// Copyright (c) 2020 Google LLC // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. #include "source/fuzz/transformation_composite_insert.h" #include "gtest/gtest.h" #include "source/fuzz/data_descriptor.h" #include "source/fuzz/fuzzer_util.h" #include "source/fuzz/instruction_descriptor.h" #include "test/fuzz/fuzz_test_util.h" namespace spvtools { namespace fuzz { namespace { TEST(TransformationCompositeInsertTest, NotApplicableScenarios) { // This test handles cases where IsApplicable() returns false. std::string shader = R"( OpCapability Shader %1 = OpExtInstImport "GLSL.std.450" OpMemoryModel Logical GLSL450 OpEntryPoint Fragment %4 "main" OpExecutionMode %4 OriginUpperLeft OpSource ESSL 310 OpName %4 "main" OpName %8 "i1" OpName %10 "i2" OpName %12 "base" OpMemberName %12 0 "a1" OpMemberName %12 1 "a2" OpName %14 "b" OpName %18 "level_1" OpMemberName %18 0 "b1" OpMemberName %18 1 "b2" OpName %20 "l1" OpName %24 "level_2" OpMemberName %24 0 "c1" OpMemberName %24 1 "c2" OpName %26 "l2" %2 = OpTypeVoid %3 = OpTypeFunction %2 %6 = OpTypeInt 32 1 %7 = OpTypePointer Function %6 %9 = OpConstant %6 1 %11 = OpConstant %6 2 %12 = OpTypeStruct %6 %6 %13 = OpTypePointer Function %12 %18 = OpTypeStruct %12 %12 %19 = OpTypePointer Function %18 %24 = OpTypeStruct %18 %18 %25 = OpTypePointer Function %24 %30 = OpTypeBool %31 = OpConstantTrue %30 %4 = OpFunction %2 None %3 %5 = OpLabel %8 = OpVariable %7 Function %10 = OpVariable %7 Function %14 = OpVariable %13 Function %20 = OpVariable %19 Function %26 = OpVariable %25 Function OpStore %8 %9 OpStore %10 %11 %15 = OpLoad %6 %8 %16 = OpLoad %6 %10 %17 = OpCompositeConstruct %12 %15 %16 OpStore %14 %17 %21 = OpLoad %12 %14 %22 = OpLoad %12 %14 %23 = OpCompositeConstruct %18 %21 %22 OpStore %20 %23 %27 = OpLoad %18 %20 %28 = OpLoad %18 %20 %29 = OpCompositeConstruct %24 %27 %28 OpStore %26 %29 OpSelectionMerge %33 None OpBranchConditional %31 %32 %33 %32 = OpLabel OpBranch %33 %33 = OpLabel OpReturn OpFunctionEnd )"; const auto env = SPV_ENV_UNIVERSAL_1_4; const auto consumer = nullptr; const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption); spvtools::ValidatorOptions validator_options; ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); TransformationContext transformation_context( MakeUnique(context.get()), validator_options); // Bad: |fresh_id| is not fresh. auto transformation_bad_1 = TransformationCompositeInsert( MakeInstructionDescriptor(29, spv::Op::OpStore, 0), 20, 29, 11, {1, 0, 0}); ASSERT_FALSE( transformation_bad_1.IsApplicable(context.get(), transformation_context)); // Bad: |composite_id| does not refer to a existing instruction. auto transformation_bad_2 = TransformationCompositeInsert( MakeInstructionDescriptor(29, spv::Op::OpStore, 0), 50, 40, 11, {1, 0, 0}); ASSERT_FALSE( transformation_bad_2.IsApplicable(context.get(), transformation_context)); // Bad: |composite_id| does not refer to a composite value. auto transformation_bad_3 = TransformationCompositeInsert( MakeInstructionDescriptor(29, spv::Op::OpStore, 0), 50, 9, 11, {1, 0, 0}); ASSERT_FALSE( transformation_bad_3.IsApplicable(context.get(), transformation_context)); // Bad: |object_id| does not refer to a defined instruction. auto transformation_bad_4 = TransformationCompositeInsert( MakeInstructionDescriptor(29, spv::Op::OpStore, 0), 50, 29, 40, {1, 0, 0}); ASSERT_FALSE( transformation_bad_4.IsApplicable(context.get(), transformation_context)); // Bad: |object_id| cannot refer to a pointer. auto transformation_bad_5 = TransformationCompositeInsert( MakeInstructionDescriptor(29, spv::Op::OpStore, 0), 50, 29, 8, {1, 0, 0}); ASSERT_FALSE( transformation_bad_5.IsApplicable(context.get(), transformation_context)); // Bad: |index| is not a correct index. auto transformation_bad_6 = TransformationCompositeInsert( MakeInstructionDescriptor(29, spv::Op::OpStore, 0), 50, 29, 11, {2, 0, 0}); ASSERT_FALSE( transformation_bad_6.IsApplicable(context.get(), transformation_context)); // Bad: Type id of the object to be inserted and the type id of the // component at |index| are not the same. auto transformation_bad_7 = TransformationCompositeInsert( MakeInstructionDescriptor(29, spv::Op::OpStore, 0), 50, 29, 11, {1, 0}); ASSERT_FALSE( transformation_bad_7.IsApplicable(context.get(), transformation_context)); // Bad: |instruction_to_insert_before| does not refer to a defined // instruction. auto transformation_bad_8 = TransformationCompositeInsert( MakeInstructionDescriptor(29, spv::Op::OpIMul, 0), 50, 29, 11, {1, 0, 0}); ASSERT_FALSE( transformation_bad_8.IsApplicable(context.get(), transformation_context)); // Bad: OpCompositeInsert cannot be inserted before OpBranchConditional with // OpSelectionMerge above it. auto transformation_bad_9 = TransformationCompositeInsert( MakeInstructionDescriptor(29, spv::Op::OpBranchConditional, 0), 50, 29, 11, {1, 0, 0}); ASSERT_FALSE( transformation_bad_9.IsApplicable(context.get(), transformation_context)); // Bad: |composite_id| does not have a type_id. auto transformation_bad_10 = TransformationCompositeInsert( MakeInstructionDescriptor(29, spv::Op::OpStore, 0), 50, 1, 11, {1, 0, 0}); ASSERT_FALSE(transformation_bad_10.IsApplicable(context.get(), transformation_context)); } TEST(TransformationCompositeInsertTest, EmptyCompositeScenarios) { // This test handles cases where either the composite is empty or the // composite contains an empty composite. std::string shader = R"( OpCapability Shader %1 = OpExtInstImport "GLSL.std.450" OpMemoryModel Logical GLSL450 OpEntryPoint Fragment %4 "main" OpExecutionMode %4 OriginUpperLeft OpSource ESSL 310 OpName %4 "main" OpName %8 "i1" OpName %10 "i2" OpName %12 "base" OpMemberName %12 0 "a1" OpMemberName %12 1 "a2" OpName %14 "b" %2 = OpTypeVoid %60 = OpTypeStruct %3 = OpTypeFunction %2 %6 = OpTypeInt 32 1 %7 = OpTypePointer Function %6 %9 = OpConstant %6 1 %11 = OpConstant %6 2 %61 = OpConstantComposite %60 %62 = OpConstantComposite %60 %12 = OpTypeStruct %6 %6 %63 = OpTypeStruct %6 %60 %13 = OpTypePointer Function %12 %4 = OpFunction %2 None %3 %5 = OpLabel %8 = OpVariable %7 Function %10 = OpVariable %7 Function %14 = OpVariable %13 Function OpStore %8 %9 OpStore %10 %11 %15 = OpLoad %6 %8 %16 = OpLoad %6 %10 %17 = OpCompositeConstruct %12 %15 %16 %64 = OpCompositeConstruct %63 %15 %61 OpStore %14 %17 OpReturn OpFunctionEnd )"; const auto env = SPV_ENV_UNIVERSAL_1_4; const auto consumer = nullptr; const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption); spvtools::ValidatorOptions validator_options; ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); TransformationContext transformation_context( MakeUnique(context.get()), validator_options); // Bad: The composite with |composite_id| cannot be empty. auto transformation_bad_1 = TransformationCompositeInsert( MakeInstructionDescriptor(64, spv::Op::OpStore, 0), 50, 61, 62, {1}); ASSERT_FALSE( transformation_bad_1.IsApplicable(context.get(), transformation_context)); // Good: It is possible to insert into a composite an element which is an // empty composite. auto