mirror of
https://github.com/KhronosGroup/SPIRV-Tools
synced 2024-11-23 04:00:05 +00:00
d35a78db57
Fixes #4960 * Switches to using enum classes with an underlying type to avoid undefined behaviour
802 lines
31 KiB
C++
802 lines
31 KiB
C++
// Copyright (c) 2019 Google LLC
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
#include "source/fuzz/fuzzer_pass.h"
|
|
|
|
#include <set>
|
|
|
|
#include "source/fuzz/fuzzer_util.h"
|
|
#include "source/fuzz/id_use_descriptor.h"
|
|
#include "source/fuzz/instruction_descriptor.h"
|
|
#include "source/fuzz/transformation_add_constant_boolean.h"
|
|
#include "source/fuzz/transformation_add_constant_composite.h"
|
|
#include "source/fuzz/transformation_add_constant_null.h"
|
|
#include "source/fuzz/transformation_add_constant_scalar.h"
|
|
#include "source/fuzz/transformation_add_global_undef.h"
|
|
#include "source/fuzz/transformation_add_global_variable.h"
|
|
#include "source/fuzz/transformation_add_local_variable.h"
|
|
#include "source/fuzz/transformation_add_loop_preheader.h"
|
|
#include "source/fuzz/transformation_add_type_boolean.h"
|
|
#include "source/fuzz/transformation_add_type_float.h"
|
|
#include "source/fuzz/transformation_add_type_function.h"
|
|
#include "source/fuzz/transformation_add_type_int.h"
|
|
#include "source/fuzz/transformation_add_type_matrix.h"
|
|
#include "source/fuzz/transformation_add_type_pointer.h"
|
|
#include "source/fuzz/transformation_add_type_struct.h"
|
|
#include "source/fuzz/transformation_add_type_vector.h"
|
|
#include "source/fuzz/transformation_split_block.h"
|
|
|
|
namespace spvtools {
|
|
namespace fuzz {
|
|
|
|
FuzzerPass::FuzzerPass(opt::IRContext* ir_context,
|
|
TransformationContext* transformation_context,
|
|
FuzzerContext* fuzzer_context,
|
|
protobufs::TransformationSequence* transformations,
|
|
bool ignore_inapplicable_transformations)
|
|
: ir_context_(ir_context),
|
|
transformation_context_(transformation_context),
|
|
fuzzer_context_(fuzzer_context),
|
|
transformations_(transformations),
|
|
ignore_inapplicable_transformations_(
|
|
ignore_inapplicable_transformations) {}
|
|
|
|
FuzzerPass::~FuzzerPass() = default;
|
|
|
|
std::vector<opt::Instruction*> FuzzerPass::FindAvailableInstructions(
|
|
opt::Function* function, opt::BasicBlock* block,
|
|
const opt::BasicBlock::iterator& inst_it,
|
|
std::function<bool(opt::IRContext*, opt::Instruction*)>
|
|
instruction_is_relevant) const {
|
|
// TODO(afd) The following is (relatively) simple, but may end up being
|
|
// prohibitively inefficient, as it walks the whole dominator tree for
|
|
// every instruction that is considered.
|
|
|
|
std::vector<opt::Instruction*> result;
|
|
// Consider all global declarations
|
|
for (auto& global : GetIRContext()->module()->types_values()) {
|
|
if (instruction_is_relevant(GetIRContext(), &global)) {
|
|
result.push_back(&global);
|
|
}
|
|
}
|
|
|
|
// Consider all function parameters
|
|
function->ForEachParam(
|
|
[this, &instruction_is_relevant, &result](opt::Instruction* param) {
|
|
if (instruction_is_relevant(GetIRContext(), param)) {
|
|
result.push_back(param);
|
|
}
|
|
});
|
|
|
|
// Consider all previous instructions in this block
|
|
for (auto prev_inst_it = block->begin(); prev_inst_it != inst_it;
|
|
++prev_inst_it) {
|
|
if (instruction_is_relevant(GetIRContext(), &*prev_inst_it)) {
|
|
result.push_back(&*prev_inst_it);
|
|
}
|
|
}
|
|
|
|
// Walk the dominator tree to consider all instructions from dominating
|
|
// blocks
|
|
auto dominator_analysis = GetIRContext()->GetDominatorAnalysis(function);
|
|
for (auto next_dominator = dominator_analysis->ImmediateDominator(block);
|
|
next_dominator != nullptr;
|
|
next_dominator =
|
|
dominator_analysis->ImmediateDominator(next_dominator)) {
|
|
for (auto& dominating_inst : *next_dominator) {
|
|
if (instruction_is_relevant(GetIRContext(), &dominating_inst)) {
|
|
result.push_back(&dominating_inst);
|
|
}
|
|
}
|
|
}
|
|
return result;
|
|
}
|
|
|
|
void FuzzerPass::ForEachInstructionWithInstructionDescriptor(
|
|
opt::Function* function,
|
|
std::function<
|
|
void(opt::BasicBlock* block, opt::BasicBlock::iterator inst_it,
|
|
const protobufs::InstructionDescriptor& instruction_descriptor)>
|
|
action) {
|
|
// Consider only reachable blocks. We do this in a separate loop to avoid
|
|
// recomputing the dominator analysis every time |action| changes the
|
|
// module.
