mirror of
https://github.com/KhronosGroup/SPIRV-Tools
synced 2024-10-19 03:20:14 +00:00
001e823b65
Adds a new transformation that can replace a constant with a uniform known to have the same value, and adds a fuzzer pass that (a) replaces a boolean with a comparison of literals (e.g. replacing "true" with "42 > 24"), and then (b) obfuscates the literals appearing in this comparison by replacing them with identically-valued uniforms, if available. The fuzzer_replayer test file has also been updated to allow initial facts to be provided, and to do error checking of the status results returned by the fuzzer and replayer components.
83 lines
2.8 KiB
C++
83 lines
2.8 KiB
C++
// Copyright (c) 2019 Google LLC
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
#ifndef SOURCE_FUZZ_FUZZER_CONTEXT_H_
|
|
#define SOURCE_FUZZ_FUZZER_CONTEXT_H_
|
|
|
|
#include <functional>
|
|
|
|
#include "source/fuzz/random_generator.h"
|
|
#include "source/opt/function.h"
|
|
|
|
namespace spvtools {
|
|
namespace fuzz {
|
|
|
|
// Encapsulates all parameters that control the fuzzing process, such as the
|
|
// source of randomness and the probabilities with which transformations are
|
|
// applied.
|
|
class FuzzerContext {
|
|
public:
|
|
// Constructs a fuzzer context with a given random generator and the minimum
|
|
// value that can be used for fresh ids.
|
|
FuzzerContext(RandomGenerator* random_generator, uint32_t min_fresh_id);
|
|
|
|
~FuzzerContext();
|
|
|
|
// Provides the random generator used to control fuzzing.
|
|
RandomGenerator* GetRandomGenerator();
|
|
|
|
// Yields an id that is guaranteed not to be used in the module being fuzzed,
|
|
// or to have been issued before.
|
|
uint32_t GetFreshId();
|
|
|
|
// Probabilities associated with applying various transformations.
|
|
// Keep them in alphabetical order.
|
|
uint32_t GetChanceOfAddingDeadBreak() { return chance_of_adding_dead_break_; }
|
|
uint32_t GetChanceOfMovingBlockDown() { return chance_of_moving_block_down_; }
|
|
uint32_t GetChanceOfObfuscatingConstant() {
|
|
return chance_of_obfuscating_constant_;
|
|
}
|
|
uint32_t GetChanceOfSplittingBlock() { return chance_of_splitting_block_; }
|
|
|
|
// Probability distributions to control how deeply to recurse.
|
|
// Keep them in alphabetical order.
|
|
const std::function<bool(uint32_t, RandomGenerator*)>&
|
|
GoDeeperInConstantObfuscation() {
|
|
return go_deeper_in_constant_obfuscation_;
|
|
}
|
|
|
|
private:
|
|
// The source of randomness.
|
|
RandomGenerator* random_generator_;
|
|
// The next fresh id to be issued.
|
|
uint32_t next_fresh_id_;
|
|
|
|
// Probabilities associated with applying various transformations.
|
|
// Keep them in alphabetical order.
|
|
uint32_t chance_of_adding_dead_break_;
|
|
uint32_t chance_of_moving_block_down_;
|
|
uint32_t chance_of_obfuscating_constant_;
|
|
uint32_t chance_of_splitting_block_;
|
|
|
|
// Functions to determine with what probability to go deeper when generating
|
|
// or mutating constructs recursively.
|
|
const std::function<bool(uint32_t, RandomGenerator*)>&
|
|
go_deeper_in_constant_obfuscation_;
|
|
};
|
|
|
|
} // namespace fuzz
|
|
} // namespace spvtools
|
|
|
|
#endif // SOURCE_FUZZ_FUZZER_CONTEXT_H_
|