transformation_good_1 = TransformationCompositeInsert( MakeInstructionDescriptor(64, spv::Op::OpStore, 0), 50, 64, 62, {1}); ASSERT_TRUE(transformation_good_1.IsApplicable(context.get(), transformation_context)); ApplyAndCheckFreshIds(transformation_good_1, context.get(), &transformation_context); ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); std::string after_transformations = R"( OpCapability Shader %1 = OpExtInstImport "GLSL.std.450" OpMemoryModel Logical GLSL450 OpEntryPoint Fragment %4 "main" OpExecutionMode %4 OriginUpperLeft OpSource ESSL 310 OpName %4 "main" OpName %8 "i1" OpName %10 "i2" OpName %12 "base" OpMemberName %12 0 "a1" OpMemberName %12 1 "a2" OpName %14 "b" %2 = OpTypeVoid %60 = OpTypeStruct %3 = OpTypeFunction %2 %6 = OpTypeInt 32 1 %7 = OpTypePointer Function %6 %9 = OpConstant %6 1 %11 = OpConstant %6 2 %61 = OpConstantComposite %60 %62 = OpConstantComposite %60 %12 = OpTypeStruct %6 %6 %63 = OpTypeStruct %6 %60 %13 = OpTypePointer Function %12 %4 = OpFunction %2 None %3 %5 = OpLabel %8 = OpVariable %7 Function %10 = OpVariable %7 Function %14 = OpVariable %13 Function OpStore %8 %9 OpStore %10 %11 %15 = OpLoad %6 %8 %16 = OpLoad %6 %10 %17 = OpCompositeConstruct %12 %15 %16 %64 = OpCompositeConstruct %63 %15 %61 %50 = OpCompositeInsert %63 %62 %64 1 OpStore %14 %17 OpReturn OpFunctionEnd )"; ASSERT_TRUE(IsEqual(env, after_transformations, context.get())); } TEST(TransformationCompositeInsertTest, IrrelevantCompositeNoSynonyms) { // This test handles cases where either |composite| is irrelevant. // The transformation shouldn't create any synonyms. // The member composite has a different number of elements than the parent // composite. std::string shader = R"( OpCapability Shader %1 = OpExtInstImport "GLSL.std.450" OpMemoryModel Logical GLSL450 OpEntryPoint Fragment %4 "main" OpExecutionMode %4 OriginUpperLeft OpSource ESSL 310 OpName %4 "main" OpName %8 "i1" OpName %10 "i2" OpName %12 "base" OpMemberName %12 0 "a1" OpMemberName %12 1 "a2" OpName %14 "b" OpName %18 "level_1" OpMemberName %18 0 "b1" OpMemberName %18 1 "b2" OpMemberName %18 2 "b3" OpName %20 "l1" OpName %25 "level_2" OpMemberName %25 0 "c1" OpMemberName %25 1 "c2" OpName %27 "l2" %2 = OpTypeVoid %3 = OpTypeFunction %2 %6 = OpTypeInt 32 1 %7 = OpTypePointer Function %6 %9 = OpConstant %6 1 %11 = OpConstant %6 2 %12 = OpTypeStruct %6 %6 %13 = OpTypePointer Function %12 %18 = OpTypeStruct %12 %12 %12 %19 = OpTypePointer Function %18 %25 = OpTypeStruct %18 %18 %26 = OpTypePointer Function %25 %31 = OpTypeBool %32 = OpConstantTrue %31 %4 = OpFunction %2 None %3 %5 = OpLabel %8 = OpVariable %7 Function %10 = OpVariable %7 Function %14 = OpVariable %13 Function %20 = OpVariable %19 Function %27 = OpVariable %26 Function OpStore %8 %9 OpStore %10 %11 %15 = OpLoad %6 %8 %16 = OpLoad %6 %10 %17 = OpCompositeConstruct %12 %15 %16 OpStore %14 %17 %21 = OpLoad %12 %14 %22 = OpLoad %12 %14 %23 = OpLoad %12 %14 %24 = OpCompositeConstruct %18 %21 %22 %23 OpStore %20 %24 %28 = OpLoad %18 %20 %29 = OpLoad %18 %20 %30 = OpCompositeConstruct %25 %28 %29 OpStore %27 %30 OpSelectionMerge %34 None OpBranchConditional %32 %33 %34 %33 = OpLabel OpBranch %34 %34 = OpLabel OpReturn OpFunctionEnd )"; const auto env = SPV_ENV_UNIVERSAL_1_4; const auto consumer = nullptr; const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption); spvtools::ValidatorOptions validator_options; ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); TransformationContext transformation_context( MakeUnique(context.get()), validator_options); // Add