|
|
std::vector<opt::BasicBlock*> reachable_blocks;
|
|
|
|
for (auto& block : *function) {
|
|
if (GetIRContext()->IsReachable(block)) {
|
|
reachable_blocks.push_back(&block);
|
|
}
|
|
}
|
|
|
|
for (auto* block : reachable_blocks) {
|
|
// We now consider every instruction in the block, randomly deciding
|
|
// whether to apply a transformation before it.
|
|
|
|
// In order for transformations to insert new instructions, they need to
|
|
// be able to identify the instruction to insert before. We describe an
|
|
// instruction via its opcode, 'opc', a base instruction 'base' that has a
|
|
// result id, and the number of instructions with opcode 'opc' that we
|
|
// should skip when searching from 'base' for the desired instruction.
|
|
// (An instruction that has a result id is represented by its own opcode,
|
|
// itself as 'base', and a skip-count of 0.)
|
|
std::vector<std::tuple<uint32_t, spv::Op, uint32_t>>
|
|
base_opcode_skip_triples;
|
|
|
|
// The initial base instruction is the block label.
|
|
uint32_t base = block->id();
|
|
|
|
// Counts the number of times we have seen each opcode since we reset the
|
|
// base instruction.
|
|
std::map<spv::Op, uint32_t> skip_count;
|
|
|
|
// Consider every instruction in the block. The label is excluded: it is
|
|
// only necessary to consider it as a base in case the first instruction
|
|
// in the block does not have a result id.
|
|
for (auto inst_it = block->begin(); inst_it != block->end(); ++inst_it) {
|
|
if (inst_it->HasResultId()) {
|
|
// In the case that the instruction has a result id, we use the
|
|
// instruction as its own base, and clear the skip counts we have
|
|
// collected.
|
|
base = inst_it->result_id();
|
|
skip_count.clear();
|
|
}
|
|
const spv::Op opcode = inst_it->opcode();
|
|
|
|
// Invoke the provided function, which might apply a transformation.
|
|
action(block, inst_it,
|
|
MakeInstructionDescriptor(
|
|
base, opcode,
|
|
skip_count.count(opcode) ? skip_count.at(opcode) : 0));
|
|
|
|
if (!inst_it->HasResultId()) {
|
|
skip_count[opcode] =
|
|
skip_count.count(opcode) ? skip_count.at(opcode) + 1 : 1;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
void FuzzerPass::ForEachInstructionWithInstructionDescriptor(
|
|
std::function<
|
|
void(opt::Function* function, opt::BasicBlock* block,
|
|
opt::BasicBlock::iterator inst_it,
|
|
const protobufs::InstructionDescriptor& instruction_descriptor)>
|
|
action) {
|
|
// Consider every block in every function.
|
|
for (auto& function : *GetIRContext()->module()) {
|
|
ForEachInstructionWithInstructionDescriptor(
|
|
&function,
|
|
[&action, &function](
|
|
opt::BasicBlock* block, opt::BasicBlock::iterator inst_it,
|
|
const protobufs::InstructionDescriptor& instruction_descriptor) {
|
|
action(&function, block, inst_it, instruction_descriptor);
|
|
});
|
|
}
|
|
}
|
|
|
|
void FuzzerPass::ApplyTransformation(const Transformation& transformation) {
|
|
if (ignore_inapplicable_transformations_) {
|
|
// If an applicable-by-construction transformation turns out to be
|
|
// inapplicable, this is a bug in the fuzzer. However, when deploying the
|
|
// fuzzer at scale for finding bugs in SPIR-V processing tools it is
|
|
// desirable to silently ignore such bugs. This code path caters for that
|
|
// scenario.
