// Copyright (c) 2020 Google LLC // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. #include "source/fuzz/fuzzer_pass_add_global_variables.h" #include "source/fuzz/transformation_add_global_variable.h" #include "source/fuzz/transformation_add_type_pointer.h" namespace spvtools { namespace fuzz { FuzzerPassAddGlobalVariables::FuzzerPassAddGlobalVariables( opt::IRContext* ir_context, TransformationContext* transformation_context, FuzzerContext* fuzzer_context, protobufs::TransformationSequence* transformations) : FuzzerPass(ir_context, transformation_context, fuzzer_context, transformations) {} void FuzzerPassAddGlobalVariables::Apply() { SpvStorageClass variable_storage_class = SpvStorageClassPrivate; for (auto& entry_point : GetIRContext()->module()->entry_points()) { // If the execution model of some entry point is GLCompute, // then the variable storage class may be Workgroup. if (entry_point.GetSingleWordInOperand(0) == SpvExecutionModelGLCompute) { variable_storage_class = GetFuzzerContext()->ChoosePercentage( GetFuzzerContext()->GetChanceOfChoosingWorkgroupStorageClass()) ? SpvStorageClassWorkgroup : SpvStorageClassPrivate; break; } } auto basic_type_ids_and_pointers = GetAvailableBasicTypesAndPointers(variable_storage_class); // These are the basic types that are available to this fuzzer pass. auto& basic_types = basic_type_ids_and_pointers.first; // These are the pointers to those basic types that are *initially* available // to the fuzzer pass. The fuzzer pass might add pointer types in cases where // none are available for a given basic type. auto& basic_type_to_pointers = basic_type_ids_and_pointers.second; // Probabilistically keep adding global variables. while (GetFuzzerContext()->ChoosePercentage( GetFuzzerContext()->GetChanceOfAddingGlobalVariable())) { // Choose a random basic type; the new variable's type will be a pointer to // this basic type. uint32_t basic_type = basic_types[GetFuzzerContext()->RandomIndex(basic_types)]; uint32_t pointer_type_id; std::vector& available_pointers_to_basic_type = basic_type_to_pointers.at(basic_type); // Determine whether there is at least one pointer to this basic type. if (available_pointers_to_basic_type.empty()) { // There is not. Make one, to use here, and add it to the available // pointers for the basic type so that future variables can potentially // use it. pointer_type_id = GetFuzzerContext()->GetFreshId(); available_pointers_to_basic_type.push_back(pointer_type_id); ApplyTransformation(TransformationAddTypePointer( pointer_type_id, variable_storage_class, basic_type)); } else { // There is - grab one. pointer_type_id = available_pointers_to_basic_type[GetFuzzerContext()->RandomIndex( available_pointers_to_basic_type)]; } ApplyTransformation(TransformationAddGlobalVariable( GetFuzzerContext()->GetFreshId(), pointer_type_id, variable_storage_class, variable_storage_class == SpvStorageClassPrivate ? FindOrCreateZeroConstant(basic_type, false) : 0, true)); } } } // namespace fuzz } // namespace spvtools