fact that the composite is irrelevant. transformation_context.GetFactManager()->AddFactIdIsIrrelevant(30); auto transformation_good_1 = TransformationCompositeInsert( MakeInstructionDescriptor(30, spv::Op::OpStore, 0), 50, 30, 11, {1, 0, 0}); ASSERT_TRUE(transformation_good_1.IsApplicable(context.get(), transformation_context)); ApplyAndCheckFreshIds(transformation_good_1, context.get(), &transformation_context); ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); // No synonyms that involve the original object - %30 - should have been // added. ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {0}), MakeDataDescriptor(50, {0}))); ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {1, 1}), MakeDataDescriptor(50, {1, 1}))); ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {1, 2}), MakeDataDescriptor(50, {1, 2}))); ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {1, 0, 1}), MakeDataDescriptor(50, {1, 0, 1}))); // We *should* have a synonym between %11 and the component of %50 into which // it has been inserted. ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(50, {1, 0, 0}), MakeDataDescriptor(11, {}))); } TEST(TransformationCompositeInsertTest, IrrelevantObjectNoSynonyms) { std::string shader = R"( OpCapability Shader %1 = OpExtInstImport "GLSL.std.450" OpMemoryModel Logical GLSL450 OpEntryPoint Fragment %4 "main" OpExecutionMode %4 OriginUpperLeft OpSource ESSL 310 OpName %4 "main" OpName %8 "i1" OpName %10 "i2" OpName %12 "base" OpMemberName %12 0 "a1" OpMemberName %12 1 "a2" OpName %14 "b" OpName %18 "level_1" OpMemberName %18 0 "b1" OpMemberName %18 1 "b2" OpMemberName %18 2 "b3" OpName %20 "l1" OpName %25 "level_2" OpMemberName %25 0 "c1" OpMemberName %25 1 "c2" OpName %27 "l2" %2 = OpTypeVoid %3 = OpTypeFunction %2 %6 = OpTypeInt 32 1 %7 = OpTypePointer Function %6 %9 = OpConstant %6 1 %11 = OpConstant %6 2 %12 = OpTypeStruct %6 %6 %13 = OpTypePointer Function %12 %18 = OpTypeStruct %12 %12 %12 %19 = OpTypePointer Function %18 %25 = OpTypeStruct %18 %18 %26 = OpTypePointer Function %25 %31 = OpTypeBool %32 = OpConstantTrue %31 %4 = OpFunction %2 None %3 %5 = OpLabel %8 = OpVariable %7 Function %10 = OpVariable %7 Function %14 = OpVariable %13 Function %20 = OpVariable %19 Function %27 = OpVariable %26 Function OpStore %8 %9 OpStore %10 %11 %15 = OpLoad %6 %8 %16 = OpLoad %6 %10 %17 = OpCompositeConstruct %12 %15 %16 OpStore %14 %17 %21 = OpLoad %12 %14 %22 = OpLoad %12 %14 %23 = OpLoad %12 %14 %24 = OpCompositeConstruct %18 %21 %22 %23 OpStore %20 %24 %28 = OpLoad %18 %20 %29 = OpLoad %18 %20 %30 = OpCompositeConstruct %25 %28 %29 OpStore %27 %30 OpSelectionMerge %34 None OpBranchConditional %32 %33 %34 %33 = OpLabel OpBranch %34 %34 = OpLabel OpReturn OpFunctionEnd )"; const auto env = SPV_ENV_UNIVERSAL_1_4; const auto consumer = nullptr; const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption); spvtools::ValidatorOptions validator_options; ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); TransformationContext transformation_context( MakeUnique(context.get()), validator_options); // Add fact that the object is irrelevant. transformation_context.GetFactManager()->AddFactIdIsIrrelevant(11); auto transformation_good_1 = TransformationCompositeInsert( MakeInstructionDescriptor(30, spv::Op::OpStore, 0), 50, 30, 11, {1, 0, 0}); ASSERT_TRUE(transformation_good_1.IsApplicable(context.get(), transformation_context)); ApplyAndCheckFreshIds(transformation_good_1, context.get(), &transformation_context); ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); // Since %30 and %50 are not irrelevant, they should be synonymous at all // indices unaffected by the insertion. ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {0}), MakeDataDescriptor(50, {0}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {1, 1}), MakeDataDescriptor(50, {1, 1}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {1, 2}), MakeDataDescriptor(50, {1, 2}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {1, 0, 1}), MakeDataDescriptor(50, {1, 0, 1}))); // Since %11 is irrelevant it should not be synonymous with the component into // which it has been inserted. ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(50, {1, 0, 0}), MakeDataDescriptor(11, {}))); } TEST(TransformationCompositeInsertTest, ApplicableCreatedSynonyms) { // This test handles cases where neither |composite| nor |object| is // irrelevant. The transformation should create synonyms. // The member composite has a different number of elements than the parent // composite. std::string shader = R"( OpCapability Shader %1 = OpExtInstImport "GLSL.std.450" OpMemoryModel Logical GLSL450 OpEntryPoint Fragment %4 "main" OpExecutionMode %4 OriginUpperLeft OpSource ESSL 310 OpName %4 "main" OpName %8 "i1" OpName %10 "i2" OpName %12 "base" OpMemberName %12 0 "a1" OpMemberName %12 1 "a2" OpName %14 "b" OpName %18 "level_1" OpMemberName %18 0 "b1" OpMemberName %18 1 "b2" OpMemberName %18 2 "b3" OpName %20 "l1" OpName %25 "level_2" OpMemberName %25 0 "c1" OpMemberName %25 1 "c2" OpName %27 "l2" %2 = OpTypeVoid %3 = OpTypeFunction %2 %6 = OpTypeInt 32 1 %7 = OpTypePointer Function %6 %9 = OpConstant %6 1 %11 = OpConstant %6 2 %12 = OpTypeStruct %6 %6 %13 = OpTypePointer Function %12 %18 = OpTypeStruct %12 %12 %12 %19 = OpTypePointer Function %18 %25 = OpTypeStruct %18 %18 %26 = OpTypePointer Function %25 %31 = OpTypeBool %32 = OpConstantTrue %31 %4 = OpFunction %2 None %3 %5 = OpLabel %8 = OpVariable %7 Function %10 = OpVariable %7 Function %14 = OpVariable %13 Function %20 = OpVariable %19 Function %27 = OpVariable %26 Function OpStore %8 %9 OpStore %10 %11 %15 = OpLoad %6 %8 %16 = OpLoad %6 %10 %17 = OpCompositeConstruct %12 %15 %16 OpStore %14 %17 %21 = OpLoad %12 %14 %22 = OpLoad %12 %14 %23 = OpLoad %12 %14 %24 = OpCompositeConstruct %18 %21 %22 %23 OpStore %20 %24 %28 = OpLoad %18 %20 %29 = OpLoad %18 %20 %30 = OpCompositeConstruct %25 %28 %29 OpStore %27 %30 OpSelectionMerge %34 None OpBranchConditional %32 %33 %34 %33 = OpLabel OpBranch %34 %34 = OpLabel OpReturn OpFunctionEnd )"; const auto env = SPV_ENV_UNIVERSAL_1_4; const auto consumer = nullptr; const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption); spvtools::ValidatorOptions validator_options; ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); TransformationContext transformation_context( MakeUnique(context.get()), validator_options); auto transformation_good_1 = TransformationCompositeInsert( MakeInstructionDescriptor(30, spv::Op::OpStore, 0), 50, 30, 11, {1, 0, 0}); ASSERT_TRUE(transformation_good_1.IsApplicable(context.get(), transformation_context)); ApplyAndCheckFreshIds(transformation_good_1, context.get(), &transformation_context); ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); // These synonyms should have been added. ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {0}), MakeDataDescriptor(50, {0}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {1, 1}), MakeDataDescriptor(50, {1, 1}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {1, 2}), MakeDataDescriptor(50, {1, 2}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {1, 0, 1}), MakeDataDescriptor(50, {1, 0, 1}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(50, {1, 0, 0}), MakeDataDescriptor(11, {}))); // These synonyms should not have been added. ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {1}), MakeDataDescriptor(50, {1}))); ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {1, 0}), MakeDataDescriptor(50, {1, 0}))); ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(30, {1, 0, 0}), MakeDataDescriptor(50, {1, 0, 0}))); auto transformation_good_2 = TransformationCompositeInsert( MakeInstructionDescriptor(50, spv::Op::OpStore, 0), 51, 50, 11, {0, 1, 1}); ASSERT_TRUE(transformation_good_2.IsApplicable(context.get(), transformation_context)); ApplyAndCheckFreshIds(transformation_good_2, context.get(), &transformation_context); ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); // These synonyms should have been added. ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(50, {1}), MakeDataDescriptor(51, {1}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(50, {0, 0}), MakeDataDescriptor(51, {0, 0}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(50, {0, 2}), MakeDataDescriptor(51, {0, 2}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(50, {0, 1, 0}), MakeDataDescriptor(51, {0, 1, 0}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(51, {0, 1, 1}), MakeDataDescriptor(11, {}))); // These synonyms should not have been added. ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(50, {0}), MakeDataDescriptor(51, {0}))); ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(50, {0, 1}), MakeDataDescriptor(51, {0, 1}))); ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(50, {0, 1, 1}), MakeDataDescriptor(51, {0, 1, 1}))); std::string after_transformations = R"( OpCapability Shader %1 = OpExtInstImport "GLSL.std.450" OpMemoryModel Logical GLSL450 OpEntryPoint Fragment %4 "main" OpExecutionMode %4 OriginUpperLeft OpSource ESSL 310 OpName %4 "main" OpName %8 "i1" OpName %10 "i2" OpName %12 "base" OpMemberName %12 0 "a1" OpMemberName %12 1 "a2" OpName %14 "b" OpName %18 "level_1" OpMemberName %18 0 "b1" OpMemberName %18 1 "b2" OpMemberName %18 2 "b3" OpName %20 "l1" OpName %25 "level_2" OpMemberName %25 0 "c1" OpMemberName %25 1 "c2" OpName %27 "l2" %2 = OpTypeVoid %3 = OpTypeFunction %2 %6 = OpTypeInt 32 1 %7 = OpTypePointer Function %6 %9 = OpConstant %6 1 %11 = OpConstant %6 2 %12 = OpTypeStruct %6 %6 %13 = OpTypePointer Function %12 %18 = OpTypeStruct %12 %12 %12 %19 = OpTypePointer Function %18 %25 = OpTypeStruct %18 %18 %26 = OpTypePointer Function %25 %31 = OpTypeBool %32 = OpConstantTrue %31 %4 = OpFunction %2 None %3 %5 = OpLabel %8 = OpVariable %7 Function %10 = OpVariable %7 Function %14 = OpVariable %13 Function %20 = OpVariable %19 Function %27 = OpVariable %26 Function OpStore %8 %9 OpStore %10 %11 %15 = OpLoad %6 %8 %16 = OpLoad %6 %10 %17 = OpCompositeConstruct %12 %15 %16 OpStore %14 %17 %21 = OpLoad %12 %14 %22 = OpLoad %12 %14 %23 = OpLoad %12 %14 %24 = OpCompositeConstruct %18 %21 %22 %23 OpStore %20 %24 %28 = OpLoad %18 %20 %29 = OpLoad %18 %20 %30 = OpCompositeConstruct %25 %28 %29 %50 = OpCompositeInsert %25 %11 %30 1 0 0 %51 = OpCompositeInsert %25 %11 %50 0 1 1 OpStore %27 %30 OpSelectionMerge %34 None OpBranchConditional %32 %33 %34 %33 = OpLabel OpBranch %34 %34 = OpLabel OpReturn OpFunctionEnd )"; ASSERT_TRUE(IsEqual(env, after_transformations, context.get())); } TEST(TransformationCompositeInsertTest, IdNotAvailableScenarios) { // This