|
|
if (!transformation.IsApplicable(GetIRContext(),
|
|
*GetTransformationContext())) {
|
|
return;
|
|
}
|
|
} else {
|
|
// This code path caters for debugging bugs in the fuzzer, where an
|
|
// applicable-by-construction transformation turns out to be inapplicable.
|
|
assert(transformation.IsApplicable(GetIRContext(),
|
|
*GetTransformationContext()) &&
|
|
"Transformation should be applicable by construction.");
|
|
}
|
|
transformation.Apply(GetIRContext(), GetTransformationContext());
|
|
auto transformation_message = transformation.ToMessage();
|
|
assert(transformation_message.transformation_case() !=
|
|
protobufs::Transformation::TRANSFORMATION_NOT_SET &&
|
|
"Bad transformation.");
|
|
*GetTransformations()->add_transformation() =
|
|
std::move(transformation_message);
|
|
}
|
|
|
|
bool FuzzerPass::MaybeApplyTransformation(
|
|
const Transformation& transformation) {
|
|
if (transformation.IsApplicable(GetIRContext(),
|
|
*GetTransformationContext())) {
|
|
transformation.Apply(GetIRContext(), GetTransformationContext());
|
|
auto transformation_message = transformation.ToMessage();
|
|
assert(transformation_message.transformation_case() !=
|
|
protobufs::Transformation::TRANSFORMATION_NOT_SET &&
|
|
"Bad transformation.");
|
|
*GetTransformations()->add_transformation() =
|
|
std::move(transformation_message);
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateBoolType() {
|
|
if (auto existing_id = fuzzerutil::MaybeGetBoolType(GetIRContext())) {
|
|
return existing_id;
|
|
}
|
|
auto result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(TransformationAddTypeBoolean(result));
|
|
return result;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateIntegerType(uint32_t width, bool is_signed) {
|
|
opt::analysis::Integer int_type(width, is_signed);
|
|
auto existing_id = GetIRContext()->get_type_mgr()->GetId(&int_type);
|
|
if (existing_id) {
|
|
return existing_id;
|
|
}
|
|
auto result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(TransformationAddTypeInt(result, width, is_signed));
|
|
return result;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateFloatType(uint32_t width) {
|
|
opt::analysis::Float float_type(width);
|
|
auto existing_id = GetIRContext()->get_type_mgr()->GetId(&float_type);
|
|
if (existing_id) {
|
|
return existing_id;
|
|
}
|
|
auto result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(TransformationAddTypeFloat(result, width));
|
|
return result;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateFunctionType(
|
|
uint32_t return_type_id, const std::vector<uint32_t>& argument_id) {
|
|
// FindFunctionType has a single argument for OpTypeFunction operands
|
|
// so we will have to copy them all in this vector
|
|
std::vector<uint32_t> type_ids(argument_id.size() + 1);
|
|
type_ids[0] = return_type_id;
|
|
std::copy(argument_id.begin(), argument_id.end(), type_ids.begin() + 1);
|
|
|
|
// Check if type exists
|
|
auto existing_id = fuzzerutil::FindFunctionType(GetIRContext(), type_ids);
|
|
if (existing_id) {
|
|
return existing_id;
|
|
}
|
|
|
|
auto result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(
|
|
TransformationAddTypeFunction(result, return_type_id, argument_id));
|
|
return result;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateVectorType(uint32_t component_type_id,
|
|
uint32_t component_count) {
|
|
assert(component_count >= 2 && component_count <= 4 &&
|
|
"Precondition: component count must be in range [2, 4].");
|
|
opt::analysis::Type* component_type =
|
|
GetIRContext()->get_type_mgr()->GetType(component_type_id);
|
|
assert(component_type && "Precondition: the component type must exist.");
|
|
opt::analysis::Vector vector_type(component_type, component_count);
|
|
auto existing_id = GetIRContext()->get_type_mgr()->GetId(&vector_type);
|
|
if (existing_id) {
|
|
return existing_id;
|
|
}
|
|
auto result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(
|
|
TransformationAddTypeVector(result, component_type_id, component_count));
|
|
return result;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateMatrixType(uint32_t column_count,
|
|
uint32_t row_count) {
|
|
assert(column_count >= 2 && column_count <= 4 &&
|
|
"Precondition: column count must be in range [2, 4].");
|
|
assert(row_count >= 2 && row_count <= 4 &&
|
|
"Precondition: row count must be in range [2, 4].");
|
|
uint32_t column_type_id =
|
|
FindOrCreateVectorType(FindOrCreateFloatType(32), row_count);
|
|
opt::analysis::Type* column_type =
|
|
GetIRContext()->get_type_mgr()->GetType(column_type_id);
|
|
opt::analysis::Matrix matrix_type(column_type, column_count);
|
|
auto existing_id = GetIRContext()->get_type_mgr()->GetId(&matrix_type);
|
|
if (existing_id) {
|
|
return existing_id;
|
|
}
|
|
auto result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(
|
|
TransformationAddTypeMatrix(result, column_type_id, column_count));
|
|
return result;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateStructType(
|
|
const std::vector<uint32_t>& component_type_ids) {
|
|
if (auto existing_id =
|
|
fuzzerutil::MaybeGetStructType(GetIRContext(), component_type_ids)) {
|
|
return existing_id;
|
|
}
|
|
auto new_id = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(TransformationAddTypeStruct(new_id, component_type_ids));
|
|
return new_id;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreatePointerType(uint32_t base_type_id,
|
|
spv::StorageClass storage_class) {
|
|
// We do not use the type manager here, due to problems related to isomorphic
|
|
// but distinct structs not being regarded as different.
