: Fix type-related bug, change undef to zero, and add assert (#3188)
This fixes a bug where the type id of a type instruction, rather than
its result id, was being used.  It also favours using zero as the
return value when replacing an OpKill or OpUnreachable with a return
instruction, and adds a check that the donor module is valid when
doing module donation.

Fixes #3187.
2020-02-14 10:04:03 +00:00
Alastair Donaldson
77fb303e58
spirv-fuzz: Fuzzer pass to add function calls (#3178)
Adds a fuzzer pass that inserts function calls into the module at
random. Calls from dead blocks can be arbitrary (so long as they do
not introduce recursion), while calls from other blocks can only be to
livesafe functions.

The change fixes some oversights in transformations to replace
constants with uniforms and to obfuscate constants which testing of
this fuzzer pass identified.
2020-02-10 23:22:34 +00:00
Alastair Donaldson
3d4a0dd48f
spirv-fuzz: Ensure that donated variables are always initialized (#3181)
This change ensures that global and local variables donated from other
modules are always initialized at their declaration in the module
being transformed.  This is to help limit issues related to undefined
behaviour that might arise due to accessing uninitialized memory.

The change also introduces some helper functions in fuzzer_util to
make it easier to find the pointee types of pointer types.
2020-02-10 20:10:41 +00:00
Alastair Donaldson
fe10239f92
spirv-fuzz: Add fuzzer passes to add loads/stores (#3176)
This change adds fuzzer passes that sprinkle loads and stores into a
module at random, with stores restricted to occur in either dead
blocks, or to use pointers for which it is known that the pointee
value does not influence the module's overall behaviour.

The change also generalises the VariableValueIsArbitrary fact to
PointeeValueIsIrrelevant, to allow stores through access chains or
object copies of variables whose values are known to be irrelevant.

The change includes some other minor refactorings.
2020-02-06 16:54:34 +00:00
Alastair Donaldson
1fc7a9ec77
spirv-fuzz: Arbitrary variable facts (#3165)
This change adds a new kind of fact to the fact manager, which records
when a variable (or pointer parameter) refers to an arbitrary value,
so that anything can be stored to it, without affecting the observable
behaviour of the module, and nothing can be guaranteed about values
loaded from it. Donated modules are the current source of such
variables, and other transformations, such as outlining, have been
adapted to propagate these facts appropriately.
2020-01-30 11:25:29 +00:00
Alastair Donaldson
521223b70a
spirv-fuzz: Make functions "livesafe" during donation (#3146)
This change allows the generator to (optionally and at random) make
the functions of a module "livesafe" during donation. This involves
introducing a loop limiter variable to each function and gating the
number of total loop iterations for the function using that variable.
It also involves eliminating OpKill and OpUnreachable instructions
(changing them to OpReturn/OpReturnValue), and clamping access chain
indices so that they are always in-bounds.
2020-01-29 15:52:31 +00:00
Alastair Donaldson
ab7ac60f14
spirv-fuzz: Refactoring and type-related fixes (#3144)
This change refactors some code for walking access chain indexes to
make it mirror the structure of other code (to improve readability in
the first instance and potentially enable a future refactoring to
extract common code), and fixes a problem related to module donation
and function types.
2020-01-21 05:59:57 -08:00
Alastair Donaldson
31acc78821
spirv-fuzz: Add fuzzer pass to perform module donation (#3117)
This change adds a fuzzer pass that allows code from other SPIR-V
modules to be donated into the module under transformation.  It also
changes the command-line options of the tools so that, in fuzzing
mode, a file must be specified that contains the names of available
donor modules.
2020-01-07 08:39:55 +00:00