test handles cases where either the composite or the object is not // available before the |instruction_to_insert_before|. std::string shader = R"( OpCapability Shader %1 = OpExtInstImport "GLSL.std.450" OpMemoryModel Logical GLSL450 OpEntryPoint Fragment %4 "main" OpExecutionMode %4 OriginUpperLeft OpSource ESSL 310 OpName %4 "main" OpName %8 "i1" OpName %10 "i2" OpName %12 "base" OpMemberName %12 0 "a1" OpMemberName %12 1 "a2" OpName %14 "b1" OpName %18 "b2" OpName %22 "lvl1" OpMemberName %22 0 "b1" OpMemberName %22 1 "b2" OpName %24 "l1" OpName %28 "i3" %2 = OpTypeVoid %3 = OpTypeFunction %2 %6 = OpTypeInt 32 1 %7 = OpTypePointer Function %6 %9 = OpConstant %6 1 %11 = OpConstant %6 2 %12 = OpTypeStruct %6 %6 %13 = OpTypePointer Function %12 %22 = OpTypeStruct %12 %12 %23 = OpTypePointer Function %22 %4 = OpFunction %2 None %3 %5 = OpLabel %8 = OpVariable %7 Function %10 = OpVariable %7 Function %14 = OpVariable %13 Function %18 = OpVariable %13 Function %24 = OpVariable %23 Function %28 = OpVariable %7 Function OpStore %8 %9 OpStore %10 %11 %15 = OpLoad %6 %8 %16 = OpLoad %6 %10 %17 = OpCompositeConstruct %12 %15 %16 OpStore %14 %17 %19 = OpLoad %6 %10 %20 = OpLoad %6 %8 %21 = OpCompositeConstruct %12 %19 %20 OpStore %18 %21 %25 = OpLoad %12 %14 %26 = OpLoad %12 %18 %27 = OpCompositeConstruct %22 %25 %26 OpStore %24 %27 %29 = OpLoad %6 %8 %30 = OpLoad %6 %10 %31 = OpIMul %6 %29 %30 OpStore %28 %31 %60 = OpCompositeConstruct %12 %20 %19 %61 = OpCompositeConstruct %22 %26 %25 OpReturn OpFunctionEnd )"; const auto env = SPV_ENV_UNIVERSAL_1_4; const auto consumer = nullptr; const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption); spvtools::ValidatorOptions validator_options; ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); TransformationContext transformation_context( MakeUnique(context.get()), validator_options); // Bad: The object with |object_id| is not available at // |instruction_to_insert_before|. auto transformation_bad_1 = TransformationCompositeInsert( MakeInstructionDescriptor(31, spv::Op::OpIMul, 0), 50, 27, 60, {1}); ASSERT_FALSE( transformation_bad_1.IsApplicable(context.get(), transformation_context)); // Bad: The composite with |composite_id| is not available at // |instruction_to_insert_before|. auto transformation_bad_2 = TransformationCompositeInsert( MakeInstructionDescriptor(31, spv::Op::OpIMul, 0), 50, 61, 21, {1}); ASSERT_FALSE( transformation_bad_2.IsApplicable(context.get(), transformation_context)); // Bad: The |instruction_to_insert_before| is the composite itself and is // available. auto transformation_bad_3 = TransformationCompositeInsert( MakeInstructionDescriptor(61, spv::Op::OpCompositeConstruct, 0), 50, 61, 21, {1}); ASSERT_FALSE( transformation_bad_3.IsApplicable(context.get(), transformation_context)); // Bad: The |instruction_to_insert_before| is the object itself and is not // available. auto transformation_bad_4 = TransformationCompositeInsert( MakeInstructionDescriptor(60, spv::Op::OpCompositeConstruct, 0), 50, 27, 60, {1}); ASSERT_FALSE( transformation_bad_4.IsApplicable(context.get(), transformation_context)); } TEST(TransformationCompositeInsertTest, CompositeInsertionWithIrrelevantIds) { // This checks that we do *not* get data synonym facts when we do composite // insertion using irrelevant ids or in dead blocks. std::string shader = R"( OpCapability Shader %1 = OpExtInstImport "GLSL.std.450" OpMemoryModel Logical GLSL450 OpEntryPoint Fragment %12 "main" OpExecutionMode %12 OriginUpperLeft OpSource ESSL 310 %2 = OpTypeVoid %3 = OpTypeFunction %2 %6 = OpTypeInt 32 1 %7 = OpTypeVector %6 2 %8 = OpConstant %6 0 %9 = OpConstantComposite %7 %8 %8 %10 = OpTypeBool %11 = OpConstantFalse %10 %16 = OpConstant %6 0 %17 = OpConstant %6 1 %18 = OpConstantComposite %7 %8 %8 %12 = OpFunction %2 None %3 %13 = OpLabel OpSelectionMerge %15 None OpBranchConditional %11 %14 %15 %14 = OpLabel OpBranch %15 %15 = OpLabel OpReturn OpFunctionEnd )"; const auto env = SPV_ENV_UNIVERSAL_1_3; const auto consumer = nullptr; const auto context = BuildModule(env, consumer, shader, kFuzzAssembleOption); spvtools::ValidatorOptions validator_options; ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); TransformationContext transformation_context( MakeUnique(context.get()), validator_options); transformation_context.GetFactManager()->AddFactBlockIsDead(14); transformation_context.GetFactManager()->AddFactIdIsIrrelevant(16); transformation_context.GetFactManager()->AddFactIdIsIrrelevant(18); // Leads to synonyms - nothing is irrelevant. auto transformation1 = TransformationCompositeInsert( MakeInstructionDescriptor(13, spv::Op::OpSelectionMerge, 0), 100, 9, 17, {0}); ASSERT_TRUE( transformation1.IsApplicable(context.get(), transformation_context)); ApplyAndCheckFreshIds(transformation1, context.get(), &transformation_context); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(100, {0}), MakeDataDescriptor(17, {}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(100, {1}), MakeDataDescriptor(9, {1}))); // Because %16 is irrelevant, we don't get a synonym with the component to // which it has been inserted (but we do for the other component). auto transformation2 = TransformationCompositeInsert( MakeInstructionDescriptor(13, spv::Op::OpSelectionMerge, 0), 101, 9, 16, {0}); ASSERT_TRUE( transformation2.IsApplicable(context.get(), transformation_context)); ApplyAndCheckFreshIds(transformation2, context.get(), &transformation_context); ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(101, {0}), MakeDataDescriptor(16, {}))); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(101, {1}), MakeDataDescriptor(9, {1}))); // Because %18 is irrelevant we only get a synonym for the component into // which insertion has taken place. auto transformation3 = TransformationCompositeInsert( MakeInstructionDescriptor(13, spv::Op::OpSelectionMerge, 0), 102, 18, 17, {0}); ASSERT_TRUE( transformation3.IsApplicable(context.get(), transformation_context)); ApplyAndCheckFreshIds(transformation3, context.get(), &transformation_context); ASSERT_TRUE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(102, {0}), MakeDataDescriptor(17, {}))); ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(102, {1}), MakeDataDescriptor(18, {1}))); // Does not lead to synonyms as block %14 is dead. auto transformation4 = TransformationCompositeInsert( MakeInstructionDescriptor(14, spv::Op::OpBranch, 0), 103, 9, 17, {0}); ASSERT_TRUE( transformation4.IsApplicable(context.get(), transformation_context)); ApplyAndCheckFreshIds(transformation4, context.get(), &transformation_context); ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(103, {0}), MakeDataDescriptor(17, {}))); ASSERT_FALSE(transformation_context.GetFactManager()->IsSynonymous( MakeDataDescriptor(103, {1}), MakeDataDescriptor(9, {1}))); ASSERT_TRUE(fuzzerutil::IsValidAndWellFormed(context.get(), validator_options, kConsoleMessageConsumer)); } } // namespace } // namespace fuzz } // namespace spvtools