|
|
auto existing_id = fuzzerutil::MaybeGetPointerType(
|
|
GetIRContext(), base_type_id, storage_class);
|
|
if (existing_id) {
|
|
return existing_id;
|
|
}
|
|
auto result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(
|
|
TransformationAddTypePointer(result, storage_class, base_type_id));
|
|
return result;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreatePointerToIntegerType(
|
|
uint32_t width, bool is_signed, spv::StorageClass storage_class) {
|
|
return FindOrCreatePointerType(FindOrCreateIntegerType(width, is_signed),
|
|
storage_class);
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateIntegerConstant(
|
|
const std::vector<uint32_t>& words, uint32_t width, bool is_signed,
|
|
bool is_irrelevant) {
|
|
auto int_type_id = FindOrCreateIntegerType(width, is_signed);
|
|
if (auto constant_id = fuzzerutil::MaybeGetScalarConstant(
|
|
GetIRContext(), *GetTransformationContext(), words, int_type_id,
|
|
is_irrelevant)) {
|
|
return constant_id;
|
|
}
|
|
auto result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(TransformationAddConstantScalar(result, int_type_id,
|
|
words, is_irrelevant));
|
|
return result;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateFloatConstant(
|
|
const std::vector<uint32_t>& words, uint32_t width, bool is_irrelevant) {
|
|
auto float_type_id = FindOrCreateFloatType(width);
|
|
if (auto constant_id = fuzzerutil::MaybeGetScalarConstant(
|
|
GetIRContext(), *GetTransformationContext(), words, float_type_id,
|
|
is_irrelevant)) {
|
|
return constant_id;
|
|
}
|
|
auto result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(TransformationAddConstantScalar(result, float_type_id,
|
|
words, is_irrelevant));
|
|
return result;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateBoolConstant(bool value, bool is_irrelevant) {
|
|
auto bool_type_id = FindOrCreateBoolType();
|
|
if (auto constant_id = fuzzerutil::MaybeGetScalarConstant(
|
|
GetIRContext(), *GetTransformationContext(), {value ? 1u : 0u},
|
|
bool_type_id, is_irrelevant)) {
|
|
return constant_id;
|
|
}
|
|
auto result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(
|
|
TransformationAddConstantBoolean(result, value, is_irrelevant));
|
|
return result;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateConstant(const std::vector<uint32_t>& words,
|
|
uint32_t type_id,
|
|
bool is_irrelevant) {
|
|
assert(type_id && "Constant's type id can't be 0.");
|
|
|
|
const auto* type = GetIRContext()->get_type_mgr()->GetType(type_id);
|
|
assert(type && "Type does not exist.");
|
|
|
|
if (type->AsBool()) {
|
|
assert(words.size() == 1);
|
|
return FindOrCreateBoolConstant(words[0], is_irrelevant);
|
|
} else if (const auto* integer = type->AsInteger()) {
|
|
return FindOrCreateIntegerConstant(words, integer->width(),
|
|
integer->IsSigned(), is_irrelevant);
|
|
} else if (const auto* floating = type->AsFloat()) {
|
|
return FindOrCreateFloatConstant(words, floating->width(), is_irrelevant);
|
|
}
|
|
|
|
// This assertion will fail in debug build but not in release build
|
|
// so we return 0 to make compiler happy.
|
|
assert(false && "Constant type is not supported");
|
|
return 0;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateCompositeConstant(
|
|
const std::vector<uint32_t>& component_ids, uint32_t type_id,
|
|
bool is_irrelevant) {
|
|
if (auto existing_constant = fuzzerutil::MaybeGetCompositeConstant(
|
|
GetIRContext(), *GetTransformationContext(), component_ids, type_id,
|
|
is_irrelevant)) {
|
|
return existing_constant;
|
|
}
|
|
uint32_t result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(TransformationAddConstantComposite(
|
|
result, type_id, component_ids, is_irrelevant));
|
|
return result;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateGlobalUndef(uint32_t type_id) {
|
|
for (auto& inst : GetIRContext()->types_values()) {
|
|
if (inst.opcode() == spv::Op::OpUndef && inst.type_id() == type_id) {
|
|
return inst.result_id();
|
|
}
|
|
}
|
|
auto result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(TransformationAddGlobalUndef(result, type_id));
|
|
return result;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateNullConstant(uint32_t type_id) {
|
|
// Find existing declaration
|
|
opt::analysis::NullConstant null_constant(
|
|
GetIRContext()->get_type_mgr()->GetType(type_id));
|
|
auto existing_constant =
|
|
GetIRContext()->get_constant_mgr()->FindConstant(&null_constant);
|
|
|
|
// Return if found
|
|
if (existing_constant) {
|
|
return GetIRContext()
|
|
->get_constant_mgr()
|
|
->GetDefiningInstruction(existing_constant)
|
|
->result_id();
|
|
}
|
|
|
|
// Create new if not found
|
|
auto result = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(TransformationAddConstantNull(result, type_id));
|
|
return result;
|
|
}
|
|
|
|
std::pair<std::vector<uint32_t>, std::map<uint32_t, std::vector<uint32_t>>>
|
|
FuzzerPass::GetAvailableBasicTypesAndPointers(
|
|
spv::StorageClass storage_class) const {
|
|
// Records all of the basic types available in the module.
|
|
std::set<uint32_t> basic_types;
|
|
|
|
// For each basic type, records all the associated pointer types that target
|
|
// the basic type and that have |storage_class| as their storage class.
|
|
std::map<uint32_t, std::vector<uint32_t>> basic_type_to_pointers;
|
|
|
|
for (auto& inst : GetIRContext()->types_values()) {
|
|
// For each basic type that we come across, record type, and the fact that
|
|
// we cannot yet have seen any pointers that use the basic type as its
|
|
// pointee type.
|
|
//
|
|
// For pointer types with basic pointee types, associate the pointer type
|
|
// with the basic type.
|
|
switch (inst.opcode()) {
|
|
case spv::Op::OpTypeBool:
|
|
case spv::Op::OpTypeFloat:
|
|
case spv::Op::OpTypeInt:
|
|
case spv::Op::OpTypeMatrix:
|
|
case spv::Op::OpTypeVector:
|
|
// These are all basic types.
|
|
basic_types.insert(inst.result_id());
|
|
basic_type_to_pointers.insert({inst.result_id(), {}});
|
|
break;
|
|
case spv::Op::OpTypeArray:
|
|
// An array type is basic if its base type is basic.
|
|
if (basic_types.count(inst.GetSingleWordInOperand(0))) {
|
|
basic_types.insert(inst.result_id());
|
|
basic_type_to_pointers.insert({inst.result_id(), {}});
|
|
}
|
|
break;
|
|
case spv::Op::OpTypeStruct: {
|
|
// A struct type is basic if it does not have the Block/BufferBlock
|
|
// decoration, and if all of its members are basic.
|
|
if (!fuzzerutil::HasBlockOrBufferBlockDecoration(GetIRContext(),
|
|
inst.result_id())) {
|
|
bool all_members_are_basic_types = true;
|
|
for (uint32_t i = 0; i < inst.NumInOperands(); i++) {
|
|
if (!basic_types.count(inst.GetSingleWordInOperand(i))) {
|
|
all_members_are_basic_types = false;
|
|
break;
|
|
}
|
|
}
|
|
if (all_members_are_basic_types) {
|
|
basic_types.insert(inst.result_id());
|
|
basic_type_to_pointers.insert({inst.result_id(), {}});
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
case spv::Op::OpTypePointer: {
|
|
// We are interested in the pointer if its pointee type is basic and it
|
|
// has the right storage class.
|
|
auto pointee_type = inst.GetSingleWordInOperand(1);
|
|
if (spv::StorageClass(inst.GetSingleWordInOperand(0)) ==
|
|
storage_class &&
|
|
basic_types.count(pointee_type)) {
|
|
// The pointer has the desired storage class, and its pointee type is
|
|
// a basic type, so we are interested in it. Associate it with its
|
|
// basic type.
|
|
basic_type_to_pointers.at(pointee_type).push_back(inst.result_id());
|
|
}
|
|
break;
|
|
}
|
|
default:
|
|
break;
|
|
}
|
|
}
|
|
return {{basic_types.begin(), basic_types.end()}, basic_type_to_pointers};
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateZeroConstant(
|
|
uint32_t scalar_or_composite_type_id, bool is_irrelevant) {
|
|
auto type_instruction =
|
|
GetIRContext()->get_def_use_mgr()->GetDef(scalar_or_composite_type_id);
|
|
assert(type_instruction && "The type instruction must exist.");
|
|
switch (type_instruction->opcode()) {
|
|
case spv::Op::OpTypeBool:
|
|
return FindOrCreateBoolConstant(false, is_irrelevant);
|
|
case spv::Op::OpTypeFloat: {
|
|
auto width = type_instruction->GetSingleWordInOperand(0);
|
|
auto num_words = (width + 32 - 1) / 32;
|
|
return FindOrCreateFloatConstant(std::vector<uint32_t>(num_words, 0),
|
|
width, is_irrelevant);
|
|
}
|
|
case spv::Op::OpTypeInt: {
|
|
auto width = type_instruction->GetSingleWordInOperand(0);
|
|
auto num_words = (width + 32 - 1) / 32;
|
|
return FindOrCreateIntegerConstant(
|
|
std::vector<uint32_t>(num_words, 0), width,
|
|
type_instruction->GetSingleWordInOperand(1), is_irrelevant);
|
|
}
|
|
case spv::Op::OpTypeArray: {
|
|
auto component_type_id = type_instruction->GetSingleWordInOperand(0);
|
|
auto num_components =
|
|
fuzzerutil::GetArraySize(*type_instruction, GetIRContext());
|
|
return FindOrCreateCompositeConstant(
|
|
std::vector<uint32_t>(
|
|
num_components,
|
|
FindOrCreateZeroConstant(component_type_id, is_irrelevant)),
|
|
scalar_or_composite_type_id, is_irrelevant);
|
|
}
|
|
case spv::Op::OpTypeMatrix:
|
|
case spv::Op::OpTypeVector: {
|
|
auto component_type_id = type_instruction->GetSingleWordInOperand(0);
|
|
auto num_components = type_instruction->GetSingleWordInOperand(1);
|
|
return FindOrCreateCompositeConstant(
|
|
std::vector<uint32_t>(
|
|
num_components,
|
|
FindOrCreateZeroConstant(component_type_id, is_irrelevant)),
|
|
scalar_or_composite_type_id, is_irrelevant);
|
|
}
|
|
case spv::Op::OpTypeStruct: {
|
|
assert(!fuzzerutil::HasBlockOrBufferBlockDecoration(
|
|
GetIRContext(), scalar_or_composite_type_id) &&
|
|
"We do not construct constants of struct types decorated with "
|
|
"Block or BufferBlock.");
|
|
std::vector<uint32_t> field_zero_ids;
|
|
for (uint32_t index = 0; index < type_instruction->NumInOperands();
|
|
index++) {
|
|
field_zero_ids.push_back(FindOrCreateZeroConstant(
|
|
type_instruction->GetSingleWordInOperand(index), is_irrelevant));
|
|
}
|
|
return FindOrCreateCompositeConstant(
|
|
field_zero_ids, scalar_or_composite_type_id, is_irrelevant);
|
|
}
|
|
default:
|
|
assert(false && "Unknown type.");
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
void FuzzerPass::MaybeAddUseToReplace(
|
|
opt::Instruction* use_inst, uint32_t use_index, uint32_t replacement_id,
|
|
std::vector<std::pair<protobufs::IdUseDescriptor, uint32_t>>*
|
|
uses_to_replace) {
|
|
// Only consider this use if it is in a block
|
|
if (!GetIRContext()->get_instr_block(use_inst)) {
|
|
return;
|
|
}
|
|
|
|
// Get the index of the operand restricted to input operands.
|
|
uint32_t in_operand_index =
|
|
fuzzerutil::InOperandIndexFromOperandIndex(*use_inst, use_index);
|
|
auto id_use_descriptor =
|
|
MakeIdUseDescriptorFromUse(GetIRContext(), use_inst, in_operand_index);
|
|
uses_to_replace->emplace_back(
|
|
std::make_pair(id_use_descriptor, replacement_id));
|
|
}
|
|
|
|
opt::BasicBlock* FuzzerPass::GetOrCreateSimpleLoopPreheader(
|
|
uint32_t header_id) {
|
|
auto header_block = fuzzerutil::MaybeFindBlock(GetIRContext(), header_id);
|
|
|
|
assert(header_block && header_block->IsLoopHeader() &&
|
|
"|header_id| should be the label id of a loop header");
|
|
|
|
auto predecessors = GetIRContext()->cfg()->preds(header_id);
|
|
|
|
assert(predecessors.size() >= 2 &&
|
|
"The block |header_id| should be reachable.");
|
|
|
|
auto function = header_block->GetParent();
|
|
|
|
if (predecessors.size() == 2) {
|
|
// The header has a single out-of-loop predecessor, which could be a
|
|
// preheader.
|
|
|
|
opt::BasicBlock* maybe_preheader;
|
|
|
|
if (GetIRContext()->GetDominatorAnalysis(function)->Dominates(
|
|
header_id, predecessors[0])) {
|
|
// The first predecessor is the back-edge block, because the header
|
|
// dominates it, so the second one is out of the loop.
|
|
maybe_preheader = &*function->FindBlock(predecessors[1]);
|
|
} else {
|
|
// The first predecessor is out of the loop.
|
|
maybe_preheader = &*function->FindBlock(predecessors[0]);
|
|
}
|
|
|
|
// |maybe_preheader| is a preheader if it branches unconditionally to
|
|
// the header. We also require it not to be a loop header.
|
|
if (maybe_preheader->terminator()->opcode() == spv::Op::OpBranch &&
|
|
!maybe_preheader->IsLoopHeader()) {
|
|
return maybe_preheader;
|
|
}
|
|
}
|
|
|
|
// We need to add a preheader.
|
|
|
|
// Get a fresh id for the preheader.
|
|
uint32_t preheader_id = GetFuzzerContext()->GetFreshId();
|
|
|
|
// Get a fresh id for each OpPhi instruction, if there is more than one
|
|
// out-of-loop predecessor.
|
|
std::vector<uint32_t> phi_ids;
|
|
if (predecessors.size() > 2) {
|
|
header_block->ForEachPhiInst(
|
|
[this, &phi_ids](opt::Instruction* /* unused */) {
|
|
phi_ids.push_back(GetFuzzerContext()->GetFreshId());
|
|
});
|
|
}
|
|
|
|
// Add the preheader.
|
|
ApplyTransformation(
|
|
TransformationAddLoopPreheader(header_id, preheader_id, phi_ids));
|
|
|
|
// Make the newly-created preheader the new entry block.
|
|
return &*function->FindBlock(preheader_id);
|
|
}
|
|
|
|
opt::BasicBlock* FuzzerPass::SplitBlockAfterOpPhiOrOpVariable(
|
|
uint32_t block_id) {
|
|
auto block = fuzzerutil::MaybeFindBlock(GetIRContext(), block_id);
|
|
assert(block && "|block_id| must be a block label");
|
|
assert(!block->IsLoopHeader() && "|block_id| cannot be a loop header");
|
|
|
|
// Find the first non-OpPhi and non-OpVariable instruction.
|
|
auto non_phi_or_var_inst = &*block->begin();
|
|
while (non_phi_or_var_inst->opcode() == spv::Op::OpPhi ||
|
|
non_phi_or_var_inst->opcode() == spv::Op::OpVariable) {
|
|
non_phi_or_var_inst = non_phi_or_var_inst->NextNode();
|
|
}
|
|
|
|
// Split the block.
|
|
uint32_t new_block_id = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(TransformationSplitBlock(
|
|
MakeInstructionDescriptor(GetIRContext(), non_phi_or_var_inst),
|
|
new_block_id));
|
|
|
|
// We need to return the newly-created block.
|
|
return &*block->GetParent()->FindBlock(new_block_id);
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateLocalVariable(
|
|
uint32_t pointer_type_id, uint32_t function_id,
|
|
bool pointee_value_is_irrelevant) {
|
|
auto pointer_type = GetIRContext()->get_type_mgr()->GetType(pointer_type_id);
|
|
// No unused variables in release mode.
|
|
(void)pointer_type;
|
|
assert(pointer_type && pointer_type->AsPointer() &&
|
|
pointer_type->AsPointer()->storage_class() ==
|
|
spv::StorageClass::Function &&
|
|
"The pointer_type_id must refer to a defined pointer type with "
|
|
"storage class Function");
|
|
auto function = fuzzerutil::FindFunction(GetIRContext(), function_id);
|
|
assert(function && "The function must be defined.");
|
|
|
|
// First we try to find a suitable existing variable.
|
|
// All of the local variable declarations are located in the first block.
|
|
for (auto& instruction : *function->begin()) {
|
|
if (instruction.opcode() != spv::Op::OpVariable) {
|
|
continue;
|
|
}
|
|
// The existing OpVariable must have type |pointer_type_id|.
|
|
if (instruction.type_id() != pointer_type_id) {
|
|
continue;
|
|
}
|
|
// Check if the found variable is marked with PointeeValueIsIrrelevant
|
|
// according to |pointee_value_is_irrelevant|.
|
|
if (GetTransformationContext()->GetFactManager()->PointeeValueIsIrrelevant(
|
|
instruction.result_id()) != pointee_value_is_irrelevant) {
|
|
continue;
|
|
}
|
|
return instruction.result_id();
|
|
}
|
|
|
|
// No such variable was found. Apply a transformation to get one.
|
|
uint32_t pointee_type_id = fuzzerutil::GetPointeeTypeIdFromPointerType(
|
|
GetIRContext(), pointer_type_id);
|
|
uint32_t result_id = GetFuzzerContext()->GetFreshId();
|
|
ApplyTransformation(TransformationAddLocalVariable(
|
|
result_id, pointer_type_id, function_id,
|
|
FindOrCreateZeroConstant(pointee_type_id, pointee_value_is_irrelevant),
|
|
pointee_value_is_irrelevant));
|
|
return result_id;
|
|
}
|
|
|
|
uint32_t FuzzerPass::FindOrCreateGlobalVariable(
|
|
uint32_t pointer_type_id, bool pointee_value_is_irrelevant) {
|
|
auto pointer_type = GetIRContext()->get_type_mgr()->GetType(pointer_type_id);
|
|
// No unused variables in release mode.
|
|
(void)pointer_type;
|
|
assert(
|
|
pointer_type && pointer_type->AsPointer() &&
|
|
(pointer_type->AsPointer()->storage_class() ==
|
|
spv::StorageClass::Private ||
|
|
pointer_type->AsPointer()->storage_class() ==
|
|
spv::StorageClass::Workgroup) &&
|
|
"The pointer_type_id must refer to a defined pointer type with storage "
|
|
"class Private or Workgroup");
|
|
|
|
// First we try to find a suitable existing variable.
|
|
for (auto& instruction : GetIRContext()->module()->types_values()) {
|
|
if (instruction.opcode() != spv::Op::OpVariable) {
|
|
continue;
|
|
}
|
|
// The existing OpVariable must have type |pointer_type_id|.
|
|
if (instruction.type_id() != pointer_type_id) {
|
|
continue;
|
|
}
|
|
// Check if the found variable is marked with PointeeValueIsIrrelevant
|
|
// according to |pointee_value_is_irrelevant|.
|
|
if (GetTransformationContext()->GetFactManager()->PointeeValueIsIrrelevant(
|
|
instruction.result_id()) != pointee_value_is_irrelevant) {
|
|
continue;
|
|
}
|
|
return instruction.result_id();
|
|
}
|
|
|
|
// No such variable was found. Apply a transformation to get one.
|
|
uint32_t pointee_type_id = fuzzerutil::GetPointeeTypeIdFromPointerType(
|
|
GetIRContext(), pointer_type_id);
|
|
auto storage_class = fuzzerutil::GetStorageClassFromPointerType(
|
|
GetIRContext(), pointer_type_id);
|
|
uint32_t result_id = GetFuzzerContext()->GetFreshId();
|
|
|
|
// A variable with storage class Workgroup shouldn't have an initializer.
|
|
if (storage_class == spv::StorageClass::Workgroup) {
|
|
ApplyTransformation(TransformationAddGlobalVariable(
|
|
result_id, pointer_type_id, spv::StorageClass::Workgroup, 0,
|
|
pointee_value_is_irrelevant));
|
|
} else {
|
|
ApplyTransformation(TransformationAddGlobalVariable(
|
|
result_id, pointer_type_id, spv::StorageClass::Private,
|
|
FindOrCreateZeroConstant(pointee_type_id, pointee_value_is_irrelevant),
|
|
pointee_value_is_irrelevant));
|
|
}
|
|
return result_id;
|
|
}
|
|
|
|
} // namespace fuzz
|
|
} // namespace spvtools
|